Exam 2: Certified Cloud Security Professional (CCSP)

Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like:

You were recently hired as a project manager at a major university to implement cloud services for the academic and administrative systems. Because the load and demand for services at a university are very cyclical in nature, commensurate with the academic calendar, which of the following aspects of cloud computing would NOT be a primary benefit to you?

What concept does the "D" represent with the STRIDE threat model?

Which of the following APIs are most commonly used within a cloud environment?

Which of the following is the MOST important requirement and guidance for testing during an audit?

What provides the information to an application to make decisions about the authorization level appropriate when granting access?

What is a key capability or characteristic of PaaS?

Which of the cloud cross-cutting aspects relates to the requirements placed on a system or application by law, policy, or requirements from standards?

Your company is in the planning stages of moving applications that have large data sets to a cloud environment. What strategy for data removal would be the MOST appropriate for you to recommend if costs and speed are primary considerations?

When a system needs to be exposed to the public Internet, what type of secure system would be used to perform only the desired operations?

Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?

Which technology is NOT commonly used for security with data in transit?

Which of the following is the optimal humidity level for a data center, per the guidelines established by the America Society of Heating, Refrigeration, and Air Conditioning Engineers (ASHRAE)?

Other than cost savings realized due to measured service, what is another facet of cloud computing that will typically save substantial costs in time and money for an organization in the event of a disaster?

Which of the following threat types can occur when encryption is not properly applied or insecure transport mechanisms are used?

What are the U.S. State Department controls on technology exports known as?

Which of the following statements about Type 1 hypervisors is true?

Which of the following areas of responsibility always falls completely under the purview of the cloud provider, regardless of which cloud service category is used?

All of the following are terms used to described the practice of obscuring original raw data so that only a portion is displayed for operational purposes, except:

Unlike SOC Type 1 reports, which are based on a specific point in time, SOC Type 2 reports are done over a period of time. What is the minimum span of time for a SOC Type 2 report?