ISC CCSP Test Engine Dumps Training With 827 Questions
CCSP Questions Pass on Your First Attempt Dumps for ISC Cloud Security Certified
NEW QUESTION # 60
Database activity monitoring (DAM) can be:
- A. Used in the place of encryption
- B. Host-based or network-based
- C. Used in place of data masking
- D. Server-based or client-based
Answer: B
Explanation:
We don't use DAM in place of encryption or masking; DAM augments these options without replacing them. We don't usually think of the database interaction as client-server, so A is the best answer.
NEW QUESTION # 61
Which audit type has been largely replaced by newer approaches since 2011?
- A. SAS-70
- B. SOC Type 1
- C. SSAE-16
- D. SOC Type 2
Answer: A
Explanation:
Explanation/Reference:
Explanation:
SAS-70 reports were replaced in 2011 with the SSAE-16 reports throughout the industry.
NEW QUESTION # 62
BCDR strategies typically do not involve the entire operations of an organization, but only those deemed critical to their business.
Which concept pertains to the amount of data and services needed to reach the predetermined level of operations?
- A. RSL
- B. SRE
- C. RPO
- D. RTO
Answer: C
Explanation:
The recovery point objective (RPO) sets and defines the amount of data an organization must have available or accessible to reach the predetermined level of operations necessary during a BCDR situation.
The recovery time objective (RTO) measures the amount of time necessary to recover operations to meet the BCDR plan. The recovery service level (RSL) measures the percentage of operations that would be recovered during a BCDR situation. SRE is provided as an erroneous response.
NEW QUESTION # 63
All of the following methods can be used to attenuate the harm caused by escalation of privilege except:
Response:
- A. The use of automated analysis tools such as SIM, SIEM, and SEM solutions
- B. Periodic and effective use of cryptographic sanitization tools
- C. Analysis and review of all log data by trained, skilled personnel on a frequent basis
- D. Extensive access control and authentication tools and techniques
Answer: B
NEW QUESTION # 64
Which of the following would NOT be considered part of resource pooling with an Infrastructure as a Service implementation?
- A. Storage
- B. CPU
- C. Mamory
- D. Application
Answer: D
Explanation:
Explanation
Infrastructure as a Service pools the compute resources for platforms and applications to build upon, including CPU, memory, and storage. Applications are not part of an IaaS offering from the cloud provider.
NEW QUESTION # 65
Which of the following is NOT one of five principles of SOC Type 2 audits?
- A. Security
- B. Privacy
- C. Processing integrity
- D. Financial
Answer: D
Explanation:
Explanation
The SOC Type 2 audits include five principles: security, privacy, processing integrity, availability, and confidentiality.
NEW QUESTION # 66
Which of the following threat types involves an application that does not validate authorization for portions of itself beyond when the user first enters it?
- A. Cross-site scripting
- B. Injection
- C. Cross-site request forgery
- D. Missing function-level access control
Answer: D
Explanation:
It is imperative that applications do checks when each function or portion of the application is accessed to ensure that the user is properly authorized. Without continual checks each time a function is accessed, an attacker could forge requests to access portions of the application where authorization has not been granted.
An injection attack is where a malicious actor sends commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries. Cross-site scripting occurs when an attacker is able to send untrusted data to a user's browser without going through validation processes. Cross-site request forgery occurs when an attack forces an authenticated user to send forged requests to an application running under their own access and credentials.
NEW QUESTION # 67
You are the security manager for a company that is considering cloud migration to an IaaS environment. You are assisting your company's IT architects in constructing the environment.
Which of the following options do you recommend?
- A. Unrestricted public access
- B. Enhanced productivity without encryption
- C. Use of a Type I hypervisor
- D. Use of a Type II hypervisor
Answer: C
NEW QUESTION # 68
Which of the cloud cross-cutting aspects relates to the ability for a cloud customer to easily remove their applications and data from a cloud environment?
- A. Interoperability
- B. Availability
- C. Reversibility
- D. Portability
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Reversibility is the ability for a cloud customer to easily remove their applications or data from a cloud environment, as well as to ensure that all traces of their applications or data have been securely removed per a predefined agreement with the cloud provider.
NEW QUESTION # 69
What must be secured on physical hardware to prevent unauthorized access to systems?
- A. SSH
- B. BIOS
- C. RDP
- D. ALOM
Answer: B
Explanation:
BIOS is the firmware that governs the physical initiation and boot up of a piece of hardware. If it is compromised, an attacker could have access to hosted systems and make configurations changes to expose or disable some security elements on the system.
NEW QUESTION # 70
What concept does the A represent within the DREAD model?
- A. Affinity
- B. Affected users
- C. Authentication
- D. Authorization
Answer: B
Explanation:
Explanation
The concept of affected users measures the percentage of users who would be impacted by a successful exploit. Scoring ranges from 0, which would impact no users, to 10, which would impact all users. None of the other options provided is the correct term.
NEW QUESTION # 71
Which United States law is focused on accounting and financial practices of organizations?
