ISC2 CCSP Exam Dumps

ISC2 CCSP Sample Question Answers

Question # 1

What are the U.S. Commerce Department controls on technology exports known as? 

A. ITAR 
B. DRM 
C. EAR 
D. EAL 

Show Answer

Question # 2

Cloud systems are increasingly used for BCDR solutions for organizations. What aspect of cloud computing makes their use for BCDR the most attractive? 

A. On-demand self-service 
B. Measured service 
C. Portability 
D. Broad network access 

Show Answer

Question # 3

With the rapid emergence of cloud computing, very few regulations were in place that pertained to it specifically, and organizations often had to resort to using a collection of regulations that were not specific to cloud in order to drive audits and policies. Which standard from the ISO/IEC was designed specifically for cloud computing? 

A. ISO/IEC 27001 
B. ISO/IEC 19889 
C. ISO/IEC 27001:2015 
D. ISO/IEC 27018 

Show Answer

Question # 4

When reviewing the BIA after a cloud migration, the organization should take into account new factors related to data breach impacts. One of these new factors is: 

A. Many states have data breach notification laws. 
B. Breaches can cause the loss of proprietary data. 
C. Breaches can cause the loss of intellectual property. 
D. Legal liability can’t be transferred to the cloud provider. 

Show Answer

Question # 5

DLP solutions can aid in deterring loss due to which of the following? 

A. Inadvertent disclosure 
B. Natural disaster
 C. Randomization 
D. Device failure 

Show Answer

Question # 6

What is the intellectual property protection for the tangible expression of a creative idea? 

A. Trade secret 
B. Copyright 
C. Trademark 
D. Patent 

Show Answer

Question # 7

Which of the following is NOT considered a type of data loss?

 A. Data corruption 
B. Stolen by hackers 
C. Accidental deletion 
D. Lost or destroyed encryption keys 

Show Answer

Question # 8

All of the following are techniques to enhance the portability of cloud data, in order to minimize the potential of vendor lock-in except: 

A. Ensure there are no physical limitations to moving
 B. Use DRM and DLP solutions widely throughout the cloud operation 
C. Ensure favorable contract terms to support portability 
D. Avoid proprietary data formats 

Show Answer

Question # 9

Which of the following statements about Type 1 hypervisors is true? 

A. The hardware vendor and software vendor are different. 
B. The hardware vendor and software vendor are the same 
C. The hardware vendor provides an open platform for software vendors.
 D. The hardware vendor and software vendor should always be different for the sake of security. 

Show Answer

Question # 10

Which data protection strategy would be useful for a situation where the ability to remove sensitive data from a set is needed, but a requirement to retain the ability to map back to the original values is also present? 

A. Masking 
B. Tokenization 
C. Encryption 
D. Anonymization

Show Answer

Question # 11

Which data sanitation method is also commonly referred to as "zeroing"? 

A. Overwriting 
B. Nullification 
C. Blanking 
D. Deleting 

Show Answer

Question # 12

Which cloud service category most commonly uses client-side key management systems? 

A. Software as a Service 
B. Infrastructure as a Service 
C. Platform as a Service 
D. Desktop as a Service 

Show Answer

Question # 13

What are the U.S. State Department controls on technology exports known as? 

A. DRM 
B. ITAR 
C. EAR 
D. EAL 

Show Answer

Question # 14

There are many situations when testing a BCDR plan is appropriate or mandated. Which of the following would not be a necessary time to test a BCDR plan?

 A. After software updates 
B. After regulatory changes 
C. After major configuration changes 
D. Annually 

Show Answer

Question # 15

BCDR strategies typically do not involve the entire operations of an organization, but only those deemed critical to their business. Which concept pertains to the amount of data and services needed to reach the predetermined level of operations? 

A. SRE 
B. RPO 
C. RSL 
D. RTO

Show Answer

Question # 16

Which of the following best describes SAML? 

A. A standard used for directory synchronization 
B. A standard for developing secure application management logistics 
C. A standard for exchanging usernames and passwords across devices. 
D. A standards for exchanging authentication and authorization data between security domains. 

Show Answer

Question # 17

Tokenization requires two distinct _________________ . 

A. Personnel
 B. Authentication factors 
C. Encryption keys 
D. Databases 

Show Answer

Question # 18

A data custodian is responsible for which of the following? 

A. Data context 
B. Data content 
C. The safe custody, transport, storage of the data, and implementation of business rules 
D. Logging access and alerts

Show Answer

Question # 19

When using an IaaS solution, what is the capability provided to the customer? 

A. To provision processing, storage, networks, and other fundamental computing resources when the consumer is able to deploy and run arbitrary software, which can include OSs and applications. 
B. To provision processing, storage, networks, and other fundamental computing resources when the auditor is able to deploy and run arbitrary software, which can include OSs and applications. 
C. To provision processing, storage, networks, and other fundamental computing resources when the provider is able to deploy and run arbitrary software, which can include OSs and applications. 
D. To provision processing, storage, networks, and other fundamental computing resources when the consumer is not able to deploy and run arbitrary software, which can include OSs and applications. 

Show Answer

Question # 20

Because cloud providers will not give detailed information out about their infrastructures and practices to the general public, they will often use established auditing reports to ensure public trust, where the reputation of the auditors serves for assurance. Which type of audit reports can be used for general public trust assurances? 

A. SOC 2 
B. SAS-70 
C. SOC 3  
D. SOC 1 

Show Answer

Question # 21

When an organization is considering the use of cloud services for BCDR planning and solutions, which of the following cloud concepts would be the most important? 

A. Reversibility 
B. Elasticity 
C. Interoperability 
D. Portability 

Show Answer

Question # 22

Maintenance mode requires all of these actions except: 

A. Remove all active production instances 
B. Ensure logging continues 
C. Initiate enhanced security controls 
D. Prevent new logins 

Show Answer

Question # 23

On large distributed systems with pooled resources, cloud computing relies on extensive orchestration to maintain the environment and the constant provisioning of resources. Which of the following is crucial to the orchestration and automation of networking resources within a cloud? 

A. DNSSEC 
B. DNS 
C. DCOM 
D. DHCP 

Show Answer

Question # 24

Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like: 

A. Ransomware 
B. Syn floods 
C. XSS and SQL injection 
D. Password cracking 

Show Answer

Question # 25

Which format is the most commonly used standard for exchanging information within a federated identity system? 

A. XML 
B. HTML 
C. SAML 
D. JSON 

Show Answer

Question # 26

What is a key capability or characteristic of PaaS?

A. Support for a homogenous environment 
B. Support for a single programming language 
C. Ability to reduce lock-in 
D. Ability to manually scale 

Show Answer

Question # 27

Which of the following is the primary purpose of an SOC 3 report? 

A. HIPAA compliance 
B. Absolute assurances 
C. Seal of approval 
D. Compliance with PCI/DSS 

Show Answer

Question # 28

The application normative framework is best described as which of the following? 

A. A superset of the ONF 
B. A stand-alone framework for storing security practices for the ONF 
C. The complete ONF 
D. A subnet of the ONF 

Show Answer

Question # 29

Whereas a contract articulates overall priorities and requirements for a business relationship, which artifact enumerates specific compliance requirements, metrics, and response times? 

A. Service level agreement 
B. Service level contract
 C. Service compliance contract 
D. Service level amendment 

Show Answer

Question # 30

Legal controls refer to which of the following? 

A. ISO 27001 
B. PCI DSS 
C. NIST 800-53r4 
D. Controls designed to comply with laws and regulations related to the cloud environment 

Show Answer

Question # 31

Different security testing methodologies offer different strategies and approaches to testing systems, requiring security personnel to determine the best type to use for their specific circumstances. What does dynamic application security testing (DAST) NOT entail that SAST does? 

A. Discovery 
B. Knowledge of the system 
C. Scanning 
D. Probing 

Show Answer

Question # 32

When data discovery is undertaken, three main approaches or strategies are commonly used to determine what the type of data, its format, and composition are for the purposes of classification. Which of the following is NOT one of the three main approaches to data discovery?

 A. Content analysis 
B. Hashing 
C. Labels 
D. Metadata 

Show Answer

Question # 33

In a cloud environment, encryption should be used for all the following, except: 

A. Secure sessions/VPN 
B. Long-term storage of data 
C. Near-term storage of virtualized images 
D. Profile formatting

Show Answer

Question # 34

IRM solutions allow an organization to place different restrictions on data usage than would otherwise be possible through traditional security controls. Which of the following controls would be possible with IRM that would not with traditional security controls? 

A. Copy 
B. Read 
C. Delete 
D. Print

Show Answer

Question # 35

Which of the following is considered a technological control? 

A. Firewall software 
B. Firing personnel 
C. Fireproof safe 
D. Fire extinguisher 

Show Answer

Question # 36

Which ITIL component is an ongoing, iterative process of tracking all deployed and configured resources that an organization uses and depends on, whether they are hosted in a traditional data center or a cloud? 

A. Problem management 
B. Continuity management 
C. Availability management 
D. Configuration management 

Show Answer

Question # 37

Data labels could include all the following, except: 

A. Data value 
B. Data of scheduled destruction 
C. Date data was created 
D. Data owner 

Show Answer

Question # 38

Which of the following technologies is NOT commonly used for accessing systems and services in a cloud environment in a secure manner? 

A. KVM 
B. HTTPS 
C. VPN 
D. TLS

Show Answer

Question # 39

The goals of SIEM solution implementation include all of the following, except: 

A. Dashboarding 
B. Performance enhancement 
C. Trend analysis 
D. Centralization of log streams 

Show Answer

Question # 40

Which of the following are attributes of cloud computing? 

A. Minimal management effort and shared resources
B. High cost and unique resources
 C. Rapid provisioning and slow release of resources 
D. Limited access and service provider interaction

Show Answer

Question # 41

Data masking can be used to provide all of the following functionality, except: 

A. Secure remote access 
B. test data in sandboxed environments 
C. Authentication of privileged users 
D. Enforcing least privilege 

Show Answer

Question # 42

What does static application security testing (SAST) offer as a tool to the testers that makes it unique compared to other common security testing methodologies? 

A. Live testing 
B. Source code access 
C. Production system scanning 
D. Injection attempts

Show Answer

Question # 43

What is one of the reasons a baseline might be changed? 

A. Numerous change requests 
B. To reduce redundancy 
C. Natural disaster 
D. Power fluctuation 

Show Answer

Question # 44

When using a PaaS solution, what is the capability provided to the customer? 

A. To deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools that the provider supports. The provider does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment. 
B. To deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools that the provider supports. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment. 
C. To deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools that the consumer supports. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.
 D. To deploy onto the cloud infrastructure provider-created or acquired applications created using programming languages, libraries, services, and tools that the provider supports. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.

Show Answer

Question # 45

What are third-party providers of IAM functions for the cloud environment? 

A. AESs 
B. SIEMs 
C. DLPs 
D. CASBs 

Show Answer

Question # 46

A variety of security systems can be integrated within a network--some that just monitor for threats and issue alerts, and others that take action based on signatures, behavior, and other types of rules to actively stop potential threats. Which of the following types of technologies is best described here? 

A. IDS 
B. IPS 
C. Proxy
 D. Firewall 

Show Answer

Question # 47

Which component of ITIL pertains to planning, coordinating, executing, and validating changes and rollouts to production environments? 

A. Release management 
B. Availability management 
C. Problem management 
D. Change management 

Show Answer

Question # 48

All of these are methods of data discovery, except: 

A. Label-based 
B. User-based 
C. Content-based 
D. Metadata-based

Show Answer

Question # 49

Which of the following terms is NOT a commonly used category of risk acceptance? 

A. Moderate 
B. Critical 
C. Minimal 
D. Accepted 

Show Answer

Question # 50

Which of the following is not an example of a highly regulated environment?

 A. Financial services 
B. Healthcare
 C. Public companies 
D. Wholesale or distribution 

Show Answer

Question # 51

Which of the following is a management role, versus a technical role, as it pertains to data management and oversight? 

A. Data owner 
B. Data processor 
C. Database administrator 
D. Data custodian 

Show Answer