ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Which of the following is NOT one of the components of multifactor authentication?
Answer: C
Multifactor authentication systems are composed of something the user knows, has, and/or is, not something the user sends. Multifactor authentication commonly uses something that a user knows, has, and/or is (such as biometrics or features).
Above and beyond general regulations for data privacy and protection, certain types of data are subjected to more rigorous regulations and oversight. Which of the following is not a regulatory framework for more sensitive or specialized data?
Answer: A
The question is concerned with "data" and FIPS 140-2 is a standard that pertains to cryptographic "modules" and not data.
Source: Adapted from community discussion — theyetifollowsme
Which data sanitation method is also commonly referred to as "zeroing"?
Answer: A
What is the concept of isolating an application from the underlying operating system for testing purposes?
Answer: D
Application virtualization is isolating an application from the underlying operating system. PERIOD. The added bit about testing is like saying legs are for walking. no they are also for jumping and squatting and kicking and... badly formed question/answer.
Source: Adapted from community discussion — kjjcraigskel
Which of the following could be used as a second component of multifactor authentication if a user has an RSA token?
Answer: C
Which term relates to the application of scientific methods and practices to evidence?
Answer: A
Forensics is the application of scientific and methodical processes to identify, collect, preserve, analyze, and summarize/report digital information and evidence.
Which of the following is NOT one of the official risk rating categories?
Answer: C
The official categories of cloud risk ratings are Minimal, Low, Moderate, High, and Critical.
SOC Type 1 reports are considered "restricted use," in that they are intended only for limited audiences and purposes. Which of the following is NOT a population that would be appropriate for a SOC Type 1 report?
Answer: C
Potential clients are not served by SOC Type 1 audits. A Type 2 or Type 3 report would be appropriate for potential clients. SOC Type 1 reports are intended for restricted use, where only the service organization itself, current clients, or auditors would have access to them.
Source: Adapted from community discussion — Nova23
Having a reservation in a cloud environment can ensure operations continue in the event of high utilization across the cloud. Which of the following would NOT be a capability covered by reservations?
Answer: D
A reservation will not guarantee auto-scaling is available because it involves the allocation of additional resources beyond what a cloud customer already has provisioned. Reservations will guarantee minimal resources are available to start virtual machines, run applications, and perform normal business operations.
What must SOAP rely on for security since it does not provide security as a built-in capability?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 271. 493 questions available.
Version 1.0.0. How we source questions