ISC CCSP Practice Verified Answers - Pass Your Exams For Sure! [2021]
Valid Way To Pass ISC Cloud Security's CCSP Exam
NEW QUESTION 92
Which of the following would NOT be used to determine the classification of data?
Response:
- A. Future use
- B. PII
- C. Metadata
- D. Creator
Answer: A
NEW QUESTION 93
Which of the following components are part of what a CCSP should review when looking at contracting with a cloud service provider?
- A. Redundant uplink grafts
- B. The physical layout of the datacenter
- C. Use of subcontractors
- D. Background checks for the provider's personnel
Answer: C
Explanation:
The use of subcontractors can add risk to the supply chain and should be considered; trusting the provider's management of their vendors and suppliers (including subcontractors) is important to trusting the provider.
Conversely, the customer is not likely to be allowed to review the physical design of the datacenter (or, indeed, even know the exact location of the datacenter) or the personnel security specifics for the provider's staff.
"Redundant uplink grafts" is a nonsense term used as a distractor.
NEW QUESTION 94
Proper implementation of DLP solutions for successful function requires which of the following?
- A. Accurate data categorization
- B. Physical presence
- C. Physical access limitations
- D. USB connectivity
Answer: A
Explanation:
Explanation
DLP tools need to be aware of which information to monitor and which requires categorization (usually done upon data creation, by the data owners). DLPs can be implemented with or without physical access or presence. USB connectivity has nothing to do with DLP solutions.
NEW QUESTION 95
In a cloud environment, encryption should be used for all the following, except:
- A. Near-term storage of virtualized images
- B. Profile formatting
- C. Long-term storage of data
- D. Secure sessions/VPN
Answer: B
Explanation:
Explanation
All of these activities should incorporate encryption, except for profile formatting, which is a made-up term.
NEW QUESTION 96
Cloud systems are increasingly used for BCDR solutions for organizations.
What aspect of cloud computing makes their use for BCDR the most attractive?
- A. Measured service
- B. On-demand self-service
- C. Portability
- D. Broad network access
Answer: A
Explanation:
Business continuity and disaster recovery (BCDR) solutions largely sit idle until they are actually needed.
This traditionally has led to increased costs for an organization because physical hardware must be purchased and operational but is not used. By using a cloud system, an organization will only pay for systems when they are being used and only for the duration of use, thus eliminating the need for extra hardware and costs. Portability is the ability to easily move services among different cloud providers. Broad network access allows access to users and staff from anywhere and from different clients, and although this would be important for a BCDR situation, it is not the best answer in this case. On-demand self-service allows users to provision services automatically and when needed, and although this too would be important for BCDR situations, it is not the best answer because it does not address costs or the biggest benefits to an organization.
NEW QUESTION 97
Which process serves to prove the identity and credentials of a user requesting access to an application or data?
- A. Authorization
- B. Repudiation
- C. Authentication
- D. Identification
Answer: C
Explanation:
Authentication is the process of proving whether the identity presented by a user is true and valid.
This can be done through common mechanisms such as user ID and password combinations or with more secure methods such as multifactor authentication.
NEW QUESTION 98
Which of the following threat types can occur when baselines are not appropriately applied or unauthorized changes are made?
- A. Security misconfiguration
- B. Insecure direct object references
- C. Unvalidated redirects and forwards
- D. Sensitive data exposure
Answer: A
Explanation:
Security misconfigurations occur when applications and systems are not properly configured or maintained in a secure manner. This can be caused from a shortcoming in security baselines or configurations, unauthorized changes to system configurations, or a failure to patch and upgrade systems as the vendor releases security patches.
NEW QUESTION 99
Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?
- A. Share
- B. Use
- C. Create
- D. Store
Answer: C
Explanation:
Explanation
Any time data is created, modified, or imported, the classification needs to be evaluated and set from the earliest phase to ensure security is always properly maintained for the duration of its lifecycle.
NEW QUESTION 100
Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?
- A. Share
- B. Use
- C. Create
- D. Store
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Any time data is created, modified, or imported, the classification needs to be evaluated and set from the earliest phase to ensure security is always properly maintained for the duration of its lifecycle.
NEW QUESTION 101
Which ITIL component focuses on ensuring that system resources, processes, and personnel are properly allocated to meet SLA requirements?
- A. Problem management
- B. Continuity management
- C. Configuration management
- D. Availability management
Answer: D
Explanation:
Availability management is focused on making sure system resources, processes, personnel, and toolsets are properly allocated and secured to meet SLA requirements. Continuity management (or business continuity management) is focused on planning for the successful restoration of systems or services after an unexpected outage, incident, or disaster. Configuration management tracks and maintains detailed information about all IT components within an organization.
Problem management is focused on identifying and mitigating known problems and deficiencies before they occur.
NEW QUESTION 102
Which component of ITIL pertains to planning, coordinating, executing, and validating changes and rollouts to production environments?
- A. Release management
- B. Problem management
- C. Change management
- D. Availability management
Answer: A
Explanation:
Explanation
Release management involves planning, coordinating, executing, and validating changes and rollouts to the production environment. Change management is a higher-level component than release management and also involves stakeholder and management approval, rather than specifically focusing the actual release itself.
Availability management is focused on making sure system resources, processes, personnel, and toolsets are properly allocated and secured to meet SLA requirements. Problem management is focused on identifying and mitigating known problems and deficiencies before they occur.
NEW QUESTION 103
What is used for local, physical access to hardware within a data center?
- A. SSH
- B. RDP
- C. VPN
- D. KVM
Answer: D
Explanation:
Local, physical access in a data center is done via KVM (keyboard, video, mouse) switches.
NEW QUESTION 104
Which kind of SSAE audit report is a cloud customer most likely to receive from a cloud provider?
- A. SOC 1 Type 2
- B. SOC 3
- C. SOC 2 Type 2
- D. SOC 1 Type 1
Answer: B
Explanation:
Explanation
The SOC 3 is the least detailed, so the provider is not concerned about revealing it. The SOC 1 Types 1 and 2 are about financial reporting, and not relevant. The SOC 2 Type 2 is much more detailed and will most likely be kept closely held by the provider.
NEW QUESTION 105
Which aspect of archiving must be tested regularly for the duration of retention requirements?
- A. Availability
- B. Portability
- C. Recoverability
- D. Auditability
Answer: C
Explanation:
In order for any archiving system to be deemed useful and compliant, regular tests must be performed to ensure the data can still be recovered and accessible, should it ever be needed, for the duration of the retention requirements.
NEW QUESTION 106
As part of the auditing process, getting a report on the deviations between intended configurations and actual policy is often crucial for an organization.
What term pertains to the process of generating such a report?
- A. Gap analysis
- B. Deficiencies
- C. Findings
- D. Errors
Answer: A
Explanation:
Explanation/Reference:
Explanation:
The gap analysis determines if there are any differences between the actual configurations in use on systems and the policies that govern what the configurations are expected or mandated to be. The other terms provided are all similar to the correct answer ("findings" in particular is often used to articulate deviations in configurations), but gap analysis is the official term used.
NEW QUESTION 107
......
ISC CCSP Pre-Exam Practice Tests | PassLeader: https://www.passleader.top/ISC/CCSP-exam-braindumps.html
CCSP practice test questions, answers, explanations: https://drive.google.com/open?id=1pjRKfhiXqi8RHxgcL7MAllnoNZX-scQH