CCSP practice questions 181–190

1. Question 181 · 493 in bank

   A crucial decision any company must make is in regard to where it hosts the data systems it depends on. A debate exists as to whether it's best to lease space in a data center or build your own data center--and now with cloud computing, whether to purchase resources within a cloud. What is the biggest advantage to leasing space in a data center versus procuring cloud services?

   • ARegulations
   • BControl
   • CSecurity
   • DCosts

   Show answer

   Answer: B

   Explanation

   I totally disagree with the explanation because the answer is "COST" Leasing gives you a COST advantage and not CONTROL. BUILDING A DATACENTER GIVES YOU CONTROL ADVANTAGE. BUILDING/PROCURING DATACENTER: When companies build their own data centers, they have complete control over nearly every aspect – from the overall facility designs down to the granular operational details like temperature and asset access. Firms that develop and operate their own data center space can also build out their resources in a phased and/or modular approach to manage capital deployment. In addition, since the space belongs to the service provider, they can utilize their assets however they please, whether this means leveraging resources for their own IT equipment or leasing space to other companies for a profit. LEASING A DATACENTER: On the other hand, leasing from a top-tier provider has its advantages as well. This approach offers a more consistent and predictable cost model and can help providers reduce capital expenditures when compared with building and operating their own facility. https://wiredre.com/data-center-decisions-building-vs-leasing-data-center-space/

   Source: Adapted from community discussion — ArizonaClassics

   Next question

2. Question 182 · 493 in bank

   Which of the following systems is used to employ a variety of different techniques to discover and alert on threats and potential threats to systems and networks?

   • AIDS
   • BIPS
   • CFirewall
   • DWAF

   Show answer

   Answer: A

   Explanation

   An intrusion detection system (IDS) is implemented to watch network traffic and operations, using predefined criteria or signatures, and alert administrators if anything suspect is found. An intrusion prevention system (IPS) is similar to an IDS but actually takes action against suspect traffic, whereas an IDS just alerts when it finds anything suspect. A firewall works at the network level and only takes into account IP addresses, ports, and protocols; it does not inspect the traffic for patterns or content. A web application firewall (WAF) works at the application layer and provides additional security via proxying, filtering service requests, or blocking based on additional factors such as the client and requests.

   Next question

3. Question 183 · 493 in bank

   Which of the following is not a risk management framework?

   • ACOBIT
   • BHex GBL
   • CISO 31000:2009
   • DNIST SP 800-37

   Show answer

   Answer: B

   Explanation

   Hex GBL is a reference to a computer part in Terry Pratchett's fictional Discworld universe. The rest are not.

   Next question

4. Question 184 · 493 in bank

   In order to ensure ongoing compliance with regulatory requirements, which phase of the cloud data lifecycle must be tested regularly?

   • AArchive
   • BShare
   • CStore
   • DDestroy

   Show answer

   Answer: A

   Next question

5. Question 185 · 493 in bank

   Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?

   • AInjection
   • BMissing function-level access control
   • CCross-site scripting
   • DCross-site request forgery

   Show answer

   Answer: C

   Explanation

   THE CORRECT ANSWER IS CRF!! Cross-site Request Forgery (CSRF) is a type of confused deputy attack, which leverages the authentication and authorization of the victim when a forged request is being sent to the web server. Therefore, a CSRF vulnerability that affects highly privileged users, such as administrators, could result in a full application compromise. During a successful CSRF attack, the victim’s web browser is tricked by a malicious website into unwanted action – it sends HTTP requests to the web application as intended by the attacker. Normally, such a request would involve submitting forms present on the web application to alter some data. https://www.acunetix.com/blog/articles/cross-site-request-forgery/

   Source: Adapted from community discussion — ArizonaClassics

   Next question

6. Question 186 · 493 in bank

   Digital investigations have adopted many of the same methodologies and protocols as other types of criminal or scientific inquiries. What term pertains to the application of scientific norms and protocols to digital investigations?

   • AScientific
   • BInvestigative
   • CMethodological
   • DForensics

   Show answer

   Answer: D

   Explanation

   Forensics refers to the application of scientific methods and protocols to the investigation of crimes. Although forensics has traditionally been applied to well- known criminal proceedings and investigations, the term equally applies to digital investigations and methods. Although the other answers provide similar- sounding terms and ideas, none is the appropriate answer in this case.

   Next question

7. Question 187 · 493 in bank

   Within a federated identity system, which entity accepts tokens from the identity provider?

   • AAssertion manager
   • BServicing party
   • CProxy party
   • DRelying party

   Show answer

   Answer: D

   Explanation

   The relying party is attached to the application or service that a user is trying to access, and it accepts authentication tokens from the user's own identity provider in order to facilitate authentication and access. The other terms provided are all associated with federated systems, but none is the correct choice in this case.

   Next question

8. Question 188 · 493 in bank

   Different types of audits are intended for different audiences, such as internal, external, regulatory, and so on. Which of the following audits are considered "restricted use" versus being for a more broad audience?

   • ASOC Type 2
   • BSOC Type 1
   • CSOC Type 3
   • DSAS-70

   Show answer

   Answer: A

   Explanation

   SOC1 & SOC2 both restricted based on ISC2 materials: SOC1: Use of these reports is restricted to the management of the service organization, user entities, and user auditors SOC2: A key difference between a SOC 2 report and a SOC 3 report is that a SOC 2 report is generally restricted in distribution and coverage, requiring a nondisclosure agreement (NDA) due to the information it contains, whereas a SOC 3 report is broadly available, with limited information and details included within it (often used to instill confidence in prospective clients or for marketing purposes).

   Source: Adapted from community discussion — xav1er

   Next question

9. Question 189 · 493 in bank

   Which protocol does the REST API depend on?

   • AHTTP
   • BXML
   • CSAML
   • DSSH

   Show answer

   Answer: A

   Explanation

   Representational State Transfer (REST) is a software architectural scheme that applies the components, connectors, and data conduits for many web applications used on the Internet. It uses and relies on the HTTP protocol and supports a variety of data formats.

   Next question

10. Question 190 · 493 in bank

    Although host-based and network-based IDSs perform similar functions and have similar capabilities, which of the following is an advantage of a network-based IDS over a host-based IDS, assuming all capabilities are equal?

    • ASegregated from host systems
    • BNetwork access
    • CScalability
    • DExternal to system patching

    Show answer

    Answer: C

    Explanation

    Scalability in cloud computing refers to the ability to increase or decrease IT resources as needed to meet changing demand.

    Source: Adapted from community discussion — cmarcos97

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCSP practice, question 181. 493 questions available.