Western Governors University (WGU) C838 Managing Cloud Security (CCSP) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which law would control matters involving violations of statutes at the federal level?
• Which of the following is not a Critical Success Factor?
• Adhering to ASHRAE standards for humidity can reduce the possibility of ________.
• Which of the following are distinguishing characteristics of a managed service provider?
• What technique replaces data with random characters while preserving string length and character set?
• Which cloud delivery model is best suited for organizations looking for comprehensive control over hardware and software?
• Data in the destroy phase can be considered destroyed if it is made permanently inaccessible. Is this statement true?
• To prevent unauthorized access, what principle should be applied to user access in cloud environments?
• Which factor is essential for selecting a cloud service provider?
• What term describes the established procedure for maintaining control over evidence to prevent tampering?
• Which BC/DR backup plan allows the customer to determine when normal operations cease and backup is initiated?
• What type of storage allows customers to access parts of a hierarchy based on their assignments?
• Which type of report assesses an organization's security, availability, processing integrity, and privacy controls?
• Which countermeasure is NOT effective in protecting cloud operations against internal threats?
• Which type of law involves conflicts between individuals and the government?
• Which of the following is a characteristic of a public cloud?
• Which of the following are storage types used with an IaaS solution?
• What issue arises when customer software may not function properly due to OS updates by a provider?
• Consider the following example: "An artist gives an art gallery permission to represent the art of some other artist but he is not allowed to reproduce his work." Which law is applied in the given example that restricts the artist?
• How does encryption enhance data security?
• What type of redundancy can we expect to find in a datacenter of any tier?
• Which of the following best describes a "hybrid cloud" deployment?
• Which of the following threats occurs due to the loss of relevant encryption keys?
• What is the intellectual property protection for a confidential recipe for muffins?
• Which method is used for analyzing risk in software systems?
• What is the significance of personnel redundancy in IT?
• APIs are defined as which of the following?
• Legal controls refer to which of the following?
• Which of the following describes application generated or imported data?
• Which organization is known for providing advice on IT service matters?
• Which of the following activities can a cloud provider offer to foster customer trust?
• What role does multi-factor authentication play in cloud security?
• In which cloud environment scenario does the business continuity strategy restore the service failover to another part of the same CSP infrastructure?
• What does Quality of Service (QoS) enable within a network?
• Which models are generally available for cloud BC/DR activities except?
• Which contractual component includes a clear understanding of data processing limitations?
• Which term best describes the process of evaluating potential vulnerabilities in a system?
• What benefit does using VPN technology provide in cloud communications?
• Deviations from the baseline should be investigated and ________.
• Which expenditure has minimized an organization's requirements of purchasing systems and resources?
• Which methodology could cloud data storage utilize to encrypt all data associated in an infrastructure as a service (IaaS) deployment model?
• Which of the following is a valid risk management metric?
• True or False: Attackers prefer Type 2 hypervisors due to their larger attack surface.
• An insecure API could potentially put entire data sets at risk for what?
• DAST is usually run against live systems. What is true about the individuals running the test?
• What is a defining characteristic of a private cloud configuration?
• Are SOAP and REST APIs required to run over SSL or TLS for security purposes?
• In which of the following is customer access blocked and alert disabled?
• What is the purpose of cloud enablement?
• What is the objective of Software-Defined Networking (SDN)?
• Which security measure reduces the likelihood of unauthorized users gaining access?
• What does the term Database as a Service (DBaaS) refer to?
• What is one primary benefit of using cloud security solutions?
• Among the following, whose responsibility is to organize the deployment and designing of an application in the cloud environment?
• Which is the internationally accepted standard for eDiscovery?
• Which cloud service model allows the least amount of control for customers?
• In which phase of digital forensics is the collected data forensically processed using a combination of manual and automated methods?
• Data in the Archive and Destroy phases may need to be handled according to what?
• In a federated identity arrangement, who acts as the identity provider?
• Which of the following components are part of what a CCSP should review when looking at contracting with a cloud service provider?
• Which tool can help in isolating and analyzing attacks by luring potential attackers?
• Which model is primarily responsible for application deployment and management in cloud services?
• In which phase of the data lifecycle does the data leave the active use phase and enter into long-term storage?
• Which testing method is useful in identifying vulnerabilities such as cross-site scripting (XSS) and SQL injection?
• What characterizes a private cloud?
• What process is used to verify that an entity has the right to access specific information?
• Which process analyzes data for certain attributes to determine the appropriate controls and policies?
• What is the primary risk associated with storing sensitive data in the cloud?
• What does STRIDE stand for in threat modeling?
• What is the intellectual property protection for the logo of a new video game?
• What type of law governs acts such as kidnapping or bank robbery?
• What is a potential risk when a cloud provider goes out of business?
• Who among the following is responsible for supervision, secure data storage, transport, and implementation of business rules?
• The application normative framework is best described as?
• What is the purpose of a Cloud Access Security Broker (CASB)?
• Which type of access control restricts access based on user roles within an organization?
• What technique can attenuate risks due to loss or theft of remote access devices?
• Which metric measures the average time between failures in a system?
• Which data-at-rest encryption method encrypts all the data stored on the volume and all snapshots created from the volume?
• What defines what the audit will produce?
• Which agency is responsible for producing guidelines on cloud computing benefits, risks, and information security?
• What describes accounting software that is hosted on remote servers?
• What is the primary focus of the definition phase in the Cloud SDLC?
• What does the Personal Information Protection and Electronic Documents Act (PIPEDA) comply with?
• Which standard protocol is used in the public cloud environment for managing identification of various agents and devices?
• What does the Organizational Normative Framework (ONF) provide in terms of application security?
• Which protocol provides authentication for client/server applications using secret-key cryptography?
• How do immutable workloads affect security overhead?
• What does SOC 2 specifically measure in a cloud service context?
• What does power line redundancy ensure in a cloud provider's infrastructure?
• What does the Security Assertion Markup Language (SAML) facilitate?
• Which of the following refers to a strategy to protect against potential losses?
• What responsibility of the data owner occurs during the Create phase related to a dataset?
• What do business continuity efforts primarily focus on?
• In terms of IT service, what entity focuses on enhancing service reliability and performance?
• What do cloud management tools assist with?
• Which aspect of STRIDE refers to unauthorized modifications of data?
• In all cloud models, security controls are driven by which of the following?
• Which term best describes a network management approach that abstracts traffic management from direct component oversight?
• Which type of law involves conflicts between the government and individuals or organizations that violate statutes?
• In a Platform as a Service (PaaS) model, who is responsible for updates and administration of the operating system?
• What is meant by a cloud operating system?
• Which identity management process targets access to enterprise resources by ensuring that the identity of an entity is verified?
• What is the recommended recovery time objective (RTO) for cloud-based applications in a business continuity plan?
• Baseline compliance scanning should alert on any deviation from the baseline.
• Which type of SSAE report includes a seal of approval from a certified auditor?
• What happens when poor documentation is present in a cloud system?
• How many layers of encryption are typically available for a database?
• Which of the following are considered to be the building blocks of cloud computing?
• What aspect heavily influences how data is treated based on physical location?
• What is the main goal of a gap analysis in security practices?
• Which artifact may be required as a data source for a compliance audit in a cloud environment?
• Countermeasures for protecting cloud operations against internal threats include all of the following except?
• Which of the following best describes a cloud carrier?
• Which characteristic of liquid propane increases its desirability as a fuel for backup generators?
• Which assumption about a CSP should be avoided when considering risks in a disaster recovery (DR) plan?
• In the context of cloud security, what is the role of NIST SP 800-53?
• Who among the following has the privilege to access the management plane to remotely manage the hosts in a cloud environment?
• Which of the following serves as a primary goal for cloud security management?
• Which of the following concerns does the "existing on-premise solution" BCDR scenario represent?
• What is the key benefit of conducting regular vulnerability assessments in a cloud environment?
• What is strongly encouraged for managing access of the directory administrators?
• Which standard addresses practices related to acquisition of forensic artifacts and can be directly applied to a cloud environment?
• A UPS should have enough power to last how long?
• Under the NIS directive, who must a CSP notify of an incident affecting the continuity of essential services?
• Who verifies the official commitment in a service-level agreement between a cloud service provider and the user?
• What is the main characteristic of a SOC 3 report?
• In cloud security, what is the primary concern of the customer?
• What is the lowest tier of datacenter redundancy, according to the Uptime Institute?
• Maintenance mode requires all of these actions except:
• Which element of STRIDE deals with the risk of data availability loss?
• What type of data can a personal cloud storage solution typically handle?
• Which standard category encompasses regulations and specifications for security in applications?
• Which method ensures that sensitive organization content is protected?
• True or False: Proper identification and documentation of key stakeholders is vital to any IT system.
• Which one of the following is essential for effective risk management in cloud security?
• Which component is crucial for ensuring cloud service availability during peak usage times?
• What role is responsible for adapting or deploying an application to a target cloud environment?
• What is the main focus of a cloud security architecture?
• What does risk acceptance indicate in a business context?
• Which of the following are not associated with HIPAA controls?
• What encryption method is used to secure data transmission between servers?
• Proper implementation of DLP solutions for successful function requires which of the following?
• When deciding whether to apply specific updates, it is best to follow ________, in order to demonstrate due care.
• Which of the following cloud services provides a key benefit for developers by allowing access to services from diverse sources nationally or internationally?
• Which statement best describes the Organizational Normative Framework (ONF)?
• Which of the following components is not associated with encryption deployments?
• Which agreement is negotiated between internal business units within an organization?
• Dynamic Application Security Testing (DAST) is best described as?
• What does NAS stand for in network storage systems?
• What type of hosting makes services available on demand via the Internet using multiple servers?
• Which term describes the management of risks associated with storing and processing data in the cloud?
• Which federation standard is an XML-based framework for authentication, entitlement, and attribute information of users in a cloud?
• Which of the following is not one of the three types of training?
• What is the focus of label-based discovery in data management?
• Which act provides copyright protections in a digital environment?
• What is the benefit of volume encryption compared to full disk encryption?
• What is the intellectual property protection for the tangible expression of a creative idea?
• What is the type of intellectual property protection for a valuable set of sales leads?
• All versions of SSL and TLS are acceptable to secure Data in Transit.
• What is the focus of SOC 2 reports?
• If a cloud customer cannot get access to the cloud provider, this affects what portion of the CIA triad?
• Which of the following is not a focus area for hardening an operating system?
• Which term refers to the process of identifying and obtaining electronic evidence for legal purposes?
• In the context of STRIDE, what does "R" stand for?
• Which of the following is NOT a component of a cloud security framework?
• Which authentication method involves multiple forms of validation for user identity?
