CCSP Exam Questions

Above and beyond general regulations for data privacy and protection, certain types of data are subjected to more rigorous regulations and oversight. Which of the following is not...

Which data sanitation method is also commonly referred to as "zeroing"?

What is the concept of isolating an application from the underlying operating system for testing purposes?

Which of the following could be used as a second component of multifactor authentication if a user has an RSA token?

Which of the following is NOT one of the official risk rating categories?

SOC Type 1 reports are considered "restricted use," in that they are intended only for limited audiences and purposes. Which of the following is NOT a population that would be appr...

Having a reservation in a cloud environment can ensure operations continue in the event of high utilization across the cloud. Which of the following would NOT be a capability cover...

What must SOAP rely on for security since it does not provide security as a built-in capability?

With a federated identity system, what does the identity provider send information to after a successful authentication?

Which of the following technologies is NOT commonly used for accessing systems and services in a cloud environment in a secure manner?

Which component of ITIL involves handling anything that can impact services for either internal or public users?

Which protocol, as a part of TLS, handles the actual secure communications and transmission of data?

Which of the following terms is NOT a commonly used category of risk acceptance?

Many activities within a cloud environment are performed via programmatic means, where complex and distributed operations are handled without the need to perform each step individu...

Being in a cloud environment, cloud customers lose a lot of insight and knowledge as to how their data is stored and their systems are deployed. Which concept from the ISO/IEC clou...

Your IT steering committee has, at a high level, approved your project to begin using cloud services. However, the committee is concerned with getting locked into a single cloud pr...

Which of the following provides assurance, to a predetermined acceptable level of certainty, that an entity is indeed who they claim to be?

Whereas a contract articulates overall priorities and requirements for a business relationship, which artifact enumerates specific compliance requirements, metrics, and response ti...

When an organization is considering the use of cloud services for BCDR planning and solutions, which of the following cloud concepts would be the most important?

What masking strategy involves the replacing of sensitive data at the time it is accessed and used as it flows between the data and application layers of a service?

Which of the following would be considered an example of insufficient due diligence leading to security or operational problems when moving to a cloud?

Which aspect of cloud computing serves as the biggest challenge to using DLP to protect data at rest?

What category of PII data can carry potential fines or even criminal charges for its improper use or disclosure?

A variety of security systems can be integrated within a network--some that just monitor for threats and issue alerts, and others that take action based on signatures, behavior, an...

Upon completing a risk analysis, a company has four different approaches to addressing risk. Which approach it takes will be based on costs, available options, and adherence to any...

Which of the following is NOT a component of access control?

What concept does the A represent within the DREAD model?

With an application hosted in a cloud environment, who could be the recipient of an eDiscovery order?

Which ITIL component focuses on ensuring that system resources, processes, and personnel are properly allocated to meet SLA requirements?

Which ITIL component is an ongoing, iterative process of tracking all deployed and configured resources that an organization uses and depends on, whether they are hosted in a tradi...

When beginning an audit, both the system owner and the auditors must agree on various aspects of the final audit report. Which of the following would NOT be something that is prede...

What concept does the D represent within the STRIDE threat model?

Which of the following is the concept of segregating information or processes, within the same system or application, for security reasons?

Which cloud service category most commonly uses client-side key management systems?

Apart from using encryption at the file system level, what technology is the most widely used to protect data stored in an object storage system?

Which of the following types of data would fall under data rights management (DRM) rather than information rights management (IRM)?

Different security testing methodologies offer different strategies and approaches to testing systems, requiring security personnel to determine the best type to use for their spec...

You need to gain approval to begin moving your company's data and systems into a cloud environment. However, your CEO has mandated the ability to easily remove your IT assets from...

What does static application security testing (SAST) offer as a tool to the testers that makes it unique compared to other common security testing methodologies?

A main objective for an organization when utilizing cloud services is to avoid vendor lock-in so as to ensure flexibility and maintain independence. Which core concept of cloud com...

Which of the following areas of responsibility always falls completely under the purview of the cloud provider, regardless of which cloud service category is used?

What type of masking would you employ to produce a separate data set for testing purposes based on production data without any sensitive information?

Which aspect of data poses the biggest challenge to using automated tools for data discovery and programmatic data classification?

When an organization is considering a cloud environment for hosting BCDR solutions, which of the following would be the greatest concern?

Just like the risk management process, the BCDR planning process has a defined sequence of steps and processes to follow to ensure the production of a comprehensive and successful...

What type of solution is at the core of virtually all directory services?

The different cloud service models have varying levels of responsibilities for functions and operations depending with the model's level of service. In which of the following model...

Which component of ITIL involves the creation of an RFC ticket and obtaining official approvals for it?

Which of the following are attributes of cloud computing?

In a cloud environment, encryption should be used for all the following, except: