ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Which publication from the United States National Institute of Standards and Technology pertains to defining cloud concepts and definitions for the various core components of cloud computing?
Answer: B
NIST Special Publications 800-145 is titled "The NIST Definition of Cloud Computing" and contains definitions and explanations of core cloud concepts and components.
Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
Answer: B
It is imperative that an application perform checks when each function or portion of the application is accessed, to ensure that the user is properly authorized to access it. Without continual checks each time a function is accessed, an attacker could forge requests to access portions of the application where authorization has not been granted.
Source: Adapted from community discussion — serget12
What is the biggest negative to leasing space in a data center versus building or maintain your own?
Answer: B
Which aspect of archiving must be tested regularly for the duration of retention requirements?
Answer: B
In order for any archiving system to be deemed useful and compliant, regular tests must be performed to ensure the data can still be recovered and accessible, should it ever be needed, for the duration of the retention requirements.
Source: Adapted from community discussion — nidoz
Which of the following represents a minimum guaranteed resource within a cloud environment for the cloud customer?
Answer: A
A reservation is a minimum resource that is guaranteed to a customer within a cloud environment. Within a cloud, a reservation can pertain to the two main aspects of computing: memory and processor. With a reservation in place, the cloud provider guarantees that a cloud customer will always have at minimum the necessary resources available to power on and operate any of their services.
When is a virtual machine susceptible to attacks while a physical server in the same state would not be?
Answer: D
Should be D, since vm is still vulnerable even when powered off, because if hypervisor or host machine gets compromised while powered ON, offline VM can be the target still. Physical machine when offline is not accessible .
Source: Adapted from community discussion — Masia767
Which of the following threat types involves an application developer leaving references to internal information and configurations in code that is exposed to the client?
Answer: C
Question not precise enough to clearly choose between A and C. A if data is generic data (for example, version of the internal database) C if used by a backend application (for example internal authentication token)
Source: Adapted from community discussion — xroxro
Which of the following is the biggest concern or challenge with using encryption?
Answer: A
Exam tip here: avoid bringing in "what if's" when evaluating the question. For example, when I first read this I thought that maybe the cipher strength would be the biggest concern "if" someone were to use a weak cipher that was easy to defeat. But I used an "if" in my logic. The question doesn't state anything about the cipher used, so we can't assume that a weak cipher would be the biggest concern when protection of encryption keys is critical across ALL encryption ciphers.
Source: Adapted from community discussion — Purespace
Which of the following would NOT be considered part of resource pooling with an Infrastructure as a Service implementation?
Answer: B
Infrastructure as a Service pools the compute resources for platforms and applications to build upon, including CPU, memory, and storage. Applications are not part of an IaaS offering from the cloud provider.
Which technology is NOT commonly used for security with data in transit?
Answer: A
DNSSEC relates to the integrity of DNS resolutions and the prevention of spoofing or redirection, and does not pertain to the actual security of transmissions or the protection of data.
Source: Adapted from community discussion — Guest4768
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 471. 493 questions available.
Version 1.0.0. How we source questions