Exam 2: Certified Cloud Security Professional (CCSP)

Which of the following could be used as a second component of multifactor authentication if a user has an RSA token?

Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?

Which of the following is considered a technological control?

Which of the following are distinguishing characteristics of a managed service provider?

Implementing baselines on systems would take an enormous amount of time and resources if the staff had to apply them to each server, and over time, it would be almost impossible to keep all the systems in sync on an ongoing basis. Which of the following is NOT a package that can be used for implementing and maintaining baselines across an enterprise?

GAAPs are created and maintained by which organization?

An SLA contains the official requirements for contract performance and satisfaction between the cloud provider and cloud customer. Which of the following would NOT be a component with measurable metrics and requirements as part of an SLA?

Which of the following is a restriction that can be enforced by information rights management (IRM) that is not possible for traditional file system controls?

Which of the following best describes a cloud carrier?

Which of the following is NOT a major regulatory framework?

Which of the following roles is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets?

Which component of ITIL involves planning for the restoration of services after an unexpected outage or incident?

The European Union passed the first major regulation declaring data privacy to be a human right. In what year did it go into effect?

The goals of SIEM solution implementation include all of the following, except:

In addition to whatever audit results the provider shares with the customer, what other mechanism does the customer have to ensure trust in the provider's performance and duties?

You just hired an outside developer to modernize some applications with new web services and functionality. In order to implement a comprehensive test platform for validation, the developer needs a data set that resembles a production data set in both size and composition. In order to accomplish this, what type of masking would you use?

What strategy involves replacing sensitive data with opaque values, usually with a means of mapping it back to the original value?

The various models generally available for cloud BC/DR activities include all of the following except:

When is a virtual machine susceptible to attacks while a physical server in the same state would not be?

What concept does the "A" represent in the DREAD model?