The Most Up-to-date Guide To CCSP Training

NEW QUESTION 1

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and published approximately every 24 months. The 2013 OWASP Top Ten list includes “unvalidated redirects and forwards.”
Which of the following is a good way to protect against this problem? Response:

• A. Don’t use redirects/forwards in your applications.
• B. Refrain from storing credentials long term.
• C. Implement security incident/event monitoring (security information and event management (SIEM)/security information management (SIM)/security event management (SEM)) solutions.
• D. Implement digital rights management (DRM) solutions.

Answer: A

NEW QUESTION 2

You are the security manager of a small firm that has just purchased a DLP solution to implement in your cloud-based production environment.
In order to get truly holistic coverage of your environment, you should be sure to include ______ as a step in the deployment process.
Response:

• A. Getting signed user agreements from all users
• B. Installation of the solution on all assets in the cloud data center
• C. Adoption of the tool in all routers between your users and the cloud provider
• D. All of your customers to install the tool

Answer: A

NEW QUESTION 3

The use of which of the following technologies will NOT require the security dependency of an operating system, other than its own?

• A. Management plane
• B. Type 1 hypervisor
• C. Type 2 hypervisor
• D. Virtual machine

Answer: B

NEW QUESTION 4

Alice is the CEO for a software company; she is considering migrating the operation from the current on-premises legacy environment into the cloud.
In order to protect her company’s intellectual property, Alice might want to consider implementing all these techniques/solutions except ______.
Response:

• A. Egress monitoring
• B. Encryption
• C. Turnstiles
• D. Digital watermarking

Answer: C

NEW QUESTION 5

Which of the following types of organizations is most likely to make use of open source software technologies?

• A. Government agencies
• B. Corporations
• C. Universities
• D. Military

Answer: C

NEW QUESTION 6

Which of the following is a method for apportioning resources that involves setting guaranteed minimums for all tenants/customers within the environment?
Response:

• A. Reservations
• B. Shares
• C. Cancellations
• D. Limits

Answer: A

NEW QUESTION 7

Your company maintains an on-premises data center for daily production activities but wants to use a cloud service to augment this capability during times of increased demand (cloud bursting).
Which deployment model would probably best suit the company’s needs? Response:

• A. Public
• B. Private
• C. Community
• D. Hybrid

Answer: D

NEW QUESTION 8

The cloud deployment model that features organizational ownership of the hardware and infrastructure, and usage only by members of that organization, is known as:
Response:

• A. Private
• B. Public
• C. Hybrid
• D. Motive

Answer: A

NEW QUESTION 9

Which of the following methods for the safe disposal of electronic records can always be used in a cloud
environment? Response:

• A. Physical destruction
• B. Encryption
• C. Overwriting
• D. Degaussing

Answer: B

NEW QUESTION 10

What are the six components that make up the STRIDE threat model? Response:

• A. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege
• B. Spoofing, Tampering, Non-Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege
• C. Spoofing, Tampering, Repudiation, Information Disclosure, Distributed Denial of Service, and Elevation of Privilege
• D. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Social Engineering

Answer: A

NEW QUESTION 11

All of the following might be used as data discovery characteristics in a content-analysis-based data discovery effort except ______.
Response:

• A. Keywords
• B. Pattern-matching
• C. Frequency
• D. Inheritance

Answer: D

NEW QUESTION 12

All of the following are activities that should be performed when capturing and maintaining an accurate, secure system baseline, except ______.
Response:

• A. Audit the baseline to ensure that all configuration items have been included and applied correctly
• B. Impose the baseline throughout the environment
• C. Capture an image of the baseline system for future reference/versioning/rollback purposes
• D. Document all baseline configuration elements and versioning data

Answer: B

NEW QUESTION 13

Which of the following is not typically included in the list of critical assets specified for continuity during BCDR contingency operations?
Response:

• A. Systems
• B. Data
• C. Cash
• D. Personnel

Answer: C

NEW QUESTION 14

Your company has just been served with an eDiscovery order to collect event data and other pertinent information from your application during a specific period of time, to be used as potential evidence for a court proceeding.
Which of the following, apart from ensuring that you collect all pertinent data, would be the MOST important consideration?
Response:

