10 free EC-Council 312-40 CCSE practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 147 questions. Work through them, then open each answer to check your reasoning.
Get all 147 questions (US$39) · Download these 10 as a PDF
Question 1
Lexie Roth works as a cloud security engineer in an IT company located in Boston, Massachusetts. Her organization generates a huge amount of data. To increase the storage size, speed, and fault tolerance, Lexie would like to configure and create a RAID. Therefore, she created a RAID on Windows Server 2016, which includes bloc-evel striping with a distributed parity. The parity information is distributed among all drives, except one. The data chunks in the RAID are larger than the regular I/O size, but they can be re-sized. To prevent data loss after a drive fails, data are calculated from the distributed parity. The RAID configured by Lexie requires at least three disks, but for robust performance, Lexie used seven disks. Based on the given information, which of the following RAID was configured and created by Lexie?
Show answer and explanation
Correct answer: B. RAID 5
RAID 5 uses block-level striping with distributed parity across all drives, where parity information is spread among all disks except one. It requires a minimum of three drives and can recover from a single drive failure using the distributed parity. The stripe size (data chunks) is configurable. Lexie's seven-disk configuration with these exact characteristics describes RAID 5.
Why the other options are wrong
- A. RAID 3 uses byte-level striping with a dedicated parity drive, not distributed parity across all drives.
- C. RAID 1 is mirroring without striping and does not use distributed parity.
- D. RAID 0 is striping without parity and provides no fault tolerance or data recovery capability.
Question 2
Cindy Williams has been working as a cloud security engineer in an IT company situated in Austin, Texas. Owing to the robust security and cost-effective features provided by AWS, her organization adopted AWS cloud-based services. Cindy has deployed an application in the Amazon Elastic Compute Cloud (EC2) instance.
Which of the following cloud computing service model does the Amazon EC2 instance represent?
Show answer and explanation
Correct answer: D. IaaS
Amazon EC2 provides virtual computing resources where users can deploy applications on virtualized hardware infrastructure. IaaS (Infrastructure-as-a-Service) is the model where the cloud provider manages virtualization, storage, and networking while the customer manages the operating system, middleware, and applications. EC2 exemplifies this model by providing compute infrastructure on demand.
Why the other options are wrong
- A. SaaS delivers complete applications over the internet; EC2 provides infrastructure, not finished applications.
- B. DaaS (Desktop-as-a-Service) delivers virtual desktop environments; EC2 provides compute instances for various uses.
- C. PaaS provides a platform with pre-configured services for development; EC2 is raw infrastructure requiring more customer management.
Question 3
Billy Pratt works as a cloud security engineer in an MNC. In 2012, his organization transferred all applications and data into an AWS cloud environment. Billy would like to analyze, investigate, and identify the root cause of malicious activities in his organization’s AWS cloud environment.
Which of the following Amazon services automatically collects data from various AWS resources and utilizes machine learning, statistical analysis, and graph theory to provide a unified and interactive view of resources and users that would help Billy in determining the root cause of suspicious activities?
Show answer and explanation
Correct answer: B. Amazon Detective
Amazon Detective automatically collects data from AWS resources including VPC Flow Logs, CloudTrail, and GuardDuty findings. It applies machine learning, statistical analysis, and graph theory to analyze relationships between resources and users, providing visualization of suspicious activities and helping determine root causes of security incidents.
Why the other options are wrong
- A. Amazon Inspector performs vulnerability assessments on EC2 instances and applications; it does not investigate existing malicious activities.
- C. Amazon GuardDuty detects threats and generates findings but does not provide the investigative analysis and root cause determination that Detective offers.
- D. Amazon Macie discovers and protects sensitive data; it does not investigate malicious activities or provide root cause analysis.
Question 4
The TCK Bank adopts cloud for storing the private data of its customers. The bank usually explains its information sharing practices to its customers and safeguards sensitive data. However, there exist some security loopholes in its information sharing practices. Therefore, hackers could steal the critical data of the bank’s customers. In this situation, under which cloud compliance framework will the bank be penalized?
Show answer and explanation
Correct answer: B. GLBA
GLBA (Gramm-Leach-Bliley Act) specifically governs financial institutions and their handling of customer personal financial information. It requires banks to explain information sharing practices and protect sensitive customer data. TCK Bank, as a financial institution with inadequate data protection practices, would face penalties under GLBA for failing to safeguard customer information.
Why the other options are wrong
- A. ITAR (International Traffic in Arms Regulations) controls exports of defense-related articles and services; it is not applicable to general banking data protection.
- C. NIST provides cybersecurity frameworks and guidelines but is not a compliance framework with legal penalty authority for financial institutions.
- D. GDPR (General Data Protection Regulation) applies primarily to EU resident data; while applicable globally in some contexts, GLBA is the specific framework for US financial institutions.
Question 5
Gabriel Bateman has been working as a cloud security engineer in an IT company for the past 5 years. Owing to the recent onset of the COVID-19 pandemic, his organization has given the provision to work from home to all employees. Gabriel’s organization uses
Microsoft Office 365 that allows all employees access files, emails, and other Office programs securely from various locations on multiple devices.
Who among the following is responsible for patch management in Microsoft Office 365?
Show answer and explanation
Correct answer: D. Microsoft is entirely responsible for patch management
Microsoft Office 365 is a SaaS offering where Microsoft manages all infrastructure, platform, and application components including patch management, updates, and maintenance. Organizations using Office 365 are not responsible for patching the service itself; Microsoft handles all updates transparently to ensure availability and security for all users.
Why the other options are wrong
- A. Microsoft bears the sole responsibility for patching Office 365; shared responsibility does not apply to SaaS patch management.
- B. Outsourcing to a third party is not appropriate or necessary since Microsoft manages all patching automatically.
