Western Governors University (WGU) C838 Managing Cloud Security (CCSP) Practice Exam – All Questions

Browse all practice questions for the Western Governors University (WGU) C838 Managing Cloud Security (CCSP) Practice Exam. Search by topic, open any question and review its full explanation, then test yourself in the practice quiz.

Start practice test Flash cards

Sealing articles to prevent tampering: a key element in the chain of custodyWhat is a critical element in the process of chain of custody?Understanding what Cloud Access Security Brokers cover and what falls outsideCloud Access Security Brokers (CASBs) might offer all the following services except:What a web application firewall actually does and why it matters for web securityWhat is the main function of a web application firewall?What CCSPs should know about contract terms with CSPs: scope of processing and subcontractor useWhich of the following are contractual components that the CCSP should review and understand fully when contracting with a CSP?Why in PaaS developers maintain only their applications while the provider handles the restIn which cloud service model is the customer required to maintain and update only the applications?

More practice questions

These questions are part of the practice quiz. Start practicing

Which of the following is a type of testing that analyzes application source code for vulnerabilities?
What should organizations consider implementing to ensure compliance with data privacy regulations?
Which concept refers to the acceptable level of uncertainty in achieving a desired outcome?
What is the statement about auditing being used only to discover security holes?
What is the definition of portability in cloud services?
Which backup plan distributes risks by utilizing the cloud provider's regular operations while the customer opts for contingency operations?
Which action enhances cloud security application deployment through standards such as ISO/IEC 27034 for the development, acquisition, and configuration of software systems?
Which term refers to the software technology that allows application software to operate independently from the underlying operating system?
What is a possible negative outcome of a poorly negotiated cloud service contract?
Which of the following is NOT a component of a cloud security framework?
Which of the following best represents the definition of REST?
What does IRM stand for in relation to data protection?
Which of the following is NOT a phase in the Risk Management Framework?
What tool is used to regularly review and inspect the data owned by an organization?
In an Infrastructure as a Service (IaaS) model, who is responsible for software installation?
Which data protection mechanism helps ensure that data is accessible even in the event of a system failure?
What is the purpose of a dry run in security testing?
What benefit does using VPN technology provide in cloud communications?
Which of the following represents the amount of information that can be recovered and restored in the event of a disaster?
Which document typically outlines the security policies and procedures to be followed in a cloud environment?
Which type of storage allows significant levels of description and enhances indexing capabilities?
Which protocol allows for communication over multiple protocols, including HTTP and FTP?
Which of the following will help achieve redundancy in virtual switches?
Who is typically responsible for the implementation, monitoring, and maintenance of the cloud within an organization?
Maintenance mode requires all of these actions except:
How many layers of encryption are typically available for a database?
What technique replaces original information with asterisks or Xs to conceal data?
Which of the following processes involves migration of an application with minimal code changes?
What is the next step in the entitlement process after translating business and security requirements into rules?
What defines the level of risk that an organization finds acceptable?
Which of the following is not a feature of SAST?
Which of the following is the science of hiding information to protect sensitive information and communications from unauthorized access?
Which of the following best describes Digital Rights Management (DRM)?
Which regulation focuses on securing data for publicly traded corporations?
What is the primary role of a cloud service auditor?
Which framework provides guidelines for cloud security and risk management?
Which agency is responsible for producing guidelines on cloud computing benefits, risks, and information security?
What technique replaces data with random characters while preserving string length and character set?
In which phase does an application enter after being implemented according to software development lifecycle principles?
What is a third-party entity that offers independent identity and access management services to CSPs and cloud customers?
What type of firewall protects application servers from HTTP traffic?
SOX was enacted because of which of the following?
Which vulnerability should be kept in mind for PaaS implementations primarily used for software development?
What does risk acceptance indicate in a business context?
Which countermeasure mitigates the risk of a rogue cloud administrator?
What is Apache CloudStack known for in cloud computing?
What is the term for the process of gathering evidence in a cloud environment?
Which term describes the management of risks associated with storing and processing data in the cloud?
Which data retention solution should be applied to a file in order to reduce the data footprint by deleting fixed content and duplicate data?
Which strategy involves shifting risk to another party?
Which risk is associated with malicious and accidental dangers to a cloud infrastructure?
Multifactor authentication requires two of the following except:
Which of the following is not a way to manage risk?
Which of the following has not been attributed as the cause of lost capabilities due to DoS?
What is the term for convoluting code to the point it is not easily decipherable even if obtained?
What is the primary benefit of cloud computing audit processes?
Which group is legally bound by the general data protection regulation (GDPR)?
Which measure can organizations take to enhance their cloud security related to personnel?
What is referred to as the abstraction layer that allows code to run without dependence on the underlying hardware?
In which scenario is a CSP considered the provider of alternative facilities?
Which jurisdictional data protection includes dealing with the international transfer of data?
What characterizes a private cloud?
Which data retention policy controls how long HIPAA data can be archived?
What is the focus of business QoS in terms of measurement?
A honeypot should contain what type of data?
Which of the following is not appropriate to include in an SLA?
Which of the following is a consequence of malware?
What is one of the goals of implementing a Data Loss Prevention (DLP) solution?
Which of the following is NOT a toolset or technology commonly used to secure data?
Which of the following techniques for ensuring cloud datacenter storage resiliency uses parity bits and disk striping?
What is the primary purpose of using a honeypot in cloud security?
Which of the following is not an example of an essential internal stakeholder?
Which law relates to personal matters such as marriage and divorce?
Which of the following components is not associated with encryption deployments?
Applications with known vulnerabilities cannot be mitigated and should never be used.
What does a cloud developer focus on?
Which of the following laws resulted from a lack of independence in audit practices?
What is one main purpose of strong authentication mechanisms in cloud security?
Which of the following best describes a sandbox?
Which design principle of secure cloud computing involves deploying cloud service provider resources to maximize availability in the event of a failure?
Where do bare metal hypervisors run?
This type of storage typically uses APIs or network requests. What is it called?
What is one major misconception regarding confidentiality and integrity?
Which control should a customer prioritize when managing data in a cloud environment?
What is a defining characteristic of a private cloud configuration?
Which environmental consideration should be addressed when planning the design of a data center?
Where should cryptographic keys for encrypted data stored in the cloud be kept?
Which testing method is useful in identifying vulnerabilities such as cross-site scripting (XSS) and SQL injection?
What does the Organizational Normative Framework (ONF) provide in terms of application security?
What is the benefit of volume encryption compared to full disk encryption?
What does the Application Normative Framework (ANF) consist of?
What is the primary benefit of using a threat model like STRIDE?
Which discovery method focuses on collecting all matching data elements for a specified purpose?
Which of the following is a primary focus of Data Loss Prevention (DLP) strategies?
What is a key characteristic of a honeypot?
What is the significance of having OSs included in IaaS?
Hardening the operating system refers to all of the following except?
Which service model allows users to rent IT infrastructure such as servers and storage?
What type of hypervisor runs directly on the host machine?
What does object storage provide in addition to data storage?
What determines the effectiveness of controls in an audit?
What term describes the advanced data analysis enabled by cloud usage, often referred to as "big data"?
If a service or solution does not meet all of the specified key characteristics, it is said to be not true cloud computing. Which of the following is a validated cloud computing characteristic?
What does private cloud storage refer to?
Under what principle does the need for continuous monitoring in cloud security fall?
What is a cloud storage architecture that manages the data in caches of copied content close to locations of high demand?
What is a key feature of multitenancy in cloud services?
What does cloud provisioning primarily involve?
What type of storage holds additional metadata accessible through APIs and potentially a web UI?
Which of the following Acts consists of the given sections: -The financial privacy -The safeguards rule -The pretexting provisions?
Which of the following is not associated with Federated ID Systems?
What is the main objective of Dynamic Application Security Testing (DAST)?
To protect data on user devices in a BYOD environment, which requirement is not advisable?
What does the "S" in the STRIDE acronym represent?
What principle does nonrepudiation support in communication systems?
To prevent unauthorized access, what principle should be applied to user access in cloud environments?
Under which act does the requirement for companies to maintain accurate financial records fall?
Who among the following has the privilege to access the management plane to remotely manage the hosts in a cloud environment?
What is defined as a collection of distributed resources responsible for storing and managing data online in the cloud?
What is the main function of Virtualization Technologies in cloud computing?
SOC 2 reports are most useful for which of the following?
Which of the following applies to the Stored Communications Act (SCA)?
What should be the primary focus of datacenter redundancy and contingency planning?
Which technology allows a user to operate encrypted data without the need of decrypting it?
What does risk assessment involve in cloud security?
To which of the following phases of the data lifecycle is the process function mapped?
What are the five key principles of ISO/IEC 27018?
Which term describes the goal of minimizing data loss from an unplanned event?
When does an XSS flaw occur?
Which cloud data storage architecture allows sensitive data to be replaced with unique identification symbols that retain all the essential information without compromising security?
In the cloud motif, who is typically considered the data owner?
What practice helps organizations maintain control over their data as it moves through different environments?
Generator fuel storage for a cloud datacenter should last for how long, at a minimum?
Which law would control matters involving violations of statutes at the federal level?
Which of the following is a characteristic of a public cloud?
Which of the following is a risk response strategy that focuses on paying to handle potential losses?
Which of the following activities takes place in a secure operations phase of the software development lifecycle?
Which characteristic of automated patching makes it attractive?
Which of the following concepts refers to consuming IT resources as a service rather than managing them directly?
What does Title II of the Electronic Communications Privacy Act of 1986 restrict?
Which feature allows for increased flexibility in utilizing various cloud services?
What type of monitoring can Database Activity Monitoring (DAM) perform?
Which legal concept refers to compensating individuals harmed by negligent actions?
Which BC/DR backup plan allows the customer to determine when normal operations cease and backup is initiated?
Which section of the CSA (Cloud Security Alliance) provides the ability to quantifiably measure return on investment (ROI) for the efficient use of resources?
Identity and access management (IAM) is a security discipline that ensures which of the following?
In which phase of digital forensics is the collected data forensically processed using a combination of manual and automated methods?
The cloud deployment model that features ownership by a cloud provider, with services offered to anyone who wants to subscribe, is known as:
Which intelligence agency's website was attacked by LulzSec on June 15, 2011?
What is the purpose of data encryption in cloud security?
In which cloud deployment model does platform security come under the enterprise's responsibility?
What is the primary purpose of a Content Delivery Network (CDN)?
In a federated system, which two components serve as its core?
The BIA can provide information about all except which of the following?
Which cloud service model allows the least amount of control for customers?
Consider the following example: "An artist gives an art gallery permission to represent the art of some other artist but he is not allowed to reproduce his work." Which law is applied in the given example that restricts the artist?
Which of the following is the least challenging with regard to eDiscovery in the cloud?
Which SOC 2 report would be run to determine if security controls are suitable based on design and intent?
Which tool can reduce confusion and misunderstanding during a BC/DR response?
Which of the following describes application generated or imported data?
Which factor exemplifies adequate cloud contract governance?
Which technology creates a secure tunnel across untrusted networks?
Which cloud service model includes operating systems along with infrastructure?
Which of the following is a common security concern in multi-tenant cloud environments?
Which of the following SOC report subtypes represents a point in time?
What aspect does a contract between cloud service providers and customers typically cover?
In SaaS, what does the customer have control over?
Which risk is related to interception of data in transit?
Which of the following is the best advantage of external audits?
Risk appetite for an organization is primarily determined by which of the following?
Which of the following describes an internal network with remote access capabilities?
What does the Personal Information Protection and Electronic Documents Act (PIPEDA) comply with?
Which specific risk does NOT uniquely affect the public cloud due to multitenancy?
Which of the following factors contributes to the effectiveness of automated patching?
Which is not a principle of GAAP?
Which challenges are associated with key management?
What is the goal of business continuity management?
Which type of access control restricts access based on user roles within an organization?
Which of the following best describes a "hybrid cloud" deployment?
What is the term for storage in the cloud allocated as an attached drive to a virtual machine?
Which cloud service model provides the least amount of configuration options?
What type of storage allows customers to access parts of a hierarchy based on their assignments?
An attacker establishes themselves on a system in such a way to enable the stealing of data over time. What kind of attack is this?
What is the main objective of applying cryptography to the data in a cloud?
What process involves destroying the encryption keys used to secure data?
Which of the following is a primary concern of data security in a cloud environment?
Which standard addresses practices related to acquisition of forensic artifacts and can be directly applied to a cloud environment?
What does the doctrine of the proper law refer to?
Which ISAE Report is run over a pre-defined period of time usually six months?
Which type of cloud allows for better adaptability for IT infrastructures?
Why is the concept of risk tolerance important in organizations?
Which of the following is part of the STRIDE model?
Which of the following refers to the permitted actions within an organization's data security framework?
A localized incident or disaster can be addressed in a cost-effective manner by using which of the following?
What does notice inform an individual about concerning their personal information?
Which cloud deployment model is operated for a single organization?
What type of policy helps customers seek financial restitution for damages caused by provider negligence?
What is one benefit of using a cloud service in an organization?
Which of the following is NOT a characteristic of Federated Identity Management?
What kind of data does the Graham-Leach-Bliley Act (GLBA) aim to protect?
What term describes the ease of moving information from one cloud provider to another or back to an on-premises environment?
What does the guide provided by ISO/IEC 27041:2015 focus on?
Which platform is an open source cloud computing and IaaS solution for private and hybrid clouds?
All of the following regions have at least one country with an overarching, federal privacy law protecting personal data of its citizens, except?
Which metric is crucial for assessing if a cloud provider meets contractual obligations?
Which cloud service model is most beneficial for software development operations (DevOps)?
In a cloud environment, who ensures that various storage types and mechanisms meet and conform to the relevant SLAs?
When the partnership is aborted, which policy should be clearly documented and communicated to terminate the partner's access to cloud-based resources?
When considering plans for data archiving, which factor is generally NOT important?
Which of the following best describes "sprawl" in a cloud environment?
In which cloud service model is the customer only responsible for the data?
What is the key distinction between contractual and regulated PII?
What approach is used to systematically manage all risks to an enterprise?
Which type of security control is primarily focused on detecting unauthorized access attempts?
In which service model allows users to install all software on vendor-provided hardware?
Which cloud deployment model exclusively allows control over hardware resources?
How many phases are there in the data lifecycle?
What kind of architecture does a hybrid cloud storage solution utilize?
All of these technologies have made cloud service viable except:
What security approach combines various technologies to protect the same asset?
Which aspect of object-based storage aids in the categorization of stored information?
The Brewer-Nash security model is also known as which of the following?
What is used to dynamically allocate the cloud resources to maximize their use?
When using transparent encryption of a database, where does the encryption engine reside?
Which of the following cloud characteristics explains that a cloud provides services to serve multiple clients according to their priority?
What is the process of taking actions to reduce the impact of risks in a system?
Which method is commonly used for preventing unauthorized access to cloud-based resources?
In which type of cloud-specific risk can a malicious user affect the entire cloud infrastructure?
What is strongly encouraged for managing access of the directory administrators?
Which phase of the software development life cycle includes writing application code?
Which of the following allows for agentless retrieval of the guest OS state, and is used for malware analysis, memory forensics, and process monitoring?
Which hypervisor type is typically tied to the host operating system?
Which of the following protocols provides encryption using cryptography for the data in transit?
Which security threat occurs when a developer leaves an unauthorized access interface within an application after release?
What does it mean when unused ports are closed in a datacenter?
What is the objective of Software-Defined Networking (SDN)?
Which term does NOT describe the practice of obscuring original raw data?
What is the purpose of a Business Impact Analysis (BIA)?
This device is used to offload processing of XML from the application:
In which phase of the Cloud SDLC do we focus on identifying business needs like accounting or CRM?
Which of the following supplemental security devices implements the DLP (data loss prevention) security control?
What is the purpose of a honeypot in cloud security?
Which of the following best defines risk?
What is the amount of data required to be maintained or restored to restore acceptable functionality?
Which type of SSAE audit report is a cloud customer most likely to receive?
Which of the following best describes a Type 1 SOC report?
Which of the following is a part of the building blocks of a cloud computing system?
In a multi-tenant environment, what is a critical risk that can arise from shared resources?
Who retains final ownership for granting data access and permissions in a shared responsibility model?
Which of the following technologies is used to ensure that secure API (Application Programming Interface) access?
Which type of privilege escalation is targeted by attacks aiming to gain unauthorized access rights?
What is the primary benefit of conducting a full test in BC/DR practices?
Which of the following practices for secure server configuration uses RBAC (Role-Based Access Control) to limit user access to a host?
What does malware typically cause in a cloud environment?
Which process is important for securing host servers within a cloud environment?
Which penalty is imposed for privacy violations under the general data protection regulation (GDPR)?
Which component is crucial for ensuring cloud service availability during peak usage times?
Which term describes the ability to quickly allocate resources in cloud computing?
What are the five Trust Services principles?
What is the main function of a Cloud Backup Service Provider?
Which aspect is crucial for successfully managing stakeholder identification?
Which of the following are considered to be the building blocks of cloud computing?
Tokenization requires two distinct ______________.
Which agreement is negotiated between internal business units within an organization?
Which interoperable authentication protocol is based on the OAuth 2 specification?
Which of the following is tier IV for data center design according to "Data Center Site Infrastructure Tier Standard: Topology"?
What functions does the CCSP perform to obtain assurance and conduct auditing on the VMs and hypervisor?
What often refers to a suite of services that back up and store data remotely?
Which of the following is a compute parameter of a cloud server?
What describes a cloud provider who manages a user's system but is not under user control?
Which is not a step in the BCDR continual process?
Which of the following are storage types used with an IaaS solution?
Which term refers to the key structure that includes management plane components which are network-enabled and remotely accessible in cloud computing?
Which of the following security standards focuses on the protection of information assets and addresses the relevant risks by looking to the ISMS (Information Security Management System)?
What term refers to programs running on the same devices used by other customers simultaneously?
Which of the following refers to a strategy to protect against potential losses?
What should configuration management always be tied to?
Which type of hypervisor is most closely associated with hardware management control?
Which model allows customers to choose and manage their software and operating systems?
What type of data is referred to as electronic protected health information (ePHI)?
What is the term for a report that contains no actual data about security controls and is referred to as the "seal of approval"?
Which of the following methods focuses on the security capabilities of internal IT and cloud providers?
Which controls does the STAR program rely on for cloud provider assessments?
Which statement is true about the chain of evidence?
The process of hardening a device should include all of the following, except:
What does a comprehensive asset inventory typically include?
All the following are ways of addressing risk, except:
What technology helps improve bandwidth by acting as a form of data caching at high demand locations?
Which cloud service model is responsible for the physical security of the facility and systems?
Which type of law involves conflicts between individuals and the government?
We use which of the following to determine the critical paths, processes, and assets of an organization?
What model provides complete infrastructure services and allows customers to install software on provisioned servers?
What is cloud portability?
What are the objectives of release and deployment management?
What does NIST SP 800-37 provide guidance on?
Under the NIS directive, who must a CSP notify of an incident affecting the continuity of essential services?
Which tool can help in isolating and analyzing attacks by luring potential attackers?
Which of the following are not associated with HIPAA controls?
What type of traffic does a WAF typically parse?
Loosely coupled clusters provide what main advantage over tightly coupled clusters?
How often should the CMB meet?
What types of threats are associated with a private cloud?
In a Platform as a Service (PaaS) model, who is responsible for updates and administration of the operating system?
Which issue can be detected with static application security testing (SAST)?
What legislation is enforced by the Securities Exchange Commission (SEC)?
Which cloud deployment model enhances cloud bursting that allows its users to utilize public cloud resources when the workload of private cloud reaches maximum capacity?
DLP can be combined with what other security technology to enhance data controls?
Which step of the BCDR Continual Process uses the RPO and RTO to determine what is needed in BCDR planning?
Which process involves the use of electronic data as evidence in a civil or criminal legal case?
When does the EU Data Protection Directive (Directive 95/46/EC) apply to data processed?
Which encryption technique connects the instance to the encryption instance responsible for all crypto operations?
True or False: Data classification dictates the controls necessary to protect the data.
What is the role of a third party in Desktop as a Service (DaaS)?
Which method helps maintain a secure environment by connecting with a cloud service provider's compliance policies?
What type of attacks can be classified as external threats?
This system is provided by the CSP, but controlled and even hosted by the customer:
What is the purpose of using SSO in security contexts?
Which of the following is not a component of contractual PII?
What term describes a software application that is accessed via the internet and not installed on a local computer?
