Question 431 · 493 in bank
Which of the following is the primary purpose of an SOC 3 report?
Show answer
Answer: C
ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Which of the following is the primary purpose of an SOC 3 report?
Answer: C
Which of the following is not an example of a highly regulated environment?
Answer: D
Wholesalers or distributors are generally not regulated, although the products they sell may be.
Which of the following methods of addressing risk is most associated with insurance?
Answer: B
Legal controls refer to which of the following?
Answer: D
Which of the following best describes a cloud carrier?
Answer: A
Gap analysis is performed for what reason?
Answer: D
The primary purpose of the gap analysis is to begin the benchmarking process against risk and security standards and frameworks.
Source: Adapted from community discussion — Bill_nye_russian_guy
Which of the following frameworks focuses specifically on design implementation and management?
Answer: A
Which of the following report is most aligned with financial control audits?
Answer: C
The SOC 1 report focuses primarily on controls associated with financial services. While IT controls are certainly part of most accounting systems today, the focus is on the controls around those financial systems.
Which of the following threat types can occur when encryption is not properly applied or insecure transport mechanisms are used?
Answer: C
Sensitive data exposure occurs when information is not properly secured through encryption and secure transport mechanisms; it can quickly become an easy and broad method for attackers to compromise information. Web applications must enforce strong encryption and security controls on the application side, but secure methods of communications with browsers or other clients used to access the information are also required. Security misconfiguration occurs when applications and systems are not properly configured for security, often a result of misapplied or inadequate baselines. Insecure direct object references occur when code references aspects of the infrastructure, especially internal or private systems, and an attacker can use that knowledge to glean more information about the infrastructure. Unvalidated redirects and forwards occur when an application has functions to forward users to other sites, and these functions are not properly secured to validate the data and redirect requests, thus allowing spoofing for malware or phishing attacks.
Limits for resource utilization can be set at different levels within a cloud environment to ensure that no particular entity can consume a level of resources that impacts other cloud customers. Which of the following is NOT a unit covered by limits?
Answer: A
"Cloud customer" seems poorly worded just to confuse us, but the whole concept is that you can indeed put limits at the customer level.
Source: Adapted from community discussion — CL888
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 431. 493 questions available.
Version 1.0.0. How we source questions