• Which of the following best describes SAML?
• Which of the following practices for secure server configuration uses RBAC (Role-Based Access Control) to limit user access to a host?
• What technology enables the processing of encrypted data without needing to decrypt it first?
• What technology allows for the creation of multiple isolated environments within a single physical infrastructure?
• The Electronic Communication Privacy Act (ECPA) primarily addresses which concern?
• Which of the following best describes Digital Rights Management (DRM)?
• A company has recently defined classification levels for its data. During which phase of the cloud data life cycle should this definition occur?
• Which of the following is not a part of the ENISA Top 8 Security Risks of cloud computing?
• Which of the following logs is used for event investigation and documentation in a SaaS environment?
• Which of the following best describes a multifactor authentication mechanism?
• Which of the following is a common challenge faced by organizations migrating to the cloud?
• What is the purpose of data encryption in cloud security?
• Which cloud service model primarily places the responsibility for access and administration on the customer?
• All formatting, security, and usage of LUNs is handled by the storage device. True or False?
• Which approach ensures that sensitive data is anonymized before being used in public datasets?
• What does a comprehensive asset inventory typically include?
• What is the primary purpose of a Business Impact Analysis (BIA)?
• What right is associated with McDonald's slogan "I'm lovin' it"?
• What is the main focus of Identity and Access Management (IAM)?
• What is the primary purpose of online backup in cloud computing?
• Which control should a customer prioritize when managing data in a cloud environment?
• Which technique scrambles data content using a mathematical algorithm while preserving its structural arrangement?
• What is a key component of the infrastructure as a service (IaaS) cloud service model?
• In which phase of the Cloud SDLC do we focus on identifying business needs like accounting or CRM?
• Which standard does Level Two of the CSA STAR involve?
• What is the term for the risk remaining after controls and countermeasures are implemented?
• In a Software as a Service (SaaS) model, who is responsible for system maintenance?
• What is the definition of portability in cloud services?
• Which service model influences the logical design by using additional measures in the application to enhance security?
• Which cloud service model is most beneficial for software development operations (DevOps)?
• Which process is responsible for granting access rights to users, programs, or processes?
• Which phase of the cloud data security life cycle typically occurs simultaneously with creation?
• Which of the following is a compute parameter of a cloud server?
• What threat does social engineering training aim to mitigate by identifying personnel who resist malicious attempts?
• True or False: A data center should be located in the same geographic area as its headquarters for ease of access.
• Which option should an organization choose if there is a need to avoid software ownership?
• What practice helps organizations maintain control over their data as it moves through different environments?
• What aspect of cloud security involves monitoring and evaluating risks?
• Which of the following is most critical for maintaining compliance in cloud environments?
• Which process aims to assess the security posture of a cloud system?
• Which consideration should be taken into account when reviewing a cloud service provider's risk of potential outage time?
• In cloud environments, what is the purpose of an SLA (Service Level Agreement)?
• Every security program and process should have which of the following?
• What is the role of authentication in a secure system?
• What term describes the ease of moving information from one cloud provider to another or back to an on-premises environment?
• The BIA can provide information about all except which of the following?
• What are the controls on technology exports enforced by the U.S. State Department known as?
• What compensates victims for injuries suffered by the culpable action or inaction of others?
• What is a common application of a HIDS (Host-based Intrusion Detection System)?
• Which of the following is not part of the STRIDE model?
• The term 'ePHI' stands for what?
• Which cloud deployment model enhances cloud bursting that allows its users to utilize public cloud resources when the workload of private cloud reaches maximum capacity?
• Which cloud service allows its customers to deploy applications created using the tools supported by the provider onto the cloud infrastructure?
• What is cloud portability?
• Which phase forms the security and foundation for IAM (Identity and Access Management) within the cloud environment?
• What type of data is referred to as electronic protected health information (ePHI)?
• Which of the following reports is most aligned with financial control audits?
• Which of the following is NOT a function of Security Information and Event Management (SIEM)?
• Which factor is essential for ensuring compliance in cloud security?
• What does cloud portability enable?
• Who publishes the optimal temperature and humidity levels for data centers?
• True or False: Different types of data may require specific sanitation methods.
• For which of the following cloud environments is the client-side key management approach used?
• Which term refers to the principles that govern data privacy and protection in an organization?
• What does a dry run test primarily focus on during a BC/DR evaluation?
• What aspect does a contract between cloud service providers and customers typically cover?
• Who is responsible for delivering, managing, and provisioning cloud services?
• The cloud deployment model that features organizational ownership of the hardware and infrastructure, and usage only by members of that organization, is known as:
• This type of storage typically uses APIs or network requests. What is it called?
• Which requirement is included when exceptions, restrictions, and potential risks are highlighted in a cloud services contract?
• Which phase of the cloud data life cycle allows both read and process functions to be performed?
• Which role collects or creates data and holds the rights and responsibilities of that data?
• In attempting to provide a layered defense, what type of security controls should senior management be convinced to include?
• What is an association of organizations that come together to exchange appropriate information about their users and resources called?
• Which countermeasure helps mitigate the risk of stolen credentials for cloud-based platforms?
• All of the following are part of a Federated Identity System except:
• Which backup plan distributes risks by utilizing the cloud provider's regular operations while the customer opts for contingency operations?
• Which network functionality controls the amount of traffic sent or received as well as the number of API requests within a specified period?
• Which of the following describes Personally Identifiable Information (PII)?
• Which of the following is considered an administrative control?
• What does risk assessment involve in cloud security?
• What is the primary goal of a Business Continuity Plan (BCP)?
• Which intelligence agency's website was attacked by LulzSec on June 15, 2011?
• Which description best characterizes the API format known as Representational State Transfer (REST)?
• Which detection and analysis technique captures a point-in-time picture of the entire stack during an incident?
• Which of the following allows for agentless retrieval of the guest OS state, and is used for malware analysis, memory forensics, and process monitoring?
• Which term describes the capability to confirm someone's identity with adequate assurance?
• What are the six stages of the cloud secure data lifecycle?
• Which approach is considered a black-box security testing method?
• What is the specification designed to facilitate application management in PaaS systems?
• What is a key capability of security information and event management?
• Which agency is responsible for producing cloud computing benefits, risks, and recommendations for information security in Europe?
• Which of the following is NOT considered a benefit of PaaS?
• Which disaster recovery plan metric indicates how long critical functions can be unavailable before irreparable harm occurs?
• Which of the following is a risk management option that halts a business function?
• What type of security control alerts the administrator about suspicious activities by monitoring the inbound and outbound packets from devices?
• Which of the following methods focuses on the security capabilities of internal IT and cloud providers?
• All policies within the organization should include a section that includes all of the following, except?
• Which role is typically involved in safeguarding cloud security for an organization?
• Which document outlines guidelines and procedures for software changes?
• Which component is among the highest risk component with respect to software vulnerabilities?
• What should private and public CSPs do to isolate themselves from other tenants?
• What is the function of the BIA (Business Impact Analysis)?
• What protects an organization's reputation and goodwill in the marketplace?
• What is an important aspect of determining Criticality in an organization?
• What term refers to programs running on the same devices used by other customers simultaneously?
• What is used to dynamically allocate the cloud resources to maximize their use?
• Which of the following is not a way to manage risk?
• Who retains final ownership for granting data access and permissions in a shared responsibility model?
• What does cloud migration involve?
• Tokenization requires two distinct ______________.
• DLP solutions can help prevent loss due to which of the following?
• What is the term for storage in the cloud allocated as an attached drive to a virtual machine?
• What term refers to the organization purchasing, leasing, or renting cloud services?
• Which model allows customers to choose and manage their software and operating systems?
• Which technique uses different entries from within the same data set to represent the data?
• Is it sufficient to rely solely on the cloud provider's vulnerability assessment?
• Which of the following should NOT be included in the Audit Scope Statement?
• Which type of risk includes malware, hacking, DoS/DDoS attacks, and man-in-the-middle attacks?
• Which standard should a global cloud services provider apply for using forensics methodologies?
• Which concept involves restricting user access to only what is necessary for their role in cloud security?
• In maintenance mode, what remains enabled while two items are disabled?
• What technique replaces original information with asterisks or Xs to conceal data?
• In which type of cloud-specific risk can a malicious user affect the entire cloud infrastructure?
• What kind of data does the Graham-Leach-Bliley Act (GLBA) aim to protect?
• Which aspect of object-based storage aids in the categorization of stored information?
• What cloud service model requires the customer to administer the operating system?
• In a cloud environment, encryption should be used for all the following, except?
• Which data protection mechanism helps ensure that data is accessible even in the event of a system failure?
• The Restatement (Second) Conflict of Law refers to which of the following?
• What is one of the main goals of incident management?
• How is redundancy achieved in virtual switches within a VLAN network?
• What is Apache CloudStack known for in cloud computing?
• Which type of encryption is generally used to protect data at rest in the cloud?
• Which ISO standard specifies requirements for establishing information security management systems?
• Which method helps maintain a secure environment by connecting with a cloud service provider's compliance policies?
• Which of the following represents a key aspect of privacy in cloud environments?
• What is a cloud computing reseller?
• Which of the following is a widely accepted standard for cloud security compliance?
• Which STRIDE threat component involves the act of disputing an identity or action?
• Which is not part of the risk management process?
• Which ISO standard outlines principles for incident investigation processes?
• What security measure helps protect sensitive data from unauthorized access?
• All of these are reasons because of which an organization may want to consider cloud migration, except:
• Security training should not be:
• Which term describes a process that allows clients to interact with cloud services over the Internet?
• Which of the following best describes a Type 1 SOC report?
• In SaaS, what does the customer have control over?
• What is a cloud storage architecture that manages the data in a hierarchy of files?
• Which of the following metrics provides the time required to finish the initiated or requested task?
• Which issue can be detected with static application security testing (SAST)?
• Which open web application security project (OWASP) Top 9 Coding Flaws leads to security issues?
• Which of the following applies to the Stored Communications Act (SCA)?
• Who is typically responsible for the implementation, monitoring, and maintenance of the cloud within an organization?
• Which problem is a common supply chain risk?
• What is the main focus of data governance in cloud environments?
• Which of the following quality assurance tests signifies the highest level of evaluation?
• Which cloud deployment model is operated for a single organization?
• Which interoperable authentication protocol is based on the OAuth 2 specification?
• A data custodian is responsible for which of the following?
• What is NOT a benefit of addressing BC/DR through cloud operations?
• Risk appetite for an organization is primarily determined by which of the following?
• Which of the following best defines the concept of risk profile?
• Which category does Rapid Provisioning and Scalability fall into?
• All the following are ways of addressing risk, except:
• What procedure involves multiple individuals, each with access to only part of a key?
