CCSP Exam Questions

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application developme...

Which kind of SSAE report comes with a seal of approval from a certified auditor? Response:

Cloud vendors are held to contractual obligations with specified metrics by: Response:

Virtual machine (VM) configuration management (CM) tools should probably include ____________. Response:

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience...

Typically, SSDs are ____________. Response:

Why might an organization choose to comply with the ISO 27001 standard? Response:

Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like: Response:

When a customer performs a penetration test in the cloud, why isn't the test an optimum simu- lation of attack conditions? Response:

When using an Infrastructure as a Service (IaaS) solution, what is the capability provided to the customer? Response:

Which type of web application monitoring most closely measures actual activity? Response:

In which of the following situations does the data owner have to administer the OS? Response:

FM-200 has all the following properties except ___________. Response:

Which network protocol is essential for allowing automation and orchestration within a cloud environment? Response:

With data in transit, which of the following will be the MOST major concern in order for a DLP solution to properly work? Response:

Which of the following methods for the safe disposal of electronic records can always be used in a cloud environment? Response:

Digital rights management (DRM) tools can be combined with ___________, to enhance security capabilities. Response:

Managed cloud services exist because the service is less expensive for each customer than creating the same services for themselves in a legacy environment. Using a managed service...

In general, a cloud BCDR solution will be _________ than a physical solution. Response:

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application developme...

In attempting to provide a layered defense, the security practitioner should convince senior management to include security controls of which type? Response:

Which of the following might make crypto-shredding difficult or useless? Response:

The Open Web Application Security Project (OWASP) Top Ten is a list of web application security threats that is composed by a member-driven OWASP committee of application developme...

Which characteristic of automated patching makes it attractive? Response:

In a data retention policy, what is perhaps the most crucial element? Response:

Which of the following is a risk that stems from a virtualized environment? Response:

Fiber-optic lines are considered part of layer __________ of the OSI model. Response:

What is the main reason virtualization is used in the cloud? Response:

What type of redundancy can we expect to find in a datacenter of any tier? Response:

When a user accesses a system, what process determines the roles and privileges that user is granted within the application? Response:

Which of the following data-sanitation approaches are always available within a cloud environment? Response:

Which type of cloud-based storage is IRM typically associated with? Response:

Which technology is most associated with tunneling? Response:

Which of the following is not included in the OWASP Top Ten web application security threats? Response:

Which of the following is perhaps the best method for reducing the risk of a specific application not delivering the proper level of functionality and performance when it is moved...

You work for a company that operates a production environment in the cloud. Another company using the same cloud provider is under investigation by law enforcement for racketeering...

All of these are reasons an organization may want to consider cloud migration except: Response:

Your company has just been served with an eDiscovery order to collect event data and other pertinent information from your application during a specific period of time, to be used...

Which of the following is not a component of the of the STRIDE model? Response:

Which of the following is NOT one of the security domains presented within the Cloud Controls Matrix? Response:

You are the security manager for a small retail business involved mainly in direct e-commerce transactions with individual customers (members of the public). The bulk of your marke...

You are developing a new process for data discovery for your organization and are charged with ensuring that all applicable data is included. Which of the following is NOT one of t...

What is the term used to describe loss of access to data because the cloud provider has ceased operation? Response:

Which ISO/IEC standards set documents the cloud definitions for staffing and official roles? Response:

The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. A cloud customer that does not perform s...

A loosely coupled storage cluster will have performance and capacity limitations based on the ____________. Response:

Digital rights management (DRM) solutions (sometimes referred to as information rights management, or IRM) often protect unauthorized distribution of what type of intellectual prop...

There are two reasons to conduct a test of the organization's recovery from backup in an environment other than the primary production environment. Which of the following is one of...

You are the security manager for a small surgical center. Your organization is reviewing upgrade options for its current, on-premises data center. In order to best meet your needs,...

Proper ________ need to be assigned to each data classification/category. Response: