Question 1

Gap analysis is performed for what reason?

Accepted Answer

A)  To begin the benchmarking process 
B)  To assure proper accounting practices are being used 
C)  To provide assurances to cloud customers 
D)  To ensure all controls are in place and working properly

Question 2

Which of the following is NOT considered a type of data loss?

Accepted Answer

A)  Data corruption 
B)  Stolen by hackers 
C)  Accidental deletion 
D)  Lost or destroyed encryption keys

Question 3

Data centers have enormous power resources that are distributed and consumed throughout the entire facility. Which of the following standards pertains to the proper fire safety standards within that scope?

Accepted Answer

A)  IDCA 
B)  BICSI 
C)  NFPA 
D)  Uptime Institute

Question 4

What type of solution is at the core of virtually all directory services?

Accepted Answer

A)  WS 
B)  LDAP 
C)  ADFS 
D)  PKI

Question 5

Which of the following statements accurately describes VLANs?

Accepted Answer

A)  They are not restricted to the same data center or the same racks. 
B)  They are not restricted to the name rack but restricted to the same data center. 
C)  They are restricted to the same racks and data centers. 
D)  They are not restricted to the same rack but restricted to same switches.

Question 6

APIs are defined as which of the following?

Accepted Answer

A)  A set of protocols, and tools for building software applications to access a web-based software application or tool 
B)  A set of routines, standards, protocols, and tools for building software applications to access a web-based software application or tool 
C)  A set of standards for building software applications to access a web-based software application or tool 
D)  A set of routines and tools for building software applications to access web-based software applications

Question 7

Many different common threats exist against web-exposed services and applications. One attack involves attempting to leverage input fields to execute queries in a nested fashion that is unintended by the developers. What type of attack is this?

Accepted Answer

A)  Injection 
B)  Missing function-level access control 
C)  Cross-site scripting 
D)  Cross-site request forgery

Question 8

Cryptographic keys should be secured ________________ .

Accepted Answer

A)  To a level at least as high as the data they can decrypt 
B)  In vaults 
C)  With two-person integrity 
D)  By armed guards

Question 9

Which of the following is NOT an application or utility to apply and enforce baselines on a system?

Accepted Answer

A)  Chef 
B)  GitHub 
C)  Puppet 
D)  Active Directory

Question 10

Which of the following is NOT one of the main intended goals of a DLP solution?

Accepted Answer

A)  Showing due diligence 
B)  Preventing malicious insiders 
C)  Regulatory compliance 
D)  Managing and minimizing risk

Question 11

Different security testing methodologies offer different strategies and approaches to testing systems, requiring security personnel to determine the best type to use for their specific circumstances. What does dynamic application security testing (DAST) NOT entail that SAST does?

Accepted Answer

A)  Discovery 
B)  Knowledge of the system 
C)  Scanning 
D)  Probing

Question 12

Which of the following is NOT a function performed by the record protocol of TLS?

Accepted Answer

A)  Encryption 
B)  Acceleration 
C)  Authentication 
D)  Compression

Question 13

What does the REST API use to protect data transmissions?

Accepted Answer

A)  NetBIOS 
B)  VPN 
C)  Encapsulation 
D)  TLS

Question 14

What type of masking strategy involves replacing data on a system while it passes between the data and application layers?

Accepted Answer

A)  Dynamic 
B)  Static 
C)  Replication 
D)  Duplication

Question 15

What is the biggest negative to leasing space in a data center versus building or maintain your own?

Accepted Answer

A)  Costs 
B)  Control 
C)  Certification 
D)  Regulation

Question 16

Which cloud deployment model is MOST likely to offer free or very cheap services to users?

Accepted Answer

A)  Hybrid 
B)  Community 
C)  Public 
D)  Private

Question 17

You need to gain approval to begin moving your company's data and systems into a cloud environment. However, your CEO has mandated the ability to easily remove your IT assets from the cloud provider as a precondition. Which of the following cloud concepts would this pertain to?

Accepted Answer

A)  Removability 
B)  Extraction 
C)  Portability 
D)  Reversibility

Question 18

To protect data on user devices in a BYOD environment, the organization should consider requiring all the following, except:

Accepted Answer

A)  Multifactor authentication 
B)  DLP agents 
C)  Two-person integrity 
D)  Local encryption

Question 19

Within an IaaS implementation, which of the following would NOT be a metric used to quantify service charges for the cloud customer?

Accepted Answer

A)  Memory 
B)  Number of users 
C)  Storage 
D)  CPU

Question 20

The goals of DLP solution implementation include all of the following, except:

Accepted Answer

A)  Elasticity 
B)  Policy enforcement 
C)  Data discovery 
D)  Loss of mitigation

Exam 2: Certified Cloud Security Professional (CCSP)