Question 1

What are SOC 1/SOC 2/SOC 3?

Accepted Answer

An SOC 1 is a report on controls at a service organization that may be relevant to a user entity's internal control over financial reporting. An SOC 2 report is based on the existing SysTrust and WebTrust principles. The purpose of an SOC 2 report is to evaluate an organization's information systems relevant to security, availability, processing integrity, confidentiality, or privacy. An SOC 3 report is also based on the existing SysTrust and WebTrust principles, like a SOC 2 report. The difference is that the SOC 3 report does not detail the testing performed.

Question 2

Which of the following is the MOST important requirement and guidance for testing during an audit?

Accepted Answer

During any audit, regulations are the most important factor and guidelines for what must be tested. Although the requirements from management, stakeholders, and shareholders are also important, regulations are not negotiable and pose the biggest risk to any organization for compliance failure.

Question 3

Many aspects and features of cloud computing can make eDiscovery compliance more difficult or costly. Which aspect of cloud computing would be the MOST complicating factor?

Accepted Answer

With multitenancy, multiple customers share the same physical hardware and systems. With the nature of a cloud environment and how it writes data across diverse systems that are shared by others, the process of eDiscovery becomes much more complicated. Administrators cannot pull physical drives or easily isolate which data to capture. They not only have to focus on which data they need to collect, while ensuring they find all of it, but they also have to make sure that other data is not accidently collected and exposed along with it. Measured service is the aspect of a cloud where customers only pay for the services they are actually using, and for the duration of their use. Portability refers to the ease with which an application or service can be moved among different cloud providers. Broad network access refers to the nature of cloud services being accessed via the public Internet, either with or without secure tunneling technologies. None of these concepts would pertain to eDiscovery.

Question 4

All of the following are terms used to described the practice of obscuring original raw data so that only a portion is displayed for operational purposes, except:

Accepted Answer

Data discovery is a term used to describe the process of identifying information according to specific traits or categories. The rest are all methods for obscuring data.

Question 5

Which of the following terms is NOT a commonly used category of risk acceptance?

Accepted Answer

"Accepted" is not a category of risk acceptance; it is a state or decision regarding risk. Common categories include terms like "Minimal," "Moderate," and "Critical," which describe the level of risk.

Question 6

A comprehensive BCDR plan will encapsulate many or most of the traditional concerns of operating a system in any data center. However, what is one consideration that is often overlooked with the formulation of a BCDR plan?

Accepted Answer

BCDR planning tends to focus so much on the failing over of services in the case of a disaster that recovery back to primary hosting after the disaster is often overlooked. In many instances, this can be just as complex a process as failing over, if not more so. Availability of staff, capacity at the BCDR site, and change management processes are typically integral to BCDR plans and are common components of them.

Question 7

Which of the following storage types is most closely associated with a traditional file system and tree structure?

Accepted Answer

Volume storage works as a virtual hard drive that is attached to a virtual machine. The operating system sees the volume the same as how a traditional drive on a physical server would be seen.

Question 8

Which of the following are the storage types associated with PaaS?

Accepted Answer

PaaS (Platform as a Service) typically involves storage types that are structured (like databases) and unstructured (like file storage).

Question 9

Which of the cloud deployment models involves spanning multiple cloud environments or a mix of cloud hosting models?

Accepted Answer

A hybrid cloud model involves the use of more than one type of cloud hosting models, typically the mix of private and public cloud hosting models.

Question 10

What is the experimental technology that might lead to the possibility of processing encrypted data without having to decrypt it first?

Accepted Answer

AES is an encryption standard. Link encryption is a method for protecting communications traffic. One-time pads are an encryption method.

Question 11

Which data state would be most likely to use TLS as a protection mechanism?

Accepted Answer

TLS would be used with data in transit, when packets are exchanged between clients or services and sent across a network. During the data-in-use state, the data is already protected via a technology such as TLS as it is exchanged over the network and then relies on other technologies such as digital signatures for protection while being used. The data-at-rest state primarily uses encryption for stored file objects. Archived data would be the same as data at rest.

Question 12

Which of the following is the least challenging with regard to eDiscovery in the cloud?

Accepted Answer

Forensic analysis is the least challenging of the answers provided as it refers to the analysis of data once it is obtained. The challenges revolve around obtaining the data for analysis due to the complexities of international law, the decentralization of data storage or difficulty knowing where to look, and identifying the data owner, controller, and processor.

Question 13

Database activity monitoring (DAM) can be:

Accepted Answer

We don't use DAM in place of encryption or masking; DAM augments these options without replacing them. We don't usually think of the database interaction as client-server, so A is the best answer.

Question 14

Which of the following is a commonly used tool for maintaining system configurations?

Accepted Answer

Puppet is a commonly used tool for maintaining system configurations based on policies, and done so from a centralized authority.

Question 15

What is the concept of segregating information or processes, within the same system or application, for security reasons?

Accepted Answer

Sandboxing involves segregating and isolating information or processes from others within the same system or application, typically for security concerns. This is generally used for data isolation (for example, keeping different communities and populations of users isolated from other similar data).

Question 16

Which of the following is the sole responsibility of the cloud customer, regardless of which cloud model is used?

Accepted Answer

Regardless of which cloud-hosting model is used, the cloud customer always has sole responsibility for the governance of systems and data.

Question 17

A main objective for an organization when utilizing cloud services is to avoid vendor lock-in so as to ensure flexibility and maintain independence. Which core concept of cloud computing is most related to vendor lock-in?

Accepted Answer

Portability is the ability for a cloud customer to easily move their systems, services, and applications among different cloud providers. By avoiding reliance on proprietary APIs and other vendor-specific cloud features, an organization can maintain flexibility to move among the various cloud providers with greater ease. Reversibility refers to the ability for a cloud customer to quickly and easy remove all their services and data from a cloud provider. Interoperability is the ability to reuse services and components for other applications and uses. Scalability refers to the ability of a cloud environment to add or remove resources to meet current demands.

Question 18

Which jurisdiction lacks specific and comprehensive privacy laws at a national or top level of legal authority?

Accepted Answer

The United States lacks a single comprehensive law at the federal level addressing data security and privacy, but there are multiple federal laws that deal with different industries.

Question 19

What is the biggest concern with hosting a key management system outside of the cloud environment?

Accepted Answer

When a key management system is outside of the cloud environment hosting the application, availability is a primary concern because any access issues with the encryption keys will render the entire application unusable.

Question 20

Your company is in the planning stages of moving applications that have large data sets to a cloud environment. What strategy for data removal would be the MOST appropriate for you to recommend if costs and speed are primary considerations?

Accepted Answer

Cryptographic erasure involves having the data encrypted, typically as a matter of standard operations, and then rendering the data useless and unreadable by destroying the encryption keys for it. It represents a very cheap and immediate way to destroy data, and it works in all environments. With a cloud environment and multitenancy, media destruction or the physical destruction of storage devices, including shredding, would not be possible. Depending on the environment, overwriting may or may not be possible, but cryptographic erasure is the best answer because it is always an available option and is very quick to implement.

Exam 2: Certified Cloud Security Professional (CCSP)