CCSP 100% Pass Guaranteed Download ISC Cloud Security Exam PDF Q&A
CCSP Practice Test Dumps with 100% Passing Guarantee
NEW QUESTION # 97
What category of PII data can carry potential fines or even criminal charges for its improper use or disclosure?
- A. Contractual
- B. Protected
- C. Regulated
- D. Legal
Answer: C
Explanation:
Regulated PII data carries legal and jurisdictional requirements, along with official penalties for its misuse or disclosure, which can be either civil or criminal in nature. Legal and protected are similar terms, but neither is the correct answer in this case. Contractual requirements can carry financial or contractual impacts for the improper use or disclosure of PII data, but not legal or criminal penalties that are officially enforced.
NEW QUESTION # 98
What are the U.S. Commerce Department controls on technology exports known as?
- A. EAR
- B. DRM
- C. ITAR
- D. EAL
Answer: A
Explanation:
Explanation
EAR is a Commerce Department program. Evaluation assurance levels are part of the Common Criteria standard from ISO. Digital rights management tools are used for protecting electronic processing of intellectual property.
NEW QUESTION # 99
What concept does the "R" represent with the DREAD model?
- A. Residual
- B. Repudiation
- C. Risk
- D. Reproducibility
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Reproducibility is the measure of how easy it is to reproduce and successful use an exploit. Scoring within the DREAD model ranges from 0, signifying a nearly impossibly exploit, up to 10, which signifies something that anyone from a simple function call could exploit, such as a URL.
NEW QUESTION # 100
Which of the following is NOT a focus or consideration of an internal audit?
- A. Certification
- B. Operational efficiency
- C. Design
- D. Costs
Answer: A
Explanation:
In order to obtain and comply with certifications, independent external audits must be performed and satisfied. Although some testing of certification controls can be part of an internal audit, they will not satisfy requirements.
NEW QUESTION # 101
Which approach is typically the most efficient method to use for data discovery?
- A. Metadata
- B. ACLs
- C. Labels
- D. Content analysis
Answer: A
Explanation:
Metadata is data about data. It contains information about the type of data, how it is stored and organized, or information about its creation and use.
NEW QUESTION # 102
Which entity requires all collection and storing of data on their citizens to be done on hardware that resides within their borders?
- A. United States
- B. France
- C. Germany
- D. Russia
Answer: D
Explanation:
Signed into law and effective starting on September 1, 2015, Russian Law 526-FZ establishes that any collecting, storing, or processing of personal information or data on Russian citizens must be done from systems and databases that are physically located with the Russian Federation.
NEW QUESTION # 103
Within an Infrastructure as a Service model, which of the following would NOT be a measured service?
- A. Number of users
- B. Memory
- C. Storage
- D. CPU
Answer: A
Explanation:
Within IaaS, the number of users on a system is not relevant to the particular hosting model in regard to cloud resources. IaaS is focused on infrastructure needs of a system or application.
Therefore, a factor such as the number of users that could affect licensing requirements, for example, would apply to the SaaS model, or in some instances to PaaS.
NEW QUESTION # 104
Which aspect of cloud computing makes data classification even more vital than in a traditional data center?
- A. Virtualization
- B. Multitenancy
- C. Interoperability
- D. Portability
Answer: B
Explanation:
With multiple tenants within the same hosting environment, any failure to properly classify data may lead to potential exposure to other customers and applications within the same environment.
NEW QUESTION # 105
A variety of security systems can be integrated within a network--some that just monitor for threats and issue alerts, and others that take action based on signatures, behavior, and other types of rules to actively stop potential threats.
Which of the following types of technologies is best described here?
- A. IPS
- B. Proxy
- C. Firewall
- D. IDS
Answer: A
Explanation:
An intrusion prevention system (IPS) can inspect traffic and detect any suspicious traffic based on a variety of factors, but it can also actively block such traffic. Although an IDS can detect the same types of suspicious traffic as an IPS, it is only design to alert, not to block. A firewall is only concerned with IP addresses, ports, and protocols; it cannot be used for the signature-based detection of traffic. A proxy can limit or direct traffic based on more extensive factors than a network firewall can, but it's not capable of using the same signature detection rules as an IPS.
NEW QUESTION # 106
Which of the following is the concept of segregating information or processes, within the same system or application, for security reasons?
- A. Cell blocking
- B. Fencing
- C. Sandboxing
- D. Pooling
Answer: C
Explanation:
Sandboxing involves the segregation and isolation of information or processes from other information or processes within the same system or application, typically for security concerns.
Sandboxing is generally used for data isolation (for example, keeping different communities and populations of users isolated from others with similar data). In IT terminology, pooling typically means bringing together and consolidating resources or services, not segregating or separating them. Cell blocking and fencing are both erroneous terms.
NEW QUESTION # 107
Which document will enforce uptime and availability requirements between the cloud customer and cloud provider?
