Use the best ways of preparing for CCSP Exam Dumps with Lead2PassExam ISC CCSP dump PDF [2022]
ISC CCSP exam candidates will surely pass the Exam if they consider the CCSP dumps learning material presented by Lead2PassExam.
NEW QUESTION 439
When using an IaaS solution, what is the capability provided to the customer?
- A. To provision processing, storage, networks, and other fundamental computing resources when the provider is able to deploy and run arbitrary software, which can include OSs and applications.
- B. To provision processing, storage, networks, and other fundamental computing resources when the auditor is able to deploy and run arbitrary software, which can include OSs and applications.
- C. To provision processing, storage, networks, and other fundamental computing resources when the consumer is able to deploy and run arbitrary software, which can include OSs and applications.
- D. To provision processing, storage, networks, and other fundamental computing resources when the consumer is not able to deploy and run arbitrary software, which can include OSs and applications.
Answer: C
Explanation:
According to "The NIST Definition of Cloud Computing," in IaaS, "the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).
NEW QUESTION 440
____________ can often be the result of inadvertent activity.
- A. Sprawl
- B. Phishing
- C. Disasters
- D. DDoS
Answer: A
NEW QUESTION 441
Which of the following is not a way to manage risk?
- A. Mitigating
- B. Enveloping
- C. Accepting
- D. Transferring
Answer: B
Explanation:
Enveloping is a nonsense term, unrelated to risk management. The rest are not.
NEW QUESTION 442
Which cloud storage type uses an opaque value or descriptor to categorize and organize data?
Response:
- A. Unstructured
- B. Structured
- C. Volume
- D. Object
Answer: A
NEW QUESTION 443
What does the REST API support that SOAP does NOT support?
- A. Acceleration
- B. Redundancy
- C. Encryption
- D. Caching
Answer: D
Explanation:
The SOAP protocol does not support caching, whereas the REST API does.
NEW QUESTION 444
What is the minimum regularity for testing a BCDR plan to meet best practices?
- A. Every six months
- B. Once year
- C. When the budget allows it
- D. Once a month
Answer: B
Explanation:
Best practices and industry standards dictate that a BCDR solution should be tested at least once a year, though specific regulatory requirements may dictate more regular testing. The BCDR plan should also be tested whenever a major modification to a system occurs.
NEW QUESTION 445
What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement?
- A. Specific
- B. Contractual
- C. Jurisdictional
- D. regulated
Answer: B
Explanation:
Contractual PII has specific requirements for the handling of sensitive and personal information, as defined at a contractual level. These specific requirements will typically document the required handling procedures and policies to deal with PII. They may be in specific security controls and configurations, required policies or procedures, or limitations on who may gain authorized access to data and systems.
NEW QUESTION 446
Which data protection strategy would be useful for a situation where the ability to remove sensitive data from a set is needed, but a requirement to retain the ability to map back to the original values is also present?
- A. Encryption
- B. Anonymization
- C. Masking
- D. Tokenization
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Tokenization involves the replacement of sensitive data fields with key or token values, which can ultimately be mapped back to the original, sensitive data values. Masking refers to the overall approach to covering sensitive data, and anonymization is a type of masking, where indirect identifiers are removed from a data set to prevent the mapping back of data to an individual. Encryption refers to the overall process of protecting data via key pairs and protecting confidentiality.
NEW QUESTION 447
What concept does the "R" represent with the DREAD model?
- A. Reproducibility
- B. Risk
- C. Repudiation
- D. Residual
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Reproducibility is the measure of how easy it is to reproduce and successful use an exploit. Scoring within the DREAD model ranges from 0, signifying a nearly impossibly exploit, up to 10, which signifies something that anyone from a simple function call could exploit, such as a URL.
NEW QUESTION 448
Which of the following storage types is most closely associated with a traditional file system and tree structure?
- A. Volume
- B. Unstructured
- C. Structured
- D. Object
Answer: A
Explanation:
Explanation
Volume storage works as a virtual hard drive that is attached to a virtual machine. The operating system sees the volume the same as how a traditional drive on a physical server would be seen.
NEW QUESTION 449
Which of the following types of software is a Type 2 hypervisor dependent on that a Type 1 hypervisor isn't?
Response:
- A. Operating system
- B. VPN
- C. IDS
- D. Firewall
Answer: A
NEW QUESTION 450
DLP solutions can aid in deterring loss due to which of the following?
- A. Performance
- B. Malicious disclosure
- C. Bad policy
- D. Power failure
Answer: B
Explanation:
DLP tools can identify outbound traffic that violates the organization's policies. DLP will not protect against losses due to performance issues or power failures. The DLP solution must be configured according to the organization's policies, so bad policies will attenuate the effectiveness of DLP tools, not the other way around.
NEW QUESTION 451
You are the IT security manager for a video game software development company. Which of the following is most likely to be your primary concern on a daily basis?
