If there are gaps in network logging data, what can you do?

You can instrument the technology stack with your own logging.

Nothing. There are simply limitations around the data that can be logged in the cloud.

Ask the cloud provider to open more ports.

You can instrument the technology stack with your own logging.

Ask the cloud provider to close more ports.

Nothing. The cloud provider must make the information available.

Who is responsible for the security of the physical infrastructure and virtualization platform?

The majority is covered by the consumer

The responsibility is split equally

What factors should you understand about the data specifically due to legal, regulatory, and jurisdictional factors?

The implications of storing complex information on simple storage systems

The physical location of the data and how it is accessed

The fragmentation and encryption algorithms employed

The language of the data and how it affects the user

The implications of storing complex information on simple storage systems

The actual size of the data and the storage format

Which cloud-based service model enables companies to provide client-based access for partners to databases or applications?

Infrastructure-as-a-service (IaaS)

CCM: The following list of controls belong to which domain of the CCM?GRM 06 – PolicyGRM 07 – Policy EnforcementGRM 08 – Policy Impact on Risk AssessmentsGRM 09 – Policy ReviewsGRM 10 – Risk AssessmentsGRM 11 – Risk Management Framework

Governance and Retention Management

Which attack surfaces, if any, does virtualization technology introduce?

Virtualization management components apart from the hypervisor

Configuration and VM sprawl issues

Which of the following is NOT a cloud computing characteristic that impacts incidence response?

Privacy concerns for co-tenants regarding the collection and analysis of telemetry and artifacts associated with an incident.

The on demand self-service nature of cloud computing environments.

Privacy concerns for co-tenants regarding the collection and analysis of telemetry and artifacts associated with an incident.

The possibility of data crossing geographic or jurisdictional boundaries.

Object-based storage in a private cloud.

The resource pooling practiced by cloud services, in addition to the rapid elasticity offered by cloud infrastructures.

CCM: A hypothetical company called: “Health4Sure” is located in the United States and provides cloud based services for tracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. Health4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document to potential clients. Which of the following approach would be most suitable to assess the overall security posture of Health4Sure’s cloud service?

The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.

The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.

The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company’s overall security posture in an efficient manner.

The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.

Why is a service type of network typically isolated on different hardware?

It manages the traffic between other networks

It requires distinct access controls

It manages resource pools for cloud consumers

It has distinct functions from other networks

It manages the traffic between other networks

Which governance domain deals with evaluating how cloud computing affects compliance with internal security policies and various legal requirements, such as regulatory and legislative?

Compliance and Audit Management

Legal Issues: Contracts and Electronic Discovery

Compliance and Audit Management

Governance and Enterprise Risk Management

An important consideration when performing a remote vulnerability test of a cloud-based application is to

Obtain provider permission for test

Use techniques to evade cloud provider’s detection systems

Use application layer testing tools exclusively

Use network layer testing tools exclusively

Schedule vulnerability test at night

Which of the following statements are NOT requirements of governance and enterprise risk management in a cloud environment?

Negotiate long-term contracts with companies who use well-vetted software application to avoid the transient nature of the cloud environment.

Inspect and account for risks inherited from other members of the cloud supply chain and take active measures to mitigate and contain risks through operational resiliency.

Respect the interdependency of the risks inherent in the cloud supply chain and communicate the corporate risk posture and readiness to consumers and dependent parties.

Negotiate long-term contracts with companies who use well-vetted software application to avoid the transient nature of the cloud environment.

Provide transparency to stakeholders and shareholders demonstrating fiscal solvency and organizational transparency.

To understand their compliance alignments and gaps with a cloud provider, what must cloud customers rely on?

Provider run audits and reports

Provider and consumer contracts

Which of the following is a perceived advantage or disadvantage of managing enterprise risk for cloud deployments?

Greater reliance on contracts, audits, and assessments due to lack of visibility or management.

More physical control over assets and processes.

Greater reliance on contracts, audits, and assessments due to lack of visibility or management.

Decreased requirement for proactive management of relationship and adherence to contracts.

Increased need, but reduction in costs, for managing risks accepted by the cloud provider.

How does virtualized storage help avoid data loss if a drive fails?

Multiple copies in different locations

Drives are backed up, swapped, and archived constantly

Data loss is unavoidable with drive failures

What is true of searching data across cloud environments?

You might not have the ability or administrative rights to search or access all hosted data.

The cloud provider must conduct the search with the full administrative controls.

All cloud-hosted email accounts are easily searchable.

Search and discovery time is always factored into a contract between the consumer and provider.

You can easily search across your environment using any E-Discovery tool.

How does running applications on distinct virtual networks and only connecting networks as needed help?

It reduces the blast radius of a compromised system

It provides dynamic and granular policies with less management overhead

It locks down access and provides stronger data security

It reduces the blast radius of a compromised system

It enables you to configure applications around business groups

How can virtual machine communications bypass network security controls?

VM communications may use a virtual network on the same hardware host

The guest OS can invoke stealth mode

Hypervisors depend upon multiple network interfaces

VM images can contain rootkits programmed to bypass firewalls

Most network security systems do not recognize encrypted VM traffic

ENISA: “VM hopping” is:

Using a compromised VM to exploit a hypervisor, used to take control of other VMs.

Improper management of VM instances, causing customer VMs to be commingled with other customer systems.

Looping within virtualized routing systems.

Lack of vulnerability management standards.

Using a compromised VM to exploit a hypervisor, used to take control of other VMs.

Instability in VM patch management causing VM routing errors.

Select the best definition of “compliance” from the options below.

The awareness and adherence to obligations, including the assessment and prioritization of corrective actions deemed necessary and appropriate.

The development of a routine that covers all necessary security measures.

The diligent habits of good security practices and recording of the same.

The timely and efficient filing of security reports.

The awareness and adherence to obligations, including the assessment and prioritization of corrective actions deemed necessary and appropriate.

The process of completing all forms and paperwork necessary to develop a defensible paper trail.

CSA - Cloud Security Alliance CCSK Practice Test 1 - Free Online Exam Prep & Questions

All cloud services utilize virtualization technologies.

False

True

Comment (0)

CSA - Cloud Security Alliance CCSK Practice Test 1

Question

CSA - Cloud Security Alliance CCSK Practice Tests

Practice Tests