Question 1

Which of the following would NOT be considered part of resource pooling with an Infrastructure as a Service implementation?

Accepted Answer

Infrastructure as a Service pools the compute resources for platforms and applications to build upon, including CPU, memory, and storage. Applications are not part of an IaaS offering from the cloud provider.

Question 2

Countermeasures for protecting cloud operations against internal threats include all of the following except:

Accepted Answer

Hardened perimeter devices are more useful at attenuating the risk of external attack.

Question 3

Which concept BEST describes the capability for a cloud environment to automatically scale a system or application, based on its current resource demands?

Accepted Answer

Rapid elasticity allows a cloud environment to automatically add or remove resources to or from a system or application based on its current demands. Whereas a traditional data center model would require standby hardware and substantial effort to add resources in response to load increases, a cloud environment can easily and rapidly expand to meet resources demands, so long as the application is properly implemented for it.

Question 4

Data masking can be used to provide all of the following functionality, except:

Accepted Answer

Data masking does not support authentication in any way. All the others are excellent use cases for data masking.

Question 5

What does the REST API use to protect data transmissions?

Accepted Answer

Representational State Transfer (REST) uses TLS for communication over secured channels. Although REST also supports SSL, at this point SSL has been phased out due to vulnerabilities and has been replaced by TLS.

Question 6

All the following are data analytics modes, except:

Accepted Answer

All the others are data analytics methods, but "refractory iterations" is a nonsense term thrown in as a red herring.

Question 7

What concept and operational process must be spelled out clearly, as far as roles and responsibilities go, between the cloud provider and cloud customer for the mitigation of any problems or security events?

Accepted Answer

Incident response is the process through which security or operational issues are handled, including and coordination with and communication to the appropriate stakeholders. None of the other terms provided is the correct response.

Question 8

What is an experimental technology that is intended to create the possibility of processing encrypted data without having to decrypt it first?

Accepted Answer

Homomorphic encryption hopes to achieve that goal; the other options are terms that have almost nothing to do with encryption.

Question 9

Which component of ITIL involves handling anything that can impact services for either internal or public users?

Accepted Answer

Incident management is responsible for handling any event that disrupts or could disrupt a service, impacting users.

Question 10

What does the REST API support that SOAP does NOT support?

Accepted Answer

The SOAP protocol does not support caching, whereas the REST API does.

Question 11

The president of your company has tasked you with implementing cloud services as the most efficient way of obtaining a robust disaster recovery configuration for your production services. Which of the cloud deployment models would you MOST likely be exploring?

Accepted Answer

A hybrid cloud model spans two more different hosting configurations or cloud providers. This would enable an organization to continue using its current hosting configuration, while adding additional cloud services to enable disaster recovery capabilities. The other cloud deployment models--public, private, and community--would not be applicable for seeking a disaster recovery configuration where cloud services are to be leveraged for that purpose rather than production service hosting.

Question 12

The European Union passed the first major regulation declaring data privacy to be a human right. In what year did it go into effect?

Accepted Answer

Adopted in 1995, Directive 95/46 EC establishes strong data protection and policy requirements, including the declaring of data privacy to be a human right. It establishes that an individual has the right to be notified when their personal data is being access or processed, that it only will ever be accessed for legitimate purposes, and that data will only be accessed to the exact extent it needs to be for the particular process or request.

Question 13

In the wake of many scandals with major corporations involving fraud and the deception of investors and regulators, which of the following laws was passed to govern accounting and financial records and disclosures?

Accepted Answer

The Sarbanes-Oxley Act (SOX) regulates the financial and accounting practices used by organizations in order to protect shareholders from improper practices and accounting errors.The Health Insurance Portability and Accountability Act (HIPAA) pertains to the protection of patient medical records and privacy. The Gramm-Leach-Bliley Act (GLBA) focuses on the use of PII within financial institutions. The Safe Harbor program was designed by the US government as a way for American companies to comply with European Union privacy laws.

Question 14

Although the REST API supports a wide variety of data formats for communications and exchange, which data formats are the most commonly used?

Accepted Answer

JavaScript Object Notation (JSON) and Extensible Markup Language (XML) are the most commonly used data formats for the Representational State Transfer (REST) API and are typically implemented with caching for increased scalability and performance. Extensible Markup Language (XML) and Security Assertion Markup Language (SAML) are both standards for exchanging encoded data between two parties, with XML being for more general use and SAML focused on authentication and authorization data. HTML is used for authoring web pages for consumption by web browsers

Question 15

What is the biggest negative to leasing space in a data center versus building or maintain your own?

Accepted Answer

When leasing space in a data center, an organization will give up a large degree of control as to how it is built and maintained, and instead must conform to the policies and procedures of the owners and operators of the data center.

Question 16

In the cloud motif, the data processor is usually:

Accepted Answer

In legal terms, when "data processor" is defined, it refers to anyone who stores, handles, moves, or manipulates data on behalf of the data owner or controller. In the cloud computing realm, this is the cloud provider.

Question 17

What is the intellectual property protection for a confidential recipe for muffins?

Accepted Answer

Confidential recipes unique to the organization are trade secrets. The other answers listed are answers to other questions.

Question 18

Firewalls are used to provide network security throughout an enterprise and to control what information can be accessed--and to a certain extent, through what means. Which of the following is NOT something that firewalls are concerned with?

Accepted Answer

Firewalls work at the network level and control traffic based on the source, destination, protocol, and ports. Whether or not the traffic is encrypted is not a factor with firewalls and their decisions about routing traffic. Firewalls work primarily with IP addresses, ports, and protocols.

Question 19

Which one of the following threat types to applications and services involves the sending of requests that are invalid and manipulated through a user's client to execute commands on the application under the user's own credentials?

Accepted Answer

A cross-site request forgery (CSRF) attack forces a client that a user has used to authenticate to an application to send forged requests under the user's own credentials to execute commands and requests that the application thinks are coming from a trusted client and user. Although this type of attack cannot be used to steal data directly because the attacker has no way of seeing the results of the commands, it does open other ways to compromise an application. Missing function-level access control exists where an application only checks for authorization during the initial login process and does not further validate with each function call. Cross-site scripting occurs when an attacker is able to send untrusted data to a user's browser without going through validation processes. An injection attack is where a malicious actor sends commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries.

Question 20

You were recently hired as a project manager at a major university to implement cloud services for the academic and administrative systems. Because the load and demand for services at a university are very cyclical in nature, commensurate with the academic calendar, which of the following aspects of cloud computing would NOT be a primary benefit to you?

Accepted Answer

Broad network access to cloud services, although it is an integral aspect of cloud computing, would not being a specific benefit to an organization with cyclical business needs. The other options would allow for lower costs during periods of low usage as well as provide the ability to expand services quickly and easily when needed for peak periods. Measured service allows a cloud customer to only use the resources it needs at the time, and resource pooling allows a cloud customer to access resources as needed. On-demand self-service enables the cloud customer to change its provisioned resources on its own, without the need to interact with the staff from the cloud provider.

Exam 2: Certified Cloud Security Professional (CCSP)