What legal protection is not provided for ideas, specific words, or recipes?
Which phase of the cloud data life cycle allows both read and process functions to be performed?
True or False: Attackers prefer Type 2 hypervisors due to their larger attack surface.
Which of the following attributes is characteristic of cloud computing?
Which technology is used to manage identity access management by building trust relationships between organizations?
Which approach involves assessing the likelihood and impact of potential cloud service risks?
What are SOC 1/SOC 2/SOC 3?
What is the type of intellectual property protection for a valuable set of sales leads?
Which of the following is a drawback of cloud computing where a customer depends on a dealer for products and services?
What technology allows for the creation of multiple isolated environments within a single physical infrastructure?
What does volume storage represent in cloud infrastructure?
Which item would be a risk for an enterprise considering contracting with a cloud service provider?
What does the Electronic Communication Privacy Act prohibit?
What is one of the reasons a baseline might be changed?
What process involves applying strong magnetic fields to erase data on hard drives and tapes?
What is a key aspect of the management plane in a cloud infrastructure?
Gathering business requirements helps determine all about organizational assets, except?
Which of the following quality assurance tests signifies the highest level of evaluation?
Which of the following controls involves policies and procedures?
What is a key capability of security information and event management?
What is the purpose of using the Cloud Security Alliance cloud controls matrix?
Which of the following allows consumers to manage and report on resources without internal engagement?
Which technology typically provides security isolation in infrastructure as a service (IaaS) cloud computing?
Which type of cloud deployment model is considered equivalent to a traditional IT architecture?
What is the most critical element in maintaining cloud security?
What protocol ensures the privacy of communication between applications?
Which design principle of secure cloud computing ensures that users can utilize data and applications from around the globe?
Which of the following statements accurately describes state law?
What is one of the main reasons for organizations to perform a risk assessment before migrating to the cloud?
Are confidentiality and integrity considered to be the same thing?
What happens when poor documentation is present in a cloud system?
Which countermeasure is NOT related to protecting cloud operations against internal threats?
Which technique uses different entries from within the same data set to represent the data?
Which method does NOT help reduce harm from escalation of privilege?
According to GDPR Policy, how quickly must breaches be reported once a company is aware of the incident?
Which federation standard is an XML-based framework for authentication, entitlement, and attribute information of users in a cloud?
Which of the following is considered a technological control?
Which authentication method involves multiple forms of validation for user identity?
Which practice can help mitigate the risk of DDoS attacks in a cloud environment?
Which process prevents the environment from being over-controlled by security measures to the point where application performance is impacted?
Gap analysis is performed for what reason?
Which type of cloud service provides applications and storage solutions via the internet?
What is a key practice for controlling physical access to a datacenter?
Which form of BC/DR testing has the least impact on operations?
What type of service model primarily focuses on providing comprehensive software applications?
What does power line redundancy ensure in a cloud provider's infrastructure?
Which of the following best describes data classification?
What is the primary purpose of Desktop as a Service (DaaS)?
Which model allows customers to use software applications hosted on the cloud without handling the underlying infrastructure?
What type of security control alerts the administrator about suspicious activities by monitoring the inbound and outbound packets from devices?
What does security redundancy entail?
Which models are generally available for cloud BC/DR activities except?
Which of the following is a security consideration when moving to a cloud environment?
Which artifact may be required as a data source for a compliance audit in a cloud environment?
What key principle underlines the privacy requirements determination in SDLC?
What does configuration management primarily concern itself with?
Which security framework is particularly noted for addressing cloud service provider security?
What is the key benefit of conducting regular vulnerability assessments in a cloud environment?
What is the name of the NIST publication that distinguishes secure cryptographic modules?
Which technology is primarily used for session encryption in web services?
What does the 'purpose' in a cloud context refer to?
IRM allows for which of the following, except?
What term applies to multiple customers using the same public cloud?
What form of intellectual property protection is provided for a useful manufacturing innovation?
What term describes the practice of evaluating applications from an attacker's viewpoint?
Which statute addresses security and privacy matters in the financial industry?
What is an important aspect of determining Criticality in an organization?
When reviewing the BIA after a cloud migration, what new factor related to data breach impacts should be considered?
The Electronic Communication Privacy Act (ECPA) primarily addresses which concern?
If a cloud customer wants a fully-operational environment with very little maintenance or administration necessary, which cloud service model would probably be best?
What principle is primarily emphasized in the management of cloud security regarding data privacy and security?
User access to the cloud environment can be administered in all of the following ways except?
What is the purpose of cloud enablement?
What right is associated with McDonald's slogan "I'm lovin' it"?
Which management practice is recommended for securing cloud environments by minimizing privileges granted to users?
Which requirement is included when exceptions, restrictions, and potential risks are highlighted in a cloud services contract?
What system takes defensive actions when suspicious activity is detected?
Which term describes a process that allows clients to interact with cloud services over the Internet?
Which form of BC/DR testing has the most impact on operations?
What are the controls on technology exports enforced by the U.S. State Department known as?
Which of the following is a common challenge faced by organizations migrating to the cloud?
What are the phases of a software development lifecycle process model?
What defines a cloud database?
What does MAD stand for in BC/DR concepts?
What does cloud storage enable companies to do with their data?
What type of attack aims to make an application unavailable?
After a cloud migration, what should the updated BIA include?
What is the primary purpose of encryption in cloud security?
Which concept involves prioritizing recovery processes after a disruptive event?
Which method is used for analyzing risk in software systems?
What is the primary purpose of risk avoidance?
Which of the following are essential characteristics of cloud computing?
Who is primarily responsible for managing Personally Identifiable Information (PII) in an organization?
What procedure involves multiple individuals, each with access to only part of a key?
Which of the following describes components of the risk-management process?
Which type of control should be used to implement custom controls that safeguard data?
What is the primary purpose of a Business Impact Analysis (BIA)?
Which management process recognizes, examines, and corrects hazards to prevent their future occurrence?
What is a key method in a risk-based approach to business continuity planning?
Which of the following phases of audit planning assures that operational and business changes have been captured as part of the audit plan?
What is the main purpose of penetration testing in cloud security?
Which cloud security control is a countermeasure for man-in-the-middle attacks?
All versions of SSL and TLS are acceptable to secure Data in Transit.
Which of the following encryption options establishes an encrypted link between a web server and a browser and ensures privacy and integrity of data on that link?
Which of the following is a benefit provided by SaaS for applications accessible by clients?
What kind of software does an enterprise application refer to?
Which of the following is NOT a benefit of using Software as a Service (SaaS)?
The generally accepted definition of cloud computing includes all of the following characteristics except:
Which two terms are considered threat models?
Which of the following can serve as an effective method for detecting unauthorized access in cloud storage?
Which document addresses CSP issues such as guaranteed uptime, liability, penalties, and dispute mediation process?
What is the specification designed to facilitate application management in PaaS systems?
Which type of encryption is generally used to protect data at rest in the cloud?
Which option describes how PII is classified into contractual and regulated categories?
An insecure API could potentially put entire data sets at risk for what?
Which of the following are the virtualization risks?
What is the primary role of a Cloud Service Provider (CSP)?
Where should the DLP (Data Leakage Prevention) engine be installed in a DIU (Data in use) topology of the data lifecycle?
What term refers to network elements that are isolated to protect them from external attacks?
Why is managing personnel threats crucial for organizations relying on cloud computing?
What is a core benefit of using multifactor authentication in cloud security?
Who among the following adds and extends value to the cloud-based services for customers?
What do cloud management tools assist with?
What is referred to as the plane that controls the entire infrastructure in a cloud environment?
A data custodian is responsible for which of the following?
Which of the following is NOT considered a best practice for key management?
Who holds the identity of all users and generates tokens for known users?
Which countermeasure is NOT effective in protecting cloud operations against internal threats?
Which countermeasure helps mitigate the risk of stolen credentials for cloud-based platforms?
What role does multi-factor authentication play in cloud security?
What is the primary focus of the definition phase in the Cloud SDLC?
Which of the following is not a risk management framework?
Which of the following is the best example of a key component of regulated PII?
What role does incident response play in data security?
In which phase of the data lifecycle does the data leave the active use phase and enter into long-term storage?
Which model includes both hardware and operating systems for development?
What does PaaS (Platform as a Service) enable consumers to do?
In cloud security, what is the primary concern of the customer?
What is the role of authentication in a secure system?
Which of the following technologies allows for secure sharing of information?
Which of the following protocols uses the X.509 certificates for authenticating a connection and exchanging the symmetric keys over a network?
What does cloud portability enable?
Which of the following describes the four cloud deployment models?
Which of the following is a countermeasure method implemented to address regulatory violations in cloud security?
From whose perspective does auditability provide processes to review system activities?
Which ISO standard refers to addressing security risks in a supply chain?
Why is event logging important in an IaaS model?
What is the process of adding validation support to a section without changing the basic mechanism of a DNS query using DNSSEC?
Which aspect of STRIDE refers to unauthorized modifications of data?
The CSA STAR program consists of three levels. Which of the following is not one of those levels?
Which of the following is NOT a function of Security Information and Event Management (SIEM)?
What are third-party providers offering IAM functions in cloud environments commonly referred to as?
In a federated identity arrangement, who acts as the identity provider?
Which identity management process targets access to enterprise resources by ensuring that the identity of an entity is verified?
In a community cloud configuration, how are resources managed?
In which risk category is the consumer unable to implement all necessary controls?
What does "attacks on the hypervisor" refer to?
For performance purposes, OS monitoring should include all of the following except:
What does a Cloud Access Security Broker (CASB) primarily provide?
Which document outlines guidelines and procedures for software changes?
Which of the following processes seeks to exploit the vulnerabilities of a system by collecting the information related to system exposures?
Which option is used to evaluate the risks and merits of various test scenarios?
Which cloud model offers access to a pool of fundamental IT resources such as computing, networking, or storage?
Which is not a part of the Management Plane?
As a cloud customer, do you have access to all logs regardless of the cloud model?
Which practice helps ensure that systems remain secure over time?
Which STRIDE threat component involves the act of disputing an identity or action?
Which of the following is considered a vulnerability in a cloud environment?
A UPS should have enough power to last how long?
What is a key benefit of using Platform as a Service (PaaS) in cloud computing for developers?
Which type of information is not typically associated with a SOC 3 report?
Which of the following represents a key aspect of privacy in cloud environments?
