CCSK Sample Questions Answers

Client, Controller, and Gateway

Client, Controller, Firewall, and Gateway

Client, Firewall, and Gateway

Controller, Firewall, and Gateway

Client, Controller, and Firewall

Only the cloud consumer

Only the cloud provider

Both the cloud provider and consumer

It is determined in the agreement between the entities

It is outsourced as per the entity agreement

Network traffic rules for cloud environments

A number of requirements to be implemented, based upon numerous standards and regulatory requirements

Federal legal business requirements for all cloud operators

A list of cloud configurations including traffic logic and efficient routes

The command and control management hierarchy of typical cloud company

Attributes belong to entities and identities belong to attributes. Each attribute can have multiple identities but only one entity.

An attribute is a unique object within a database. Each attribute it has a number of identities which help define its parameters.

An identity is a distinct and unique object within a particular namespace. Attributes are properties which belong to an identity. Each identity can have multiple attributes.

Attributes are made unique by their identities.

Identities are the network names given to servers. Attributes are the characteristics of each server.

Obtain provider permission for test

Use techniques to evade cloud provider’s detection systems

Use application layer testing tools exclusively

Use network layer testing tools exclusively

Schedule vulnerability test at night

False

True

Any encryption option that is available for volume storage, object storage, or PaaS

Provider-managed and (sometimes) proxy encryption

Client/application and file/folder encryption

Object encryption Volume storage encryption

The Data Security Lifecycle has six stages, is strictly linear, and never varies.

The Data Security Lifecycle has six stages, can be non-linear, and varies in that some data may never pass through all stages.

The Data Security Lifecycle has five stages, is circular, and varies in that some data may never pass through all stages.

The Data Security Lifecycle has six stages, can be non-linear, and is distinct in that data must always pass through all phases.

The Data Security Lifecycle has five stages, can be non-linear, and is distinct in that data must always pass through all phases.

Administrative access

Management plane

Identity and Access Management

Single sign-on

Cloud dashboard

Service Provider or Tenant/Consumer

Physical, Network, Compute, Storage, Application or Data

SaaS, PaaS or IaaS

False

True

Access control

Federated Identity Management

Authoritative source

Entitlement

Authentication

By proxying or redirecting web traffic to the cloud provider

By utilizing a partitioned network drive

On the premise through a software or appliance installation

Both A and C

None of the above

Inspect and account for risks inherited from other members of the cloud supply chain and take active measures to mitigate and contain risks through operational resiliency.

Respect the interdependency of the risks inherent in the cloud supply chain and communicate the corporate risk posture and readiness to consumers and dependent parties.

Negotiate long-term contracts with companies who use well-vetted software application to avoid the transient nature of the cloud environment.

Provide transparency to stakeholders and shareholders demonstrating fiscal solvency and organizational transparency.

Both B and C.

False

True

A library of data definitions

A group of entities which have decided to exist together in a single

cloud

Identities which share similar attributes

Several countries which have agreed to define their identities with

similar attributes

The connection of one identity repository to another

Infrastructure

Datastructure

Infostructure

Applistructure

Metastructure

The on demand self-service nature of cloud computing environments.

Privacy concerns for co-tenants regarding the collection and analysis of telemetry and artifacts associated with an incident.

The possibility of data crossing geographic or jurisdictional boundaries.

Object-based storage in a private cloud.

The resource pooling practiced by cloud services, in addition to the rapid elasticity offered by cloud infrastructures.

The process of specifying and maintaining access policies

Checking data storage to make sure it meets compliance requirements

Giving a third party vendor permission to work on your cloud solution

Establishing/asserting the identity to the application

Enforcing the rules by which access is granted to the resources

False

True

It reduces hardware costs

It provides dynamic and granular policies with less management overhead

It locks down access and provides stronger data security

It reduces the blast radius of a compromised system

It enables you to configure applications around business groups

You should apply cloud firewalls on a per-network basis.

You should deploy your cloud firewalls identical to the existing firewalls.

You should always open traffic between workloads in the same virtual subnet for better visibility.

You should implement a default allow with cloud firewalls and then restrict as necessary.

You should implement a default deny with cloud firewalls.

Application logic

Access controls

Encryption solutions

Physical destruction

Asset management and tracking

False

True

Encryption

Organization

Knowledge management

IDS

Insulation

Platform-as-a-service (PaaS)

Desktop-as-a-service (DaaS)

Infrastructure-as-a-service (IaaS)

Identity-as-a-service (IDaaS)

Software-as-a-service (SaaS)

It may require a subpoena of the provider directly

It would require a previous access agreement

It would require an act of war

It would require a previous contractual agreement to obtain the application or access to the environment

It would never be obtained in this situation

Code Review

Static Application Security Testing (SAST)

Unit Testing

Functional Testing

Dynamic Application Security Testing (DAST)

The CSP server facility

The logs of all customers in a multi-tenant cloud

The network components controlled by the CSP

The CSP office spaces

Their own virtual instances in the cloud

Auditors working in the interest of the cloud customer

Independent auditors

Certified by CSA

Auditors working in the interest of the cloud provider

None of the above

The metrics defining the service level required to achieve regulatory objectives.

The duration of time that a security violation can occur before the client begins assessing regulatory fines.

The cost per incident for security breaches of regulated information.

The regulations that are pertinent to the contract and how to circumvent them.

The type of security software which meets regulations and the number of licenses that will be needed.

Multi-application, single tenant environments

Long distance relationships

Multi-tenant environments

Distributed computing arrangements

Single tenant environments