Best practices for key management include all of the following, except:

Ensure multifactor authentication

What is the correct order of the phases of the data life cycle?

Create, Store, Use, Share, Archive, Destroy

Create, Use, Store, Share, Archive, Destroy

Create, Archive, Store, Share, Use, Destroy

Create, Store, Use, Archive, Share, Destroy

Create, Store, Use, Share, Archive, Destroy

Cryptographic keys should be secured ________________ .

To a level at least as high as the data they can decrypt

The various models generally available for cloud BC/DR activities include all of the following except:

Cloud provider, backup from private provider

Private architecture, cloud backup

Cloud provider, backup from another cloud provider

Cloud provider, backup from same provider

Cloud provider, backup from private provider

To address shared monitoring and testing responsibilities in a cloud configuration, the provider might offer all these to the cloud customer except:

Security control administration

Access to audit logs and performance data

Security control administration

Which kind of SSAE audit report is most beneficial for a cloud customer, even though it's unlikely the cloud provider will share it?

SOC 1 Type 1 Answer: C The SOC 3 is the least detailed, so the provider is not concerned about revealing it. The SOC 1 Types 1 and 2 are about financial reporting and not relevant.The SOC 2 Type 2 is much more detailed and will most likely be kept closely held by the provider.

When reviewing the BIA after a cloud migration, the organization should take into account new factors related to data breach impacts. One of these new factors is:

Legal liability can't be transferred to the cloud provider.

Many states have data breach notification laws.

Breaches can cause the loss of proprietary data.

Breaches can cause the loss of intellectual property.

Legal liability can't be transferred to the cloud provider.

Countermeasures for protecting cloud operations against external attackers include all of the following except:

Detailed and extensive background checks.

Continual monitoring for anomalous activity.

Detailed and extensive background checks.

Regular and detailed configuration/change management activities

Hardened devices and systems, including servers, hosts, hypervisors, and virtual machines.

User access to the cloud environment can be administered in all of the following ways except:

Customer provides administration on behalf of the provider

Provider provides administration on behalf the customer

Customer directly administers access

Third party provides administration on behalf of the customer

Customer provides administration on behalf of the provider

Countermeasures for protecting cloud operations against internal threats include all of the following except:

Extensive and comprehensive training programs, including initial, recurring, and refresher sessions

Because of multitenancy, specific risks in the public cloud that don't exist in the other cloud service models include all the following except:

Risk of loss/disclosure due to legal seizures

All of the following are techniques to enhance the portability of cloud data, in order to minimize the potential of vendor lock-in except:

Use DRM and DLP solutions widely throughout the cloud operation

Ensure there are no physical limitations to moving

Use DRM and DLP solutions widely throughout the cloud operation

Ensure favorable contract terms to support portability

Hardening the operating system refers to all of the following except:

Removing unnecessary services and libraries

The application normative framework is best described as which of the following?

A stand-alone framework for storing security practices for the ONF

Which of the following best describes the Organizational Normative Framework (ONF)?

A framework of containers for all components of application security, best practices, catalogued and leveraged by the organization.

A set of application security, and best practices, catalogued and leveraged by the organization

A container for components of an application's security, best practices catalogued and leveraged by the organization

A framework of containers for some of the components of application security, best practices, catalogued and leveraged by the organization

A framework of containers for all components of application security, best practices, catalogued and leveraged by the organization.

A UPS should have enough power to last how long?

Long enough for graceful shutdown

Which of the following best describes the purpose and scope of ISO/IEC 27034-1?

Provides an overview of application security that introduces definitive concepts, principles, and processes involved in application security.

Describes international privacy standards for cloud computing

Serves as a newer replacement for NIST 800-52 r4

Provides on overview of network and infrastructure security designed to secure cloud applications.

Provides an overview of application security that introduces definitive concepts, principles, and processes involved in application security.

Which of the following best describes SAML?

A standards for exchanging authentication and authorization data between security domains.

A standard used for directory synchronization

A standard for developing secure application management logistics

A standard for exchanging usernames and passwords across devices.

A standards for exchanging authentication and authorization data between security domains.

APIs are defined as which of the following?

A set of routines, standards, protocols, and tools for building software applications to access a web-based software application or tool

A set of protocols, and tools for building software applications to access a web-based software application or tool

A set of routines, standards, protocols, and tools for building software applications to access a web-based software application or tool

A set of standards for building software applications to access a web-based software application or tool

A set of routines and tools for building software applications to access web-based software applications

Which of the following best describes data masking?

A method for creating similar but inauthentic datasets used for software testing and user training.

A method used to protect prying eyes from data such as social security numbers and credit card data.

A method where the last few numbers in a dataset are not obscured. These are often used for authentication.

Data masking involves stripping out all digits in a string of numbers so as to obscure the original number.

Which of the following best describes a sandbox?

An isolated space where untested code and experimentation can safely occur separate from the production environment.

A space where you can safely execute malicious code to see what it does.

An isolated space where transactions are protected from malicious software

An isolated space where untested code and experimentation can safely occur within the production environment.

A localized incident or disaster can be addressed in a cost-effective manner by using which of the following?

Strict adherence to applicable regulations

ISC CCSP Practice Test 12 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

ISC CCSP Practice Test 12

Question

ISC CCSP Practice Tests

Practice Tests