Which of the following threat types involves the sending of commands or arbitrary data through input fields in an application in an attempt to get that code executed as part of normal processing?

Missing function-level access control

You are working for a cloud service provider and receive an eDiscovery order pertaining to one of your customers.Which of the following would be the most appropriate action to take first?

Take a shapshot of the virtual machines

Which of the following threat types can occur when baselines are not appropriately applied or when unauthorized changes are made?

Insecure direct object references

Unvalidated redirects and forwards

Which of the following threat types involves the sending of invalid and manipulated requests through a user's client to execute commands on the application under their own credentials?

Missing function-level access control

What is a serious complication an organization faces from the compliance perspective with international operations?

Different operational procedures

Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?

Missing function-level access control

Many different common threats exist against web-exposed services and applications. One attack involves attempting to leverage input fields to execute queries in a nested fashion that is unintended by the developers.What type of attack is this?

Missing function-level access control

ISC CCSP Practice Test 7 - Free Online Exam Prep & Questions

Question 1 / 40

Three central concepts define what type of data and information an organization is responsible for pertaining to eDiscovery.

Which of the following are the three components that comprise required disclosure?

Possession, ownership, control

Ownership, use, creation

Control, custody, use

Possession, custody, control

Comment (0)

Suggested answer: D

Explanation:

Data that falls under the purview of an eDiscovery request is that which is in the possession, custody, or control of the organization. Although this is an easy concept in a traditional data center, it can be difficult to distinguish who actually possesses and controls the data in a cloud environment due to multitenancy and resource pooling. Although these options provide similar-sounding terms, they are ultimately incorrect.

asked 18/09/2024

Roberto Recine

52 questions

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

ISC CCSP Practice Test 7

Question

ISC CCSP Practice Tests

Practice Tests