Which of the following guidelines covers eDiscovery?
What is the main focus of a cloud security architecture?
What role does encryption play in data security within the cloud?
What type of encryption allows operations on ciphertext without decryption?
Which process aims to assess the security posture of a cloud system?
Which body establishes optimal temperature and humidity levels?
What is one of the factors that limit administrator access in a cloud environment?
What is the function of a controller?
If a cloud customer wants a bare-bones environment in which to replicate their own enterprise for BC/DR purposes, which cloud service model would probably be best?
In which cloud deployment model are all infrastructure-level logs visible to the CCSP as detailed application logs?
Which of the following actions is NOT advisable for securing devices in a datacenter?
Legal controls refer to which of the following?
All of these are features of cloud computing except:
What is the role of the cloud vendor in a SaaS model?
What is a third-party service provider that manages and distributes remote cloud-based data backup solutions?
In which cloud computing arrangement does the cloud customer have the most control over their data and systems?
What term describes the essential aspects of an organization without which it cannot operate?
What is the primary goal of a Business Continuity Plan (BCP)?
Deviations from the baseline should be investigated and ________.
Which control helps mitigate the risk of sensitive information leaving the cloud environment?
When discussing data sanitization methods, which method involves completely removing data?
In BC/DR planning, what is the goal measured in time for recovering from interruptions?
Which of the following best describes the chain of custody in the context of evidence handling?
What does resiliency in data storage refer to?
Which method is commonly used to ensure data privacy in cloud computing?
What does MFA stand for in cloud security?
Dynamic Application Security Testing (DAST) is best described as?
What is the benefit of personnel redundancy in managing IT resources?
When a cloud customer uploads PII to a cloud provider, who becomes ultimately responsible for the security of that PII?
Which method is being used when a company evaluates the acceptable loss exposure associated with a cloud solution for a given set of objectives and resources?
The CMB should include representations from all of the following offices except:
The Family Educational Rights and Privacy Act (FERPA) primarily protects what type of data?
Which of the following is NOT a security concept for customers of cloud computing?
Which of the following is NOT an issue of key management?
The Restatement (Second) Conflict of Law refers to which of the following?
Who in an organization determines the overall risk profile?
What ensures that the use of data complies with organizational policies, standards, and relevant regulations?
Which security control is a shared responsibility within the Software as a Service (SaaS) model?
Which of the following is not associated with security?
What defines a successful incident response?
Which concept involves restricting user access to only what is necessary for their role in cloud security?
What must organizations consider to ensure data privacy when utilizing cloud services?
Which of the following is not a focus area for hardening an operating system?
Which legislation must a trusted cloud service adhere to when utilizing the data of EU citizens?
Which action facilitates communication paths for a cloud customer and their service provider during an incident?
What is the function of an encryption key?
Which term refers to a cloud service that manages access rights to data?
Which model provides hardware resources for cloud applications?
Which countermeasure enhances redundancy for physical facilities hosting cloud equipment during the threat of a power outage?
What term is used to describe a model where consumers only pay for computing resources they utilize, similar to utility services?
Which of the following describes the concept of 'simplicity' in cloud services?
What should private and public CSPs do to isolate themselves from other tenants?
What is the main focus of Identity and Access Management (IAM)?
Which of the following best describes a Data Loss Prevention (DLP) strategy?
What is the amount of fuel that should be on hand to power generators for backup datacenter power, in all tiers, according to the Uptime Institute?
Which cloud computing tool is used to discover internal use of cloud services using various mechanisms such as network monitoring?
Which process verifies untested and untrusted codes in a controlled cloud environment?
All of the following are part of a Federated Identity System except:
APIs are defined as which of the following?
What is the main focus of data governance in cloud environments?
What is the Cloud Security Alliance Cloud Controls Matrix (CCM)?
What type of redundancy can we expect to find in a datacenter of any tier?
What is the primary technique used for sanitizing data in the cloud?
Which of the following provides privacy protections for certain electronic communication and computing services from unauthorized access or interception?
What does vendor lock-out refer to in a cloud service context?
What type of attack attempts to identify known holes in security systems?
Which of the following frameworks focuses specifically on design implementation and management?
What does SLA stand for in the context of cloud services?
Which cloud service model best allows users to deploy applications without worrying about underlying infrastructure?
What is a key benefit provided to customers using an IaaS solution?
What is the main characteristic of a SOC 3 report?
ISO/IEC 27037:2012 is a guide for what process?
Dynamic Application Security Testing (DAST) is primarily focused on what aspect of a software product?
In cloud environments, what feature allows for service use without human interaction?
Is it necessary to obtain prior permission from the local Data Protection Commissioner before transferring data internationally?
What is required for Level One of the CSA Security, Trust, and Assurance Registry (STAR)?
Which STRIDE component deals with denial of service attacks?
Which cloud infrastructure is shared by several organizations with common concerns, such as mission, policy, or compliance considerations?
What is the purpose of ISO/IEC 27042:2015?
The Brewer-Nash model is also known as which of the following?
Which document serves as a guide for implementing a risk management framework comprehensively?
Which role is typically involved in safeguarding cloud security for an organization?
A standard base of technologies and policies across different organizations is known as what?
In a PaaS environment, who is responsible for the installation and maintenance of the operating system?
In addition to battery backup, a UPS can offer which capability?
What is a baseline in the context of network security?
Path management and networking primarily determine what aspect of cloud performance?
What is a key component of the infrastructure as a service (IaaS) cloud service model?
In the context of cloud security, what does residual risk refer to?
Which international standard is focused on risk management processes and practices?
Which service model influences the logical design by using additional measures in the application to enhance security?
What is the primary advantage of using a cloud service?
In attempting to provide a layered defense, what type of security controls should senior management be convinced to include?
Which of the following open web application security threats occurs when suspicious data in an application is sent to the web browser without proper validation?
What are the virtualization components governed by the management plane?
What is the role of policies in cloud environments?
What does 'scalability' mean in the context of organizational computing needs?
Every security program and process should have which of the following?
Which statement about SOAP is not true?
Which of the following authentication protocols allows organizations to trust each other's identity information?
The BC/DR kit should include all of the following except:
Sandboxing provides which of the following?
What is one responsibility of the cloud provider regarding physical security control?
What type of law governs offenses such as kidnapping or bank robbery?
Which of the following represents a key feature of cloud computing?
Is it sufficient to rely solely on the cloud provider's vulnerability assessment?
Which of the following best describes the principle of least privilege?
In the context of cloud security, what is the role of NIST SP 800-53?
What metric indicates how long it should take to repair a failed component in a system?
What type of data obfuscation involves hiding sensitive information?
What type of storage allows users to access their data from various remote locations?
What is the term for a situation where a customer is unable to migrate to another provider due to constraints?
Which of the following metrics provides the time required to finish the initiated or requested task?
Which is a PII law specifically for financial institutions?
Which process is responsible for granting access rights to users, programs, or processes?
Key management in a cloud environment is not very important. True or False?
What is lock-in in reference to cloud services?
Which regulation requires a CSP to comply with copyright law for hosted content?
What is the gathering of data as evidence referred to in cybersecurity?
What legislation was passed due to scandals involving publicly traded corporations such as Enron and WorldCom?
Which aspect of business continuity pertains to maintaining functionality during crises?
Which statement reflects a significant benefit of using cloud services?
What is the primary focus of secure initial configuration processes?
For which of the following cloud environments is the client-side key management approach used?
Which professional is responsible for the deployment of cloud applications to their respective environments?
Which of the following describes a testing environment that isolates untested code changes?
Which countermeasure is NOT applicable to protecting cloud operations from internal threats?
Which of the following is NOT considered a benefit of PaaS?
Which description best characterizes the API format known as Representational State Transfer (REST)?
What is the primary focus of static application security testing?
Which open web application security project (OWASP) Top 9 Coding Flaws leads to security issues?
What system allows a single user authentication process across multiple IT systems?
Which term defines the risk of unauthorized access to information due to overlapping virtual resources?
Bit splitting as a technique typically aims to enhance which aspect of cloud storage?
Which practice is essential for securing cloud environments against unauthorized access?
What term describes the administration of user accounts and their associated attributes in directory services?
What security approach involves using multiple overlapping methods to secure an environment?
In a cloud environment, which of the following can be an issue when working with integrations?
What are the U.S. Commerce Department's controls on technology exports called?
What type of hosting makes services available on demand via the Internet using multiple servers?
In the cloud motif, who usually acts as the data processor?
Which phase of the cloud data life cycle is associated with crypto-shredding?
Which technology allows an administrator to remotely manage a fleet of servers?
What technology enables the processing of encrypted data without needing to decrypt it first?
What creates new data feeds from existing datasets within the environment?
What does the Security Assertion Markup Language (SAML) facilitate?
What occurs during a guest escape in a cloud environment?
Which of the following input entities of data classification are required to follow a specific process of incident management activating measures to limit the damage to the concerned data?
Which cloud model is characterized by reliance on a third-party for services, leading to specific threats such as rogue administrator and contractual failure?
In maintenance mode, what remains enabled while two items are disabled?
Data labels could include all the following, except?
Which of the following is not one of the three types of training?
What does e-Discovery entail in a legal context?
What is a cloud storage architecture that manages the data in a hierarchy of files?
The term 'ePHI' stands for what?
_______ drive security decisions.
What is the term for vulnerability testing where you have knowledge of the systems involved?
Which expenditure has minimized an organization's requirements of purchasing systems and resources?
How does encryption enhance data security?
What is a critical component of effective incident response in cloud environments?
Which of the following cloud services provides a key benefit for developers by allowing access to services from diverse sources nationally or internationally?
Which of the following is a valid risk management metric?
With whom does a service provider dictate both the technology and operational procedures being made available to the cloud consumer?
RPO and RSL are used to establish when services and data are completely restored.
What is the main goal of a gap analysis in security practices?
Which security testing approach is used to review source code and binaries without executing the application?
Which type of hypervisor are malicious attackers most likely to target?
Which operation management ensures the integrity of the live environment and presents the correct components to customers?
What is conducted to identify weaknesses and vulnerabilities before a full audit?
Which act was enacted to protect the privacy of customer financial information?
Who determines when and how a private cloud meets the policies and needs of an organization?
Which technique scrambles data content using a mathematical algorithm while preserving its structural arrangement?
Which of the following countermeasures is designed specifically for preventing data breaches in cloud operations?