• After a cloud migration, what should the updated BIA include?
• Which of the following methods of addressing risk is most associated with insurance?
• This type of hypervisor is tied directly to the hardware or "Bare Metal".
• What type of computing relies on sharing computing resources rather than local servers or personal devices?
• Gathering business requirements helps determine all about organizational assets, except?
• All of these are features of cloud computing except:
• What do virtualization technologies enable in cloud computing?
• Which standard outlines the steps to create an Information Security Management System (ISMS)?
• Which of the following is an aspect of cloud service provider accountability?
• Which statement reflects a significant benefit of using cloud services?
• RFCs are approved by which of the following?
• What functions does the CCSP perform to obtain assurance and conduct auditing on the VMs and hypervisor?
• What is the objective of the Security Alliance's Cloud Controls Matrix?
• Dynamic application security testing (DAST) is best described as what type of test?
• Hardening the operating system refers to all of the following except?
• Which of the following is NOT a data analytics mode?
• What is typically a characteristic of a Community Cloud?
• Which security framework is particularly noted for addressing cloud service provider security?
• Which of the following is an example of a cloud service provider?
• What is one of the main reasons for organizations to perform a risk assessment before migrating to the cloud?
• What does it mean when unused ports are closed in a datacenter?
• Which model includes both hardware and operating systems for development?
• An organization will conduct a risk assessment to evaluate which of the following?
• Which of the following is the best advantage of external audits?
• What is the primary function of Platform as a Service (PaaS)?
• When the partnership is aborted, which policy should be clearly documented and communicated to terminate the partner's access to cloud-based resources?
• Which term describes the ability to quickly allocate resources in cloud computing?
• Which of the following laws resulted from a lack of independence in audit practices?
• Which ISAE Report is run over a pre-defined period of time usually six months?
• Which hypervisor type is typically tied to the host operating system?
• What is the primary technique used for sanitizing data in the cloud?
• What defines the level of risk that an organization finds acceptable?
• What term describes the assurance that a sender cannot deny sending a message nor can the recipient deny receiving it?
• Which of the following techniques for ensuring cloud datacenter storage resiliency uses encrypted chunks of data?
• What type of BCDR (Business Continuity and Disaster Recovery) strategy involves the selection of an additional deployment zone and recreation of the processing capacity on a different location?
• What is the method of analyzing data for specific attributes to determine the appropriate controls to apply?
• When reviewing the BIA after a cloud migration, what new factor related to data breach impacts should be considered?
• Which of the following is part of the STRIDE model?
• Which term is defined as a percentage measurement of computing power needed based on the required percentage of the production system during a disaster?
• What type of cloud storage allows an individual access to their data from any location?
• What are the phases of a software development lifecycle process model?
• Who holds the identity of all users and generates tokens for known users?
• This plugin parses HTTP traffic and applies a set of rules before sending it to the application server. What is it called?
• In which phase does an application enter after being implemented according to software development lifecycle principles?
• What type of cloud is defined as a multi-tenant setup shared between organizations that belong to a specific group?
• What is the primary purpose of a Content Delivery Network (CDN)?
• Which of the following phases of audit planning assures that operational and business changes have been captured as part of the audit plan?
• What is a method used to simulate how tasks would be performed in a business continuity/disaster recovery scenario?
• Which of the following cloud characteristics explains that a cloud provides services to serve multiple clients according to their priority?
• Which of the following allows logical isolation of hosts on a network?
• Which specific risk does NOT uniquely affect the public cloud due to multitenancy?
• ISO/IEC 27037:2012 is a guide for what process?
• This cloud model provides the highest level of management and control over IT resources.
• Which regulation in the United States defines the requirements for a CSP to implement and report on internal accounting controls?
• In the context of data protection, what is the primary goal of tokenization?
• Which of the following SOC report subtypes spans a period of time?
• What system takes defensive actions when suspicious activity is detected?
• Which of the following is NOT considered data classification?
• Which architecture helps assess and plan security needs for IT and cloud providers?
• What action should be taken for continuous improvement after a disaster event?
• What is the process of taking actions to reduce the impact of risks in a system?
• Which of the following controls involves policies and procedures?
• What role does encryption play in data security within the cloud?
• Which of the following actions is NOT advisable for securing devices in a datacenter?
• Which concept refers to the acceptable level of uncertainty in achieving a desired outcome?
• Which type of encryption applies only to a portion of a hard drive?
• What does "defense in depth" entail regarding security controls?
• What can occur when a hypervisor is improperly designed or configured?
• What is the amount of fuel that should be on hand to power generators for backup datacenter power, in all tiers, according to the Uptime Institute?
• Automations can be used to monitor the baselines and remediation of servers.
• What is a key benefit of using Platform as a Service (PaaS) in cloud computing for developers?
• Which approach is essential for protecting email servers from external threats when connected to untrusted networks?
• What is the role of an Identity Provider in a security system?
• What does SLA stand for in the context of cloud services?
• DRM tools use a variety of methods for enforcement of intellectual property rights. Which of the following is NOT included?
• What is the first international set of privacy controls in the cloud?
• What type of service model primarily focuses on providing comprehensive software applications?
• Which practice can help mitigate the risk of DDoS attacks in a cloud environment?
• What refers to the ability of a user to gain permissions above their authorized level?
• Which is a PII law specifically for financial institutions?
• What is conducted to identify weaknesses and vulnerabilities before a full audit?
• Which technology makes the network control programmable and dynamically adjusts the flow of traffic when the pattern of network consumption changes?
• What is a third-party service provider that manages and distributes remote cloud-based data backup solutions?
• According to GDPR Policy, how quickly must breaches be reported once a company is aware of the incident?
• Does the cloud model eliminate the need for a failover site?
• This system is provided by the CSP, but controlled and even hosted by the customer:
• The process of hardening a device should include which of the following?
• What is the main function of Virtualization Technologies in cloud computing?
• What is the primary function of a Hardware Security Module (HSM)?
• RPO and RSL are used to establish when services and data are completely restored.
• What legislation was passed due to scandals involving publicly traded corporations such as Enron and WorldCom?
• Which of the following is the least challenging with regard to eDiscovery in the cloud?
• In the tokenization architecture, which step should be performed after the tokenization server generates the token?
• Which of the following factors contributes to the effectiveness of automated patching?
• For performance purposes, OS monitoring should include all of the following except:
• What is the unauthorized exposure of data called?
• Identity and access management (IAM) is a security discipline that ensures which of the following?
• Which of the following is not a component of contractual PII?
• What principle governs the decision to accept risks in a security context?
• Which of the following describes components of the risk-management process?
• A cloud administrator recommends using tokenization as an alternative to protecting data without encryption. Which step should occur immediately before an authorized application request to access the data?
• What term refers to the relationship between shareholders and management in a corporation?
• Which of the following are required for improving the level of assurance in cloud computing?
• Which type of SSAE audit report is a cloud customer most likely to receive?
• Which design principle of secure cloud computing involves deploying cloud service provider resources to maximize availability in the event of a failure?
• Which kind of Data Obfuscation method replaces data with random values that can be mapped to actual data?
• What is the primary role of a cloud access security broker (CASB)?
• Which STRIDE component deals with denial of service attacks?
• Which cloud deployment model exclusively allows control over hardware resources?
• What does resiliency in data storage refer to?
• Which federal agency is responsible for accepting applications for new patents?
• Which of the following is not one of the SDLC phases?
• Which cloud model offers access to a pool of fundamental IT resources such as computing, networking, or storage?
• Which challenges are associated with key management?
• What refers to the auditing and prevention of unauthorized data exfiltration?
• Which of the following protocols provides encryption using cryptography for the data in transit?
• Which of the following best represents the definition of REST?
• Which aspect is crucial for successfully managing stakeholder identification?
• Which item should be part of the legal framework analysis if a company wishes to store prescription drug records in a SaaS solution?
• From whose perspective does auditability provide processes to review system activities?
• Are there potential extra costs associated with eDiscovery in a cloud environment?
• Which type of privilege escalation is targeted by attacks aiming to gain unauthorized access rights?
• Which of the following is not a recognized authentication factor?
• What is the benefit of personnel redundancy in managing IT resources?
• Which process prevents the environment from being over-controlled by security measures to the point where application performance is impacted?
• Which countermeasure mitigates the risk of a rogue cloud administrator?
• What is the focus of ISO/IEC 27001 certification?
• Where should the DLP (Data Leakage Prevention) engine be installed in a DIU (Data in use) topology of the data lifecycle?
• Which of the following ensures no default passwords remain in systems?
• Which of the following is a risk response strategy that focuses on paying to handle potential losses?
• Which practice involves handling risk associated with an activity without accepting all risks?
• What is the role of the cloud vendor in a SaaS model?
• During which phase of the Cloud SDLC are user stories and interface designs developed?
• Countermeasures for protecting cloud operations against external attackers include all of the following except?
• Which environmental consideration should be addressed when planning the design of a data center?
• When considering plans for data archiving, which factor is generally NOT important?
• Which of the following input entities of data classification are required to follow a specific process of incident management activating measures to limit the damage to the concerned data?
• Which of the following is not associated with security?
• Which of the following is NOT a method of data discovery?
• Which standard outlines the principles and processes for managing risk?
• For what purpose is a compensating control used in a cloud environment?
• What term refers to laws enacted by a state legislature as opposed to national laws?
• Which data retention method is stored with a minimal amount of metadata storage with the content?
• What type of cloud model offers solutions to a limited number of individuals, ensuring specific security requirements?
• Which of the following statements accurately describes state law?
• Which kind of hypervisor would malicious actors prefer to attack, ostensibly because it offers a greater attack surface?
• What method of access control requires multiple forms of authentication?
• Which operation management ensures the integrity of the live environment and presents the correct components to customers?
• Which control method focuses on managing the configuration of the initial setup?
• What kind of architecture does a hybrid cloud storage solution utilize?
• What is the function of an encryption key?
• Categories of personal data that can be processed include which of the following?
• Which data source provides auditability and traceability for event investigation as well as documentation?
• What is a primary feature of IaaS?
• Who among the following adds and extends value to the cloud-based services for customers?
• Which platform is an open source cloud computing and IaaS solution for private and hybrid clouds?
• What system allows a single user authentication process across multiple IT systems?
• What is the role of a third party in Desktop as a Service (DaaS)?
• In the context of cloud services, who is primarily concerned with security and operation?
• What does the Electronic Communication Privacy Act prohibit?
• An organization wants to maintain control of its IT environments while benefiting from flexibility and cost savings. Which cloud deployment model should they choose?
• Which of the following is NOT a benefit of using Software as a Service (SaaS)?
