CCSP practice questions 41–50

1. Question 41 · 493 in bank

   Which of the following would be a reason to undertake a BCDR test?

   • AFunctional change of the application
   • BChange in staff
   • CUser interface overhaul of the application
   • DChange in regulations

   Show answer

   Answer: B

   Explanation

   Disagree with this answer. From practical exp, if it's a monolithic application and IaaS/PaaS then any application change will not require BCDR test as the infra layer or DR would have been the same. SImilarly containers and SaaS app change/update/config change also should not require BCDR test. Regulation change can be valid reason for BCDR test. Somebody commented here about RTO sarcastically but those RPO/RTO changes could be internal rules/policy with BCDR and definitely may require "next" DR test to test /confirm the new targets. More regulations can be state or Federal Govt restrictions for e.g. about failover from Govt DC to happen only to other DCs within certain geographical perimeter. Like many other ISC question, language of this question also rather vague. ISC may expect answer for this as Application change but that's not something ideally trigger this.

   Source: Adapted from community discussion — CloudTrip

   Next question

2. Question 42 · 493 in bank

   What is the biggest challenge to data discovery in a cloud environment?

   • AFormat
   • BOwnership
   • CLocation
   • DMultitenancy

   Show answer

   Answer: C

   Explanation

   When the data is multi tenant, you cannot have access to the each tenant and get the data , it is a big concern, when the question says whats the biggest concern, it should be multi tenancy.

   Source: Adapted from community discussion — phanil1

   Next question

3. Question 43 · 493 in bank

   Which crucial aspect of cloud computing can be most threatened by insecure APIs?

   • AAutomation
   • BRedundancy
   • CResource pooling
   • DElasticity

   Show answer

   Answer: A

   Explanation

   Cloud environments depend heavily on API calls for management and automation. Any vulnerability with the APIs can cause significant risk and exposure to all tenants of the cloud environment.

   Next question

4. Question 44 · 493 in bank

   Which of the following should NOT be part of the requirement analysis phase of the software development lifecycle?

   • AFunctionality
   • BProgramming languages
   • CSoftware platform
   • DSecurity requirements

   Show answer

   Answer: B

   Explanation

   Answer is correct. The Secure Software Development Lifecycle (SDLC) Process phases are 1. Requirement Gathering and Feasibility 2. Requirement Analysis 3. Design 4. Development/Coding 5. Testing 6. Maintenance Note: It is essential that security be included in discussions and the SDLC process from the very initial stages. Carter, Daniel. CCSP Certified Cloud Security Professional All-in-One Exam Guide, Second Edition (p. 169). McGraw-Hill Education. Kindle Edition.

   Source: Adapted from community discussion — MahesswarShriMohanty

   Next question

5. Question 45 · 493 in bank

   Which of the cloud cross-cutting aspects relates to the assigning of jobs, tasks, and roles, as well as to ensuring they are successful and properly performed?

   • AService-level agreements
   • BGovernance
   • CRegulatory requirements
   • DAuditability

   Show answer

   Answer: B

   Explanation

   Governance is the system by which the provisioning and usage of cloud services are directed and controlled. Governance defines actions, assigns responsibilities, and verifies performance. Governance includes the policy, process, and internal controls that comprise how an organization is run. Everything from the structures and policies to the leadership and other mechanisms for management.

   Source: Adapted from community discussion — Seke

   Next question

6. Question 46 · 493 in bank

   What is a serious complication an organization faces from the perspective of compliance with international operations?

   • ADifferent certifications
   • BMultiple jurisdictions
   • CDifferent capabilities
   • DDifferent operational procedures

   Show answer

   Answer: B

   Next question

7. Question 47 · 493 in bank

   Which regulatory system pertains to the protection of healthcare data?

   • AHIPAA
   • BHAS
   • CHITECH
   • DHFCA

   Show answer

   Answer: A

   Explanation

   The Health Insurance Portability and Accountability Act (HIPAA) sets stringent requirements in the United States for the protection of healthcare records.

   Next question

8. Question 48 · 493 in bank

   Which aspect of cloud computing makes it very difficult to perform repeat audits over time to track changes and compliance?

   • AVirtualization
   • BMultitenancy
   • CResource pooling
   • DDynamic optimization

   Show answer

   Answer: A

   Explanation

   I dont understand comments like these. The given answer is A. You select A, then state multitenancy is correct (which is B), and refer to the explanation provided being good, which is an explanation for virtualization being the answer. Why is this upvoted two times?

   Source: Adapted from community discussion — styro

   Next question

9. Question 49 · 493 in bank

   Which security concept would business continuity and disaster recovery fall under?

   • AConfidentiality
   • BAvailability
   • CFault tolerance
   • DIntegrity

   Show answer

   Answer: B

   Explanation

   Disaster recovery and business continuity are vital concerns with availability. If data is destroyed or compromised, having regular backup systems in place as well as being able to perform disaster recovery in the event of a major or widespread problem allows operations to continue with an acceptable loss of time and data to management. This also ensures that sensitive data is protected and persisted in the event of the loss or corruption of data systems or physical storage systems.

   Next question

10. Question 50 · 493 in bank

    Which of the following is NOT an application or utility to apply and enforce baselines on a system?

    • AChef
    • BGitHub
    • CPuppet
    • DActive Directory

    Show answer

    Answer: B

    Explanation

    github is a a sw repository and collaboration tool. Not a control SW tool, the other ones are SW control tools. And yes, you can enforce baselines with AD. GPO- Group Policy Objects & templates.

    Source: Adapted from community discussion — kepalon

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CCSP practice, question 41. 493 questions available.