Which security technology can provide secure network communications from on-site enterprise systems to a cloud platform?
What type of technology is commonly used for load balancing in cloud environments?
Who among the following is responsible for supervision, secure data storage, transport, and implementation of business rules?
What role is responsible for adapting or deploying an application to a target cloud environment?
Which security strategy is associated with data rights management solutions?
What is often a major challenge to getting both redundant power and communications utility connections?
What is one of the main goals of incident management?
How is the compliance of the cloud service provider's legal and regulatory requirements verified when securing personally identifiable information (PII) data in the cloud?
What is a key capability of infrastructure as a service (IaaS)?
Volume Storage is split into pieces called what?
Which element is protected by an encryption system?
What is one of the recommended ways to harden Operating Systems in a cloud environment?
What process is used to verify that an entity has the right to access specific information?
Cloud vendors are held to contractual obligations with specified metrics by:
What system is used to notify administrators about nearing capacity limits that might affect SLA parameters?
What term describes the action of applying minor changes to existing systems?
In which of the following threats does an illicit denial of an event occur?
What cloud service model requires the customer to administer the operating system?
What is the primary function of Platform as a Service (PaaS)?
In which cloud environment scenario does the business continuity strategy restore the service failover to another part of the same CSP infrastructure?
Which technique helps to analyze the data itself in the content analysis method?
Which of the following is important in maintaining data integrity?
This concept affords the right to look at things anonymously and to be "forgotten" by a system when you leave.
Which of the following concerns does the "existing on-premise solution" BCDR scenario represent?
Which standard outlines the steps to create an Information Security Management System (ISMS)?
Which process is conducted to ensure that policies are understood in the context of the risks introduced into an organization?
Which of the following is not part of the STRIDE model?
Which of the following is an example of a cloud service provider?
If a patch is unavailable for a vulnerability, what action may be advisable?
Which technique safeguards systems against newly found vulnerabilities while providing additional functionalities?
What process helps check the hardware and software along with distribution facets like SDN control planes?
The cloud deployment model that features organizational ownership of the hardware and infrastructure, and usage only by members of that organization, is known as:
What is the biggest concern for migration of services during BCDR?
Which type of hypervisor runs on top of the operating system on a host device?
A cloud administrator recommends using tokenization as an alternative to protecting data without encryption. Which step should occur immediately before an authorized application request to access the data?
What is the process of creating virtual versions of hardware, OS, and storage devices called?
What is the lowest tier of datacenter redundancy, according to the Uptime Institute?
Which issue occurs when a web browser is sent data without proper validation?
What is called the process of intended permanent destruction of the data keys?
Which design principle of secure cloud computing ensures that the business can resume essential operations in the event of an availability-affecting incident?
Which standard provides an overview of application security including concepts and processes?
Which of the following is a benefit of layered defenses in security?
How is redundancy achieved in virtual switches within a VLAN network?
Which of the following is a consequence of applying strong magnetic fields to data storage media?
What audits financial reporting instruments and consists of two subclasses?
Which testing methodology runs against systems that can tune their focus of security?
What term refers to the organization purchasing, leasing, or renting cloud services?
What is a significant risk associated with cloud services that affects data integrity?
Which term describes the optimization of cloud services for specific industries or applications?
What is the focus of Client-Side Key Management Systems (KMS)?
What is likely to enhance a customer's trust in a cloud provider?
Which of the following is a core principle of cloud security architecture?
What does XaaS represent in cloud computing?
Who among the following allocates cloud service connection and transportation between the CSPs and the cloud service consumers?
Which cloud-specific risk must be considered when moving infrastructure operations to the cloud?
What is the term for a service provider that offers customers storage or software solutions via the Internet?
Adhering to ASHRAE standards for humidity can reduce the possibility of ________.
Which of the following vulnerabilities exploits a user's browser to generate unauthorized commands?
How is the time period that data should be kept by an organization typically expressed?
What refers to the auditing and prevention of unauthorized data exfiltration?
Which of the following best defines the concept of risk profile?
What additional mechanism does the customer have to ensure trust in the provider's performance and duties?
What framework involves policies and procedures for managing risk exposure?
What do virtualization vendors utilize to allow host clusters to scale and manage resources without service disruption?
What is an essential characteristic of Digital Rights Management (DRM)?
What is the experimental technology that might lead to the possibility of processing encrypted data without having to decrypt it first?
Which concept is essential for ensuring security in cloud environments by controlling identity access?
In cloud security, what does OS logging typically signify?
What is the objective of the Security Alliance's Cloud Controls Matrix?
Which of the following contributes to an effective security monitoring strategy in a cloud environment?
What is one characteristic of a public cloud?
When deciding whether to apply specific updates, it is best to follow ________, in order to demonstrate due care.
Which term refers to the allocation of resources in cloud computing?
What is a significant risk associated with the absence of multi-factor authentication in cloud services?
Which regulation is not necessarily related directly to privacy?
All of the following should be included in the audit scope definition except:
DLP solutions can help prevent loss due to which of the following?
In a Software as a Service (SaaS) model, who is responsible for system maintenance?
Which term refers to the structured storage of data that can be accessed by online applications?
A user installs a modem to work from home. This is an example of which type of threat?
DRM tools use a variety of methods for enforcement of intellectual property rights. Which of the following is NOT included?
What does a dry run test primarily focus on during a BC/DR evaluation?
Which element of STRIDE deals with the risk of data availability loss?
Which technique does NOT enhance data portability in cloud operations?
Which method should the cloud consumer use to secure the management plane of the cloud service provider?
Which type of cloud service involves an integrated arrangement of two or more cloud servers?
What refers to the ability of a user to gain permissions above their authorized level?
What does a community cloud model particularly address in organizational contexts?
What is the focus of SOC 2 reports?
What is the term for items that serve as early indicators of potential risks or issues?
Which Threat Model provides a standardized way of describing threats by their attributes?
Which role collects or creates data and holds the rights and responsibilities of that data?
Which standard is primarily concerned with eDiscovery processes?
What are the six stages of the cloud secure data lifecycle?
Which of the following best describes policy management in a cloud environment?
What process involves the generation, storage, and application of keys according to a security policy?
Which is not a part of the BCDR Continual Process?
What type of cloud is defined as a multi-tenant setup shared between organizations that belong to a specific group?
Data in the destroy phase can be considered destroyed if it is made permanently inaccessible. Is this statement true?
Which of the following security responsibilities are shared between an organization and its CSP in an IaaS cloud environment?
What is a potential risk when a cloud provider goes out of business?
True or False: Proper identification and documentation of key stakeholders is vital to any IT system.
Security training should not be:
Which testing method must be conducted to validate the effectiveness of a business continuity plan?
In the context of cloud security, what does QoS primarily focus on?
What type of encryption allows for performing calculations on cipher data without decrypting it first?
Which service model would be most appropriate for a company seeking to provide infrastructure resources like virtual machines?
Which of the following services are accessible within the SaaS cloud service model?
Which data-at-rest encryption method encrypts all the data stored on the volume and all snapshots created from the volume?
The goals of SIEM solution implementation include all of the following, except:
Which data protection technique involves twisting the information in such a way that it remains unintelligible, even if the source code is obtained?
Which of the following are required for improving the level of assurance in cloud computing?
Countermeasures for protecting cloud operations against external attackers include all of the following except?
Which of the following defines the concept of encryption?
In the context of cloud services, who is primarily concerned with security and operation?
Which of the following best describes a Public Cloud?
Which of the following should NOT be included in the Audit Scope Statement?
Which statement best describes the Organizational Normative Framework (ONF)?
What two parameters define the compute capacity of a cloud server?
Which of the following statements is true of key management?
What term describes the concept of sharing resources with other cloud customers simultaneously?
What is the name of the specification designed to ease management of applications across public and private cloud platforms?
True or False: Open Source Software is less secure than proprietary software.
What is a method used to simulate how tasks would be performed in a business continuity/disaster recovery scenario?
What responsibility does a customer hold in the SaaS cloud service?
Who is ultimately responsible for the creation and control of data?
Which technology makes the network control programmable and dynamically adjusts the flow of traffic when the pattern of network consumption changes?
This type of hypervisor is tied directly to the hardware or "Bare Metal".
Which phase of the software development life cycle includes determining business and security requirements?
Which agency is responsible for producing cloud computing benefits, risks, and recommendations for information security in Europe?
Which of the following is used to distribute workloads across multiple physical devices?
The right to be forgotten refers to which of the following?
What do virtualization technologies enable in cloud computing?
During which phase of the Cloud SDLC are user stories and interface designs developed?
Which cloud threat is characterized by a flaw in one client's application exposing data from other clients in a multitenant service?
What protects an organization's reputation and goodwill in the marketplace?
What does 'elasticity' in cloud computing refer to?
Which of the following are distinguishing characteristics of a managed service provider?
Which of the following components are part of what a CCSP should review when looking at contracting with a cloud service provider?
Which is the internationally accepted standard for eDiscovery?
What is the primary purpose of a contract in a cloud service agreement?
What is the primary function of Static Application Security Testing (SAST)?
What does the term Database as a Service (DBaaS) refer to?
Which cloud model provides data location assurance?
Which metric measures the average time between failures in a system?
What does a Web Application Firewall (WAF) primarily protect against?
Which Cloud Model primarily uses databases to store data?
Which of the following is not a common cloud service model?
Which architecture helps assess and plan security needs for IT and cloud providers?
Which of the following terms refers to the ability to recover from faults in a system?
What does the acronym CASB stand for in cloud computing?
Which of the following is a way to conduct e-discovery investigations in cloud environments?
What is a key component of GLBA?
What term describes a service that replicates data across the global Internet?
What is the purpose of using Puppet configuration management system?
Which individual plays a crucial role in evaluating technologies and vendors for cloud deployments?
Which type of law involves conflicts between the government and individuals or organizations that violate statutes?
What result is achieved by removing all nonessential services and software of devices for secure configuration of hardware?
What arrangement allows multiple enterprises to use the same identification data for access?
Which standard category encompasses regulations and specifications for security in applications?
Which of the following best describes a multifactor authentication mechanism?
What does a cloud architect primarily do?
What term is used to describe the logs and documentation needed for audits and compliance?
Which primary security control should be used by all cloud accounts to defend against the widest range of attacks?
What does a secure data port help to reduce?
Which term describes the capability to confirm someone's identity with adequate assurance?
What does Identity and Access Management (IAM) ensure?