• Which disaster recovery (DR) site results in the quickest recovery in the event of a disaster?
• Which of the following is not a cloud deployment model?
• Which of the following is considered a "white box" test?
• Which of the following is a part of the building blocks of a cloud computing system?
• What key aspect of cloud computing refers to the legal geographical implications of data storage?
• In which cloud service model is the customer responsible for maintaining the operating system?
• Which protocol allows for communication over multiple protocols, including HTTP and FTP?
• Which process is ongoing and implemented throughout the system life cycle to keep track of identified risks?
• Which of the following best describes data masking?
• In cloud security, what does the principle of "least privilege" refer to?
• Which of the following best defines a trade secret?
• What is the key distinction between contractual and regulated PII?
• Which design principle of secure cloud computing ensures that the business can resume essential operations in the event of an availability-affecting incident?
• Which of the following best describes the principle of least privilege?
• Which of the following is a benefit provided by SaaS for applications accessible by clients?
• Multifactor authentication requires two of the following except:
• Which of the following provides privacy protections for certain electronic communication and computing services from unauthorized access or interception?
• What defines a cloud database?
• What are the virtualization components governed by the management plane?
• Which legal concept refers to compensating individuals harmed by negligent actions?
• What model provides complete infrastructure services and allows customers to install software on provisioned servers?
• What does a framework for cloud controls typically enable?
• Which of the following is a primary concern of data security in a cloud environment?
• The CSA STAR program consists of three levels. Which of the following is not one of those levels?
• In terms of cloud security, which factor is crucial for ensuring data integrity?
• Which security control is a shared responsibility within the Software as a Service (SaaS) model?
• What is one major misconception regarding confidentiality and integrity?
• What is a component of device hardening?
• What type of hypervisor runs directly on the host machine?
• What key principle underlines the privacy requirements determination in SDLC?
• Which cloud service model provides the least amount of configuration options?
• Which cloud model incorporates the use of structured vs unstructured storage types?
• What does the doctrine of the proper law refer to?
• What types of threats are associated with a private cloud?
• What document outlines both parties' responsibilities and service provisions in cloud engagements?
• Which aspect of business continuity planning considers alternatives for a complete loss of the provider?
• In a cloud environment, which of the following can be an issue when working with integrations?
• The process of hardening a device should include all of the following, except:
• Dynamic Application Security Testing (DAST) is primarily focused on what aspect of a software product?
• Which statement is true regarding software-defined networking?
• Which of the following frameworks identifies the top 8 security risks based on likelihood and impact?
• The BC/DR kit should include all of the following except:
• What type of law governs offenses such as kidnapping or bank robbery?
• What type of traffic does a WAF typically parse?
• The baseline should cover which of the following?
• Which phrase best describes the features of Infrastructure as a Service?
• Which of the following are the key regulations applicable to the CSP facility?
• What is a security-related concern for a Platform as a Service (PaaS) solution?
• What is the primary focus of cloud security governance?
• Which of the following cloud storages allows users to share and sync data stored on a mobile device?
• Which of the following is a common security concern in multi-tenant cloud environments?
• What additional mechanism does the customer have to ensure trust in the provider's performance and duties?
• Which mode of encryption secures data while it navigates the CSP network or the Internet?
• Which entity ensures compliance with regulatory frameworks for organizations?
• Which of the following best describes a Data Loss Prevention (DLP) strategy?
• Which type of hypervisor runs on top of the operating system on a host device?
• What describes the scope of Business Continuity (BC)?
• Which of the following best describes risk transference?
• Which phase of the cloud data life cycle is associated with crypto-shredding?
• What is the technique that involves distributing encrypted data across multiple storage solutions?
• Which technique does NOT enhance data portability in cloud operations?
• Which artifact may be required as a data source for a regulatory compliance audit (i.e., HIPAA, PCI-DSS) in a cloud environment?
• In cloud security, what does OS logging typically signify?
• What is the role of a cloud service manager?
• Which of the following is a primary focus of Data Loss Prevention (DLP) strategies?
• Key management in a cloud environment is not very important. True or False?
• In which scenario is the cloud provider responsible for determining the backup configuration and declaring disasters?
• Which SOC 2 report would be run to determine if security controls are suitable based on design and intent?
• Which statement is true about the chain of evidence?
• Which controls does the STAR program rely on for cloud provider assessments?
• Which of the following is the best example of a key component of regulated PII?
• Which mechanism is used to restrict a list of possible actions down to only permitted actions?
• What should be the primary focus of datacenter redundancy and contingency planning?
• What is the primary reason for having power line redundancy in cloud infrastructure?
• What is the Cloud Security Alliance STAR program designed to provide?
• What are white-box testing methodologies capable of assessing directly?
• What is a possible negative outcome of a poorly negotiated cloud service contract?
• Which type of attack is commonly associated with the failure of isolation controls in virtualization?
• What is the primary purpose of using a honeypot in cloud security?
• Who among the following allocates cloud service connection and transportation between the CSPs and the cloud service consumers?
• What does e-Discovery entail in a legal context?
• What type of monitoring can Database Activity Monitoring (DAM) perform?
• DLP can be combined with what other security technology to enhance data controls?
• What term describes systems that are controlled and maintained at the customer's site?
• What is one of the reasons a baseline might be changed?
• Which of the following can serve as an effective method for detecting unauthorized access in cloud storage?
• What is the term used to describe the risk of processing on one virtualized instance being detected by other instances on the same host?
• Which standard provides an overview of application security including concepts and processes?
• In addition to battery backup, a UPS can offer which capability?
• In which cloud deployment model does platform security come under the enterprise's responsibility?
• Which form of BC/DR testing has the most impact on operations?
• What is the main risk of not properly securing API endpoints in cloud services?
• What does "attacks on the hypervisor" refer to?
• The Doctrine of the Proper Law is used to determine what?
• What does data discovery involve?
• What does MTBF stand for in the context of cloud security metrics?
• What is a key component of GLBA?
• Which type of hypervisor are malicious attackers most likely to target?
• Which of the following represents a key feature of cloud computing?
• Which of the following frameworks focuses specifically on design implementation and management?
• Which statement is true regarding the scope of an audit based on the cloud model used?
• Which measure can organizations take to enhance their cloud security related to personnel?
• In which cloud computing arrangement does the cloud customer have the most control over their data and systems?
• Which cloud model allows the consumer to have sole responsibility for management and governance?
• What is the goal of risk mitigation?
• In which of the following tests of the recovery plan are the industry workers mobilized to an alternative site to perform actual recovery process?
• Which act protects the general public and shareholders from accounting errors and illegal practices in the enterprise?
• Which of the following techniques for ensuring cloud datacenter storage resiliency uses parity bits and disk striping?
• In data management, what typically explains the duration for which data is stored?
• What is the primary benefit of cloud computing audit processes?
• Which technique helps to analyze the data itself in the content analysis method?
• What term describes an association of organizations that assist with information exchange and resource access?
• What often refers to a suite of services that back up and store data remotely?
• Which of the following supplemental security devices implements the DLP (data loss prevention) security control?
• What does NIST SP 800-37 provide guidance on?
• Which practice helps ensure that systems remain secure over time?
• Which of the following is NOT considered a best practice for key management?
• What is typically a responsibility of a cloud security practitioner?
• Which of the following processes involves migration of an application with minimal code changes?
• What is the statement about auditing being used only to discover security holes?
• What is the biggest concern for migration of services during BCDR?
• Which process involves defining access rules based on business requirements?
• Which type of cloud deployment model is considered equivalent to a traditional IT architecture?
• What characteristic is essential for cloud computing?
• Which act allows banks to merge with and own insurance companies while ensuring customer account information remains private?
• Which level of CSA STAR needs the release of results related to security-properties monitoring based on the Cloud Trust Protocol (CTP)?
• What is a cloud storage architecture that manages the data in caches of copied content close to locations of high demand?
• Why is managing personnel threats crucial for organizations relying on cloud computing?
• What is one feature of Information Rights Management (IRM)?
• Which control should be implemented to effectively manage unauthorized access in a cloud environment?
• In information security, what does the term 'authentication' specifically aim to establish?
• In PaaS, the customer has control over which aspect?
• What legal protection is not provided for ideas, specific words, or recipes?
• Gap analysis is performed for what reason?
• This concept affords the right to look at things anonymously and to be "forgotten" by a system when you leave.
• Which method is being used when a company evaluates the acceptable loss exposure associated with a cloud solution for a given set of objectives and resources?
• Which of the following is NOT a toolset or technology commonly used to secure data?
• What is one of the recommended ways to harden Operating Systems in a cloud environment?
• What process replaces sensitive data with unique identification symbols while retaining essential information?
• Which of the following items should be redundant in a data center?
• Which of the following types of storage do cloud infrastructure services use?
• What does security redundancy entail?
• Which of the following security standards focuses on the protection of information assets and addresses the relevant risks by looking to the ISMS (Information Security Management System)?
• Which term allows an individual to correct any inaccuracies in their own information?
• Which of the following concepts refers to consuming IT resources as a service rather than managing them directly?
• Which form of BC/DR testing has the least impact on operations?
• Which framework is often applied to ensure data privacy and protection in cloud computing environments?
• Who determines when and how a private cloud meets the policies and needs of an organization?
• What process involves the generation, storage, and application of keys according to a security policy?
• What type of information does the Health Insurance Portability and Accountability Act (HIPAA) protect?
• What does Virtual Machine Introspection (VMI) help mitigate within a virtual machine?
• What is required to establish and maintain log management in an organization?
• Which concept is essential for ensuring security in cloud environments by controlling identity access?
• Which tool can reduce confusion and misunderstanding during a BC/DR response?
• Cryptographic keys should be secured ______________.
• What does RTO represent in the context of business continuity?
• What does a CMB meeting help review and analyze?
• In cloud development, which of the following is essential to success?
• Which statute addresses security and privacy matters in the financial industry?
• Which of the following are essential characteristics of cloud computing?
• In cloud models, the customer is given access and ability to modify which of the following?
• Cloud vendors are held to contractual obligations with specified metrics by:
• A system capable of monitoring and analyzing the internals of a computing system as well as the network packets on its network is known as:
• What technology uses multiple low-cost drives to enhance performance and provide redundancy?
• What does cloud provisioning primarily involve?
• Which law relates to personal matters such as marriage and divorce?
• What creates new data feeds from existing datasets within the environment?
• A honeypot should contain what type of data?
• What term describes the advanced data analysis enabled by cloud usage, often referred to as "big data"?
• What types of data storage does PaaS typically utilize?
• Which type of control should be used to implement custom controls that safeguard data?
• What is the primary risk associated with insufficient due diligence in cloud deployments?