- A. Service level agreement
- B. Contract
- C. Regulation
- D. Operational level agreement
Answer: A
NEW QUESTION # 108
Which of the following would be considered an example of insufficient due diligence leading to security or operational problems when moving to a cloud?
- A. Reliance on physical network controls
- B. Monitoring
- C. Use of a remote key management system
- D. Programming languages used
Answer: A
Explanation:
Explanation
Many organizations in a traditional data center make heavy use of physical network controls for security.
Although this is a perfectly acceptable best practice in a traditional data center, this reliance is not something that will port to a cloud environment. The failure of an organization to properly understand and adapt to the difference in network controls when moving to a cloud will likely leave an application with security holes and vulnerabilities. The use of a remote key management system, monitoring, or certain programming languages would not constitute insufficient due diligence by itself.
NEW QUESTION # 109
What concept does the "D" represent with the STRIDE threat model?
- A. Data loss
- B. Distributed
- C. Denial of service
- D. Data breach
Answer: C
Explanation:
Explanation
Any application can be a possible target of denial-of-service (DoS) attacks. From the application side, the developers should minimize how many operations are performed for non-authenticated users. This will keep the application running as quickly as possible and using the least amount of system resources to help minimize the impact of any such attacks.
NEW QUESTION # 110
On large distributed systems with pooled resources, cloud computing relies on extensive orchestration to maintain the environment and the constant provisioning of resources.
Which of the following is crucial to the orchestration and automation of networking resources within a cloud?
- A. DNS
- B. DNSSEC
- C. DCOM
- D. DHCP
Answer: D
Explanation:
Explanation
The Dynamic Host Configuration Protocol (DHCP) automatically configures network settings for a host so that these settings do not need to be configured on the host statically. Given the rapid and programmatic provisioning of resources within a cloud environment, this capability is crucial to cloud operations. Both DNS and its security-integrity extension DNSSEC provide name resolution to IP addresses, but neither is used for the configuration of network settings on a host. DCOM refers to the Distributed Component Object Model, which was developed by Microsoft as a means to request services across a network, and is not used for network configurations at all.
NEW QUESTION # 111
You are the IT security manager for a video game software development company. Which of the following is most likely to be your primary concern on a daily basis?
- A. Regulatory compliance
- B. Security flaws in your products
- C. Security flaws in your organization
- D. Health and human safety
Answer: C
NEW QUESTION # 112
What is a serious complication an organization faces from the compliance perspective with international operations?
- A. Different certifications
- B. Different capabilities
- C. Different operational procedures
- D. Multiple jurisdictions
Answer: D
Explanation:
Explanation/Reference:
Explanation:
When operating within a global framework, a security professional runs into a multitude of jurisdictions and requirements, which often may not be clearly applicable or may be in contention with each other. These requirements can involve the location of the users and the type of data they enter into systems, the laws governing the organization that owns the application and any regulatory requirements they may have, and finally the appropriate laws and regulations for the jurisdiction housing the IT resources and where the data is actually stored, which may be multiple jurisdictions as well. Different certifications would not come into play as a challenge because the major IT and data center certifications are international and would apply to any cloud provider. Different capabilities and different operational procedures would be mitigated by the organization's selection of a cloud provider and would not be a challenge if an appropriate provider was chosen, regardless of location.
NEW QUESTION # 113
Which of the following types of data would fall under data rights management (DRM) rather than information rights management (IRM)?
- A. Personnel data
- B. Financial records
- C. Security profiles
- D. Publications
Answer: D
Explanation:
Explanation
Whereas IRM is used to protect a broad range of data, DRM is focused specifically on the protection of consumer media, such as publications, music, movies, and so on. IRM is used to protect general institution data, so financial records, personnel data, and security profiles would all fall under the auspices of IRM.
NEW QUESTION # 114
Who should be involved in review and maintenance of user accounts/access?
- A. The accounting department
- B. The security manager
- C. The user's manager
- D. The incident response team
Answer: C
NEW QUESTION # 115
Which cloud service category would be most ideal for a cloud customer that is developing software to test its applications among multiple hosting providers to determine the best option for its needs?
- A. SaaS
- B. PaaS
- C. DaaS
- D. IaaS
Answer: B
Explanation:
Explanation
Platform as a Service would allow software developers to quickly and easily deploy their applications among different hosting providers for testing and validation in order to determine the best option. Although IaaS would also be appropriate for hosting applications, it would require too much configuration of application servers and libraries in order to test code. Conversely, PaaS would provide a ready-to-use environment from the onset. DaaS would not be appropriate in any way for software developers to use to deploy applications.
IaaS would not be appropriate in this scenario because it would require the developers to also deploy and maintain the operating system images or to contract with another firm to do so. SaaS, being a fully functional software platform, would not be appropriate for deploying applications into.
NEW QUESTION # 116
......
CCSP PDF Dumps Are Helpful To produce Your Dreams Correct QA's: https://exams4sure.briandumpsprep.com/CCSP-prep-exam-braindumps.html
