CCSP practice questions 141–150

1. Question 141 · 493 in bank

   From a security perspective, what component of a cloud computing infrastructure represents the biggest concern?

   • AHypervisor
   • BManagement plane
   • CObject storage
   • DEncryption

   Show answer

   Answer: B

   Explanation

   Question says "cloud computing infrastructure " I would think it is either Hypervisor (multi tenancy, data bleed, VM escape) or the Encryption. storing keys etc Management plane is more of a concern from insider threat perspective, can be easily secured using MFA and location/IP based controls to prevent external threats.

   Source: Adapted from community discussion — [Removed]

   Next question

2. Question 142 · 493 in bank

   Which of the following is NOT one of the main intended goals of a DLP solution?

   • AShowing due diligence
   • BPreventing malicious insiders
   • CRegulatory compliance
   • DManaging and minimizing risk

   Show answer

   Answer: A

   Explanation

   It is difficult to cover ALL data fraud cases by insiders with DLP. B is partially correct, and others are fully correct, so B is the answer.

   Source: Adapted from community discussion — Guest4768

   Next question

3. Question 143 · 493 in bank

   Data center and operations design traditionally takes a tiered, topological approach. Which of the following standards is focused on that approach and is prevalently used throughout the industry?

   • AIDCA
   • BNFPA
   • CBICSI
   • DUptime Institute

   Show answer

   Answer: D

   Explanation

   The Uptime Institute publishes the most widely known and used standard for data center topologies and tiers. The National Fire Protection Association (NFPA) publishes a broad range of fire safety and design standards for many different types of facilities. Building Industry Consulting Services International (BICSI) issues certifications for data center cabling. The International Data Center Authority (IDCA) offers the Infinity Paradigm, which takes a macro-level approach to data center design.

   Next question

4. Question 144 · 493 in bank

   Jurisdictions have a broad range of privacy requirements pertaining to the handling of personal data and information. Which jurisdiction requires all storage and processing of data that pertains to its citizens to be done on hardware that is physically located within its borders?

   • AJapan
   • BUnited States
   • CEuropean Union
   • DRussia

   Show answer

   Answer: D

   Explanation

   The Russian government requires all data and processing of information about its citizens to be done solely on systems and applications that reside within the physical borders of the country. The United States, European Union, and Japan focus their data privacy laws on requirements and methods for the protection of data, rather than where the data physically resides.

   Next question

5. Question 145 · 493 in bank

   Which United States law is focused on accounting and financial practices of organizations?

   • ASafe Harbor
   • BGLBA
   • CSOX
   • DHIPAA

   Show answer

   Answer: C

   Explanation

   Both GLBA and SOX have to do with financial practices. But C is the better answer. B. GLBA (Gramm-Leach-Bliley Act): This U.S. federal law, also known as the Financial Services Modernization Act of 1999, focuses on protecting consumers' personal financial information held by financial institutions. It includes provisions to protect personal data, requires financial institutions to explain their information-sharing practices to their customers, and safeguards sensitive data. C. SOX (Sarbanes-Oxley Act): This is the correct answer. The Sarbanes-Oxley Act of 2002 is a U.S. federal law that established comprehensive auditing and financial regulations for public companies. It was enacted in response to financial scandals such as Enron and WorldCom to protect investors from fraudulent accounting activities and improve the accuracy and reliability of corporate disclosures.

   Source: Adapted from community discussion — TheFivePips

   Next question

6. Question 146 · 493 in bank

   The management plane is used to administer a cloud environment and perform administrative tasks across a variety of systems, but most specifically it's used with the hypervisors. What does the management plane typically leverage for this orchestration?

   • AAPIs
   • BScripts
   • CTLS
   • DXML

   Show answer

   Answer: A

   Explanation

   The management plane uses APIs to execute remote calls across the cloud environment to various management systems, especially hypervisors. This allows a centralized administrative interface, often a web portal, to orchestrate tasks throughout an enterprise. Scripts may be utilized to execute API calls, but they are not used directly to interact with systems. XML is used for data encoding and transmission, but not for executing remote calls. TLS is used to encrypt communications and may be used with API calls, but it is not the actual process for executing commands.

   Next question

7. Question 147 · 493 in bank

   When dealing with PII, which category pertains to those requirements that can carry legal sanctions or penalties for failure to adequately safeguard the data and address compliance requirements?

   • AContractual
   • BJurisdictional
   • CRegulated
   • DLegal

   Show answer

   Answer: C

   Explanation

   Regulated PII pertains to data that is outlined in law and regulations. Violations of the requirements for the protection of regulated PII can carry legal sanctions or penalties. Contractual PII involves required data protection that is determined by the actual service contract between the cloud provider and cloud customer, rather than outlined by law. Violations of the provisions of contractual PII carry potential financial or contractual implications, but not legal sanctions. Legal and jurisdictional are similar terms to regulated, but neither is the official term used.

   Next question

8. Question 148 · 493 in bank

   Although the United States does not have a single, comprehensive privacy and regulatory framework, a number of specific regulations pertain to types of data or populations. Which of the following is NOT a regulatory system from the United States federal government?

   • AHIPAA
   • BSOX
   • CFISMA
   • DPCI DSS

   Show answer

   Answer: D

   Explanation

   The Payment Card Industry Data Security Standard (PCI DSS) pertains to organizations that handle credit card transactions and is an industry-regulatory standard, not a governmental one. The Sarbanes-Oxley Act (SOX) was passed in 2002 and pertains to financial records and reporting, as well as transparency requirements for shareholders and other stakeholders. The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996 and pertains to data privacy and security for medical records. FISMA refers to the Federal Information Security Management Act of 2002 and pertains to the protection of all US federal government IT systems, with the exception of national security systems.

   Next question

9. Question 149 · 493 in bank

   The president of your company has tasked you with implementing cloud services as the most efficient way of obtaining a robust disaster recovery configuration for your production services. Which of the cloud deployment models would you MOST likely be exploring?

   • AHybrid
   • BPrivate
   • CCommunity
   • DPublic

   Show answer

   Answer: A

   Explanation

   In this specific case, nothing says that production would move from onprem to cloud so we should assume only bcp/dr elements may be put to cloud meaning either simply backup and archiving and perhaps also the replication of on-prem resources to their cloud counterparts whenever it is needed. In any case, this is a hybrid setup which may require some degree of interoperability. Public cloud would be more suitable if they specify least cost and least effort without specific security needs, but it's not mentioned.

   Source: Adapted from community discussion — Zeezee2

   Next question

10. Question 150 · 493 in bank

    If you are running an application that has strict legal requirements that the data cannot reside on systems that contain other applications or systems, which aspect of cloud computing would be prohibitive in this case?

    • AMultitenancy
    • BBroad network access
    • CPortability
    • DElasticity

    Show answer

    Answer: A

    Explanation

    Multitenancy is the aspect of cloud computing that involves having multiple customers and applications running within the same system and sharing the same resources. Although considerable mechanisms are in place to ensure isolation and separation, the data and applications are ultimately using shared resources. Broad network access refers to the ability to access cloud services from any location or client. Portability refers to the ability to easily move cloud services between different cloud providers, whereas elasticity refers to the capabilities of a cloud environment to add or remove services, as needed, to meet current demand.

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCSP practice, question 141. 493 questions available.