• Which cloud infrastructure is shared by several organizations with specific shared concerns?
• Which of the following are the virtualization risks?
• A generator transfer switch should bring backup power online within what time frame?
• Which jurisdictional data protection controls the ways that financial institutions deal with the private information of individuals?
• What type of agreement aims to negotiate policies with various parties in accordance with the agreed-upon targets?
• Which process is conducted to ensure that policies are understood in the context of the risks introduced into an organization?
• Which testing method must be conducted to validate the effectiveness of a business continuity plan?
• What does 'elasticity' in cloud computing refer to?
• In what phase of the Cloud SDLC is the actual code written based on previously established parameters?
• Which aspect is most crucial when conducting a Risk Assessment in a cloud environment?
• What tool is often utilized for ensuring compliance and monitoring data loss prevention?
• Which of the following is considered a vulnerability in a cloud environment?
• Which of the following cloud service models provides the most control over the infrastructure?
• Volume Storage is split into pieces called what?
• Which data protection technique involves twisting the information in such a way that it remains unintelligible, even if the source code is obtained?
• Tort law is primarily concerned with which of the following?
• Which legislation must a trusted cloud service adhere to when utilizing the data of EU citizens?
• What do Application Programming Interfaces (APIs) provide for software applications?
• Which method does NOT help reduce harm from escalation of privilege?
• Which multi-factor authentication (MFA) option uses a physical universal serial bus (USB) device to generate one-time passwords?
• Where does a Type 1 Hypervisor typically reside?
• How does a cloud service provider benefit from operating a cloud environment?
• Which process aims to identify the relevant risks that may affect the AIC (Availability, Integrity, and Confidentiality) of key information assets?
• What is a key benefit of the public cloud deployment model?
• What does encryption primarily provide in cloud security?
• Does encryption ensure the integrity of data?
• Which model allows customers to use software applications hosted on the cloud without handling the underlying infrastructure?
• Which concept involves prioritizing recovery processes after a disruptive event?
• What type of policy helps customers seek financial restitution for damages caused by provider negligence?
• Which term does NOT describe the practice of obscuring original raw data?
• The Brewer-Nash model is also known as which of the following?
• What framework is often used for providing third-party applications limited access to HTTP services?
• In which of the following encryption techniques does the encryption engine run on a secure machine that handles all the cryptographic actions?
• Which technology improves the ability of the transport layer security (TLS) to ensure privacy when communicating between applications?
• What is one of the factors that limit administrator access in a cloud environment?
• What does recovery point objective (RPO) typically refer to?
• What is the primary focus of secure initial configuration processes?
• Which primary security control should be used by all cloud accounts to defend against the widest range of attacks?
• Is it necessary to obtain prior permission from the local Data Protection Commissioner before transferring data internationally?
• SOX was enacted because of which of the following?
• A portable storage is vulnerable to which threat?
• What tool is used to regularly review and inspect the data owned by an organization?
• Which of the following best describes policy management in a cloud environment?
• Which technology typically provides security isolation in infrastructure as a service (IaaS) cloud computing?
• What term applies to multiple customers using the same public cloud?
• Which individual plays a crucial role in evaluating technologies and vendors for cloud deployments?
• Which of the following describes the technology that alerts on potential security breaches?
• What arrangement allows multiple enterprises to use the same identification data for access?
• Which management practice is recommended for securing cloud environments by minimizing privileges granted to users?
• In a federated system, which two components serve as its core?
• What must organizations consider to ensure data privacy when utilizing cloud services?
• Which platform as a service (PaaS) data type should be used for a banking cloud platform that needs seamless and searchable relational database inclusion?
• What is a key method in a risk-based approach to business continuity planning?
• As part of ITIL, what kind of ticket is created to make a change?
• Which of the following is not a feature of DAST?
• Which type of security control is primarily focused on detecting unauthorized access attempts?
• Which jurisdictional data protection safeguards protected health information (PHI)?
• What is the gathering of data as evidence referred to in cybersecurity?
• If a cloud customer wants a fully-operational environment with very little maintenance or administration necessary, which cloud service model would probably be best?
• What does MAD stand for in BC/DR concepts?
• Which security strategy is associated with data rights management solutions?
• If a cloud customer wants a secure, isolated sandbox in order to conduct software development and testing, which cloud service model would probably be best?
• Which item would be a risk for an enterprise considering contracting with a cloud service provider?
• Which of the following testing is referred to as white-box testing and is used to determine the coding errors?
• Which of the following is tier IV for data center design according to "Data Center Site Infrastructure Tier Standard: Topology"?
• Which of the following best describes a Public Cloud?
• Which frameworks are associated with risk management?
• Which process is important for securing host servers within a cloud environment?
• Which of the following is NOT a security concept for customers of cloud computing?
• What is the key issue associated with the object storage type that the CCSP has to be aware of?
• In the cloud motif, who usually acts as the data processor?
• SOC 2 reports are most useful for which of the following?
• What type of storage is used for swapping storage files?
• What is the focus of business QoS in terms of measurement?
• What determines the effectiveness of controls in an audit?
• Which cloud computing tool may help detect data migrations to cloud services?
• The cloud deployment model that features ownership by a cloud provider, with services offered to anyone who wants to subscribe, is known as:
• All of the following can result in vendor lock-in except:
• Which data source provides auditability and traceability for event investigation as well as documentation?
• Why is the concept of risk tolerance important in organizations?
• What does Title II of the Electronic Communications Privacy Act of 1986 restrict?
• What type of discovery is used when responding to a mandate with a specific purpose?
• Which of the following vulnerabilities exploits a user's browser to generate unauthorized commands?
• What is the goal of business continuity management?
• What policy describes the media type used for data archiving?
• Which approach involves assessing the likelihood and impact of potential cloud service risks?
• What does PaaS (Platform as a Service) enable consumers to do?
• Which of the following terms refers to the ability to recover from faults in a system?
• The Brewer-Nash security model is also known as which of the following?
• Which metric is crucial for assessing if a cloud provider meets contractual obligations?
• Which NIST publication ensures appropriate security requirements and controls for U.S. federal government information?
• What legal concept protects expressions of ideas and does not cover ideas themselves?
• What does a community cloud model particularly address in organizational contexts?
• Which phase of the cloud data life cycle uses content delivery networks?
• Which of the following Acts consists of the given sections: -The financial privacy -The safeguards rule -The pretexting provisions?
• What is the role of policies in cloud environments?
• In a community cloud configuration, how are resources managed?
• What is the purpose of using Puppet configuration management system?
• Which of the following is NOT a dependency to consider in the BIA review after cloud migration?
• Which technology creates a secure tunnel across untrusted networks?
• Which organization publishes the most commonly used standards for data center tiers and topologies?
• Which standard addresses the privacy aspects of cloud computing for consumers?
• What is a significant risk associated with the absence of multi-factor authentication in cloud services?
• What is an essential characteristic of Digital Rights Management (DRM)?
• What does cloud storage enable companies to do with their data?
• Which group is legally bound by the general data protection regulation (GDPR)?
• What does personal data refer to in the context of cloud security?
• What is the primary purpose of risk avoidance?
• What does NIST Special Publication (SP) 800-122 primarily focus on?
• Which phase of the software development life cycle includes writing application code?
• Where would the monitoring engine be deployed when using a network-based DLP system?
• Which authentication standard is most effective when integrating multiple external service providers?
• In which service model allows users to install all software on vendor-provided hardware?
• Which model requires the customer to perform their own systems patching?
• Which of the following encryption options establishes an encrypted link between a web server and a browser and ensures privacy and integrity of data on that link?
• Which of the following protocols uses the X.509 certificates for authenticating a connection and exchanging the symmetric keys over a network?
• What is the purpose of a dry run in security testing?
• How is the time period that data should be kept by an organization typically expressed?
• Which term refers to a cloud service that manages access rights to data?
• Which cloud infrastructure is shared by several organizations with common concerns, such as mission, policy, or compliance considerations?
• What is one main purpose of strong authentication mechanisms in cloud security?
• What is the purpose of using the Cloud Security Alliance cloud controls matrix?
• What does private cloud storage refer to?
• What does a Cloud Access Security Broker (CASB) primarily provide?
• What is one characteristic of a public cloud?
• What is the next step in the entitlement process after translating business and security requirements into rules?
• What is a significant risk associated with cloud storage that organizations need to acknowledge?
• What are third-party providers offering IAM functions in cloud environments commonly referred to as?
• Which of the following is not a feature of SAST?
• What does hybrid cloud storage combine?
• What are the five Trust Services principles?
• What principle is primarily emphasized in the management of cloud security regarding data privacy and security?
• What is the primary function of Static Application Security Testing (SAST)?
• Which factor exemplifies adequate cloud contract governance?
• Which of the following is not one of the types of controls?
• In which scenario is a CSP considered the provider of alternative facilities?
• What feature ensures that only authorized users can access specific resources?
• Which vulnerability should be kept in mind for PaaS implementations primarily used for software development?
• Where should cryptographic keys for encrypted data stored in the cloud be kept?
• What is a key benefit provided to customers using an IaaS solution?
• When discussing data sanitization methods, which method involves completely removing data?
• What is the purpose of scoping in cloud engagement?
• What should organizations consider implementing to ensure compliance with data privacy regulations?
• Which ISO standard refers to addressing security risks in a supply chain?
• In a PaaS environment, who is responsible for the installation and maintenance of the operating system?
• What is the aspect of the DMCA that has often been abused and places the burden of proof on the accused?
• What is the main objective of Dynamic Application Security Testing (DAST)?
• What does SAST stand for in the context of white-box testing?
• Which of the following describes the concept of 'simplicity' in cloud services?
• Which process involves the use of electronic data as evidence in a civil or criminal legal case?
• What is a key characteristic of a honeypot?
• Which term refers to the allocation of resources in cloud computing?
• What are the five key principles of ISO/IEC 27018?
• Which method creates a structurally similar, inauthentic version of data for testing purposes?
• Which process verifies untested and untrusted codes in a controlled cloud environment?
• Where do bare metal hypervisors run?
• Which method is commonly used to ensure data privacy in cloud computing?
• What is an experimental technology intended for processing encrypted data without decryption?
• What is the primary focus of static application security testing?
• The following are Data States as referred to by DLP, except?
• Which method should the cloud consumer use to secure the management plane of the cloud service provider?
• Which option describes how PII is classified into contractual and regulated categories?
• Which data format does SOAP (Simple Object Access Protocol) support?
• What is the term for convoluting code to the point it is not easily decipherable even if obtained?
• What system is used to notify administrators about nearing capacity limits that might affect SLA parameters?
• Which service model would be most appropriate for a company seeking to provide infrastructure resources like virtual machines?
