Question 1

Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like:

Accepted Answer

A)  Ransomware 
B)  Syn floods 
C)  XSS and SQL injection 
D)  Password cracking

Question 2

You were recently hired as a project manager at a major university to implement cloud services for the academic and administrative systems. Because the load and demand for services at a university are very cyclical in nature, commensurate with the academic calendar, which of the following aspects of cloud computing would NOT be a primary benefit to you?

Accepted Answer

A)  Measured service 
B)  Broad network access 
C)  Resource pooling 
D)  On-demand self-service

Question 3

What concept does the "D" represent with the STRIDE threat model?

Accepted Answer

A)  Data loss 
B)  Denial of service 
C)  Data breach 
D)  Distributed

Question 4

Which of the following APIs are most commonly used within a cloud environment?

Accepted Answer

A)  REST and SAML 
B)  SOAP and REST 
C)  REST and XML 
D)  XML and SAML

Question 5

Which of the following is the MOST important requirement and guidance for testing during an audit?

Accepted Answer

A)  Stakeholders 
B)  Shareholders 
C)  Management 
D)  Regulations

Question 6

What provides the information to an application to make decisions about the authorization level appropriate when granting access?

Accepted Answer

A)  User 
B)  Relying party 
C)  Federation 
D)  Identity Provider

Question 7

What is a key capability or characteristic of PaaS?

Accepted Answer

A)  Support for a homogenous environment 
B)  Support for a single programming language 
C)  Ability to reduce lock-in 
D)  Ability to manually scale

Question 8

Which of the cloud cross-cutting aspects relates to the requirements placed on a system or application by law, policy, or requirements from standards?

Accepted Answer

A)  regulatory requirements 
B)  Auditability 
C)  Service-level agreements 
D)  Governance

Question 9

Your company is in the planning stages of moving applications that have large data sets to a cloud environment. What strategy for data removal would be the MOST appropriate for you to recommend if costs and speed are primary considerations?

Accepted Answer

A)  Shredding 
B)  Media destruction 
C)  Crypthographic erasure 
D)  Overwriting

Question 10

When a system needs to be exposed to the public Internet, what type of secure system would be used to perform only the desired operations?

Accepted Answer

A)  Firewall 
B)  Proxy 
C)  Honeypot 
D)  Bastion

Question 11

Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?

Accepted Answer

A)  Create 
B)  Use 
C)  Share 
D)  Store

Question 12

Which technology is NOT commonly used for security with data in transit?

Accepted Answer

A)  DNSSEC 
B)  IPsec 
C)  VPN 
D)  HTTPS

Question 13

Which of the following is the optimal humidity level for a data center, per the guidelines established by the America Society of Heating, Refrigeration, and Air Conditioning Engineers (ASHRAE)?

Accepted Answer

A)  30-50 percent relative humidity 
B)  50-75 percent relative humidity 
C)  20-40 percent relative humidity 
D)  40-60 percent relative humidity

Question 14

Other than cost savings realized due to measured service, what is another facet of cloud computing that will typically save substantial costs in time and money for an organization in the event of a disaster?

Accepted Answer

A)  Broad network access 
B)  Interoperability 
C)  Resource pooling 
D)  Portability

Question 15

Which of the following threat types can occur when encryption is not properly applied or insecure transport mechanisms are used?

Accepted Answer

A)  Security misconfiguration 
B)  Insecure direct object references 
C)  Sensitive data exposure 
D)  Unvalidated redirects and forwards

Question 16

What are the U.S. State Department controls on technology exports known as?

Accepted Answer

A)  DRM 
B)  ITAR 
C)  EAR 
D)  EAL

Question 17

Which of the following statements about Type 1 hypervisors is true?

Accepted Answer

A)  The hardware vendor and software vendor are different. 
B)  The hardware vendor and software vendor are the same 
C)  The hardware vendor provides an open platform for software vendors. 
D)  The hardware vendor and software vendor should always be different for the sake of security.

Question 18

Which of the following areas of responsibility always falls completely under the purview of the cloud provider, regardless of which cloud service category is used?

Accepted Answer

A)  Infrastructure 
B)  Data 
C)  Physical 
D)  Governance

Question 19

All of the following are terms used to described the practice of obscuring original raw data so that only a portion is displayed for operational purposes, except:

Accepted Answer

A)  Tokenization 
B)  Masking 
C)  Data discovery 
D)  Obfuscation

Question 20

Unlike SOC Type 1 reports, which are based on a specific point in time, SOC Type 2 reports are done over a period of time. What is the minimum span of time for a SOC Type 2 report?

Accepted Answer

A)  Six months 
B)  One month 
C)  One year 
D)  One week

Exam 2: Certified Cloud Security Professional (CCSP)