ISC CCSP Cert Guide PDF 100% Cover Real Exam Questions
Pass CCSP Exam - Real Questions and Answers
NEW QUESTION 13
Many aspects of cloud computing bring enormous benefits over a traditional data center, but also introduce new challenges unique to cloud computing.
Which of the following aspects of cloud computing makes appropriate data classification of high importance?
- A. Portability
- B. Multitenancy
- C. Interoperability
- D. Reversibility
Answer: B
Explanation:
Explanation/Reference:
Explanation:
With multitenancy, where different cloud customers all share the same physical systems and networks, data classification becomes even more important to ensure that the appropriate security controls are applied immediately to prevent any potential leakage or exposure to other customers. Portability refers to the ability to move easily from one cloud provider to another. Interoperability refers to the ability to reuse components and services for different uses. Reversibility refers to the ability of the cloud customer to quickly and completely remove all data and services from a cloud provider and to verify the removal.
NEW QUESTION 14
DLP solutions can aid in deterring loss due to which of the following?
- A. Natural disaster
- B. Randomization
- C. Inadvertent disclosure
- D. Device failure
Answer: C
Explanation:
DLP solutions may protect against inadvertent disclosure. Randomization is a technique for obscuring data, not a risk to data. DLP tools will not protect against risks from natural disasters, or against impacts due to device failure.
NEW QUESTION 15
What are the phases of a software development lifecycle process model?
- A. Planning and requirements analysis, design, define, develop, testing, and maintenance
- B. Define, planning and requirements analysis, design, develop, testing, and maintenance
- C. Planning and requirements analysis, define, design, testing, develop, and maintenance
- D. Planning and requirements analysis, define, design, develop, testing, and maintenance
Answer: D
NEW QUESTION 16
The cloud customer's trust in the cloud provider can be enhanced by all of the following except:
- A. Audits
- B. Shared administration
- C. real-time video surveillance
- D. SLAs
Answer: C
Explanation:
Explanation
Video surveillance will not provide meaningful information and will not enhance trust. All the others will do it.
NEW QUESTION 17
What type of security threat is DNSSEC designed to prevent?
- A. Spoofing
- B. Account hijacking
- C. Injection
- D. Snooping
Answer: A
Explanation:
Explanation
DNSSEC is designed to prevent the spoofing and redirection of DNS resolutions to rogue sites.
NEW QUESTION 18
Which of the following is not a reason for conducting audits?
- A. Security assurance
- B. Regulatory compliance
- C. Determination of service quality
- D. User satisfaction
Answer: D
NEW QUESTION 19
Each of the following is an element of the Identification phase of the identity and access management (IAM) process except _____________.
Response:
- A. Provisioning
- B. Inversion
- C. Deprovisioning
- D. Management
Answer: B
NEW QUESTION 20
What is one of the benefits of implementing an egress monitoring solution?
Response:
- A. Preventing DDoS attacks
- B. Inventorying data assets
- C. Interviewing data owners
- D. Protecting against natural disasters
Answer: B
NEW QUESTION 21
Which type of threat is often used in conjunction with phishing attempts and is often viewed as greatly increasing the likeliness of success?
- A. Unvalidated redirects and forwards
- B. Cross-site scripting
- C. Cross-site request forgery
- D. Insecure direct object references
Answer: A
NEW QUESTION 22
Which of the following is not a risk management framework?
- A. NIST SP 800-37
- B. COBIT
- C. Hex GBL
- D. ISO 31000:2009
Answer: C
Explanation:
Explanation
Hex GBL is a reference to a computer part in Terry Pratchett's fictional Discworld universe. The rest are not.
NEW QUESTION 23
Your IT steering committee has, at a high level, approved your project to begin using cloud services. However, the committee is concerned with getting locked into a single cloud provider and has flagged the ability to easily move between cloud providers as a top priority. It also wants to save costs by reusing components.
Which cross-cutting aspect of cloud computing would be your primary focus as your project plan continues to develop and you begin to evaluate cloud providers?
- A. Portability
- B. Resiliency
- C. Scalability
- D. Interoperability
Answer: D
Explanation:
Explanation
Interoperability is ability to easily move between cloud providers, by either moving or reusing components and services. This can pertain to any cloud deployment model, and it gives organizations the ability to constantly evaluate costs and services as well as move their business to another cloud provider as needed or desired. Portability relates to the wholesale moving of services from one cloud provider to another, not necessarily the reuse of components or services for other purposes. Although resiliency is not an official concept within cloud computing, it certainly would be found throughout other topics such as elasticity, auto-scaling, and resource pooling. Scalability pertains to changing resource allocations to a service to meet current demand, either upward or downward in scope.
NEW QUESTION 24
What is a serious complication an organization faces from the perspective of compliance with international operations?
- A. Different capabilities
- B. Different certifications
- C. Different operational procedures
- D. Multiple jurisdictions
Answer: D
Explanation:
Explanation/Reference:
Explanation:
When operating within a global framework, a security professional runs into a multitude of jurisdictions and requirements, and many times they might be in contention with one other or not clearly applicable. These requirements can include the location of the users and the type of data they enter into systems, the laws governing the organization that owns the application and any regulatory requirements they may have, as well as the appropriate laws and regulations for the jurisdiction housing the IT resources and where the data is actually stored, which might be multiple jurisdictions as well.
