CCSP practice questions 11–20

1. Question 11 · 493 in bank

   Which type of audit report is considered a "restricted use" report for its intended audience?

   • ASAS-70
   • BSSAE-16
   • CSOC Type 1
   • DSOC Type 2

   Show answer

   Answer: D

   Explanation

   the question doesn't seem correct The SOC 2 Type 1 is not extremely useful for determining the security and trust of an organization. The SOC 2 Type 1 only reviews the design of controls, not how they are implemented and maintained, or their function. The SOC 2 Type 2 report, however, does just that. This is why the SOC 2 Type 2 is the sort of report that is extremely useful for getting a true assessment of an organization’s security posture.

   Source: Adapted from community discussion — ragar123

   Next question

2. Question 12 · 493 in bank

   What is the concept of segregating information or processes, within the same system or application, for security reasons?

   • Afencing
   • BSandboxing
   • CCellblocking
   • DPooling

   Show answer

   Answer: B

   Explanation

   Sandboxing involves segregating and isolating information or processes from others within the same system or application, typically for security concerns. This is generally used for data isolation (for example, keeping different communities and populations of users isolated from other similar data).

   Source: Adapted from community discussion — cmarcos97

   Next question

3. Question 13 · 493 in bank

   Which of the following approaches would NOT be considered sufficient to meet the requirements of secure data destruction within a cloud environment?

   • ACryptographic erasure
   • BZeroing
   • COverwriting
   • DDeletion

   Show answer

   Answer: D

   Explanation

   Nope. In cloud environments, usually you dont have ways to overwrite the information at physical level, so the best way is to use cryptographic erasure. And the worst is just trusting the Deletion features, because it does not actually delete the information; only the pointers to it.

   Source: Adapted from community discussion — evilwizardington

   Next question

4. Question 14 · 493 in bank

   The European Union passed the first major regulation declaring data privacy to be a human right. In what year did it go into effect?

   • A2010
   • B2000
   • C1995
   • D1990

   Show answer

   Answer: C

   Explanation

   The directive was repealed to the regulation in 2018 (see https://gdpr-text.com/read/article-94/). But all that is irrelevant. In the context of the ISC2 question, their answer is rightfully 1995.

   Source: Adapted from community discussion — Lenell

   Next question

5. Question 15 · 493 in bank

   Which of the following is NOT a key area for performance monitoring as far as an SLA is concerned?

   • ACPU
   • BUsers
   • CMemory
   • DNetwork

   Show answer

   Answer: B

   Explanation

   An SLA requires performance monitoring of CPU, memory, storage, and networking. The number of users active on a system would not be part of an SLA specifically, other than in regard to the impact on the other four variables.

   Next question

6. Question 16 · 493 in bank

   Which of the following is the MOST important requirement and guidance for testing during an audit?

   • AStakeholders
   • BShareholders
   • CManagement
   • DRegulations

   Show answer

   Answer: D

   Explanation

   Regulations requirements are mandatory if compliance is a must. These can get the organization fined or lose it compliance/certifications. Requirements from management, stakeholders, and shareholders can have different levels of scope which might or might not include regulations requirements.

   Source: Adapted from community discussion — certifiedgeek

   Next question

7. Question 17 · 493 in bank

   Which value refers to the amount of data an organization would need to recover in the event of a BCDR situation in order to reach an acceptable level of operations?

   • ASRE
   • BRTO
   • CRPO
   • DRSL

   Show answer

   Answer: C

   Next question

8. Question 18 · 493 in bank

   What must SOAP rely on for security?

   • AEncryption
   • BTokenization
   • CTLS
   • DSSL

   Show answer

   Answer: C

   Explanation

   C. TLS (Transport Layer Security) for security. TLS is a protocol that provides encryption and secure communication over a network. While SOAP can use other security measures like encryption and tokenization, it typically relies on TLS (or its predecessor, SSL) to ensure secure communication between client and server.

   Source: Adapted from community discussion — Mo22

   Next question

9. Question 19 · 493 in bank

   Which of the following is a commonly used tool for maintaining system configurations?

   • AMaestro
   • BOrchestrator
   • CPuppet
   • DConductor

   Show answer

   Answer: C

   Explanation

   Puppet is a commonly used tool for maintaining system configurations based on policies, and done so from a centralized authority.

   Source: Adapted from community discussion — ichnos

   Next question

10. Question 20 · 493 in bank

    What type of data does data rights management (DRM) protect?

    • AConsumer
    • BPII
    • CFinancial
    • DHealthcare

    Show answer

    Answer: A

    Explanation

    DRM applies to the protection of consumer media, such as music, publications, video, movies, and soon.

    Source: Adapted from community discussion — Ola4real

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCSP practice, question 11. 493 questions available.