ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
What concept does the A represent within the DREAD model?
Answer: A
The concept of affected users measures the percentage of users who would be impacted by a successful exploit. Scoring ranges from 0, which would impact no users, to 10, which would impact all users. None of the other options provided is the correct term.
Source: Adapted from community discussion — xaccan
With an application hosted in a cloud environment, who could be the recipient of an eDiscovery order?
Answer: B
Either the cloud customer or the cloud provider could receive an eDiscovery order, and in almost all circumstances they would need to work together to ensure compliance.
Which ITIL component focuses on ensuring that system resources, processes, and personnel are properly allocated to meet SLA requirements?
Answer: B
Availability management is focused on making sure system resources, processes, personnel, and toolsets are properly allocated and secured to meet SLA requirements. Continuity management (or business continuity management) is focused on planning for the successful restoration of systems or services after an unexpected outage, incident, or disaster. Configuration management tracks and maintains detailed information about all IT components within an organization. Problem management is focused on identifying and mitigating known problems and deficiencies before they occur.
Which ITIL component is an ongoing, iterative process of tracking all deployed and configured resources that an organization uses and depends on, whether they are hosted in a traditional data center or a cloud?
Answer: D
Configuration management tracks and maintains detailed information about all IT components within an organization. Availability management is focused on making sure system resources, processes, personnel, and toolsets are properly allocated and secured to meet SLA requirements. Continuity management (or business continuity management) is focused on planning for the successful restoration of systems or services after an unexpected outage, incident, or disaster. Problem management is focused on identifying and mitigating known problems and deficiencies before they occur.
When beginning an audit, both the system owner and the auditors must agree on various aspects of the final audit report. Which of the following would NOT be something that is predefined as part of the audit agreement?
Answer: A
Explanation - The ultimate size of the audit report is not something that would ever be included in the audit scope or definition. Decisions about the content of the report should be the only factor that drives the ultimate size of the report. The structure, audience, and format of the audit report are all crucial elements that must be defined and agreed upon as part of the audit scope.
Source: Adapted from community discussion — Pegasus_orb
Which of the following is the concept of segregating information or processes, within the same system or application, for security reasons?
Answer: B
Sandboxing involves the segregation and isolation of information or processes from other information or processes within the same system or application, typically for security concerns. Sandboxing is generally used for data isolation (for example, keeping different communities and populations of users isolated from others with similar data). In IT terminology, pooling typically means bringing together and consolidating resources or services, not segregating or separating them. Cell blocking and fencing are both erroneous terms.
Which cloud service category most commonly uses client-side key management systems?
Answer: B
Remote Key Management Service is where the cloud customer owns, operates and maintains a key management system on premises, and their systems deployed in the cloud connect the KMS Client Side Key Management - similar to Remote Key Management service, except that most of the processing and control is done on the customer/cloud user side. Client side looks to put the customer or cloud user in complete control of encryption and decryption keys. FOR THE EXAM: Client-side Key Management viewed as better
Source: Adapted from community discussion — Zeezee2
GAAPs are created and maintained by which organization?
Answer: B
Generally Accepted Accounting Principles (GAAPs) are created and maintained by: B. AICPA (American Institute of Certified Public Accountants) Explanation: A. ISO/IEC: The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) develop and publish international standards, but they are not responsible for accounting standards like GAAP. B. AICPA (American Institute of Certified Public Accountants): The AICPA plays a significant role in the development and maintenance of accounting standards in the United States. However, it's worth noting that the Financial Accounting Standards Board (FASB) is the primary organization that establishes GAAP. The AICPA supports the FASB in this role. C. PCI Council: The Payment Card Industry Security Standards Council (PCI SSC) is responsible for the PCI Data Security Standards (PCI DSS), which relate to payment card security, not accounting standards. D. ISO: The International Organization for Standardization (ISO) develops international standards across various industries, but it does not create or maintain GAAP.
Source: Adapted from community discussion — TheFivePips
Apart from using encryption at the file system level, what technology is the most widely used to protect data stored in an object storage system?
Answer: A
Information rights management (IRM) technologies allow security controls and policies to be enforced on a data object regardless of where it resides. They also allow for extended controls such as expirations and copying restrictions, which are not available through traditional control mechanisms. Hypertext Transfer Protocol Secure (HTTPS), virtual private network (VPN), and Transport Layer Security (TLS) are all technologies and protocols that are widely used with cloud implementations for secure access to systems and services and likely will be used in conjunction with other object data protection strategies.
Source: Adapted from community discussion — FranklinG
Which of the following types of data would fall under data rights management (DRM) rather than information rights management (IRM)?
Answer: C
Whereas IRM is used to protect a broad range of data, DRM is focused specifically on the protection of consumer media, such as publications, music, movies, and so on. IRM is used to protect general institution data, so financial records, personnel data, and security profiles would all fall under the auspices of IRM.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 301. 493 questions available.
Version 1.0.0. How we source questions