• When using transparent encryption of a database, where does the encryption engine reside?
• With whom does a service provider dictate both the technology and operational procedures being made available to the cloud consumer?
• Which action enhances cloud security application deployment through standards such as ISO/IEC 27034 for the development, acquisition, and configuration of software systems?
• Which service model allows users to rent IT infrastructure such as servers and storage?
• What is one critical component of a privacy management program?
• Which of the following is not an example of an essential internal stakeholder?
• Which term defines the risk of unauthorized access to information due to overlapping virtual resources?
• Which of the following activities takes place in a secure operations phase of the software development lifecycle?
• What acronym summarizes the six threat categories related to cloud security?
• Which security threat occurs when a developer leaves an unauthorized access interface within an application after release?
• The goals of SIEM solution implementation include all of the following, except:
• Which model provides hardware resources for cloud applications?
• What is typically a significant concern of enterprise security in cloud settings related to the access point?
• Which jurisdictional data protection includes dealing with the international transfer of data?
• Which of the following statements is true of key management?
• Which technology allows an organization to control access to sensitive documents stored in the cloud?
• Which of the following are the data classification categories?
• Which is not a principle of GAAP?
• In the context of cloud security, what does residual risk refer to?
• What is the purpose of a Business Impact Analysis (BIA)?
• What security approach involves using multiple overlapping methods to secure an environment?
• When does the EU Data Protection Directive (Directive 95/46/EC) apply to data processed?
• What term describes the concept of sharing resources with other cloud customers simultaneously?
• What is the primary benefit of conducting a full test in BC/DR practices?
• What is the purpose of a honeypot in cloud security?
• A standard base of technologies and policies across different organizations is known as what?
• What allows enterprises to store their data on the Internet instead of locally?
• Which methods are used for the safe disposal of electronic records in cloud environments?
• What is the primary role of a Cloud Service Provider (CSP)?
• Which data retention solution should be applied to a file in order to reduce the data footprint by deleting fixed content and duplicate data?
• Which model is a full application and distributed model managed by the provider?
• Which Threat Model provides a standardized way of describing threats by their attributes?
• Who is primarily responsible for managing Personally Identifiable Information (PII) in an organization?
• Who among the following acts as a middleman between CSPs and their customers to facilitate the customers with the best provider?
• What result is achieved by removing all nonessential services and software of devices for secure configuration of hardware?
• Which technology allows a user to operate encrypted data without the need of decrypting it?
• Which of the following SOC report subtypes represents a point in time?
• Which two terms are considered threat models?
• What term refers to the rights and obligations for persons harmed by others?
• What security approach combines various technologies to protect the same asset?
• What should be regularly tested to ensure operational readiness in disaster recovery plans?
• Which risk is associated with malicious and accidental dangers to a cloud infrastructure?
• What do virtualization vendors utilize to allow host clusters to scale and manage resources without service disruption?
• Which cloud model provides data location assurance?
• Where is the agreement between the cloud customer and provider regarding responsibilities codified?
• Which of the following authentication protocols allows organizations to trust each other's identity information?
• Which design principle of secure cloud computing ensures that users can utilize data and applications from around the globe?
• What is a major pitfall in cloud application deployment?
• _______ drive security decisions.
• When does an XSS flaw occur?
• What is an essential step to take when choosing a cloud service provider?
• Which of the following are key areas of performance metrics?
• When a cloud customer uploads PII to a cloud provider, who becomes ultimately responsible for the security of that PII?
• Which of the following is NOT an effective tool for mitigating insider threats in cloud security?
• What kind of software does an enterprise application refer to?
• GAAPs are created and maintained by which organization?
• What is referred to as the abstraction layer that allows code to run without dependence on the underlying hardware?
• Which risk during the eDiscovery process would limit the usefulness of the requested data from the cloud by third parties?
• What is a software or hardware-based network security system that controls the incoming and outgoing network traffic based on an applied rule set?
• Which is the correct order of the Cloud Secure Data Lifecycle?
• Which cloud security control is a countermeasure for man-in-the-middle attacks?
• Which regulation requires a CSP to comply with copyright law for hosted content?
• Which option is used to evaluate the risks and merits of various test scenarios?
• What type of attack aims to make an application unavailable?
• What regulation allows American and EU PII exchange without requiring American Entities to follow EU PII Laws?
• What audits financial reporting instruments and consists of two subclasses?
• Which element is a cloud virtualization risk?
• To which of the following phases of the data lifecycle is the process function mapped?
• What is a key capability of infrastructure as a service (IaaS)?
• Which statement is accurate regarding the characteristics of sensitive data?
• Which of the following security responsibilities are shared between an organization and its CSP in an IaaS cloud environment?
• Which role is primarily responsible for ensuring cloud storage mechanisms meet service-level agreements?
• In which risk category is the consumer unable to implement all necessary controls?
• Which term describes the goal of minimizing data loss from an unplanned event?
• What is required for Level One of the CSA Security, Trust, and Assurance Registry (STAR)?
• Which cloud service model allows you to manage the underlying infrastructure?
• Which of the following is a drawback of cloud computing where a customer depends on a dealer for products and services?
• Which of the following is a security consideration when moving to a cloud environment?
• Which term refers to the structured storage of data that can be accessed by online applications?
• Which type of cloud allows for better adaptability for IT infrastructures?
• What aspect of the disaster recovery (DR) plan ensures control when issues exceed capabilities?
• What protocol ensures the privacy of communication between applications?
• In the context of cloud security, which of the following is critical for protecting sensitive data?
• The CMB should include representations from all of the following offices except:
• What is the primary purpose of Desktop as a Service (DaaS)?
• Where should the final data backup repository be located for a disaster recovery (DR) service?
• What is defined as a collection of distributed resources responsible for storing and managing data online in the cloud?
• What type of encryption allows operations on ciphertext without decryption?
• Which of the following reports is no longer used?
• Which of the following refers to the permitted actions within an organization's data security framework?
• What is the term for a company’s formal request to obtain goods or services from an external vendor?
• What is the term used to describe the amount of risk that leadership and stakeholders are willing to accept?
• Which cloud service model best allows users to deploy applications without worrying about underlying infrastructure?
• What does a cloud developer focus on?
• Which method supports secure data transmission via web services?
• Which characteristic of automated patching makes it attractive?
• What term describes the administration of user accounts and their associated attributes in directory services?
• Which security technology can provide secure network communications from on-site enterprise systems to a cloud platform?
• In a cloud environment, who ensures that various storage types and mechanisms meet and conform to the relevant SLAs?
• Which strategy involves shifting risk to another party?
• Which technology allows an administrator to remotely manage a fleet of servers?
• Which feature allows for increased flexibility in utilizing various cloud services?
• Which resiliency technique attenuates the possible loss of functional capabilities during contingency operations?
• Under which act does the requirement for companies to maintain accurate financial records fall?
• What is one of the goals of implementing a Data Loss Prevention (DLP) solution?
• Which technology is used to manage identity access management by building trust relationships between organizations?
• Which of the following best describes a sandbox?
• What is an essential feature of the security model for cloud data?
• Which control helps mitigate the risk of sensitive information leaving the cloud environment?
• What does a secure data port help to reduce?
• Which type of auditing typically focuses on an organization’s internal controls regarding financial reporting?
• If a service or solution does not meet all of the specified key characteristics, it is said to be not true cloud computing. Which of the following is a validated cloud computing characteristic?
• Which of the following is a consequence of applying strong magnetic fields to data storage media?
• Which of the following is considered a technological control?
• What describes the practice of ensuring data quality, privacy, and security in accordance with regulatory requirements?
• Which of the following is not appropriate to include in an SLA?
• Which of the following best describes a Cloud Service Provider (CSP)?
• Which is not a part of the Management Plane?
• Which penalty is imposed for privacy violations under the general data protection regulation (GDPR)?
• Which of the following best defines risk?
• Which term describes information retained for legal, regulatory, or business reasons?
• What does configuration management primarily concern itself with?
• Which of the following is the science of hiding information to protect sensitive information and communications from unauthorized access?
• What type of assessment is performed when there is insufficient data to assist the risk assessment, using estimates to express risk?
• Which of the following best describes data classification?
• What does object storage provide in addition to data storage?
• Which of the following best describes risk?
• Which of the following is not a risk management framework?
• Which risk is related to interception of data in transit?
• Which risk management strategy involves shifting risk from one organization to another?
• What is the primary governance of federal law?
• In the context of cloud security, what is the definition of a federated identity provider?
• What technology helps improve bandwidth by acting as a form of data caching at high demand locations?
• What is the role of a Cloud Services Brokerage (CSB)?
• Which of the following is not an aspect of physical security that ought to be considered in the planning and design of a cloud datacenter facility?
• Which of the following technologies allows for secure sharing of information?
• Which of the following is the primary purpose of an SOC 3 report?
• What does a cloud architect primarily do?
• All of the following should be included in the audit scope definition except:
• Which type of attack aims to overwhelm a target’s resources?
• Which cloud service model includes operating systems along with infrastructure?
• What are SOC 1/SOC 2/SOC 3?
• Which cloud model is characterized by reliance on a third-party for services, leading to specific threats such as rogue administrator and contractual failure?
• In a federated environment, who is the relying party, and what does it do?
• Applications with known vulnerabilities cannot be mitigated and should never be used.
• Which security method should be included in a defense-in-depth, when examined from the perspective of a content security policy?
• What is a Service-Level Agreement (SLA)?
• What does the guide provided by ISO/IEC 27041:2015 focus on?
• What is a core benefit of using multifactor authentication in cloud security?
• What type of technology is commonly used for load balancing in cloud environments?
• Which technique safeguards systems against newly found vulnerabilities while providing additional functionalities?
• Which countermeasure enhances redundancy for physical facilities hosting cloud equipment during the threat of a power outage?
• What does SAML stand for in relation to federation standards?
• Which regulation focuses on securing data for publicly traded corporations?
• Which is not a part of the BCDR Continual Process?
• In which situation could cloud clients find it impossible to recover or access their own data if their cloud provider goes bankrupt?
• What does 'scalability' mean in the context of organizational computing needs?
• Which discovery method focuses on collecting all matching data elements for a specified purpose?
• Which of the following countermeasures is designed specifically for preventing data breaches in cloud operations?
• In cloud environments, what feature allows for service use without human interaction?
• What does vendor lock-out refer to in a cloud service context?
• What legislation is enforced by the Securities Exchange Commission (SEC)?
• Which statement about SOAP is not true?
• Which item is required in a cloud contract?
• DRM solutions typically include all the following functions EXCEPT:
• In SOC 2 Auditing, how many categories make up the security principle?
• What technology is specifically used for monitoring and analyzing database activity independently of the database management system?
