Question 1

Which of the following roles is responsible for creating cloud components and the testing and validation of services?

Accepted Answer

The cloud service developer is responsible for developing and creating cloud components and services, as well as for testing and validating services.

Question 2

Which crucial aspect of cloud computing can be most threatened by insecure APIs?

Accepted Answer

Cloud environments depend heavily on API calls for management and automation. Any vulnerability with the APIs can cause significant risk and exposure to all tenants of the cloud environment. Resource pooling and elasticity could both be impacted by insecure APIs, as both require automation and orchestration to operate properly, but automation is the better answer here. Redundancy would not be directly impacted by insecure APIs.

Question 3

Every security program and process should have which of the following?

Accepted Answer

Policy drives all programs and functions in the organization; the organization should not conduct any operations that don't have a policy governing them. Penalties may or may not be an element of policy, and severity depends on the topic. Multifactor authentication and homomorphic encryption are red herrings here.

Question 4

Security is a critical yet often overlooked consideration for BCDR planning. At which stage of the planning process should security be involved?

Accepted Answer

Defining the scope of the plan is the very first step in the overall process. Security should be included from the very earliest stages and throughout the entire process. Bringing in security at a later stage can lead to additional costs and time delays to compensate for gaps in planning. Risk assessment, requirements gathering, and analysis are all later steps in the process, and adding in security at any of those points can potentially cause increased costs and time delays.

Question 5

Which of the following is NOT part of a retention policy?

Accepted Answer

The data retention policy covers the duration, format, technologies, protection, and accessibility of archives, but does not address the specific costs of its implementation and maintenance.

Question 6

Within a federated identity system, which of the following would you be MOST likely to use for sending information for consumption by a relying party?

Accepted Answer

The Security Assertion Markup Language (SAML) is the most widely used method for encoding and sending attributes and other information from an identity provider to a relying party.WS-Federation, which is used by Active Directory Federation Services (ADFS), is the second most used method for sending information to a relying party, but it is not a better choice than SAML. XML is similar to SAML in the way it encodes and labels data, but it does not have all of the required extensions that SAML does. HTML is not used within federated systems at all.

Question 7

Which of the following is considered an external redundancy for a data center?

Accepted Answer

Generators are considered an external redundancy to a data center. Power distribution units (PDUs), storage systems, and power feeds to racks are all internal to a data center, and as such they are considered internal redundancies.

Question 8

Which value refers to the amount of data an organization would need to recover in the event of a BCDR situation in order to reach an acceptable level of operations?

Accepted Answer

The recovery point objective (RPO) is defined as the amount of data a company would need to maintain and recover in order to function at a level acceptable to management. This may or may not be a restoration to full operating capacity, depending on what management deems as crucial and essential.

Question 9

Which aspect of cloud computing will be most negatively impacted by vendor lock-in?

Accepted Answer

A cloud customer utilizing proprietary APIs or services from one cloud provider that are unlikely to be available from another cloud provider will most negatively impact portability.

Question 10

In addition to battery backup, a UPS can offer which capability?

Accepted Answer

A UPS can provide line conditioning, adjusting power so that it is optimized for the devices it serves and smoothing any power fluctuations; it does not offer any of the other listed functions.

Question 11

What concept does the A represent within the DREAD model?

Accepted Answer

The concept of affected users measures the percentage of users who would be impacted by a successful exploit. Scoring ranges from 0, which would impact no users, to 10, which would impact all users. None of the other options provided is the correct term.

Question 12

Data labels could include all the following, except:

Accepted Answer

All the others might be included in data labels, but multifactor authentication is a procedure used for access control, not a label.

Question 13

The WS-Security standards are built around all of the following standards except which one?

Accepted Answer

The WS-Security specifications, as well as the WS-Federation system, are built upon XML, WDSL, and SOAP. SAML is a very similar protocol that is used as an alternative to WS.XML, WDSL, and SOAP are all integral to the WS-Security specifications.

Question 14

The GAPP framework was developed through a joint effort between the major Canadian and American professional accounting associations in order to assist their members with managing and preventing risks to the privacy of their data and customers. Which of the following is the meaning of GAPP?

Accepted Answer

The GAPP framework stands for "Generally Accepted Privacy Principles," which is designed to help organizations manage and protect personal information effectively.

Question 15

Having a reservation in a cloud environment can ensure operations continue in the event of high utilization across the cloud. Which of the following would NOT be a capability covered by reservations?

Accepted Answer

A reservation will not guarantee auto-scaling is available because it involves the allocation of additional resources beyond what a cloud customer already has provisioned. Reservations will guarantee minimal resources are available to start virtual machines, run applications, and perform normal business operations.

Question 16

What type of host is exposed to the public Internet for a specific reason and hardened to perform only that function for authorized users?

Accepted Answer

A bastion host is a server that is fully exposed to the public Internet, but is extremely hardened to prevent attacks and is usually dedicated for a specific application or usage; it is not something that will serve multiple purposes. This singular focus allows for much more stringent security hardening and monitoring.

Question 17

What concept does the D represent within the STRIDE threat model?

Accepted Answer

Any application can be a possible target of denial of service (DoS) attacks. From the application side, the developers should minimize how many operations are performed for unauthenticated users. This will keep the application running as quickly as possible and using the least amount of system resources to help minimize the impact of any such attacks. None of the other options provided is the correct term.

Question 18

Which of the following best describes the purpose and scope of ISO/IEC 27034-1?

Accepted Answer

ISO/IEC 27034-1 provides an overview of application security, introducing concepts, principles, and processes involved in securing applications.

Question 19

Which of the following standards primarily pertains to cabling designs and setups in a data center?

Accepted Answer

The standards put out by Building Industry Consulting Service International (BICSI) primarily cover complex cabling designs and setups for data centers, but also include specifications on power, energy efficiency, and hot/cold aisle setups.

Question 20

Many activities within a cloud environment are performed via programmatic means, where complex and distributed operations are handled without the need to perform each step individually. Which of the following concepts does this describe?

Accepted Answer

Orchestration is the programmatic means of managing and coordinating activities within a cloud environment and allowing for a commensurate level of automation and self-service. Provisioning, allocation, and automation are all components of orchestration, but none refers to the overall concept.

Exam 2: Certified Cloud Security Professional (CCSP)