NEW QUESTION 25
What process is used within a clustered system to provide high availability and load balancing?
- A. Dynamic optimization
- B. Dynamic balancing
- C. Dynamic clustering
- D. Dynamic resource scheduling
Answer: D
Explanation:
Explanation
Explanation:
Dynamic resource scheduling (DRS) is used within all clustering systems as the method for clusters to provide high availability, scaling, management, and workload distribution and balancing of jobs and processes. From a physical infrastructure perspective, DRS is used to balance compute loads between physical hosts in a cloud to maintain the desired thresholds and limits on the physical hosts.
NEW QUESTION 26
Which of the following aspects of cloud computing would make it more likely that a cloud provider would be unwilling to satisfy specific certification requirements?
- A. Multitenancy
- B. Regulation
- C. Virtualization
- D. Resource pooling
Answer: A
Explanation:
Explanation/Reference:
Explanation:
With cloud providers hosting a number of different customers, it would be impractical for them to pursue additional certifications based on the needs of a specific customer. Cloud environments are built to a common denominator to serve the greatest number of customers. Especially within a public cloud model, it is not possible or practical for a cloud provider to alter its services for specific customer demands.
Resource pooling and virtualization within a cloud environment would be the same for all customers, and would not impact certifications that a cloud provider might be willing to pursue. Regulations would form the basis for certification problems and would be a reason for a cloud provider to pursue specific certifications to meet customer requirements.
NEW QUESTION 27
Which Common Criteria Evaluation Assurance Level (EAL) is granted to those products that are formally verified in terms of design and tested by an independent third party?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 28
Which of the following threat types involves the sending of invalid and manipulated requests through a user's client to execute commands on the application under their own credentials?
- A. Cross-site request forgery
- B. Missing function-level access control
- C. Cross-site scripting
- D. Injection
Answer: A
Explanation:
Explanation/Reference:
Explanation:
A cross-site request forgery (CSRF) attack forces a client that a user has used to authenticate to an application to send forged requests under the user's own credentials to execute commands and requests that the application thinks are coming from a trusted client and user. Although this type of attack cannot be used to steal data directly because the attacker has no way to see the results of the commands, it does open other ways to compromise an application. Missing function-level access control exists where an application only checks for authorization during the initial login process and does not further validate with each function call. An injection attack is where a malicious actor sends commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries. Cross-site scripting occurs when an attacker is able to send untrusted data to a user's browser without going through validation processes.
NEW QUESTION 29
What concept does the "D" represent with the STRIDE threat model?
- A. Data loss
- B. Distributed
- C. Data breach
- D. Denial of service
Answer: D
Explanation:
Any application can be a possible target of denial-of-service (DoS) attacks. From the application side, the developers should minimize how many operations are performed for non-authenticated users. This will keep the application running as quickly as possible and using the least amount of system resources to help minimize the impact of any such attacks.
NEW QUESTION 30
Which of the following is considered an internal redundancy for a data center?
- A. Power distribution units
- B. Power substations
- C. Generators
- D. Network circuits
Answer: A
Explanation:
Explanation
Power distribution units are internal to a data center and supply power to internal components such as racks, appliances, and cooling systems. As such, they are considered an internal redundancy.
NEW QUESTION 31
The tasks performed by the hypervisor in the virtual environment can most be likened to the tasks of the ________ in the legacy environment.
- A. Central processing unit (CPU)
- B. OS
- C. Security team
- D. PGP
Answer: A
NEW QUESTION 32
What process entails taking sensitive data and removing the indirect identifiers from each data object so that the identification of a single entity would not be possible?
- A. Anonymization
- B. Encryption
- C. Masking
- D. Tokenization
Answer: A
Explanation:
Explanation
Anonymization is a type of masking, where indirect identifiers are removed from a data set to prevent the mapping back of data to an individual. Although masking refers to the overall approach of covering sensitive data, anonymization is the best answer here because it is more specific to exactly what is being asked.
Tokenization involves the replacement of sensitive data with a key value that can be matched back to the real value. However, it is not focused on indirect identifiers or preventing the matching to an individual.
Encryption refers to the overall process of protecting data via key pairs and protecting confidentiality.
NEW QUESTION 33
......
Prerequisites
The potential candidates for the (ISC)2 CSSP certification should have at least 5 years of cumulative, paid, and full-time professional experience in the Information Technology sector. Three of these five years must be within the domain of information security and at least one year of experience must be in one or more of the six domains of the (ISC)2 CCSP Common Book of Knowledge. Those individuals who already earned the CSA CCSK certificate can substitute it for the prerequisite experience.
100% Free CCSP Daily Practice Exam With 830 Questions: https://www.dumpsking.com/CCSP-testking-dumps.html
Pass CCSP Review Guide, Reliable CCSP Test Engine: https://drive.google.com/open?id=1qkigRrJO5Sqwre-ny6T_mbcKeR_CCXvg