• Which element is protected by an encryption system?
• Which of the following is not classified as an access control?
• If a cloud customer wants a bare-bones environment in which to replicate their own enterprise for BC/DR purposes, which cloud service model would probably be best?
• Object Storage is usually accessed through which of the following?
• A private cloud project primarily supports what type of configuration?
• Which process involves permanently removing personal identifiers from data?
• What term describes the focus on only those departments impacted by cloud engagement?
• What is the main focus of ISO/IEC 27034-1?
• Which Cloud Model primarily uses databases to store data?
• Which of the following is a consequence of malware?
• What is the common purpose of Incident Response plans?
• What is the term for a situation where a customer is unable to migrate to another provider due to constraints?
• What responsibility does a customer hold in the SaaS cloud service?
• Which section of the CSA (Cloud Security Alliance) provides the ability to quantifiably measure return on investment (ROI) for the efficient use of resources?
• Under what principle does the need for continuous monitoring in cloud security fall?
• What technology provides a shared resource pool managed to maximize the number of guest operating systems?
• What is the response called that follows a cost-benefit analysis when addressing a risk?
• Which cloud data storage architecture allows sensitive data to be replaced with unique identification symbols that retain all the essential information without compromising security?
• What are the U.S. Commerce Department's controls on technology exports called?
• What type of storage allows users to access their data from various remote locations?
• Which body establishes optimal temperature and humidity levels?
• Who in an organization determines the overall risk profile?
• Which type of cloud service involves an integrated arrangement of two or more cloud servers?
• How is the compliance of the cloud service provider's legal and regulatory requirements verified when securing personally identifiable information (PII) data in the cloud?
• Which software configuration management tool integrates during building, deploying, and managing infrastructure?
• Which of the following open web application security threats occurs when suspicious data in an application is sent to the web browser without proper validation?
• What type of storage holds additional metadata accessible through APIs and potentially a web UI?
• Which storage type allows customers to have flexibility by enabling them to put anything into a blank volume?
• Which of the following represents the amount of information that can be recovered and restored in the event of a disaster?
• In the context of cloud services, what does 'bare metal' refer to?
• Which of the following is NOT a phase in the Risk Management Framework?
• Which risk is controlled by implementing a private cloud?
• What legal activity might involve the confiscation or inspection of a host machine by law enforcement?
• What type of security responsibility primarily falls on the enterprise when utilizing cloud services?
• What process involves destroying the encryption keys used to secure data?
• If a patch is unavailable for a vulnerability, what action may be advisable?
• Which framework provides guidelines for cloud security and risk management?
• What is the function of a controller?
• Which of the following guidelines includes national privacy strategies, privacy management programs, and data security breach notification?
• In a cloud context, what does the term "provider lock-in" refer to?
• Which term describes the action of confirming identity access to an information system?
• Which attack vector is associated with cloud infrastructure?
• Which of the following best describes "sprawl" in a cloud environment?
• Which of the following describes the four tiers of data center site infrastructure?
• Which of the following is NOT a characteristic of Federated Identity Management?
• What term describes the ease or difficulty of transferring data out of a provider's datacenter?
• Which phase of the software development life cycle includes determining business and security requirements?
• What kind of relationship exists between organizational and application normative framework?
• Which act grants students the right to opt-out of information sharing regarding their educational records?
• Which of the following has not been attributed as the cause of lost capabilities due to DoS?
• What does a redundancy mechanism primarily aim to achieve in a data storage context?
• The right to be forgotten refers to which of the following?
• Which document serves as a guide for implementing a risk management framework comprehensively?
• Which practice is essential for securing cloud environments against unauthorized access?
• What is the term for a report that contains no actual data about security controls and is referred to as the "seal of approval"?
• What is a key aspect of the management plane in a cloud infrastructure?
• Which of the following attributes is characteristic of cloud computing?
• What does IaaS primarily manage for a cloud customer?
• Which term refers to the software technology that allows application software to operate independently from the underlying operating system?
• Which communication model focuses on ensuring the confidentiality of user business details?
• What characterizes public cloud storage?
• User access to the cloud environment can be administered in all of the following ways except?
• What defines a successful incident response?
• What type of attack attempts to identify known holes in security systems?
• Which concept refers to the maximum acceptable amount of time that a system can be down after a disaster?
• Which term refers to the risk assessment and management processes aimed at protecting data and systems?
• To protect data on user devices in a BYOD environment, which requirement is not advisable?
• What is the name of the specification designed to ease management of applications across public and private cloud platforms?
• What is the primary benefit of using a threat model like STRIDE?
• What is the process of creating virtual versions of hardware, OS, and storage devices called?
• All of the following are components of DLP except:
• What is the process of adding validation support to a section without changing the basic mechanism of a DNS query using DNSSEC?
• Which service model encompasses all the resources of IaaS and PaaS, as well as software programs?
• What term is used to describe a model where consumers only pay for computing resources they utilize, similar to utility services?
• Which cloud computing tool is used to discover internal use of cloud services using various mechanisms such as network monitoring?
• What is the main objective of applying cryptography to the data in a cloud?
• What type of firewall protects application servers from HTTP traffic?
• What is one benefit of using a cloud service in an organization?
• What does the term "service level agreement" (SLA) refer to in cloud services?
• Who is a cloud service provider (CSP) required to notify after a security breach that discloses personal information likely to cause serious harm?
• Which of the following is considered a physical control?
• Which of the following allows consumers to manage and report on resources without internal engagement?
• Which countermeasure is NOT applicable to protecting cloud operations from internal threats?
• Which cloud service model is responsible for the physical security of the facility and systems?
• What is the purpose of ISO/IEC 27042:2015?
• In the context of cloud security, what does QoS primarily focus on?
• What type of threat is posed by a malicious insider in an organization?
• Which of the following is not a method of hardening devices in a cloud datacenter?
• Which cloud security measure helps prevent man-in-the-middle attacks?
• Which type of attack is specifically designed to flood a network with excessive requests?
• What ensures that the use of data complies with organizational policies, standards, and relevant regulations?
• What metric indicates how long it should take to repair a failed component in a system?
• Which method is used to identify specific kinds of data within datasets?
• Which of the following is NOT an issue of key management?
• What type of encryption allows for performing calculations on cipher data without decrypting it first?
• A user installs a modem to work from home. This is an example of which type of threat?
• What is the role of a cloud access security broker (CASB)?
• Which type of storage allows significant levels of description and enhances indexing capabilities?
• Which of the following guidelines covers eDiscovery?
• What is the term for the process of gathering evidence in a cloud environment?
• The right to audit should be part of what documents?
• Which standard is primarily concerned with eDiscovery processes?
• What term describes the action of applying minor changes to existing systems?
• What does XaaS represent in cloud computing?
• What is the key benefit of conducting a dry run during a security process?
• Bit splitting as a technique typically aims to enhance which aspect of cloud storage?
• What is likely to enhance a customer's trust in a cloud provider?
• Which of the following is a Type 1 hypervisor?
• Which category of the ISO/IEC 27034-1 standard relates to processes regarding application security?
• What is the significance of having OSs included in IaaS?
• What does the term 'scoping' refer to in cloud security?
• Which is not a step in the BCDR continual process?
• What does SAST primarily analyze?
• What does a successful identity management process primarily enhance within enterprises?
• What type of report is classified as SOC 1 and what is its purpose?
• What defines what is to be covered in the audit?
• Which of the following is a core principle of cloud security architecture?
• What is a plan to fix or mitigate all findings from an audit called?
• Which document typically outlines the security policies and procedures to be followed in a cloud environment?
• What term is used to describe the logs and documentation needed for audits and compliance?
• What does a Web Application Firewall (WAF) primarily protect against?
• The risk that a cloud provider might go out of business and the cloud customer might not be able to recover data is known as:
• What is a type of multifactor authentication (MFA)?
• Which action is required for breaches of data under the general data protection regulation (GDPR) within 72 hours of becoming aware of the event?
• What does the Application Normative Framework (ANF) consist of?
• Which of the following is the software that manages the requests of multiple guest machines to access the resources of the host machine?
• The Family Educational Rights and Privacy Act (FERPA) primarily protects what type of data?
• Data labels could include all the following, except?
• Which of the following cloud-specific risks occurs when various applications are pushed to a cloud environment without complete understanding of the CSP environment?
• What is called the process of intended permanent destruction of the data keys?
• What is the process of allocating the cloud provider's services and application to the customers for utilizing them?
• What does MFA stand for in cloud security?
• What is a baseline in the context of network security?
• Which of the following is a type of testing that analyzes application source code for vulnerabilities?
• Which cloud storage model keeps enterprise data behind the firewall?
• Why is event logging important in an IaaS model?
• What is the Cloud Security Alliance Cloud Controls Matrix (CCM)?
• What does risk avoidance refer to in the context of organizational security?
• Which of the following is a primary goal of security hardening?
• Which of the following contributes to an effective security monitoring strategy in a cloud environment?
• What term describes a software application that is accessed via the internet and not installed on a local computer?
• Why is eDiscovery difficult in the cloud?
• In BC/DR planning, what is the goal measured in time for recovering from interruptions?
• How can the cloud customer's trust in the cloud provider be enhanced?
• The Sarbanes-Oxley Act is enforced by which entity?
• Which type of hypervisor is most closely associated with hardware management control?
• The generally accepted definition of cloud computing includes all of the following characteristics except:
• Which of the following is a potential threat to cloud operations?
• Which of the following technologies is used to ensure that secure API (Application Programming Interface) access?
• In the cloud motif, who is typically considered the data owner?
• What do regulations such as GDPR emphasize in the handling of personal data?
• Which of the following is not a common cloud service model?
• What does the acronym CASB stand for in cloud computing?
• Which cloud service delivers cloud services over a network that is open for free usage?
• What does the documentation of asset inventory reflect?
• What security threat involves multiple redundancies to protect against service disruptions?
• Which of the following is important in maintaining data integrity?
• Which type of cloud service provides applications and storage solutions via the internet?
• Which professional is responsible for the deployment of cloud applications to their respective environments?
• What is characterized by the ability to allocate and deallocate resources based on demand?
• What is the purpose of cloud testing?
• Which encryption technique connects the instance to the encryption instance responsible for all crypto operations?
• Which of the following services are accessible within the SaaS cloud service model?
• This is the amount of services that is required to be restored to meet the requirements of a BCDR plan:
• As a cloud customer, do you have access to all logs regardless of the cloud model?
• Which of the following aids in the ability to demonstrate due diligence efforts?
• Which of the following measures is indicative of security redundancy?
• All of these technologies have made cloud service viable except:
• Sandboxing provides which of the following?