What is the first international set of privacy controls in the cloud?
In the tokenization architecture, which step should be performed after the tokenization server generates the token?
Baseline compliance scanning should alert on any deviation from the baseline.
What tool is often utilized for ensuring compliance and monitoring data loss prevention?
What principle governs the decision to accept risks in a security context?
Which assumption about a CSP should be avoided when considering risks in a disaster recovery (DR) plan?
What does SAST stand for in the context of white-box testing?
What does the term 'scoping' refer to in cloud security?
Which software configuration management tool integrates during building, deploying, and managing infrastructure?
Which of the following is not a method of hardening devices in a cloud datacenter?
What type of data can a personal cloud storage solution typically handle?
What is the significance of personnel redundancy in IT?
What kind of relationship exists between organizational and application normative framework?
Is Data Classification considered a core concept of PCI DSS?
A private cloud project primarily supports what type of configuration?
What is an essential step to take when choosing a cloud service provider?
Which ISO standard outlines principles for incident investigation processes?
Which of the following describes the technology that alerts on potential security breaches?
Which international standard guide provides procedures for incident investigation principles and processes?
Which method supports secure data transmission via web services?
Which type of risk includes malware, hacking, DoS/DDoS attacks, and man-in-the-middle attacks?
Which term describes information retained for legal, regulatory, or business reasons?
What does IaaS primarily manage for a cloud customer?
Which of the following is the primary purpose of an SOC 3 report?
Which of the following is not one of the SDLC phases?
Which of the following is a Type 1 hypervisor?
Which action is required for breaches of data under the general data protection regulation (GDPR) within 72 hours of becoming aware of the event?
What is the primary purpose of online backup in cloud computing?
What is a primary action taken to enhance security in a datacenter?
Which of the following is considered a "white box" test?
Which platform as a service (PaaS) data type should be used for a banking cloud platform that needs seamless and searchable relational database inclusion?
Which of the following SOC report subtypes spans a period of time?
What is the primary focus of the Sarbanes-Oxley Act of 2002?
Which of the following is NOT an effective tool for mitigating insider threats in cloud security?
Object Storage is usually accessed through which of the following?
In the context of cloud security, which of the following is critical for protecting sensitive data?
What is the primary risk associated with insufficient due diligence in cloud deployments?
What threat does social engineering training aim to mitigate by identifying personnel who resist malicious attempts?
Which control should be implemented to effectively manage unauthorized access in a cloud environment?
What is the Cloud Security Alliance STAR program designed to provide?
What is a key benefit of the public cloud deployment model?
What technology allows users to access and manage software applications online without needing to install them locally?
Which of the following is a primary goal of security hardening?
What defines what the audit will produce?
What aspect heavily influences how data is treated based on physical location?
What is a software or hardware-based network security system that controls the incoming and outgoing network traffic based on an applied rule set?
What security threat involves multiple redundancies to protect against service disruptions?
Among the following, whose responsibility is to organize the deployment and designing of an application in the cloud environment?
What responsibility of the data owner occurs during the Create phase related to a dataset?
Which methodology could cloud data storage utilize to encrypt all data associated in an infrastructure as a service (IaaS) deployment model?
Which data source provides auditability and traceability for event investigation as well as documentation?
Which is not part of the risk management process?
Which of the following allows logical isolation of hosts on a network?
What do business continuity efforts primarily focus on?
Which of the following is not a feature of DAST?
Which of the following reports is no longer used?
In what phase of the Cloud SDLC is the actual code written based on previously established parameters?
The Sarbanes-Oxley Act is enforced by which entity?
What is one primary benefit of using cloud security solutions?
Which of the following is NOT a method of data discovery?
What is the response called that follows a cost-benefit analysis when addressing a risk?
In information security, what does the term 'authentication' specifically aim to establish?
Which cloud model allows the consumer to have sole responsibility for management and governance?
Single Sign On works by issuing:
What method of access control requires multiple forms of authentication?
What is the purpose of scoping in cloud engagement?
What encryption method protects all of a system's data at rest?
Which of the following describes the four tiers of data center site infrastructure?
Which element is a cloud virtualization risk?
Which of the following reports is most aligned with financial control audits?
What is the aspect of the DMCA that has often been abused and places the burden of proof on the accused?
Which factor is essential for ensuring compliance in cloud security?
Proper implementation of DLP solutions for successful function requires which of the following?
Which of the following is an application virtualization solution?
What term describes the ease or difficulty of transferring data out of a provider's datacenter?
Which of the following cloud service models provides the most control over the infrastructure?
Which cloud service allows its customers to deploy applications created using the tools supported by the provider onto the cloud infrastructure?
Which of the following capabilities of an Information Rights Management (IRM) solution confirms the content delivery and offers proof of compliance with an organization's information security policy?
In which situation could cloud clients find it impossible to recover or access their own data if their cloud provider goes bankrupt?
Which term best describes the process of evaluating potential vulnerabilities in a system?
What does STRIDE stand for in threat modeling?
What is the primary risk associated with storing sensitive data in the cloud?
What does a redundancy mechanism primarily aim to achieve in a data storage context?
What is the role of an Identity Provider in a security system?
What type of agreement aims to negotiate policies with various parties in accordance with the agreed-upon targets?
The following are Data States as referred to by DLP, except?
Which entity ensures compliance with regulatory frameworks for organizations?
Which factor is essential for selecting a cloud service provider?
What acronym summarizes the six threat categories related to cloud security?
What is the focus of label-based discovery in data management?
What is a primary feature of IaaS?
Which protocol provides authentication for client/server applications using secret-key cryptography?
Which term best describes a formal solicitation for proposals from vendors?
What issue arises when customer software may not function properly due to OS updates by a provider?
Which organization publishes the most commonly used standards for data center tiers and topologies?
What is the function of the BIA (Business Impact Analysis)?
Which kind of Data Obfuscation method replaces data with random values that can be mapped to actual data?
Which jurisdictional data protection controls the ways that financial institutions deal with the private information of individuals?
Why is eDiscovery difficult in the cloud?
How can the cloud customer's trust in the cloud provider be enhanced?
What type of assessment is performed when there is insufficient data to assist the risk assessment, using estimates to express risk?
Which network functionality controls the amount of traffic sent or received as well as the number of API requests within a specified period?
Which of the following best describes SAML?
Which of the following ensures no default passwords remain in systems?
Which of the following is not an aspect of physical security that ought to be considered in the planning and design of a cloud datacenter facility?
Which term allows an individual to correct any inaccuracies in their own information?
What is the key issue associated with the object storage type that the CCSP has to be aware of?
The baseline should cover which of the following?
Which of the following is not a feature of a secure KVM component?
Which approach is considered a black-box security testing method?
What term refers to the rights and obligations for persons harmed by others?
Which method is used to identify specific kinds of data within datasets?
What is a Service-Level Agreement (SLA)?
Which service model encompasses all the resources of IaaS and PaaS, as well as software programs?
What is the process of allocating the cloud provider's services and application to the customers for utilizing them?
What is the primary governance of federal law?
What does the documentation of asset inventory reflect?
What is the function of a secure kernel-based virtual machine?
What is NOT a benefit of addressing BC/DR through cloud operations?
Countermeasures for protecting cloud operations against internal threats include all of the following except?
Which risk is controlled by implementing a private cloud?
What is an experimental technology intended for processing encrypted data without decryption?
What describes accounting software that is hosted on remote servers?
Data labels could include all the following, except?
Which type of SSAE report includes a seal of approval from a certified auditor?
What type of security responsibility primarily falls on the enterprise when utilizing cloud services?
Are SOAP and REST APIs required to run over SSL or TLS for security purposes?
Which resiliency technique attenuates the possible loss of functional capabilities during contingency operations?
Which type of report assesses an organization's security, availability, processing integrity, and privacy controls?
Which method creates a structurally similar, inauthentic version of data for testing purposes?
What is the term used to describe the amount of risk that leadership and stakeholders are willing to accept?
What compensates victims for injuries suffered by the culpable action or inaction of others?
What is characterized by the ability to allocate and deallocate resources based on demand?
Data masking can be used to provide all of the following functionality, except:
What document outlines both parties' responsibilities and service provisions in cloud engagements?
In which of the following tests of the recovery plan are the industry workers mobilized to an alternative site to perform actual recovery process?
Which disaster recovery plan metric indicates how long critical functions can be unavailable before irreparable harm occurs?
True or False: The customer's legal liability for its data is unaffected by the provider's negligence.
Tort law is primarily concerned with which of the following?
Which of the following is considered an administrative control?
True or False: A data center should be located in the same geographic area as its headquarters for ease of access.
Which cloud model incorporates the use of structured vs unstructured storage types?
What is typically a responsibility of a cloud security practitioner?
Where would the monitoring engine be deployed when using a network-based DLP system?
Which of the following is NOT a data analytics mode?
Which of the following are the key regulations applicable to the CSP facility?
What type of report is classified as SOC 1 and what is its purpose?
Which of the following logs is used for event investigation and documentation in a SaaS environment?
Which benefit does cloud computing primarily provide to businesses?
The process of hardening a device should include which of the following?
Which technology can be used to protect data in transit across a cloud network?
Which phase forms the security and foundation for IAM (Identity and Access Management) within the cloud environment?
Which ISO standard specifies requirements for establishing information security management systems?
Which of the following is a risk management option that halts a business function?
What risk is magnified by cloud computing, involving the possible misuse of access by employees?
What does "defense in depth" entail regarding security controls?
Which process analyzes data for certain attributes to determine the appropriate controls and policies?
What is a common application of a HIDS (Host-based Intrusion Detection System)?
What framework is often used for providing third-party applications limited access to HTTP services?
Categories of personal data that can be processed include which of the following?
Which cloud storage model keeps enterprise data behind the firewall?
Which storage method allows mobile devices to store data in the cloud and access it anywhere?
Which of the following best describes risk?
Where should the final data backup repository be located for a disaster recovery (DR) service?
Which organization is known for providing advice on IT service matters?
As part of ITIL, what kind of ticket is created to make a change?
What is meant by a cloud operating system?
What is an association of organizations that come together to exchange appropriate information about their users and resources called?
Which of the following is a protocol specification for the exchange of structured information in web services?
Which process involves permanently removing personal identifiers from data?
What describes the scope of Business Continuity (BC)?
Which authentication standard is most effective when integrating multiple external service providers?
