ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Which type of testing uses the same strategies and toolsets that hackers would use?
Answer: A
Penetration testing involves using the same strategies and toolsets that hackers would use against a system to discovery potential vulnerabilities.
From a security perspective, which of the following is a major concern when evaluating possible BCDR solutions?
Answer: C
Which of the following is NOT a focus or consideration of an internal audit?
Answer: A
Speaking from experience doing security audits at clients, internal audits do NOT result in an official certification of any kind. See it as a way of 1) finding gaps and fixing them by a certain date by which an external audit will actually perform the audit and provide certification.
Source: Adapted from community discussion — Zeezee2
Which of the following cloud aspects complicates eDiscovery?
Answer: C
With multitenancy, eDiscovery becomes more complicated because the data collection involves extra steps to ensure that only those customers or systems that are within scope are turned over to the requesting authority.
Source: Adapted from community discussion — ArizonaClassics
Which of the following is the sole responsibility of the cloud customer, regardless of which cloud model is used?
Answer: D
Indeed ultimate liability is not transferred. Only financial ramifications of mishandling data that was brought to light by regulatory audit, contract breach or other may be subject to payback by insurance as long as the reason is acceptable following the contract with the insurer.
Source: Adapted from community discussion — Zeezee2
What process is used within a clustered system to provide high availability and load balancing?
Answer: D
Dynamic resource scheduling (DRS) is used within all clustering systems as the method for clusters to provide high availability, scaling, management, and workload distribution and balancing of jobs and processes. From a physical infrastructure perspective, DRS is used to balance compute loads between physical hosts in a cloud to maintain the desired thresholds and limits on the physical hosts.
Source: Adapted from community discussion — ikamalbhatt
Which of the following is NOT a function performed by the handshake protocol of TLS?
Answer: B
The handshake protocol negotiates and establishes the connection as well as handles the key exchange and establishes the session ID. It does not perform the actual encryption of data packets.
Source: Adapted from community discussion — David_S
Unlike SOC Type 1 reports, which are based on a specific point in time, SOC Type 2 reports are done over a period of time. What is the minimum span of time for a SOC Type 2 report?
Answer: A
They need to fix the language on these. SOC 1, SOC 2 Type 1 and Type 2 etc. Use the correct format or it makes studying more difficult.
Source: Adapted from community discussion — EdwardLeeBurtle
What changes are necessary to application code in order to implement DNSSEC?
Answer: D
In order to implement DNSSEC, some changes to application code may be necessary. DNSSEC is a security extension to the Domain Name System (DNS) that provides authentication for DNS lookups. To implement DNSSEC, application code may need to be updated to perform additional DNS lookups in order to verify the authenticity of DNS records. This may involve adding code to perform cryptographic operations in order to validate DNSSEC signatures. Therefore, the correct answer is option C, "Additional DNS lookups."
Source: Adapted from community discussion — DA95
Which type of controls are the SOC Type 1 reports specifically focused on?
Answer: C
SOC Type 1 reports are focused specifically on internal controls as they relate to financial reporting.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 21. 493 questions available.
Version 1.0.0. How we source questions