• What is the function of a secure kernel-based virtual machine?
• Web application firewalls (WAFs) primarily protect against which type of attacks?
• What is the primary role of a cloud service auditor?
• Which data-protection policy moves data that is no longer used to a separate storage device for long-term maintenance?
• What is often a major challenge to getting both redundant power and communications utility connections?
• What risk is magnified by cloud computing, involving the possible misuse of access by employees?
• Which issue occurs when a web browser is sent data without proper validation?
• Which of the following will help achieve redundancy in virtual switches?
• Which benefit does cloud computing primarily provide to businesses?
• DLP solutions can deter loss due to which of the following?
• All of the following regions have at least one country with an overarching, federal privacy law protecting personal data of its citizens, except?
• What process helps check the hardware and software along with distribution facets like SDN control planes?
• Which of the following best describes the chain of custody in the context of evidence handling?
• Which type of environment is designed to isolate untested code from operational systems?
• Which of the following capabilities of an Information Rights Management (IRM) solution confirms the content delivery and offers proof of compliance with an organization's information security policy?
• Which of the following defines the concept of encryption?
• Which type of management system focuses on reducing threats and risks to IT and Data resources?
• Which standard applies to credit card processing?
• Which term refers to the key structure that includes management plane components which are network-enabled and remotely accessible in cloud computing?
• The cloud deployment model that features joint ownership of assets among an affinity group is known as:
• What does notice inform an individual about concerning their personal information?
• True or False: The customer's legal liability for its data is unaffected by the provider's negligence.
• Which type of attack involves overwhelming a system with traffic to disrupt its operations?
• What is a firewall primarily used for in cloud security?
• What process involves applying strong magnetic fields to erase data on hard drives and tapes?
• What principle does nonrepudiation support in communication systems?
• What should configuration management always be tied to?
• Which type of control is important in order to achieve compliance for risk management?
• What is a significant risk associated with cloud services that affects data integrity?
• Which action facilitates communication paths for a cloud customer and their service provider during an incident?
• What is one responsibility of the cloud provider regarding physical security control?
• Which cloud threat is characterized by a flaw in one client's application exposing data from other clients in a multitenant service?
• What does the "S" in the STRIDE acronym represent?
• Which regulation is not necessarily related directly to privacy?
• Which technology enables the examination of various aspects of a VM without an agent?
• Are confidentiality and integrity considered to be the same thing?
• What is the experimental technology that might lead to the possibility of processing encrypted data without having to decrypt it first?
• IRM allows for which of the following, except?
• Which technology does cloud computing utilize through a management interface?
• What is the purpose of using SSO in security contexts?
• Which type of test is typically more accurate and delivers more results: SAST or DAST?
• Which standard outlines domains which establish frameworks for risk assessment?
• Which of the following is a benefit of layered defenses in security?
• Which level of CSA STAR involves continuous monitoring of security properties?
• What is a critical component of effective incident response in cloud environments?
• In an Infrastructure as a Service (IaaS) model, who is responsible for software installation?
• What is a primary action taken to enhance security in a datacenter?
• What is the primary purpose of a contract in a cloud service agreement?
• This device is used to offload processing of XML from the application:
• Which cloud security control eliminates the risk of a virtualization guest escape from another tenant?
• In which of the following components of the data retention policy do data-retention considerations depend heavily on the required compliance administration associated with the data type?
• What is the primary focus of the Sarbanes-Oxley Act of 2002?
• What principle should be followed to ensure the availability of services in a cloud environment?
• Which of the following is not an example of a highly regulated environment?
• Which data retention policy controls how long HIPAA data can be archived?
• Which of the following describes a testing environment that isolates untested code changes?
• Which of the following is used to distribute workloads across multiple physical devices?
• What is a critical aspect of logging during maintenance mode?
• What term describes the essential aspects of an organization without which it cannot operate?
• Which type of information is not typically associated with a SOC 3 report?
• Which international standard is focused on risk management processes and practices?
• An attacker establishes themselves on a system in such a way to enable the stealing of data over time. What kind of attack is this?
• How often should the CMB meet?
• Which model is an open-source alternative to STRIDE offered by Octotrike?
• What are the objectives of release and deployment management?
• What framework involves policies and procedures for managing risk exposure?
• What is the primary purpose of encryption in cloud security?
• Which act was enacted to protect the privacy of customer financial information?
• Loosely coupled clusters provide what main advantage over tightly coupled clusters?
• What term describes a service that replicates data across the global Internet?
• Which method is predominantly used in federated identity environments?
• In a multi-tenant environment, what is a critical risk that can arise from shared resources?
• Which countermeasure is NOT related to protecting cloud operations against internal threats?
• Which technology can be used to protect data in transit across a cloud network?
• Which term best describes a formal solicitation for proposals from vendors?
• What is the term for a service provider that offers customers storage or software solutions via the Internet?
• Generator fuel storage for a cloud datacenter should last for how long, at a minimum?
• Which of the following is a protocol specification for the exchange of structured information in web services?
• What technology operates independently of the DBMS to audit database activity?
• Which of the following terms is not associated with cloud forensics?
• Which international standard guide provides procedures for incident investigation principles and processes?
• Which of the following processes seeks to exploit the vulnerabilities of a system by collecting the information related to system exposures?
• Which of the following is a way to conduct e-discovery investigations in cloud environments?
• Which of the following describes an internal network with remote access capabilities?
• HIPAA, SOX, and PCI DSS are examples of what?
• What is the main purpose of penetration testing in cloud security?
• Which cloud-specific risk must be considered when moving infrastructure operations to the cloud?
• What approach is used to systematically manage all risks to an enterprise?
• True or False: Data classification dictates the controls necessary to protect the data.
• What is a key practice for controlling physical access to a datacenter?
• What is the primary focus of change management in a network context?
• A localized incident or disaster can be addressed in a cost-effective manner by using which of the following?
• What type of attacks can be classified as external threats?
• What describes a cloud provider who manages a user's system but is not under user control?
• Single Sign On works by issuing:
• Which security testing approach is used to review source code and binaries without executing the application?
• Which of the following is not a risk management framework?
• In which cloud deployment model are all infrastructure-level logs visible to the CCSP as detailed application logs?
• What type of data obfuscation involves hiding sensitive information?
• Which step of the BCDR Continual Process uses the RPO and RTO to determine what is needed in BCDR planning?
• Which of the following is a primary objective of conducting continuous security scanning during development?
• What is a common challenge organizations face when implementing cloud security controls?
• Data labels could include all the following, except?
• A storage area network (SAN) is primarily connected to users through which type of protocol?
• What is the most critical element in maintaining cloud security?
• What does malware typically cause in a cloud environment?
• Which term describes the optimization of cloud services for specific industries or applications?
• What is the main goal of mitigation in the context of cloud security?
• We use which of the following to determine the critical paths, processes, and assets of an organization?
• What is the primary advantage of using a cloud service?
• Which cloud computing technology unlocks business value through digital and physical access to maps?
• Which storage method allows mobile devices to store data in the cloud and access it anywhere?
• Clustered storage architectures can either be tightly coupled or what other type?
• Which of the following is an application virtualization solution?
• Risk transference typically involves which of the following?
• True or False: Open Source Software is less secure than proprietary software.
• What does the 'purpose' in a cloud context refer to?
• What encryption method protects all of a system's data at rest?
• What does Identity and Access Management (IAM) ensure?
• Path management and networking primarily determine what aspect of cloud performance?
• Which logical design decision can be attributed to required regulation?
• What type of threat involves cache poisoning where forged data is inserted into the cache of the name server?
• Which document addresses CSP issues such as guaranteed uptime, liability, penalties, and dispute mediation process?
• Which platform as a service (PaaS) storage architecture should be used to store presentations, documents, and audio files?
• What is the main function of a Cloud Backup Service Provider?
• What is the term for vulnerability testing where you have knowledge of the systems involved?
• What are the four elements that a data retention policy should define?
• Which of the following describes the four cloud deployment models?
• What term describes the practice of evaluating applications from an attacker's viewpoint?
• Which management process recognizes, examines, and corrects hazards to prevent their future occurrence?
• Which virtualization risk occurs when an OS on a VM outbursts to access a hypervisor?
• Where is DLP to protect Data at Rest installed?
• What does IRM stand for in relation to data protection?
• Which technology is primarily used for session encryption in web services?
• In cloud security, what is the primary concern when handling user data?
• What is the primary purpose of a disaster recovery plan?
• What form of intellectual property protection is provided for a useful manufacturing innovation?
• Which method is commonly used for preventing unauthorized access to cloud-based resources?
• What part of the logical infrastructure design is used to configure cloud resources, such as launching virtual machines or configuring virtual networks?
• What is a key feature of multitenancy in cloud services?
• Who is ultimately responsible for the creation and control of data?
• What technology allows users to access and manage software applications online without needing to install them locally?
• Which aspect of business continuity pertains to maintaining functionality during crises?
• What is used to separate the physical architecture of an organization when the security controls applied by the virtualization components seem to be weak?
• Who is responsible for managing data on behalf of the data owner?
• In which of the following threats does an illicit denial of an event occur?
• What two parameters define the compute capacity of a cloud server?
• What is the name of the NIST publication that distinguishes secure cryptographic modules?
• What is the focus of Client-Side Key Management Systems (KMS)?
• Is Data Classification considered a core concept of PCI DSS?
• Which of the following refers to a user gaining unauthorized control over system privileges?
• What is a third-party entity that offers independent identity and access management services to CSPs and cloud customers?
• What is the term for items that serve as early indicators of potential risks or issues?
• What is the main purpose of a Service Level Agreement (SLA)?
• What does volume storage represent in cloud infrastructure?
• Which is the lowest level of the CSA STAR program?
• Data masking can be used to provide all of the following functionality, except:
• What term refers to network elements that are isolated to protect them from external attacks?
• What is the amount of data required to be maintained or restored to restore acceptable functionality?
• What is referred to as the plane that controls the entire infrastructure in a cloud environment?
• How many phases are there in the data lifecycle?
• Which technology should be included in the disaster recovery plan to prevent data loss?
• Which of the following is a countermeasure method implemented to address regulatory violations in cloud security?
• In which cloud service model is the customer only responsible for the data?
• What occurs during a guest escape in a cloud environment?
• Which of the following is not associated with Federated ID Systems?
• Which testing methodology runs against systems that can tune their focus of security?
• Which is a cloud service model category?
• What is lock-in in reference to cloud services?
• What type of risk is associated with sharing knowledge of a trade secret?
• Which of the following methods is used for implementing volume storage encryption in an IaaS environment?
• What role does incident response play in data security?
• Which of the following is not a feature of a secure KVM component?
• Data labels could include all the following, except?