Response:
- A. Security flaws in your organization
- B. Health and human safety
- C. Security flaws in your products
- D. Regulatory compliance
Answer: A
NEW QUESTION 452
The various models generally available for cloud BC/DR activities include all of the following except:
- A. Cloud provider, backup from same provider
- B. Private architecture, cloud backup
- C. Cloud provider, backup from another cloud provider
- D. Cloud provider, backup from private provider
Answer: D
Explanation:
Explanation
This is not a normal configuration and would not likely provide genuine benefit.
NEW QUESTION 453
In a cloud environment, encryption should be used for all the following, except:
- A. Secure sessions/VPN
- B. Long-term storage of data
- C. Near-term storage of virtualized images
- D. Profile formatting
Answer: D
Explanation:
All of these activities should incorporate encryption, except for profile formatting, which is a made-up term.
NEW QUESTION 454
Which of the following is a method for apportioning resources that involves setting guaranteed minimums for all tenants/customers within the environment?
- A. Limits
- B. Cancellations
- C. Reservations
- D. Shares
Answer: C
NEW QUESTION 455
Which aspect of cloud computing will be most negatively impacted by vendor lock-in?
- A. Elasticity
- B. Portability
- C. Interoperability
- D. Reversibility
Answer: B
Explanation:
Explanation/Reference:
Explanation:
A cloud customer utilizing proprietary APIs or services from one cloud provider that are unlikely to be available from another cloud provider will most negatively impact portability.
NEW QUESTION 456
A poorly negotiated cloud service contract could result in all the following detrimental effects except:
- A. Malware
- B. Lack of necessary services
- C. Vendor lock-in
- D. Unfavorable terms
Answer: A
NEW QUESTION 457
Which component of ITIL involves the creation of an RFC ticket and obtaining official approvals for it?
- A. Problem management
- B. Change management
- C. Deployment management
- D. Release management
Answer: B
Explanation:
The change management process involves the creation of the official Request for Change (RFC) ticket, which is used to document the change, obtain the required approvals from management and stakeholders, and track the change to completion. Release management is a subcomponent of change management, where the actual code or configuration change is put into place.
Deployment management is similar to release management, but it's where changes are actually implemented on systems. Problem management is focused on the identification and mitigation of known problems and deficiencies before they are able to occur.
NEW QUESTION 458
Your organization has made it a top priority that any cloud environment being considered to host production systems have guarantees that resources will always be available for allocation when needed.
Which of the following concepts will you need to ensure is part of the contract and SLA?
Response:
- A. Limits
- B. Reservations
- C. Resource pooling
- D. Shares
Answer: B
NEW QUESTION 459
Audits are either done based on the status of a system or application at a specific time or done as a study over a period of time that takes into account changes and processes.
Which of the following pairs matches an audit type that is done over time, along with the minimum span of time necessary for it?
- A. SOC Type 2, six months
- B. SOC Type 2, one year
- C. SOC Type 1, one year
- D. SOC Type 2, one month
Answer: A
Explanation:
Explanation/Reference:
Explanation:
SOC Type 2 audits are done over a period of time, with six months being the minimum duration. SOC Type 1 audits are designed with a scope that's a static point in time, and the other times provided for SOC Type 2 are incorrect.
NEW QUESTION 460
Which entity requires all collection and storing of data on their citizens to be done on hardware that resides within their borders?
- A. Russia
- B. United States
- C. France
- D. Germany
Answer: A
Explanation:
Explanation
Signed into law and effective starting on September 1, 2015, Russian Law 526-FZ establishes that any collecting, storing, or processing of personal information or data on Russian citizens must be done from systems and databases that are physically located with the Russian Federation.
NEW QUESTION 461
Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?
- A. Missing function-level access control
- B. Cross-site request forgery
- C. Cross-site scripting
- D. Injection
Answer: B
Explanation:
Explanation
Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user's browser without going through any validation or sanitization processes, or perhaps the code is not properly escaped from processing by the browser. The code is then executed on the user's browser with their own access and permissions, allowing the attacker to redirect the user's web traffic, steal data from their session, or potentially access information on the user's own computer that their browser has the ability to access. Missing function-level access control exists where an application only checks for authorization during the initial login process and does not further validate with each function call. An injection attack is where a malicious actor sends commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries. Cross-site request forgery occurs when an attack forces an authenticated user to send forged requests to an application running under their own access and credentials.
NEW QUESTION 462
What principle must always been included with an SOC 2 report?
- A. Privacy
- B. Processing integrity
- C. Security
- D. Confidentiality
Answer: C
NEW QUESTION 463
What is the only data format permitted with the SOAP API?
- A. SAML
- B. XSML
- C. XML
- D. HTML
Answer: C
Explanation:
The SOAP protocol only supports the XML data format.
NEW QUESTION 464
......
Full CCSP Practice Test and 830 unique questions with explanations waiting just for you, get it now: https://drive.google.com/open?id=1L-rvz0FeaUYV9FzDUhC_3fkDufSnUhFX
Accurate & Verified Answers As Seen in the Real Exam here: https://www.lead2passexam.com/ISC/valid-CCSP-exam-dumps.html