- C. Gabriel's organization has no responsibility for patching the Office 365 service itself; they only manage their user accounts and data.
Question 6
Kelsey Lewis has been working as a cloud security engineer in a BPO company that provides 24 × 7 customer service. Owing to the cost-effective storage and security features provided by cloud computing, her organization adopted the cloud environment 4 years ago. Kelsey implemented the TLS protocol to provide security to e-mail communications, voice over IP (VoIP) communication, web traffic, messaging clients, file transfers, and internet services (Domain Name Service (DNS) and Network Time Protocol (NTP)).
Which certificate is used by TLS for communication authentication and encryption between hosts?
Show answer and explanation
Correct answer: D. X.509 certificates issued by the Certificate Authority
X.509 is the standard certificate format used by TLS (and SSL) for authentication and encryption. X.509 certificates are issued by Certificate Authorities and contain public keys, identity information, and digital signatures. TLS uses these certificates to establish secure communication channels between hosts in email, web traffic, VoIP, and other services.
Why the other options are wrong
- A. X.507 is not a valid certificate standard; X.509 is the correct standard for TLS.
- B. X.508 does not exist as a certificate standard in TLS protocols.
- C. X.506 is not a valid certificate standard for TLS communication.
Question 7
Tom Holland works as a cloud security engineer in an IT company located in Lansing, Michigan. His organization has adopted cloud-based services wherein user access, application, and data security are the responsibilities of the organization, and the OS, hypervisor, physical, infrastructure, and network security are the responsibilities of the cloud service provider. Based on the aforementioned cloud security shared responsibilities, which of the following cloud computing service models is enforced in Tom’s organization?
Show answer and explanation
Correct answer: D. Platform-as-a-Service
In PaaS (Platform-as-a-Service), the cloud provider manages the OS, hypervisor, physical infrastructure, and network security while the organization manages applications, data, and user access. Tom's organization has these exact responsibilities split with the provider handling infrastructure and hypervisor while the organization handles application and data security.
Why the other options are wrong
- A. SaaS includes application management by the provider; the organization would not manage application security.
- B. On-Premises means the organization manages everything including physical infrastructure, which contradicts the scenario.
- C. IaaS puts more infrastructure responsibility on the provider, but typically the organization manages the OS and hypervisor, unlike the stated scenario.
Question 8
An organization, PARADIGM PlayStation, moved its infrastructure to a cloud as a security practice. It established an incident response team to monitor the hosted websites for security issues. While examining network access logs using SIEM, the incident response team came across some incidents that suggested that one of their websites was targeted by attackers and they successfully performed an SQL injection attack.
Subsequently, the incident response team made the website and database server offline. In which of the following steps of the incident response lifecycle, the incident team determined to make that decision?
Show answer and explanation
Correct answer: A. Containment
Containment is the phase where actions are taken to stop the attack and prevent further damage. When the incident response team decided to take the website and database server offline, they were implementing containment measures to isolate the compromised systems and prevent attackers from continuing the SQL injection attack or accessing additional resources.
Why the other options are wrong
- B. Analysis is the phase where the team investigates and determines what happened; the decision to take systems offline is action-oriented containment, not analysis.
- C. Coordination and information sharing involves communicating about the incident with other teams and organizations, not making isolation decisions.
- D. Post-mortem occurs after the incident is resolved and involves reviewing lessons learned, not making real-time containment decisions.
Question 9
Global CloudEnv is a cloud service provider that provides various cloud-based services to cloud consumers. The cloud service provider adheres to the framework that can be used as a tool to systematically assess cloud implementation by providing guidance on the security controls that should be implemented by specific actors within the cloud supply chain. It is used as the standard to assess the security posture of organizations on the Security, Trust, Assurance, and Risk (STAR) registry. Based on the given information, which of the following cybersecurity control frameworks does Global CloudEnv adhere to?
Show answer and explanation
Correct answer: C. CSA CCM
The Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) is the framework used to systematically assess cloud implementation and provides guidance on security controls for actors within the cloud supply chain. It serves as the standard for assessing security posture on the CSA STAR (Security, Trust, Assurance, and Risk) registry, which is the industry's premier registry documenting security controls and practices of cloud service providers.
Why the other options are wrong
- A. CDMI (Cloud Data Management Interface) is a standard for cloud data management and storage, not a security control framework for assessing cloud implementation.
- B. CSA CAIQ (Consensus Assessments Initiative Questionnaire) is a questionnaire used to document cloud provider security practices, but it is not the framework itself used for systematic assessment on the STAR registry.
- D. ITU-T X.1601 is a standard for security framework for cloud computing, but it is not the specific framework referenced in the STAR registry context described.
Question 10
Global SoftTechSol is a multinational company that provides customized software solutions and services to various clients located in different countries. It uses a public cloud to host its applications and services. Global SoftTechSol uses Cloud Debugger to inspect the current state of a running application in real-time, find bugs, and understand the behavior of the code in production.
Identify the service provider that provides the Cloud Debugger feature to Global SoftTechSol?
Show answer and explanation
Correct answer: A. Google
Google Cloud Debugger is the service that allows developers to inspect the current state of a running application in real-time, find bugs, and understand code behavior in production. This is a specific Google Cloud Platform service designed for debugging applications running in Google Cloud environments.
Why the other options are wrong
- B. IBM Cloud offers various debugging and development tools, but Cloud Debugger is specifically a Google Cloud service.
- C. Microsoft Azure provides debugging tools, but Cloud Debugger as described is a Google-specific service offering.
- D. AWS offers X-Ray for tracing and debugging applications, but the specific service called 'Cloud Debugger' is provided by Google.
That was 10 of 147.
The full EC-Council 312-40 CCSE pack has all 147 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.