Question 371 · 493 in bank
Best practices for key management include all of the following, except:
Show answer
Answer: A
Explanation
We should do all of these except for requiring multifactor authentication, which is pointless in key management.
ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Best practices for key management include all of the following, except:
Answer: A
We should do all of these except for requiring multifactor authentication, which is pointless in key management.
What is the correct order of the phases of the data life cycle?
Answer: D
The other options are the names of the phases, but out of proper order.
Cryptographic keys should be secured ________________ .
Answer: A
The physical security of crypto keys is of some concern, but guards or vaults are not always necessary. Two-person integrity might be a good practice for protecting keys. The best answer to this question is option A, because it is always true, whereas the remaining options depend on circumstances.
What are third-party providers of IAM functions for the cloud environment?
Answer: D
Data loss, leak prevention, and protection is a family of tools used to reduce the possibility of unauthorized disclosure of sensitive information. SIEMs are tools used to collate and manage log data. AES is an encryption standard.
What are the U.S. Commerce Department controls on technology exports known as?
Answer: C
C. "The U.S. Department of Commerce's Bureau of Industry and Security (BIS) administers U.S. laws, regulations and policies governing the export and reexport of commodities, software, and technology (collectively “items”) falling under the jurisdiction of the Export Administration Regulations (EAR)."
Source: Adapted from community discussion — NYF
All of these are methods of data discovery, except:
Answer: B
All the others are valid methods of data discovery; user-based is a red herring with no meaning.
The various models generally available for cloud BC/DR activities include all of the following except:
Answer: D
This is not a normal configuration and would not likely provide genuine benefit.
Which kind of SSAE audit reviews controls dealing with the organization's controls for assuring the confidentiality, integrity, and availability of data?
Answer: B
SOC 2 deals with the CIA triad. SOC 1 is for financial reporting. SOC 3 is only an attestation by the auditor. There is no SOC 4.
To address shared monitoring and testing responsibilities in a cloud configuration, the provider might offer all these to the cloud customer except:
Answer: B
While the provider might share any of the other options listed, the provider will not share administration of security controls with the customer. Security controls are the sole province of the provider.
Which kind of SSAE audit report is most beneficial for a cloud customer, even though it's unlikely the cloud provider will share it?
Answer: C
The SOC 3 is the least detailed, so the provider is not concerned about revealing it. The SOC 1 Types 1 and 2 are about financial reporting and not relevant. The SOC 2 Type 2 is much more detailed and will most likely be kept closely held by the provider.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 371. 493 questions available.
Version 1.0.0. How we source questions