Which standard outlines the principles and processes for managing risk?
Which of the following measures is indicative of security redundancy?
Which method is predominantly used in federated identity environments?
Which term refers to the process of identifying and obtaining electronic evidence for legal purposes?
What is an essential feature of the security model for cloud data?
What does a framework for cloud controls typically enable?
Clustered storage architectures can either be tightly coupled or what other type?
Which item is required in a cloud contract?
What is the main risk of not properly securing API endpoints in cloud services?
If a cloud customer cannot get access to the cloud provider, this affects what portion of the CIA triad?
Which of the following is not a risk management framework?
Which one of the following is essential for effective risk management in cloud security?
Risk transference typically involves which of the following?
Where is the agreement between the cloud customer and provider regarding responsibilities codified?
Which cloud infrastructure is shared by several organizations with specific shared concerns?
Which of the following activities can a cloud provider offer to foster customer trust?
Which statement is true regarding the scope of an audit based on the cloud model used?
What is the primary focus of cloud security governance?
Which is the lowest level of the CSA STAR program?
Which of the following is most critical for maintaining compliance in cloud environments?
Which of the following is not an example of a highly regulated environment?
Which technology enables the examination of various aspects of a VM without an agent?
What type of storage is used for swapping storage files?
Which problem is a common supply chain risk?
What part of the logical infrastructure design is used to configure cloud resources, such as launching virtual machines or configuring virtual networks?
What aspect of the disaster recovery (DR) plan ensures control when issues exceed capabilities?
Which federal agency is responsible for accepting applications for new patents?
What term describes the established procedure for maintaining control over evidence to prevent tampering?
What is the primary focus of change management in a network context?
How does a cloud service provider benefit from operating a cloud environment?
Which model is a full application and distributed model managed by the provider?
What is the main goal of mitigation in the context of cloud security?
Which of the following are the data classification categories?
Which of the following are key areas of performance metrics?
Which technology should be included in the disaster recovery plan to prevent data loss?
The right to audit should be part of what documents?
In cloud security, what does the principle of "least privilege" refer to?
True or False: Different types of data may require specific sanitation methods.
Which category of the ISO/IEC 27034-1 standard relates to processes regarding application security?
Which aspect is most crucial when conducting a Risk Assessment in a cloud environment?
Which frameworks are associated with risk management?
Data labels could include all the following, except?
What security measure helps protect sensitive data from unauthorized access?
What does a CMB meeting help review and analyze?
Which logical design decision can be attributed to required regulation?
For what purpose is a compensating control used in a cloud environment?
What does cloud migration involve?
Which standard applies to credit card processing?
What process replaces sensitive data with unique identification symbols while retaining essential information?
What term describes the focus on only those departments impacted by cloud engagement?
HIPAA, SOX, and PCI DSS are examples of what?
This is the amount of services that is required to be restored to meet the requirements of a BCDR plan:
This plugin parses HTTP traffic and applies a set of rules before sending it to the application server. What is it called?
What is the purpose of a Cloud Access Security Broker (CASB)?
What describes the practice of ensuring data quality, privacy, and security in accordance with regulatory requirements?
Which mode of encryption secures data while it navigates the CSP network or the Internet?
What does personal data refer to in the context of cloud security?
What is the technique that involves distributing encrypted data across multiple storage solutions?
Which of the following items should be redundant in a data center?
Which cloud security control eliminates the risk of a virtualization guest escape from another tenant?
What does risk avoidance refer to in the context of organizational security?
What does RTO represent in the context of business continuity?
In terms of IT service, what entity focuses on enhancing service reliability and performance?
Which of the following is not classified as an access control?
What feature ensures that only authorized users can access specific resources?
Who among the following acts as a middleman between CSPs and their customers to facilitate the customers with the best provider?
Which of the following is not a Critical Success Factor?
Which of the following is NOT a dependency to consider in the BIA review after cloud migration?
What is typically a significant concern of enterprise security in cloud settings related to the access point?
A company has recently defined classification levels for its data. During which phase of the cloud data life cycle should this definition occur?
Who verifies the official commitment in a service-level agreement between a cloud service provider and the user?
What technique can attenuate risks due to loss or theft of remote access devices?
Which term is defined as a percentage measurement of computing power needed based on the required percentage of the production system during a disaster?
What is a significant risk associated with cloud storage that organizations need to acknowledge?
What is the intellectual property protection for a confidential recipe for muffins?
What does hybrid cloud storage combine?
What technology is specifically used for monitoring and analyzing database activity independently of the database management system?
Cryptographic keys should be secured ______________.
All policies within the organization should include a section that includes all of the following, except?
What type of discovery is used when responding to a mandate with a specific purpose?
What type of information does the Health Insurance Portability and Accountability Act (HIPAA) protect?
What is the primary reason for having power line redundancy in cloud infrastructure?
Which method ensures that sensitive organization content is protected?
What does MTBF stand for in the context of cloud security metrics?
The cloud deployment model that features joint ownership of assets among an affinity group is known as:
Which aspect of business continuity planning considers alternatives for a complete loss of the provider?
Which technology allows an organization to control access to sensitive documents stored in the cloud?
What does NAS stand for in network storage systems?
Which of the following best describes a Cloud Service Provider (CSP)?
In cloud environments, what is the purpose of an SLA (Service Level Agreement)?
The risk that a cloud provider might go out of business and the cloud customer might not be able to recover data is known as:
Are there potential extra costs associated with eDiscovery in a cloud environment?
Which role is primarily responsible for ensuring cloud storage mechanisms meet service-level agreements?
Which data format does SOAP (Simple Object Access Protocol) support?
What type of BCDR (Business Continuity and Disaster Recovery) strategy involves the selection of an additional deployment zone and recreation of the processing capacity on a different location?
In cloud development, which of the following is essential to success?
This cloud model provides the highest level of management and control over IT resources.
Which act grants students the right to opt-out of information sharing regarding their educational records?
Which of the following is considered a physical control?
What is a critical aspect of logging during maintenance mode?
Which of the following guidelines includes national privacy strategies, privacy management programs, and data security breach notification?
In the context of data protection, what is the primary goal of tokenization?
What do regulations such as GDPR emphasize in the handling of personal data?
Which model requires the customer to perform their own systems patching?
What is a component of device hardening?
What is the primary function of a Hardware Security Module (HSM)?
In which of the following components of the data retention policy do data-retention considerations depend heavily on the required compliance administration associated with the data type?
What characterizes public cloud storage?
Which attack vector is associated with cloud infrastructure?
What is the common purpose of Incident Response plans?
Which of the following is the software that manages the requests of multiple guest machines to access the resources of the host machine?
What term describes the assurance that a sender cannot deny sending a message nor can the recipient deny receiving it?
What term describes an association of organizations that assist with information exchange and resource access?
What legal activity might involve the confiscation or inspection of a host machine by law enforcement?
What type of threat involves cache poisoning where forged data is inserted into the cache of the name server?
What legal concept protects expressions of ideas and does not cover ideas themselves?
What is the main focus of ISO/IEC 27034-1?
Which type of attack is specifically designed to flood a network with excessive requests?
Which process is ongoing and implemented throughout the system life cycle to keep track of identified risks?
Which communication model focuses on ensuring the confidentiality of user business details?
Which approach is essential for protecting email servers from external threats when connected to untrusted networks?
What is the main purpose of a Service Level Agreement (SLA)?
Which standard outlines domains which establish frameworks for risk assessment?
Where does a Type 1 Hypervisor typically reside?
What is the focus of ISO/IEC 27001 certification?
Which virtualization risk occurs when an OS on a VM outbursts to access a hypervisor?
Which of the following is not a recognized authentication factor?
Web application firewalls (WAFs) primarily protect against which type of attacks?
Which of the following is NOT considered data classification?
All of the following are components of DLP except:
What technology operates independently of the DBMS to audit database activity?
What is a major pitfall in cloud application deployment?
Which term best describes a network management approach that abstracts traffic management from direct component oversight?
Which act provides copyright protections in a digital environment?
The Doctrine of the Proper Law is used to determine what?
Which jurisdictional data protection safeguards protected health information (PHI)?
What principle should be followed to ensure the availability of services in a cloud environment?
RFCs are approved by which of the following?
Which methods are used for the safe disposal of electronic records in cloud environments?
What term refers to laws enacted by a state legislature as opposed to national laws?
What technology uses multiple low-cost drives to enhance performance and provide redundancy?
Who publishes the optimal temperature and humidity levels for data centers?
Which of the following is a primary objective of conducting continuous security scanning during development?
Which contractual component includes a clear understanding of data processing limitations?
Which of the following cloud storages allows users to share and sync data stored on a mobile device?
The application normative framework is best described as?
What type of law governs acts such as kidnapping or bank robbery?
What regulation allows American and EU PII exchange without requiring American Entities to follow EU PII Laws?
What action should be taken for continuous improvement after a disaster event?
What should be regularly tested to ensure operational readiness in disaster recovery plans?
Which detection and analysis technique captures a point-in-time picture of the entire stack during an incident?
Which standard protocol is used in the public cloud environment for managing identification of various agents and devices?
What does recovery point objective (RPO) typically refer to?
Which concept refers to the maximum acceptable amount of time that a system can be down after a disaster?
What defines what is to be covered in the audit?
GAAPs are created and maintained by which organization?
Which characteristic of liquid propane increases its desirability as a fuel for backup generators?
Which risk management strategy involves shifting risk from one organization to another?
What does SOC 2 specifically measure in a cloud service context?
What aspect of cloud security involves monitoring and evaluating risks?
Which cloud computing technology unlocks business value through digital and physical access to maps?
What are the four elements that a data retention policy should define?
Which act protects the general public and shareholders from accounting errors and illegal practices in the enterprise?
In which cloud service model is the customer responsible for maintaining the operating system?
What is the recommended recovery time objective (RTO) for cloud-based applications in a business continuity plan?
Which standard should a global cloud services provider apply for using forensics methodologies?
An organization wants to maintain control of its IT environments while benefiting from flexibility and cost savings. Which cloud deployment model should they choose?
Which term refers to the risk assessment and management processes aimed at protecting data and systems?
Which is the correct order of the Cloud Secure Data Lifecycle?
Does the cloud model eliminate the need for a failover site?
Which of the following types of storage do cloud infrastructure services use?
Which technology improves the ability of the transport layer security (TLS) to ensure privacy when communicating between applications?