- A. HIPAA
- B. Safe Harbor
- C. SOX
- D. GLBA
Answer: C
Explanation:
Explanation/Reference:
Explanation:
The Sarbanes-Oxley (SOX) Act is not an act that pertains to privacy or IT security directly, but rather regulates accounting and financial practices used by organizations. It was passed to protect stakeholders and shareholders from improper practices and errors, and it sets forth rules for compliance, regulated and enforced by the Securities and Exchange Commission (SEC). The main influence on IT systems and operations is the requirements it sets for data retention, specifically in regard to what types of records must be preserved and for how long.
NEW QUESTION # 72
Which of the following threat types involves an application developer leaving references to internal information and configurations in code that is exposed to the client?
- A. Insecure direct object references
- B. Unvalidated redirect and forwards
- C. Security misconfiguration
- D. Sensitive data exposure
Answer: A
Explanation:
Explanation/Reference:
Explanation:
An insecure direct object reference occurs when a developer has in their code a reference to something on the application side, such as a database key, the directory structure of the application, configuration information about the hosting system, or any other information that pertains to the workings of the application that should not be exposed to users or the network. Unvalidated redirects and forwards occur when an application has functions to forward users to other sites, and these functions are not properly secured to validate the data and redirect requests, allowing spoofing for malware of phishing attacks.
Sensitive data exposure occurs when an application does not use sufficient encryption and other security controls to protect sensitive application data. Security misconfigurations occur when applications and systems are not properly configured or maintained in a secure manner.
NEW QUESTION # 73
The tasks performed by the hypervisor in the virtual environment can most be likened to the tasks of the
________ in the legacy environment.
Response:
- A. OS
- B. Central processing unit (CPU)
- C. Security team
- D. PGP
Answer: B
NEW QUESTION # 74
Which of the following provides assurance, to a predetermined acceptable level of certainty, that an entity is indeed who they claim to be?
- A. Authorization
- B. Proofing
- C. Identification
- D. Authentication
Answer: D
Explanation:
Explanation
Authentication goes a step further than identification by providing a means for proving an entity's identification. Authentication is most commonly done through mechanisms such as passwords. Identification involves ascertaining who the entity is, but without a means of proving it, such as a name or user ID.
Authorization occurs after authentication and sets access permissions and other privileges within a system or application for the user. Proofing is not a term that is relevant to the question.
NEW QUESTION # 75
Which of the following methods is often used to obscure data from production systems for use in test or development environments?
- A. Masking
- B. Classification
- C. Encryption
- D. Tokenization
Answer: A
NEW QUESTION # 76
According to OWASP recommendations, active software security testing should include all of the following except ____________.
Response:
- A. Input validation testing
- B. Testing for error handling
- C. Session initiation testing
- D. Testing for weak cryptography
Answer: C
NEW QUESTION # 77
Which of the following is not typically included in the list of critical assets specified for continuity during BCDR contingency operations?
Response:
- A. Data
- B. Personnel
- C. Systems
- D. Cash
Answer: D
NEW QUESTION # 78
In addition to battery backup, a UPS can offer which capability?
- A. Communication redundancy
- B. Confidentiality
- C. Breach alert
- D. Line conditioning
Answer: D
Explanation:
Explanation
A UPS can provide line conditioning, adjusting power so that it is optimized for the devices it serves and smoothing any power fluctuations; it does not offer any of the other listed functions.
NEW QUESTION # 79
Why does a Type 2 hypervisor typically offer less security control than a Type 1 hypervisor?
- A. A Type 2 hypervisor is open source, so attackers can more easily find exploitable vulnerabilities with that access.
- B. A Type 2 hypervisor runs on top of another operating system and is dependent on the security of the OS for its own security.
- C. A Type 2 hypervisor is always exposed to the public Internet for federated identity access.
- D. A Type 2 hypervisor allows users to directly perform some functions with their own access.
Answer: B
Explanation:
Explanation
A Type 2 hypervisor differs from a Type 1 hypervisor in that it runs on top of another operating system rather than directly tied into the underlying hardware of the virtual host servers. With this type of implementation, additional security and architecture concerns come into play because the interaction between the operating system and the hypervisor becomes a critical link. The hypervisor no longer has direct interaction and control over the underlying hardware, which means that some performance will be lost due to the operating system in the middle needing its own resources, patching requirements, and operational oversight.
NEW QUESTION # 80
BCDR strategies typically do not involve the entire operations of an organization, but only those deemed critical to their business.
Which concept pertains to the amount of data and services needed to reach the predetermined level of operations?
- A. RSL
- B. SRE
- C. RPO
- D. RTO
Answer: C
Explanation:
The recovery point objective (RPO) sets and defines the amount of data an organization must have available or accessible to reach the predetermined level of operations necessary during a BCDR situation. The recovery time objective (RTO) measures the amount of time necessary to recover operations to meet the BCDR plan.
The recovery service level (RSL) measures the percentage of operations that would be recovered during a BCDR situation. SRE is provided as an erroneous response.
NEW QUESTION # 81
Which of the following methods of addressing risk is most associated with insurance?
- A. Mitigation
- B. Avoidance
- C. Acceptance
- D. Transference
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Avoidance halts the business process, mitigation entails using controls to reduce risk, acceptance involves taking on the risk, and transference usually involves insurance.
NEW QUESTION # 82
......
CCSP Practice Test Pdf Exam Material: https://freedownload.prep4sures.top/CCSP-real-sheets.html