• A. Encryption
• B. Chain of custody
• C. Compression
• D. Confidentiality

Answer: B

NEW QUESTION 15

What is used with a single sign-on system for authentication after the identity provider has successfully authenticated a user?
Response:

• A. Token
• B. Key
• C. XML
• D. SAML

Answer: A

NEW QUESTION 16

What sort of legal enforcement may the Payment Card Industry (PCI) Security Standards Council not bring to bear against organizations that fail to comply with the Payment Card Industry Data Security Standard (PCI DSS)?
Response:

• A. Fines
• B. Jail time
• C. Suspension of credit card processing privileges
• D. Subject to increased audit frequency and scope

Answer: B

NEW QUESTION 17

If bit-splitting is used to store data sets across multiple jurisdictions, how may this enhance security? Response:

• A. By making seizure of data by law enforcement more difficult
• B. By hiding it from attackers in a specific jurisdiction
• C. By ensuring that users can only accidentally disclose data to one geographic area
• D. By restricting privilege user access

Answer: A

NEW QUESTION 18

You are the IT director for a small contracting firm. Your company is considering migrating to a cloud production environment.
Which service model would best fit your needs if you wanted an option that reduced the chance of vendor lock-in but also did not require the highest degree of administration by your own personnel?
Response:

• A. IaaS
• B. PaaS
• C. SaaS
• D. TanstaafL

Answer: B

NEW QUESTION 19

What is a cloud storage architecture that manages the data in caches of copied content close to locations of high demand?
Response:

• A. Object-based storage
• B. File-based storage
• C. Database
• D. CDN

Answer: D

NEW QUESTION 20

Every cloud service provider that opts to join the CSA STAR program registry must complete a ______.

• A. SOC 2, Type 2 audit report
• B. Consensus Assessment Initiative Questionnaire (CAIQ)
• C. NIST 800-37 RMF audit
• D. ISO 27001 ISMS review

Answer: B

NEW QUESTION 21

Penetration testing is a(n) ______ form of security assessment.
Response:

• A. Active
• B. Comprehensive
• C. Total
• D. Inexpensive

Answer: A

NEW QUESTION 22

A denial of service (DoS) attack can potentially impact all customers within a cloud environment with the continued allocation of additional resources. Which of the following can be useful for a customer to protect themselves from a DoS attack against another customer?
Response:

• A. Limits
• B. Reservations
• C. Shares
• D. Borrows

Answer: B

NEW QUESTION 23

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application development experts and published approximately every 24 months. The 2013 OWASP Top Ten list includes “using components with known vulnerabilities.”
Why would an organization ever use components with known vulnerabilities to create software? Response:

• A. The organization is insured.
• B. The particular vulnerabilities only exist in a context not being used by developers.
• C. Some vulnerabilities only exist in foreign countries.
• D. A component might have a hidden vulnerability.

Answer: B

NEW QUESTION 24

In application-level encryption, where does the encryption engine reside? Response:

• A. In the application accessing the database
• B. In the OS on which the application is run
• C. Within the database accessed by the application
• D. In the volume where the database resides

Answer: A

NEW QUESTION 25

Which kind of SSAE audit reviews controls dealing with the organization’s controls for assuring the confidentiality, integrity, and availability of data?
Response:

• A. SOC 1
• B. SOC 2
• C. SOC 3
• D. SOC 4

Answer: B

NEW QUESTION 26

Which of the following is a possible negative aspect of bit-splitting? Response:

• A. It may require trust in additional third parties beyond the primary cloud service provider.
• B. There may be cause for management concern that the technology will violate internal policy.
• C. Users will have far greater difficulty understanding the implementation.
• D. Limited vendors make acquisition and support challenging.

Answer: A

NEW QUESTION 27

All of the following entitles are required to use FedRAMP-accredited Cloud Service Providers except
______.
Response:

• A. The US post office
• B. The Department of Homeland Security
• C. Federal Express
• D. The CIA

Answer: C

NEW QUESTION 28

At which layer does the IPSec protocol operate to encrypt and protect communications between two parties? Response:

• A. Network
• B. Application
• C. Transport
• D. Data link

Answer: A

NEW QUESTION 29
......