Does encryption ensure the integrity of data?
Which data-protection policy moves data that is no longer used to a separate storage device for long-term maintenance?
In terms of cloud security, which factor is crucial for ensuring data integrity?
What does Virtual Machine Introspection (VMI) help mitigate within a virtual machine?
Which cloud delivery model is best suited for organizations looking for comprehensive control over hardware and software?
What is the key benefit of conducting a dry run during a security process?
Which of the following threats occurs due to the loss of relevant encryption keys?
What is typically a characteristic of a Community Cloud?
All of the following can result in vendor lock-in except:
What is a plan to fix or mitigate all findings from an audit called?
Which type of attack aims to overwhelm a target’s resources?
What does a successful identity management process primarily enhance within enterprises?
In which of the following is customer access blocked and alert disabled?
What is one feature of Information Rights Management (IRM)?
Which cloud security measure helps prevent man-in-the-middle attacks?
What is the role of a cloud service manager?
What policy describes the media type used for data archiving?
What key aspect of cloud computing refers to the legal geographical implications of data storage?
Which process aims to identify the relevant risks that may affect the AIC (Availability, Integrity, and Confidentiality) of key information assets?
What technology provides a shared resource pool managed to maximize the number of guest operating systems?
Which model is an open-source alternative to STRIDE offered by Octotrike?
Which is a cloud service model category?
Which phrase best describes the features of Infrastructure as a Service?
In a federated environment, who is the relying party, and what does it do?
Who is a cloud service provider (CSP) required to notify after a security breach that discloses personal information likely to cause serious harm?
Which control method focuses on managing the configuration of the initial setup?
Which of the following methods is used for implementing volume storage encryption in an IaaS environment?
Which standard addresses the privacy aspects of cloud computing for consumers?
In the context of STRIDE, what does "R" stand for?
Which of the following best describes a cloud carrier?
What allows enterprises to store their data on the Internet instead of locally?
In data management, what typically explains the duration for which data is stored?
What type of threat is posed by a malicious insider in an organization?
What is the term for a company’s formal request to obtain goods or services from an external vendor?
Which approach ensures that sensitive data is anonymized before being used in public datasets?
All formatting, security, and usage of LUNs is handled by the storage device. True or False?
What type of cloud storage allows an individual access to their data from any location?
What term refers to the relationship between shareholders and management in a corporation?
Which type of control is important in order to achieve compliance for risk management?
Which of the following is not a part of the ENISA Top 8 Security Risks of cloud computing?
What is used to separate the physical architecture of an organization when the security controls applied by the virtualization components seem to be weak?
What is the primary role of a cloud access security broker (CASB)?
What type of risk is associated with sharing knowledge of a trade secret?
Which phase of the cloud data security life cycle typically occurs simultaneously with creation?
Which phase of the cloud data life cycle uses content delivery networks?
Which of the following serves as a primary goal for cloud security management?
Which cloud service model allows you to manage the underlying infrastructure?
What is a type of multifactor authentication (MFA)?
Which of the following is not a cloud deployment model?
Which of the following refers to a user gaining unauthorized control over system privileges?
Which item should be part of the legal framework analysis if a company wishes to store prescription drug records in a SaaS solution?
Which type of encryption applies only to a portion of a hard drive?
What characteristic is essential for cloud computing?
All of these are reasons because of which an organization may want to consider cloud migration, except:
Which regulation in the United States defines the requirements for a CSP to implement and report on internal accounting controls?
What do Application Programming Interfaces (APIs) provide for software applications?
Which of the following is a potential threat to cloud operations?
Which type of attack is commonly associated with the failure of isolation controls in virtualization?
Which statement is accurate regarding the characteristics of sensitive data?
Which of the following is a widely accepted standard for cloud security compliance?
Which of the following is not one of the types of controls?
Which of the following techniques for ensuring cloud datacenter storage resiliency uses encrypted chunks of data?
If a cloud customer wants a secure, isolated sandbox in order to conduct software development and testing, which cloud service model would probably be best?
In the context of cloud services, what does 'bare metal' refer to?
Where is DLP to protect Data at Rest installed?
What does SAML stand for in relation to federation standards?
What type of computing relies on sharing computing resources rather than local servers or personal devices?
Which of the following terms is not associated with cloud forensics?
What is the role of a cloud access security broker (CASB)?
What is a firewall primarily used for in cloud security?
What is the term for the risk remaining after controls and countermeasures are implemented?
Which security measure reduces the likelihood of unauthorized users gaining access?
Which model is primarily responsible for application deployment and management in cloud services?
Which process involves defining access rules based on business requirements?
What can occur when a hypervisor is improperly designed or configured?
In cloud models, the customer is given access and ability to modify which of the following?
Which technology does cloud computing utilize through a management interface?
Which statement is true regarding software-defined networking?
Which of the following is an aspect of cloud service provider accountability?
Which type of attack involves overwhelming a system with traffic to disrupt its operations?
What does Quality of Service (QoS) enable within a network?
What does encryption primarily provide in cloud security?
What is the method of analyzing data for specific attributes to determine the appropriate controls to apply?
Which of the following cloud-specific risks occurs when various applications are pushed to a cloud environment without complete understanding of the CSP environment?
Which cloud service delivers cloud services over a network that is open for free usage?
Which of the following methods of addressing risk is most associated with insurance?
Which act allows banks to merge with and own insurance companies while ensuring customer account information remains private?
In all cloud models, security controls are driven by which of the following?
Which multi-factor authentication (MFA) option uses a physical universal serial bus (USB) device to generate one-time passwords?
What types of data storage does PaaS typically utilize?
Which practice involves handling risk associated with an activity without accepting all risks?
Which cloud computing tool may help detect data migrations to cloud services?
A system capable of monitoring and analyzing the internals of a computing system as well as the network packets on its network is known as:
Which disaster recovery (DR) site results in the quickest recovery in the event of a disaster?
In a cloud environment, encryption should be used for all the following, except?
Which of the following best describes risk transference?
Which artifact may be required as a data source for a regulatory compliance audit (i.e., HIPAA, PCI-DSS) in a cloud environment?
What is the unauthorized exposure of data called?
In which of the following encryption techniques does the encryption engine run on a secure machine that handles all the cryptographic actions?
Which of the following best describes data masking?
Which data retention method is stored with a minimal amount of metadata storage with the content?
What does the term "service level agreement" (SLA) refer to in cloud services?
Which platform as a service (PaaS) storage architecture should be used to store presentations, documents, and audio files?
What does NIST Special Publication (SP) 800-122 primarily focus on?
In SOC 2 Auditing, how many categories make up the security principle?
What is one critical component of a privacy management program?
What is the role of a Cloud Services Brokerage (CSB)?
In PaaS, the customer has control over which aspect?
Data in the Archive and Destroy phases may need to be handled according to what?
What is the intellectual property protection for the logo of a new video game?
Which NIST publication ensures appropriate security requirements and controls for U.S. federal government information?
Which data source provides auditability and traceability for event investigation as well as documentation?
Which security method should be included in a defense-in-depth, when examined from the perspective of a content security policy?
What is the term used to describe the risk of processing on one virtualized instance being detected by other instances on the same host?
A portable storage is vulnerable to which threat?
An organization will conduct a risk assessment to evaluate which of the following?
Dynamic application security testing (DAST) is best described as what type of test?
Which of the following describes Personally Identifiable Information (PII)?
A generator transfer switch should bring backup power online within what time frame?
Which consideration should be taken into account when reviewing a cloud service provider's risk of potential outage time?
In cloud security, what is the primary concern when handling user data?
Which of the following aids in the ability to demonstrate due diligence efforts?
Which kind of hypervisor would malicious actors prefer to attack, ostensibly because it offers a greater attack surface?
DAST is usually run against live systems. What is true about the individuals running the test?
A storage area network (SAN) is primarily connected to users through which type of protocol?
Who is responsible for delivering, managing, and provisioning cloud services?
Which category does Rapid Provisioning and Scalability fall into?
What is required to establish and maintain log management in an organization?
Which term describes the action of confirming identity access to an information system?
What term describes systems that are controlled and maintained at the customer's site?
Which option should an organization choose if there is a need to avoid software ownership?
Which risk during the eDiscovery process would limit the usefulness of the requested data from the cloud by third parties?
What type of cloud model offers solutions to a limited number of individuals, ensuring specific security requirements?
Which level of CSA STAR needs the release of results related to security-properties monitoring based on the Cloud Trust Protocol (CTP)?
Which mechanism is used to restrict a list of possible actions down to only permitted actions?
Which of the following best defines a trade secret?
What are white-box testing methodologies capable of assessing directly?
Which standard does Level Two of the CSA STAR involve?
What is a cloud computing reseller?
Which component is among the highest risk component with respect to software vulnerabilities?
Which level of CSA STAR involves continuous monitoring of security properties?
In the context of cloud security, what is the definition of a federated identity provider?
What does data discovery involve?
How do immutable workloads affect security overhead?
What is the primary purpose of a disaster recovery plan?
Which of the following frameworks identifies the top 8 security risks based on likelihood and impact?
What is the goal of risk mitigation?
What is a common challenge organizations face when implementing cloud security controls?
Which framework is often applied to ensure data privacy and protection in cloud computing environments?
What does SAST primarily analyze?
DRM solutions typically include all the following functions EXCEPT:
Which term refers to the principles that govern data privacy and protection in an organization?
Which type of environment is designed to isolate untested code from operational systems?
What encryption method is used to secure data transmission between servers?
Which type of management system focuses on reducing threats and risks to IT and Data resources?
Which cloud service model primarily places the responsibility for access and administration on the customer?
Which storage type allows customers to have flexibility by enabling them to put anything into a blank volume?
DLP solutions can deter loss due to which of the following?
Which type of test is typically more accurate and delivers more results: SAST or DAST?
In which scenario is the cloud provider responsible for determining the backup configuration and declaring disasters?
In a cloud context, what does the term "provider lock-in" refer to?
Which type of auditing typically focuses on an organization’s internal controls regarding financial reporting?
What is the intellectual property protection for the tangible expression of a creative idea?
Who is responsible for managing data on behalf of the data owner?
Automations can be used to monitor the baselines and remediation of servers.
Which of the following testing is referred to as white-box testing and is used to determine the coding errors?
What is a security-related concern for a Platform as a Service (PaaS) solution?
What is the purpose of cloud testing?

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy