128 free ISC2 CCSP practice questions from the CertStash pack of 512, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 128 free here, all 512 in the pack, and each step includes the one before it.
Get all 512 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following roles is responsible for creating cloud components and the testing and validation of services?
Show answer and explanation
Correct answer: D. Cloud service developer
A cloud service developer is the role responsible for creating cloud components and performing the testing and validation of services. This role focuses on the development lifecycle and quality assurance of cloud-based solutions, including design, implementation, and validation.
Why the other options are wrong
- A. Cloud auditors review and assess security and compliance, not create components.
- B. Inter-cloud providers facilitate communication between different cloud providers.
- C. Cloud service brokers manage selection, deployment, and optimization of cloud services, not development.
Question 2
What is the best source for information about securing a physical asset's BIOS?
Show answer and explanation
Correct answer: C. Vendor documentation
Vendor documentation is the best source for information about securing a physical asset's BIOS because manufacturers provide detailed, accurate guidance specific to their hardware models, including security features, configuration options, and recommended settings.
Why the other options are wrong
- A. Security policies provide organizational guidelines but not technical BIOS-specific details.
- B. Manual pages typically refer to software manuals, not hardware BIOS documentation.
- D. Regulations establish compliance requirements but not technical BIOS configuration details.
Question 3
Which of the following is not a component of contractual PII?
Show answer and explanation
Correct answer: B. Value of data
The value of data is not a standard component of contractual PII requirements. Contractual obligations for PII typically address scope of processing, location/storage of data, use of subcontractors, data protection measures, and breach notification, but not inherent monetary value assignments.
Why the other options are wrong
- A. Scope of processing is a core contractual PII component defining what data operations are permitted.
- C. Location of data is essential for contractual PII, specifying where personal information is stored and processed.
- D. Use of subcontractors is a critical contractual PII element, as it affects data handling responsibility and liability.
Question 4
Which of the following concepts refers to a cloud customer paying only for the resources and offerings they use within a cloud environment, and only for the duration that they are consuming them?
Show answer and explanation
Correct answer: B. Measured service
Measured service is the NIST term for the cloud characteristic where usage is monitored, controlled, and reported, allowing customers to pay only for resources and services consumed during the period they use them, enabling transparent billing models.
Why the other options are wrong
- A. Consumable service is not a standard cloud computing term.
- C. Billable service describes the outcome of measurement but is not the official cloud computing concept.
- D. Metered service is similar but measured service is the established NIST terminology for this characteristic.
Question 5
Which of the following roles involves testing, monitoring, and securing cloud services for an organization?
Show answer and explanation
Correct answer: D. Cloud service administrator
A cloud service administrator is responsible for testing, monitoring, and securing cloud services for an organization. This role manages the operational aspects of cloud services including configuration, performance monitoring, security controls, and ongoing maintenance.
Why the other options are wrong
- A. Cloud service integrators focus on combining and integrating cloud services, not testing and securing them.
- B. Cloud service business managers handle business aspects and strategy, not technical testing and securing.
- C. Cloud service users consume cloud services but do not test, monitor, or secure them administratively.
Question 6
What is the only data format permitted with the SOAP API?
Show answer and explanation
Correct answer: D. XML
XML is the only data format permitted with the SOAP API. SOAP uses XML exclusively for its message structure, envelope format, and protocol definitions, making it the mandatory data format for SOAP communications.
Why the other options are wrong
- A. HTML is a markup language for web pages, not used by SOAP.
- B. SAML is a security assertion markup language for authentication, not a SOAP data format.
- C. XSML is not a standard data format used with SOAP APIs.
Question 7
Which data formats are most commonly used with the REST API?
Show answer and explanation
Correct answer: C. XML and JSON
XML and JSON are the most commonly used data formats with REST APIs. REST is flexible and supports multiple formats, but JSON and XML are the industry standards for REST API requests and responses due to their simplicity and broad support.
Why the other options are wrong
- A. SAML is an authentication protocol, not a typical REST API data format.
- B. SAML is not a REST API data format; while XML is correct, SAML is not paired with it here.
- D. SAML and HTML are not the standard REST API formats; HTML is for web pages, not APIs.
Question 8
Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?
Show answer and explanation
Correct answer: B. Missing function-level access control
Missing function-level access control refers to applications that fail to validate authorization for specific functions after initial authentication checks. An attacker can access restricted functions by directly calling them, bypassing intended access controls at the function or method level.
Why the other options are wrong
- A. Injection attacks involve inserting malicious code into application inputs, not authorization validation failures.
- C. Cross-site request forgery tricks authenticated users into performing unwanted actions, but doesn't specifically involve missing function-level authorization.
- D. Cross-site scripting involves injecting malicious scripts into web pages, not authorization validation at the function level.
Question 9
Which of the following roles involves overseeing billing, purchasing, and requesting audit reports for an organization within a cloud environment?
Show answer and explanation
Correct answer: B. Cloud service business manager
The Cloud Service Business Manager is responsible for overseeing business-related aspects including billing, purchasing, and requesting audit reports. This role bridges business and technical operations within cloud environments.
Why the other options are wrong
- A. Cloud service users consume services but do not manage billing or audit processes.
- C. Cloud service administrators focus on technical infrastructure management, not business billing and purchasing.
- D. Cloud service integrators specialize in connecting systems and services, not financial oversight.
Question 10
What is the biggest concern with hosting a key management system outside of the cloud environment?
Show answer and explanation
Correct answer: C. Availability
Hosting a key management system outside the cloud environment creates the biggest availability concern because access to encryption keys may be delayed or interrupted if external systems experience outages, directly impacting the ability to decrypt data in the cloud.
Why the other options are wrong
- A. While confidentiality is important, it can be protected through secure transmission protocols and authentication.
- B. Portability is not primarily affected by external key management hosting.
- D. Integrity of keys can be maintained through cryptographic controls and auditing regardless of location.
What people say about the full CCSP pack 4.8 from 12
I passed my CCSP exam with 87% grades. I was feeling stressed about my exam, but after using their dumps and study material - all that hard work paid off! I am grateful to Cert Stash for making this achievement possible.
Cert Stash is the best way to study for your exams. I was able to score a 93% on my CCSP exam thanks to Cert Stash, it's so convenient!
I was nervous about the exam, but Cert Stash dumps prepared me perfectly. Highly recommend them!
Question 11
What is the data encapsulation used with the SOAP protocol referred to?
Show answer and explanation
Correct answer: B. Envelope
In SOAP, the data encapsulation structure is formally called a SOAP Envelope. The envelope wraps the entire SOAP message, containing the header (optional metadata) and body (actual message content). This is standard SOAP terminology defined in SOAP specifications.
Why the other options are wrong
- A. Packet is a networking term, not SOAP-specific terminology.
- C. Payload is a general term for data being transmitted but not the formal SOAP term.
- D. Object refers to data structures in programming but is not the SOAP encapsulation term.
Question 12
Which of the following is the optimal temperature for a data center, per the guidelines established by the America Society of Heating, Refrigeration, and Air Conditioning Engineers (ASHRAE)?
Show answer and explanation
Correct answer: B. 64.4-80.6degF(18-27degC)
ASHRAE guidelines specify the optimal temperature range for data centers as 64.4-80.6°F (18-27°C). This range balances equipment performance, longevity, and energy efficiency. This is the standard recommendation for maintaining proper data center operating conditions and equipment reliability.
Why the other options are wrong
- A. 69.8-86.0°F is too warm and exceeds ASHRAE optimal guidelines; this range is acceptable but not optimal.
- C. 51.8-66.2°F is too cold and outside the ASHRAE recommended range; this can cause condensation and equipment issues.
- D. 44.6-60.8°F is far too cold and would damage equipment through condensation and thermal stress.
Question 13
Which of the cloud cross-cutting aspects relates to the requirements placed on the cloud provider by the cloud customer for minimum performance standards and requirements that must be met?
Show answer and explanation
Correct answer: B. SLAs
Service Level Agreements (SLAs) are the cloud cross-cutting aspect that defines the minimum performance standards, availability guarantees, and other requirements that the cloud provider must meet for the cloud customer. SLAs establish contractual obligations and performance metrics.
Why the other options are wrong
- A. Regulatory requirements relate to compliance and legal obligations, not specifically to performance standards between provider and customer.
- C. Auditability refers to the ability to audit and track activities, not to performance standards and minimum requirements.
- D. Governance covers policy and decision-making frameworks but is not specifically about performance standards and contractual minimums.
Question 14
Which networking concept in a cloud environment allows for network segregation and isolation of IP spaces?
Show answer and explanation
Correct answer: D. VLAN
VLAN (Virtual Local Area Network) allows for network segregation and isolation of IP spaces in cloud environments by creating logically isolated networks on shared physical infrastructure, enabling multiple tenants or applications to operate securely.
Why the other options are wrong
- A. PLAN is not a recognized networking standard or technology.
- B. WAN (Wide Area Network) connects geographically distant networks but doesn't provide segmentation within a cloud environment.
- C. LAN (Local Area Network) covers a physical area but lacks the virtual isolation capabilities needed for cloud multitenancy.
Question 15
What is the best approach for dealing with services or utilities that are installed on a system but not needed to perform their desired function?
Show answer and explanation
Correct answer: A. Remove
Removing unnecessary services is the best security practice for reducing attack surface. While disabling (option C) is a practical intermediate step, complete removal eliminates the service entirely and prevents accidental re-enablement or exploitation of dormant code. Monitoring and stopping are reactive or temporary measures that do not fully address the risk.
Why the other options are wrong
- B. Monitoring does not reduce risk; it only detects activity after the fact.
- C. Disabling is better than leaving enabled, but removal is more secure as it eliminates the code entirely.
- D. Stopping is a temporary measure that does not persist across restarts or prevent exploitation of dormant services.
Question 16
What is the primary reason that makes resolving jurisdictional conflicts complicated?
Show answer and explanation
Correct answer: D. Lack of international authority
The primary reason resolving jurisdictional conflicts is complicated is the lack of international authority. Different nations maintain sovereign control over their legal systems, and no single international body has enforcement authority over all jurisdictions, making it difficult to resolve disputes that cross borders.
Why the other options are wrong
- A. While different technology standards may create challenges, they are not the primary reason jurisdictional conflicts are difficult to resolve.
- B. Costs are a secondary factor; the fundamental issue is the lack of enforcement authority.
- C. Language barriers can impede communication but are not the primary reason for jurisdictional conflict complications.
Question 17
Which type of audit report is considered a "restricted use" report for its intended audience?
Show answer and explanation
Correct answer: D. SOC Type 2
SOC Type 2 reports are considered restricted use reports intended only for management, internal auditors, and those with a need to know, as they contain detailed information about the design and effectiveness of controls over a specific period and may reveal sensitive security details.
Why the other options are wrong
- A. SAS-70 is an older standard that has been superseded and is not specifically classified as restricted use in modern practice.
- B. SSAE-16 is a general auditing standard framework, not specifically a restricted use report designation.
- C. SOC Type 1 reports focus on design of controls and are more suitable for broader distribution than Type 2.
Question 18
What concept does the "I" represent with the STRIDE threat model?
Show answer and explanation
Correct answer: B. Information disclosure
In the STRIDE threat model, the 'I' represents Information Disclosure. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Information Disclosure refers to threats where sensitive data is exposed to unauthorized parties.
Why the other options are wrong
- A. Integrity is represented by 'T' (Tampering) in the STRIDE model, not 'I'.
- C. IT security is not a component of the STRIDE threat model.
- D. Insider threat is not specifically represented as the 'I' in STRIDE; Information Disclosure is the correct term.
Question 19
Which concept BEST describes the capability for a cloud environment to automatically scale a system or application, based on its current resource demands?
Show answer and explanation
Correct answer: D. Rapid elasticity
Rapid elasticity describes the cloud capability to automatically and quickly scale computing resources (up or down) in response to changing demand. This is a core characteristic of cloud computing that allows systems to adapt to resource requirements in real-time.
Why the other options are wrong
- A. On-demand self-service refers to users provisioning resources without manual intervention, not automatic scaling.
- B. Resource pooling describes sharing infrastructure among multiple customers, not the scaling capability.
- C. Measured service refers to monitoring and metering resource usage, not the automatic scaling function.
Question 20
Which technology is NOT commonly used for security with data in transit?
Show answer and explanation
Correct answer: A. DNSSEC
DNSSEC (DNS Security Extensions) is used to secure DNS queries and responses, protecting the DNS infrastructure itself rather than protecting general data in transit. While DNSSEC is important for DNS security, it is not commonly used as a general data-in-transit security technology. IPsec, VPN, and HTTPS are all widely deployed technologies specifically designed to encrypt and protect data as it moves across networks.
Why the other options are wrong
- B. IPsec is commonly used for securing data in transit at the network layer.
- C. VPN is one of the most common technologies for protecting data in transit across untrusted networks.
- D. HTTPS is the standard and most widely used technology for securing web-based data in transit.
Question 21
Which of the following is the biggest concern or challenge with using encryption?
Show answer and explanation
Correct answer: A. Dependence on keys
The biggest concern with encryption is the dependence on keys. Encryption is only as secure as the keys used to perform it, keys must be generated securely, stored safely, rotated regularly, and protected from unauthorized access. Losing keys means losing access to encrypted data permanently; compromised keys render encryption useless. Key management is a complex, ongoing operational challenge that affects all aspects of an encryption program, making it the paramount concern.
Why the other options are wrong
- B. Modern cipher algorithms are well-established and vetted; cipher strength is rarely the primary concern when properly implemented ciphers are used.
- C. Encryption efficiency is generally acceptable for most modern applications and is not the biggest challenge.
- D. Protocol standards for encryption are well-defined and standardized; this is not a major concern.
Question 22
Which term relates to the application of scientific methods and practices to evidence?
Show answer and explanation
Correct answer: A. Forensics
Forensics relates to the application of scientific methods and practices to evidence. Digital forensics specifically applies investigative and analytical techniques to digital evidence in a manner that preserves integrity and follows established scientific methodologies.
Why the other options are wrong
- B. Methodical describes a systematic approach but is not the technical term for applying science to evidence.
- C. Theoretical refers to conceptual frameworks rather than the application of scientific methods to evidence.
- D. Measured relates to quantification or careful assessment but does not capture the concept of applying science to evidence.
Question 23
What is a standard configuration and policy set that is applied to systems and virtual machines called?
Show answer and explanation
Correct answer: B. Baseline
A baseline is a standard configuration and policy set that is applied consistently across systems and virtual machines to establish a secure and standardized foundation. This term is widely used in IT security and compliance frameworks to refer to the documented, approved minimum security standards against which systems are measured.
Why the other options are wrong
- A. Standardization is a general concept but not the specific technical term for the configuration and policy set applied to systems.
- C. Hardening refers to the process of securing a system by reducing vulnerabilities, not the standard configuration set itself.
- D. Redline is not a standard IT security term for configuration and policy sets.
Question 24
Which aspect of archiving must be tested regularly for the duration of retention requirements?
Show answer and explanation
Correct answer: B. Recoverability
Recoverability must be tested regularly throughout the retention period to ensure that archived data can actually be restored when needed. This is a critical compliance and operational requirement, archival is only valuable if data can be successfully recovered. While availability, auditability, and portability are also important archive characteristics, recoverability specifically addresses the core function of archives: that data remains accessible and restorable for the entire retention duration.
Why the other options are wrong
- A. Availability is important but less critical to test continuously; the focus is on whether data can be recovered when needed.
- C. Auditability (tracking access/changes) is important but not the primary regular testing requirement for archives.
- D. Portability (moving between systems) is not typically a primary regular testing requirement for archive retention.
Question 25
Where is a DLP solution generally installed when utilized for monitoring data in use?
Show answer and explanation
Correct answer: D. User's client
DLP solutions monitoring 'data in use' (active data being processed) must be installed on the user's client/endpoint where the data is actively being accessed and manipulated. This is the point where data leaves the secure confines of servers and enters user applications, making it vulnerable to exfiltration. Client-side DLP agents monitor user actions, clipboard operations, and data transfers in real-time.
Why the other options are wrong
- A. Application server DLP protects data at rest and in transit, not data in active use by end users.
- B. Database server monitoring addresses stored data, not data currently in use by clients.
- C. Network perimeter DLP monitors data in transit between systems, not data in use on client devices.
Question 26
Which regulatory system pertains to the protection of healthcare data?
Show answer and explanation
Correct answer: A. HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is the primary U.S. regulatory system that specifically pertains to the protection of healthcare data and patient privacy. It establishes standards for securing protected health information (PHI) and applies to covered entities and business associates in the healthcare industry.
Why the other options are wrong
- B. HAS is not a recognized major healthcare data protection regulatory system.
- C. HITECH is a law that enhances HIPAA enforcement but is secondary to HIPAA itself for healthcare data protection.
- D. HFCA is not a recognized healthcare data protection regulatory system.
Question 27
One of the main components of system audits is the ability to track changes over time and to match these changes with continued compliance and internal processes. Which aspect of cloud computing makes this particular component more challenging than in a traditional data center?
Show answer and explanation
Correct answer: B. Virtualization
Virtualization makes change tracking and compliance auditing more challenging in cloud environments because virtual resources can be created, modified, and destroyed rapidly without traditional physical infrastructure logs. Virtual machines can be spun up and down quickly, making it difficult to maintain an accurate audit trail of changes and their timeline.
Why the other options are wrong
- A. Portability refers to moving workloads between clouds, which is less directly related to change tracking challenges.
- C. Elasticity (auto-scaling) is a symptom of the problem but virtualization is the underlying technology that causes the audit challenge.
- D. Resource pooling refers to shared infrastructure but doesn't directly address the change tracking difficulty.
Question 28
Which of the following roles involves the connection and integration of existing systems and services to a cloud environment?
Show answer and explanation
Correct answer: D. Cloud service integrator
A cloud service integrator is the role responsible for connecting and integrating existing systems and services to a cloud environment. This role bridges on-premises infrastructure with cloud services, managing the technical aspects of system integration. The other roles have different primary responsibilities: business managers handle strategic aspects, users consume services, and administrators manage operational aspects of cloud services.
Why the other options are wrong
- A. Cloud service business managers focus on strategic and business aspects, not technical system integration.
- B. Cloud service users consume cloud services but do not perform integration work.
- C. Cloud service administrators manage operational aspects of cloud services, not system integration activities.
Question 29
Which of the following publishes the most commonly used standard for data center design in regard to tiers and topologies?
Show answer and explanation
Correct answer: B. Uptime Institute
The Uptime Institute publishes the Tier Standard for Topology, which is the most widely recognized and commonly used standard for classifying data center design in terms of tiers (Tier I through Tier IV) and their associated topologies. This standard is industry-adopted globally for data center infrastructure classification.
Why the other options are wrong
- A. IDCA (International Data Center Authority) is not the primary publisher of the standard data center tier classification system.
- C. NFPA (National Fire Protection Association) focuses on fire safety and electrical standards, not data center tier and topology design.
- D. BICSI (Building Industry Consulting Services International) provides standards for telecommunications infrastructure but not the primary data center tier standard.
Question 30
When is a virtual machine susceptible to attacks while a physical server in the same state would not be?
Show answer and explanation
Correct answer: D. When it is powered off
A virtual machine that is powered off is susceptible to attacks that a powered-off physical server would not be, specifically, attacks on the hypervisor, the VM image file itself, or the host system where the VM resides. An attacker with access to the host infrastructure can modify, copy, or inspect the powered-off VM's image files, snapshot data, or exploit the virtualization layer. A powered-off physical server sitting in a data center cannot be remotely exploited in these same ways since the virtualization abstraction layer doesn't exist.
Why the other options are wrong
- A. Being behind a WAF (Web Application Firewall) provides protection equally to both virtual and physical servers.
- B. Being behind an IPS (Intrusion Prevention System) provides protection equally to both virtual and physical servers.
- C. Unpatched systems are vulnerable in the same ways regardless of whether they are virtual or physical machines.
Question 31
What type of host is exposed to the public Internet for a specific reason and hardened to perform only that function for authorized users?
Show answer and explanation
Correct answer: B. Bastion
A bastion host is a hardened, specially configured server exposed to the public Internet that serves as a controlled access point for authorized users. It performs a specific function (such as SSH access or web service) and is secured with minimal services and strict access controls.
Why the other options are wrong
- A. A proxy acts as an intermediary for requests but is not specifically hardened for a single public-facing function.
- C. A honeypot is intentionally vulnerable and used to detect attacks, not to provide authorized access.
- D. A WAF (Web Application Firewall) is a security device, not a host type that serves as a hardened access point.
Question 32
Which of the following is the sole responsibility of the cloud customer, regardless of which cloud model is used?
Show answer and explanation
Correct answer: D. Data
Data is the sole responsibility of the cloud customer regardless of cloud model (IaaS, PaaS, or SaaS). The customer owns and is responsible for their data, including its security, privacy, classification, and compliance requirements. Infrastructure, platform, and application responsibilities vary by cloud model, but data responsibility remains constant.
Why the other options are wrong
- A. Infrastructure responsibility varies by cloud model; in IaaS the customer manages it, but in SaaS the provider does.
- B. Platform responsibility is shared or provider-managed depending on the cloud model chosen.
- C. Application responsibility varies by cloud model; in SaaS the provider manages applications, in IaaS the customer does.
Question 33
Which of the following would NOT be a reason to activate a BCDR strategy?
Show answer and explanation
Correct answer: A. Staffing loss
While staffing loss is certainly a serious operational challenge, it is typically handled through human resources and workforce management practices rather than requiring activation of a Business Continuity and Disaster Recovery (BCDR) strategy. BCDR strategies are activated for major disruptive events like terrorism attacks, utility disruptions, and natural disasters that threaten business operations at a systemic level.
Why the other options are wrong
- B. A terrorism attack is a major threat warranting BCDR activation.
- C. Utility disruptions are significant operational threats requiring BCDR activation.
- D. Natural disasters are primary scenarios for which BCDR strategies are designed.
Question 34
What is an often overlooked concept that is essential to protecting the confidentiality of data?
Show answer and explanation
Correct answer: B. Training
Training is an often overlooked yet essential concept for protecting data confidentiality. Human awareness and proper handling practices are critical because even the strongest technical controls can be circumvented by users who lack security training. Employee education about data handling, social engineering, and confidentiality practices is fundamental to an effective security program.
Why the other options are wrong
- A. Strong passwords are important but are a technical control, not the most overlooked concept, they are widely recognized as necessary.
- C. Security controls are expected elements of data protection and are not typically overlooked.
- D. Policies are established security measures that are part of standard security programs, not typically overlooked.
Question 35
Which cloud service category would be most ideal for a cloud customer that is developing software to test its applications among multiple hosting providers to determine the best option for its needs?
Show answer and explanation
Correct answer: B. PaaS
Platform as a Service (PaaS) is ideal for developers who need to test applications across multiple hosting providers. PaaS provides a development and testing platform with development tools, databases, and middleware, allowing developers to build and test applications without managing underlying infrastructure, making it easy to switch providers.
Why the other options are wrong
- A. DaaS (Desktop as a Service) provides virtual desktops, not application development and testing platforms.
- C. IaaS provides raw infrastructure but requires more management overhead; PaaS is better suited for rapid testing across providers.
- D. SaaS provides finished software applications, not a platform for custom application development and testing.
Question 36
Where is an XML firewall most commonly deployed in the environment?
Show answer and explanation
Correct answer: D. Between the firewall and application server
An XML firewall is most commonly deployed between the firewall and the application server. This placement allows it to inspect and filter XML traffic at the network boundary before it reaches the application, protecting against XML-based attacks while permitting legitimate XML messages to pass through to the application layer.
Why the other options are wrong
- A. XML firewalls are not typically deployed between application and data layers; that location is too deep in the architecture.
- B. Deployment between IPS and firewall does not align with standard XML firewall architecture practices.
- C. While XML inspection could occur here, the perimeter between firewall and application server is the standard location for gateway-level XML filtering.
Question 37
If a cloud computing customer wishes to guarantee that a minimum level of resources will always be available, which of the following set of services would compromise the reservation?
Show answer and explanation
Correct answer: D. CPU and memory
To guarantee a minimum level of resources will always be available, a cloud customer would typically reserve CPU and memory resources. These are the two fundamental compute resources that must be reserved to ensure predictable application performance. Reservations for CPU and memory provide guaranteed baseline capacity for the customer's workloads.
Why the other options are wrong
- A. Memory and networking reservations are important, but CPU is more critical than networking for guaranteeing minimum resource availability.
- B. Software licensing is not typically part of resource reservation, and CPU-storage reservations don't capture the compute capacity guarantee.
- C. CPU and storage reservations miss memory, which along with CPU forms the core compute resources requiring guarantee.
Question 38
Clustered systems can be used to ensure high availability and load balancing across individual systems through a variety of methodologies. What process is used within a clustered system to ensure proper load balancing and to maintain the health of the overall system to provide high availability?
Show answer and explanation
Correct answer: D. Distributed resource scheduling
Distributed resource scheduling is the process used in clustered systems to dynamically allocate workloads across cluster nodes, monitor system health, and ensure optimal resource utilization for high availability. This scheduling mechanism continuously distributes requests and workloads while maintaining awareness of node health status.
Why the other options are wrong
- A. Distributed clustering is not a standard process term for load balancing within clusters.
- B. Distributed balancing is not the formal term used in clustering architecture terminology.
- C. Distributed optimization refers to mathematical optimization techniques, not the operational process managing cluster health and load distribution.
Question 39
With a cloud service category where the cloud customer is responsible for deploying all services, systems, and components needed for their applications, which of the following storage types are MOST likely to be available to them?
Show answer and explanation
Correct answer: B. Volume and object
In Infrastructure-as-a-Service (IaaS), where the customer is responsible for deploying all services and components for their applications, the most commonly available storage types are volume storage (block storage for virtual machines) and object storage (for unstructured data, files, and blobs). These represent the primary storage abstractions provided by IaaS platforms to support diverse application requirements.
Why the other options are wrong
- A. Structured and hierarchical are data organization models, not the storage type categories offered in IaaS.
- C. While volume storage is correct, database storage is typically a managed service offered at higher service levels (PaaS/DBaaS) rather than raw IaaS.
- D. Structured and unstructured refer to data characteristics, not the storage service types; object and volume are the correct storage type categories.
Question 40
The European Union is often considered the world leader in regard to the privacy of personal data and has declared privacy to be a "human right." In what year did the EU first assert this principle?
Show answer and explanation
Correct answer: A. 1995
The European Union formally asserted privacy as a human right in 1995 with the adoption of the Data Protection Directive (95/46/EC), which was later replaced by the GDPR in 2018. This 1995 directive was groundbreaking legislation that established privacy as a fundamental human right and set the standard for global data protection practices.
Why the other options are wrong
- B. 2000 was after the EU's initial assertion; the foundational directive was passed in 1995.
- C. 2010 is too recent; privacy was established as a right much earlier.
- D. 1999 is after the key 1995 Data Protection Directive was adopted.
Question 41
Which of the following is the sole responsibility of the cloud provider, regardless of which cloud model is used?
Show answer and explanation
Correct answer: C. Physical environment
The physical environment (data centers, servers, networking hardware, security perimeter) is the sole responsibility of the cloud provider across all cloud models, IaaS, PaaS, and SaaS. The customer never manages the physical infrastructure itself, though responsibilities for platform, data, and other layers vary by model.
Why the other options are wrong
- A. Platform responsibility varies by model; customers manage it in IaaS but not in SaaS.
- B. Data responsibility belongs to the customer in all cloud models; the provider only manages storage infrastructure.
- D. Infrastructure responsibility is shared; while the provider manages physical infrastructure, customers manage application-level infrastructure in IaaS.
Question 42
Which of the following actions will NOT make data part of the "create" phase of the cloud data lifecycle?
Show answer and explanation
Correct answer: A. Modifying metadata
Modifying metadata is not part of the 'create' phase; it represents a separate action performed on already-created data. The create phase includes constructing new data (D), importing data (B), and initial data creation. Modifying metadata (A) occurs during the use/manage phase, after data creation. Modifying data (C) could be considered part of creation during initial setup, but metadata modification is distinct from data creation itself.
Why the other options are wrong
- B. Importing data is part of the create phase as it establishes data within the system.
- C. Modifying data during initial creation can be considered part of the create phase.
- D. Constructing new data is the core action of the create phase.
Question 43
Which of the following aspects of cloud computing would make it more likely that a cloud provider would be unwilling to satisfy specific certification requirements?
Show answer and explanation
Correct answer: B. Multitenancy
Multitenancy, where multiple customers share the same physical infrastructure, creates significant obstacles to meeting specific certification requirements. Isolating one tenant's data and resources from others while satisfying audit and compliance mandates becomes extremely complex and costly. This architectural characteristic of cloud computing makes providers reluctant to commit to specialized certifications that require dedicated or isolated resources.
Why the other options are wrong
- A. Regulation is an external constraint that drives certification requirements but doesn't inherently make providers unwilling to meet them.
- C. Virtualization is a technology that actually enables better resource isolation and can support certification compliance.
- D. Resource pooling is a cloud efficiency characteristic but is separate from the compliance complexity created by multitenancy.
Question 44
Most APIs will support a variety of different data formats or structures. However, the SOAP API will only support which one of the following data formats?
Show answer and explanation
Correct answer: A. XML
SOAP (Simple Object Access Protocol) is a strict, standards-based protocol that exclusively uses XML for message formatting. Unlike REST APIs which can support multiple data formats, SOAP enforces XML as the only supported data structure for all communications.
Why the other options are wrong
- B. XSLT is a transformation language for XML, not a data format that SOAP supports for message content.
- C. JSON is a data format supported by REST APIs and other flexible APIs, but SOAP does not support JSON.
- D. SAML is a security assertion format, not a data format that SOAP uses for its core messaging.
Question 45
What strategy involves hiding data in a data set to prevent someone from identifying specific individuals based on other data fields present?
Show answer and explanation
Correct answer: A. Anonymization
Anonymization is the technique of hiding or removing identifying data from a dataset so that individuals cannot be identified based on the remaining data fields. This involves removing or obscuring personally identifiable information while maintaining data utility for analysis.
Why the other options are wrong
- B. Tokenization replaces sensitive data with tokens but maintains a mapping, so individuals could theoretically be re-identified.
- C. Masking obscures data display but doesn't prevent identification through correlation with other fields.
- D. Obfuscation is a general term for obscuring data but is less specific and formal than anonymization for preventing individual identification.
Question 46
Which of the following approaches would NOT be considered sufficient to meet the requirements of secure data destruction within a cloud environment?
Show answer and explanation
Correct answer: D. Deletion
Simple deletion is NOT sufficient for secure data destruction in cloud environments because deleted files often remain recoverable through various means. Cryptographic erasure, zeroing, and overwriting are certified methods that ensure data is truly irrecoverable.
Why the other options are wrong
- A. Cryptographic erasure is a valid and approved secure destruction method.
- B. Zeroing (writing zeros to storage) is an approved secure destruction technique.
- C. Overwriting with random or specific patterns is an established secure destruction method.
Question 47
Which of the following standards primarily pertains to cabling designs and setups in a data center?
Show answer and explanation
Correct answer: B. BICSI
BICSI (Building Industry Consulting Services International) is the primary standard that pertains to cabling designs and setups in data centers, providing specifications for structured cabling systems and infrastructure.
Why the other options are wrong
- A. IDCA is not a recognized standard for data center cabling.
- C. NFPA (National Fire Protection Association) focuses on fire safety and electrical safety, not cabling design.
- D. Uptime Institute focuses on data center tier classifications and operational standards, not cabling specifications.
Question 48
What must be secured on physical hardware to prevent unauthorized access to systems?
Show answer and explanation
Correct answer: A. BIOS
BIOS (Basic Input/Output System) must be secured on physical hardware to prevent unauthorized access and modification of system settings at the firmware level. Securing BIOS with passwords and settings prevents attackers from bypassing operating system security controls. SSH, RDP, and ALOM are remote access protocols, not physical hardware security mechanisms.
Why the other options are wrong
- B. SSH is a remote protocol for secure shell access, not a physical hardware security control.
- C. RDP is a remote desktop protocol for accessing systems remotely, not a physical security mechanism.
- D. ALOM is a Sun systems management protocol for remote access, not a fundamental physical hardware security control.
Question 49
Which of the following attempts to establish an international standard for eDiscovery processes and best practices?
Show answer and explanation
Correct answer: B. ISO/IEC 27050
ISO/IEC 27050 is the international standard specifically designed for eDiscovery processes and best practices. It provides guidelines for electronic discovery in legal and investigative contexts, covering processes such as identification, preservation, collection, processing, review, analysis, and production of electronically stored information.
Why the other options are wrong
- A. ISO/IEC 31000 addresses risk management, not eDiscovery.
- C. ISO/IEC 19888 does not relate to eDiscovery standards.
- D. ISO/IEC 27001 is an information security management standard, not an eDiscovery standard.
Question 50
Your boss has tasked your team with getting your legacy systems and applications connected with new cloud-based services that management has decided are crucial to customer service and offerings. Which role would you be assuming under this directive?
Show answer and explanation
Correct answer: C. Cloud service integrator
A cloud service integrator is the role responsible for connecting and integrating legacy systems with new cloud-based services. This role focuses on bridging on-premises infrastructure with cloud solutions, managing the technical aspects of integration, APIs, and ensuring compatibility between disparate systems.
Why the other options are wrong
- A. A cloud service administrator manages cloud infrastructure and operations but doesn't specifically focus on integrating legacy systems with new services.
- B. A cloud service user consumes cloud services but doesn't have the responsibility for integrating systems.
- D. A cloud service business manager handles business strategy and decisions, not the technical integration work.
Question 51
What type of security threat is DNSSEC designed to prevent?
Show answer and explanation
Correct answer: C. Spoofing
DNSSEC (Domain Name System Security Extensions) is designed to prevent DNS spoofing attacks, where an attacker intercepts or forges DNS responses to redirect users to malicious websites. DNSSEC provides authentication and integrity verification of DNS data through cryptographic signatures.
Why the other options are wrong
- A. Account hijacking is not the primary threat addressed by DNSSEC.
- B. While DNSSEC provides some protection against snooping, its primary purpose is preventing spoofing attacks.
- D. Injection attacks are not the primary focus of DNSSEC; it addresses DNS-specific threats.
Question 52
Which of the following represents a control on the maximum amount of resources that a single customer, virtual machine, or application can consume within a cloud environment?
Show answer and explanation
Correct answer: D. Limit
A Limit is a control mechanism that sets a maximum ceiling on resource consumption by a single customer, VM, or application, preventing any entity from consuming beyond that threshold. A reservation guarantees minimum resources; a share allocates proportional resources; and provision means to allocate resources without a maximum constraint.
Why the other options are wrong
- A. Share allocates proportional resources among entities but does not enforce a maximum limit.
- B. Reservation guarantees minimum resources available, not maximum consumption.
- C. Provision means to allocate resources without necessarily enforcing a maximum constraint.
Question 53
Which value refers to the percentage of production level restoration needed to meet BCDR objectives?
Show answer and explanation
Correct answer: C. RSL
Recovery Service Level (RSL) refers to the percentage of production-level functionality and capacity that must be restored to meet business continuity and disaster recovery objectives. RSL establishes the target recovery state and defines how much of normal operations must be recovered.
Why the other options are wrong
- A. RPO (Recovery Point Objective) measures the acceptable amount of data loss in time, not the percentage of production restoration.
- B. RTO (Recovery Time Objective) measures how quickly recovery must occur, not the percentage of production level needed.
- D. SRE (Site Reliability Engineering) is a methodology for operational management, not a BCDR metric.
Question 54
What provides the information to an application to make decisions about the authorization level appropriate when granting access?
Show answer and explanation
Correct answer: D. Identity Provider
The Identity Provider supplies the information and attributes about a user that allow an application to make authorization decisions regarding appropriate access levels. The IdP asserts user identity, attributes, and group memberships that the relying party uses to determine what resources and permissions the user should receive. Users are subjects, relying parties consume identity assertions, and federation is the mechanism enabling this trust relationship.
Why the other options are wrong
- A. The user is the subject of authorization but does not provide authorization decision information.
- B. The relying party consumes authorization information but does not provide it to applications.
- C. Federation is the mechanism enabling the relationship but not the source of authorization information.
Question 55
Which of the following roles is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets?
Show answer and explanation
Correct answer: C. Cloud service operations manager
A cloud service operations manager is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets. This role handles the operational aspects of cloud deployment and ongoing service management.
Why the other options are wrong
- A. A cloud service business manager focuses on business strategy and decision-making, not operational system preparation.
- B. A cloud service deployment manager prepares systems for initial cloud deployment but does not typically handle ongoing monitoring and inventory management.
- D. A cloud service manager focuses on overall service provisioning and delivery rather than the specific operational and administrative responsibilities described.
Question 56
Which if the following is NOT one of the three components of a federated identity system transaction?
Show answer and explanation
Correct answer: D. Proxy relay
A federated identity system transaction involves three core components: the user (subject requesting access), the identity provider (entity that authenticates and asserts identity), and the relying party (service provider that trusts the identity assertion). A proxy relay is not a standard component of federated identity transactions, though proxies may exist in some implementations, they are not fundamental to the federation model.
Why the other options are wrong
- A. The relying party is a required component that consumes identity assertions from the identity provider.
- B. The identity provider is essential, responsible for authenticating users and providing identity assertions.
- C. The user is the subject of the federated transaction who authenticates and receives authorization.
Question 57
Which of the following service capabilities gives the cloud customer the most control over resources and configurations?
Show answer and explanation
Correct answer: C. Infrastructure
Infrastructure as a Service (IaaS) provides cloud customers with the most control over resources and configurations. With IaaS, customers manage the operating system, middleware, runtime, applications, and data, while the provider manages only the infrastructure layer.
Why the other options are wrong
- A. Desktop services provide the least control, as the provider manages nearly all aspects of the system.
- B. Platform as a Service (PaaS) gives less control than IaaS; customers cannot configure the underlying infrastructure.
- D. Software as a Service (SaaS) provides the least control, with the provider managing all aspects of the application.
Question 58
With software-defined networking, what aspect of networking is abstracted from the forwarding of traffic?
Show answer and explanation
Correct answer: A. Routing
Software-defined networking (SDN) abstracts routing control from the data forwarding plane. In SDN architecture, the control plane (which makes routing decisions) is separated from the data plane (which forwards traffic), allowing centralized, programmable network management through software controllers rather than relying on distributed routing protocols in individual devices.
Why the other options are wrong
- B. Session management is not the primary aspect abstracted in SDN; the focus is on decoupling control logic from forwarding.
- C. Filtering is a function that operates within the forwarding plane and is not the core abstraction of SDN architecture.
- D. Firewalling is a security function that can be implemented via SDN but is not the fundamental aspect that SDN abstracts.
Question 59
Which of the following technologies is used to monitor network traffic and notify if any potential threats or attacks are noticed?
Show answer and explanation
Correct answer: D. IDS
IDS (Intrusion Detection System) is specifically designed to monitor network traffic and analyze it for potential threats or attack patterns. When suspicious activity is detected, it sends notifications to security personnel. While IPS can block, WAF protects web applications, and firewalls control access, IDS is the primary technology that monitors and alerts on network threats.
Why the other options are wrong
- A. IPS (Intrusion Prevention System) blocks threats but is not primarily a monitoring and notification tool.
- B. WAF (Web Application Firewall) protects web applications specifically, not general network traffic.
- C. Firewalls control traffic flow but don't analyze packets for attack signatures and threats.
Question 60
Which of the following represents a prioritization of applications or cloud customers for the allocation of additional requested resources when there is a limitation on available resources?
Show answer and explanation
Correct answer: D. Share
Share represents prioritization and allocation of resources among competing customers or applications based on defined weights or priorities when resources are constrained. Provision allocates resources without prioritization; limit sets maximum consumption; reservation guarantees minimum resources, none of which represent dynamic prioritization of additional resources.
Why the other options are wrong
- A. Provision means to allocate resources without establishing prioritization among entities.
- B. Limit sets a maximum ceiling on consumption, not a prioritization mechanism.
- C. Reservation guarantees minimum resources but does not prioritize allocation of additional available resources.
Question 61
Which jurisdiction lacks specific and comprehensive privacy laws at a national or top level of legal authority?
Show answer and explanation
Correct answer: D. United States
The United States lacks a single comprehensive national privacy law at the federal level. Instead, it has a fragmented approach with sector-specific laws (HIPAA, GLBA, COPPA, etc.) and state-level regulations. In contrast, the EU has GDPR, Germany has comprehensive data protection laws, and Russia has federal privacy legislation (Federal Law on Personal Data).
Why the other options are wrong
- A. The EU has GDPR, a comprehensive privacy regulation at the top level of legal authority.
- B. Germany has comprehensive privacy laws including the Federal Data Protection Act (BDSG) at the national level.
- C. Russia has Federal Law on Personal Data, providing national-level privacy regulation.
Question 62
What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement?
Show answer and explanation
Correct answer: B. Contractual
Contractual PII refers to personally identifiable information whose regulatory status is determined by the specific terms and conditions of a hosting agreement or contract between parties, rather than being universally regulated. This allows organizations to define protection requirements based on their specific business relationships and agreements.
Why the other options are wrong
- A. Specific PII is not a standard classification term for data regulated by contract conditions.
- C. Regulated PII is handled according to external laws and standards, not contractual specifics.
- D. Jurisdictional PII is determined by geographic location and applicable laws, not by individual hosting agreements.
Question 63
Which phase of the cloud data lifecycle would be the MOST appropriate for the use of DLP technologies to protect the data?
Show answer and explanation
Correct answer: C. Share
The Share phase is most appropriate for DLP deployment because data sharing is when exfiltration risk is highest, data is actively being transferred, accessed by multiple parties, and moving across boundaries. DLP solutions are most effective when monitoring data at points of greatest vulnerability and control. While DLP can protect during other phases, the Share phase represents the critical point where data is most exposed to unauthorized access or disclosure.
Why the other options are wrong
- A. Use phase involves internal processing, where DLP is secondary to access controls.
- B. Store phase primarily requires encryption and access controls rather than DLP monitoring.
- D. Create phase is the beginning stage where data classification and baseline protections are established, not where sharing controls are needed.
Question 64
Which is the appropriate phase of the cloud data lifecycle for determining the data's classification?
Show answer and explanation
Correct answer: A. Create
Data classification should occur at the Create phase of the data lifecycle, when data is first generated or collected. This is when the organization determines what type of data is being created and what protection level it requires. Classification at this early stage enables appropriate handling throughout the data's entire lifecycle.
Why the other options are wrong
- B. The Use phase is when data is actively processed; classification should already be established before this point.
- C. The Share phase requires data to already be classified to determine appropriate access controls and sharing permissions.
- D. The Store phase requires prior classification to determine proper storage security controls and retention policies.
Question 65
Which of the following service capabilities gives the cloud customer the least amount of control over configurations and deployments?
Show answer and explanation
Correct answer: C. Software
Software as a Service (SaaS) gives customers the least control, they can only configure application-level settings and data. With SaaS, the cloud provider controls the underlying infrastructure, platform, runtime, middleware, and application itself. Customers cannot modify configurations at deeper layers like the operating system, database, or network.
Why the other options are wrong
- A. Platform as a Service (PaaS) gives more control than SaaS; customers can deploy and configure applications and some runtime environments.
- B. Infrastructure as a Service (IaaS) gives significantly more control than SaaS; customers manage virtual machines, storage, and networking.
- D. Desktop typically refers to Desktop as a Service, which while restrictive, is often classified as a form of SaaS and provides similar control levels; however, SaaS is the more standard and correct answer.
Question 66
Which of the following threat types can occur when baselines are not appropriately applied or unauthorized changes are made?
Show answer and explanation
Correct answer: C. Security misconfiguration
Security misconfiguration occurs when baselines are not properly applied, systems are not hardened according to standards, or unauthorized changes are made that deviate from secure configurations. This threat directly results from failing to maintain security baselines. Security misconfiguration is the absence of proper security controls and standards, making it the exact threat that baselines are designed to prevent.
Why the other options are wrong
- A. Insecure direct object references relate to access control vulnerabilities, not baseline application failures.
- B. Unvalidated redirects and forwards involve input validation issues, not baseline configuration problems.
- D. Sensitive data exposure is a consequence of various vulnerabilities but not specifically tied to baseline application.
Question 67
Which of the cloud cross-cutting aspects relates to the ability to easily move services and applications between different cloud providers?
Show answer and explanation
Correct answer: C. Portability
Portability in cloud computing refers to the ability to easily move services, applications, and data between different cloud providers without significant rework or vendor lock-in. This is a key cross-cutting aspect that enables organizations to maintain flexibility in their cloud strategy.
Why the other options are wrong
- A. Reversibility refers to the ability to exit a cloud provider and retrieve data, not the ability to move between providers.
- B. Availability relates to uptime and service accessibility, not moving between cloud providers.
- D. Interoperability refers to systems working together seamlessly, not specifically moving between different cloud providers.
Question 68
Where is a DLP solution generally installed when utilized for monitoring data at rest?
Show answer and explanation
Correct answer: B. Host system
A DLP (Data Loss Prevention) solution monitoring data at rest is typically installed on host systems where the data is stored. Host-based DLP agents monitor files, databases, and storage on individual computers and servers to detect and prevent unauthorized access or transmission of sensitive data.
Why the other options are wrong
- A. Network firewalls are used for monitoring data in transit, not data at rest.
- C. Application servers may have DLP components but the primary installation point for monitoring data at rest is on hosts where data is stored.
- D. While database servers may have DLP components, host-based installation is the general answer for monitoring data at rest across systems.
Question 69
Which cloud storage type requires special consideration on the part of the cloud customer to ensure they do not program themselves into a vendor lock-in situation?
Show answer and explanation
Correct answer: B. Object
Object storage presents the highest vendor lock-in risk because proprietary APIs, data formats, and metadata schemas vary significantly between providers. Customers who build applications tightly coupled to a specific object storage service's API or features find migration to alternative vendors extremely difficult and costly. This architectural dependency is the defining characteristic of object storage lock-in risk.
Why the other options are wrong
- A. Unstructured storage is a broad category that doesn't specifically highlight vendor lock-in concerns.
- C. Volume storage (block storage) uses standard protocols (iSCSI, Fibre Channel) making portability relatively straightforward.
- D. Structured storage (databases) has standardized query languages and migration tools reducing lock-in compared to object storage.
Question 70
In the wake of many scandals with major corporations involving fraud and the deception of investors and regulators, which of the following laws was passed to govern accounting and financial records and disclosures?
Show answer and explanation
Correct answer: D. SOX
The Sarbanes-Oxley Act (SOX) was passed in 2002 in response to corporate accounting scandals involving companies like Enron and WorldCom. SOX specifically governs accounting practices, financial record-keeping, and disclosure requirements to protect investors and regulators from fraud.
Why the other options are wrong
- A. GLBA (Gramm-Leach-Bliley Act) governs financial privacy and data protection but not accounting standards.
- B. Safe Harbor is a framework for data transfer and privacy compliance, not accounting regulation.
- C. HIPAA (Health Insurance Portability and Accountability Act) governs healthcare data privacy, not financial records.
Question 71
Which of the following is NOT a function performed by the handshake protocol of TLS?
Show answer and explanation
Correct answer: B. Encryption
The TLS handshake protocol is responsible for negotiating connection parameters, exchanging keys, and establishing session identifiers, but encryption itself is not performed during the handshake. Encryption occurs after the handshake is complete and a secure connection is established. The handshake sets up the cryptographic parameters needed for encryption, but does not perform the actual data encryption.
Why the other options are wrong
- A. Key exchange is a core function of the TLS handshake protocol.
- C. Negotiation of connection parameters (cipher suites, versions, etc.) is a primary handshake function.
- D. Establishing a session ID is part of the handshake process to enable session resumption.
Question 72
Which aspect of cloud computing makes it very difficult to perform repeat audits over time to track changes and compliance?
Show answer and explanation
Correct answer: A. Virtualization
Virtualization makes it very difficult to perform repeat audits over time to track changes and compliance because virtual resources are constantly created, modified, and destroyed in cloud environments. Virtual machines and containers are ephemeral and dynamic, making it challenging to maintain consistent audit trails and perform meaningful compliance comparisons across time periods.
Why the other options are wrong
- B. Multitenancy affects data isolation but does not specifically impede the ability to track changes in audit trails over time.
- C. Resource pooling relates to resource sharing rather than the dynamic nature that complicates repeat auditing.
- D. Dynamic optimization describes performance tuning rather than the core issue affecting audit repeatability.
Question 73
Which of the following roles is responsible for peering with other cloud services and providers?
Show answer and explanation
Correct answer: B. Inter-cloud provider
An Inter-cloud provider (also called cloud-to-cloud provider) is responsible for peering and establishing connections with other cloud services and providers to enable multi-cloud interoperability. A cloud auditor performs compliance audits, a cloud service broker acts as an intermediary for customers, and a cloud service developer builds cloud solutions.
Why the other options are wrong
- A. Cloud auditors perform compliance and security auditing, not peering with other providers.
- C. Cloud service brokers manage relationships between customers and providers, not provider-to-provider peering.
- D. Cloud service developers build and maintain cloud applications and services, not provider relationships.
Question 74
How is an object stored within an object storage system?
Show answer and explanation
Correct answer: A. Key value
Object storage systems store data as objects using a key-value model. Each object is uniquely identified by a key and contains the actual data (value). This approach differs from traditional file systems or databases and enables scalability and distributed storage across multiple nodes.
Why the other options are wrong
- B. Database storage structures data in rows, columns, and tables, which is different from object storage's key-value model.
- C. LDAP is a directory service protocol for user authentication and authorization, not an object storage mechanism.
- D. Tree structures organize data hierarchically like file systems, whereas object storage uses a flat namespace with key-value pairs.
Question 75
Which of the following is considered an internal redundancy for a data center?
Show answer and explanation
Correct answer: B. Chillers
Internal redundancy refers to redundant systems within the data center itself that the operator controls. Chillers are HVAC cooling systems that the data center operator deploys internally to maintain temperature; having multiple chillers provides internal redundancy. Power feeds, network circuits, and generators are typically sourced from external providers or infrastructure outside the data center's direct control, making them external redundancy measures.
Why the other options are wrong
- A. Power feeds come from external utility providers and represent external redundancy.
- C. Network circuits are provided by external carriers and represent external redundancy.
- D. Generators may be sourced externally and primarily protect against external power loss rather than internal system failures.
Question 76
Which of the following is a widely used tool for code development, branching, and collaboration?
Show answer and explanation
Correct answer: A. GitHub
GitHub is the industry-standard, widely adopted platform for version control, code development, branching, and team collaboration. It uses Git as its underlying version control system and provides comprehensive features for managing code repositories, pull requests, code reviews, and collaborative development workflows.
Why the other options are wrong
- B. Maestro is not a recognized standard tool for code development and collaboration.
- C. Orchestrator is typically used for workflow automation, not code development and branching.
- D. Conductor is not a widely used code development and collaboration tool in standard IT practice.
Question 77
Which United States law is focused on PII as it relates to the financial industry?
Show answer and explanation
Correct answer: D. GLBA
The Gramm-Leach-Bliley Act (GLBA) is specifically designed to protect PII in the financial industry, requiring financial institutions to safeguard customer information and inform customers about information practices. HIPAA applies to healthcare, SOX applies to corporate governance and auditing, and Safe Harbor is a data transfer mechanism (now replaced by Standard Contractual Clauses).
Why the other options are wrong
- A. HIPAA governs healthcare privacy, not financial industry privacy.
- B. SOX (Sarbanes-Oxley) addresses corporate governance and financial reporting, not PII protection in finance.
- C. Safe Harbor is a framework for international data transfers, not focused on financial industry PII.
Question 78
Implementing baselines on systems would take an enormous amount of time and resources if the staff had to apply them to each server, and over time, it would be almost impossible to keep all the systems in sync on an ongoing basis. Which of the following is NOT a package that can be used for implementing and maintaining baselines across an enterprise?
Show answer and explanation
Correct answer: D. GitHub
GitHub is a version control and repository platform designed for code management and collaboration; it is not a configuration management or baseline implementation tool. Puppet, SCCM (System Center Configuration Manager), and Chef are all established infrastructure-as-code and configuration management platforms specifically designed to implement and maintain system baselines across enterprises at scale.
Why the other options are wrong
- A. Puppet is a leading configuration management tool for baseline implementation.
- B. SCCM is Microsoft's enterprise configuration management solution for baseline deployment.
- C. Chef is a popular infrastructure-as-code framework for managing baselines across systems.
Question 79
Which of the following aspects of security is solely the responsibility of the cloud provider?
Show answer and explanation
Correct answer: B. Physical security
Physical security of data centers, including building access, surveillance, environmental controls, and facility protection, is solely the responsibility of the cloud provider. In the shared responsibility model, regulatory compliance is shared, operating system auditing is the customer's responsibility, and developer security practices are customer responsibilities.
Why the other options are wrong
- A. Regulatory compliance is a shared responsibility between provider and customer based on the service model.
- C. Operating system auditing and hardening is the customer's responsibility in cloud environments.
- D. Personal security practices of developers are the responsibility of the organization employing them, not the cloud provider.
Question 80
Which of the following is NOT something that an HIDS will monitor?
Show answer and explanation
Correct answer: D. Network traffic
A Host-based Intrusion Detection System (HIDS) monitors activity on an individual host/computer. It examines configurations, user logins, and critical system files for signs of compromise or malicious activity. However, HIDS does not monitor network traffic, that is the responsibility of Network-based IDS (NIDS). HIDS operates at the host level, not the network level.
Why the other options are wrong
- A. HIDS monitors system configurations to detect unauthorized changes.
- B. HIDS monitors user logins and authentication attempts to detect suspicious access.
- C. HIDS monitors critical system files for unauthorized modifications or access.
Question 81
Which of the following threat types can occur when baselines are not appropriately applied or when unauthorized changes are made?
Show answer and explanation
Correct answer: A. Security misconfiguration
Security misconfiguration occurs when baselines are not appropriately applied or when unauthorized changes are made to system configurations. When secure configuration baselines are not established or maintained, or when deviations from approved configurations occur without authorization, the system becomes vulnerable to security misconfiguration threats. This includes missing security patches, default credentials, and improper settings.
Why the other options are wrong
- B. Insecure direct object references involve improper access control to data objects, not baseline configuration management.
- C. Unvalidated redirects and forwards relate to improper input validation in URL handling, not configuration baselines.
- D. Sensitive data exposure is a consequence of various vulnerabilities but is not specifically tied to baseline application and unauthorized changes.
Question 82
Which of the cloud deployment models involves spanning multiple cloud environments or a mix of cloud hosting models?
Show answer and explanation
Correct answer: C. Hybrid
Hybrid cloud deployment spans multiple cloud environments or mixes public and private cloud resources. This model allows organizations to maintain sensitive workloads in private clouds while leveraging public cloud for scalability and cost efficiency, creating a blend of different hosting models.
Why the other options are wrong
- A. Community cloud serves a specific group with shared concerns but does not span multiple environments.
- B. Public cloud is a single deployment model with resources available to the general public.
- D. Private cloud is a single deployment model with resources dedicated to one organization.
Question 83
What type of masking strategy involves making a separate and distinct copy of data with masking in place?
Show answer and explanation
Correct answer: C. Static
Static masking creates a separate and distinct copy of production data with sensitive information masked or redacted in place. This masked copy is then used for testing and development purposes, preserving the original data structure while protecting sensitive values.
Why the other options are wrong
- A. Dynamic masking masks data on-the-fly during queries without creating a separate copy, typically used in real-time environments.
- B. Replication is the process of copying data but does not inherently imply masking is applied to that copy.
- D. Duplication refers to creating copies of data but is not the specific term for the masking strategy described.
Question 84
Which of the following is the optimal humidity level for a data center, per the guidelines established by the America Society of Heating, Refrigeration, and Air Conditioning Engineers (ASHRAE)?
Show answer and explanation
Correct answer: D. 40-60 percent relative humidity
ASHRAE guidelines specify 40-60 percent relative humidity as the optimal range for data center environments. This range minimizes risks of both static electricity damage (which increases in very dry conditions) and corrosion or condensation (which increases in very humid conditions). The 40-60% range provides the best balance for protecting equipment and maintaining operational efficiency.
Why the other options are wrong
- A. 30-50% is too dry and increases static electricity risk.
- B. 50-75% is too humid and increases corrosion and condensation risk.
- C. 20-40% is excessively dry and creates significant static electricity hazards.
Question 85
Within a SaaS environment, what is the responsibility on the part of the cloud customer in regard to procuring the software used?
Show answer and explanation
Correct answer: B. Licensing
In a SaaS model, the customer is responsible for licensing management, ensuring proper license compliance and managing the number of users/seats according to the agreement. The cloud provider handles software development, maintenance, and purchasing. The customer must track and manage their licensing obligations to remain compliant.
Why the other options are wrong
- A. Software maintenance is the cloud provider's responsibility in SaaS.
- C. Software development is entirely the cloud provider's responsibility in SaaS.
- D. The cloud provider handles purchasing; the customer manages their license allocation.
Question 86
What concept does the "A" represent in the DREAD model?
Show answer and explanation
Correct answer: A. Affected users
In the DREAD risk assessment model, 'A' stands for 'Affected users,' representing how many users or systems would be impacted by a successful exploit. The DREAD acronym stands for Damage, Reproducibility, Exploitability, Affected users, and Discoverability. Affected users is a critical factor in prioritizing which vulnerabilities pose the greatest business risk.
Why the other options are wrong
- B. Authentication is not part of the DREAD model.
- C. Affinity is not part of the DREAD model.
- D. Authorization is not part of the DREAD model.
Question 87
Within an Infrastructure as a Service model, which of the following would NOT be a measured service?
Show answer and explanation
Correct answer: C. Number of users
In Infrastructure as a Service, the measured services are typically infrastructure-level resources such as CPU, storage, memory, and bandwidth, resources directly tied to the computational and storage capacity provisioned. The number of users is not a standard measured service metric in IaaS, as it relates more to application-level concerns and would typically be relevant in SaaS models.
Why the other options are wrong
- A. CPU is a core measured service in IaaS, quantified by cores, frequency, or compute time.
- B. Storage is a primary measured service in IaaS, typically billed by gigabytes or terabytes used.
- D. Memory is a fundamental measured service in IaaS, quantified by GB allocated and used.
Question 88
What does dynamic application security testing (DAST) NOT entail?
Show answer and explanation
Correct answer: D. Knowledge of the system
Dynamic Application Security Testing (DAST) is a black-box testing methodology that does NOT require knowledge of the system's internal architecture, source code, or design. DAST involves scanning and probing a running application to discover vulnerabilities by observing its behavior and responses, making it fundamentally different from white-box testing approaches that require system knowledge.
Why the other options are wrong
- A. Scanning is a core DAST activity used to identify potential vulnerabilities.
- B. Probing the application with various inputs is a fundamental DAST technique.
- C. Discovery of vulnerabilities through runtime analysis is the primary goal of DAST.
Question 89
During which phase of the cloud data lifecycle is it possible for the classification of data to change?
Show answer and explanation
Correct answer: A. Use
During the Use phase, data classification can most readily change based on how the data is actually being used and what it's combined with. As data is processed, shared, or enriched with other information, its sensitivity, regulatory requirements, or business value may increase or decrease. For example, anonymized data becomes sensitive when linked with other datasets, or confidential data may become public after a business event.
Why the other options are wrong
- B. Archive phase is final storage where classification is typically locked and doesn't change.
- C. Create phase establishes the initial classification that generally remains stable unless reclassified intentionally.
- D. Share phase assumes data is already classified and focuses on controlling access to that classified data.
Question 90
Jurisdictions have a broad range of privacy requirements pertaining to the handling of personal data and information. Which jurisdiction requires all storage and processing of data that pertains to its citizens to be done on hardware that is physically located within its borders?
Show answer and explanation
Correct answer: D. Russia
Russia has some of the strictest data residency laws requiring that personal data pertaining to Russian citizens be stored and processed exclusively on servers physically located within Russian borders. This is enforced through legislation to maintain national data sovereignty and control.
Why the other options are wrong
- A. Japan has data protection requirements but not an absolute data residency mandate requiring all processing within its borders.
- B. The United States does not have a blanket data residency requirement for citizen data at the federal level.
- C. The European Union has strong data protection (GDPR) but allows data transfer outside EU borders under certain conditions like Standard Contractual Clauses, rather than requiring residency within EU borders.
Question 91
Humidity levels for a data center are a prime concern for maintaining electrical and computing resources properly as well as ensuring that conditions are optimal for top performance. Which of the following is the optimal humidity level, as established by ASHRAE?
Show answer and explanation
Correct answer: C. 40 to 60 percent relative humidity
ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers) recommends optimal humidity levels of 40 to 60 percent relative humidity for data centers. This range prevents both static electricity buildup (which occurs at low humidity) and condensation/corrosion (which occurs at high humidity), maintaining optimal performance of electrical and computing equipment.
Why the other options are wrong
- A. 20 to 40 percent is too dry and increases static electricity risks.
- B. 50 to 75 percent exceeds the upper optimal limit and increases condensation risks.
- D. 30 to 50 percent includes values below the ASHRAE recommended minimum threshold.
Question 92
Which of the following is NOT a function performed by the record protocol of TLS?
Show answer and explanation
Correct answer: B. Acceleration
The TLS record protocol performs encryption, authentication, and compression of data. Acceleration is not a function of the record protocol; it does not speed up connections. The record protocol's core responsibilities are protecting data through encryption and authentication while optionally compressing it before transmission.
Why the other options are wrong
- A. Encryption is a primary function of the TLS record protocol.
- C. Authentication is a primary function of the TLS record protocol.
- D. Compression is an optional function of the TLS record protocol.
Question 93
Which value refers to the amount of time it takes to recover operations in a BCDR situation to meet management's objectives?
Show answer and explanation
Correct answer: D. RTO
RTO (Recovery Time Objective) is the metric that specifies the maximum amount of time allowed to recover operations and restore systems to meet management's objectives during a BCDR event. RPO (Recovery Point Objective) measures maximum acceptable data loss, RSL is not a standard metric, and SRE (Service Reliability Engineering) is a practice, not a recovery metric.
Why the other options are wrong
- A. RSL is not a standard BCDR metric.
- B. RPO measures acceptable data loss, not time to recovery.
- C. SRE is a practice discipline, not a BCDR recovery metric.
Question 94
Which of the following can be useful for protecting cloud customers from a denial-of-service (DoS) attack against another customer hosted in the same cloud?
Show answer and explanation
Correct answer: A. Reservations
Reservations allow cloud customers to guarantee a minimum allocation of resources (CPU, memory, bandwidth) that cannot be consumed by other tenants, thereby protecting against resource exhaustion DoS attacks from neighboring customers in a multi-tenant environment. This ensures that a malicious customer's resource consumption cannot degrade service to others.
Why the other options are wrong
- B. Measured service monitors usage but does not prevent one customer from consuming resources and impacting another.
- C. Limits restrict a single customer's usage but do not inherently protect one customer from another's attacks; they are reactive rather than protective.
- D. Shares allocate resources proportionally but do not guarantee isolation; a DoS attack can still impact resource availability for other tenants sharing the same pool.
Question 95
Which OSI layer does IPsec operate at?
Show answer and explanation
Correct answer: A. Network
IPsec (Internet Protocol Security) operates at the Network Layer (Layer 3) of the OSI model. It provides encryption and authentication for IP packets at the network layer, allowing secure communication between hosts or networks.
Why the other options are wrong
- B. Transport layer protocols like TCP and UDP operate above IPsec; IPsec provides security at the network layer.
- C. Application layer is above the network layer and does not encompass IPsec's primary operational scope.
- D. Presentation layer is even higher in the OSI stack and is not where IPsec operates.
Question 96
What is the concept of segregating information or processes, within the same system or application, for security reasons?
Show answer and explanation
Correct answer: B. Sandboxing
Sandboxing is the concept of segregating information, processes, or applications within the same system or environment to contain risks and prevent unauthorized access or interference. It creates isolated environments where code or processes can run with restricted permissions.
Why the other options are wrong
- A. Fencing is not a standard IT security term for segregating processes or information.
- C. Cellblocking is not a recognized IT security term for process or information segregation.
- D. Pooling refers to the sharing of resources, which is opposite to segregation for security purposes.
Question 97
Which of the cloud cross-cutting aspects relates to the oversight of processes and systems, as well as to ensuring their compliance with specific policies and regulations?
Show answer and explanation
Correct answer: A. Governance
Governance is the cloud cross-cutting aspect that relates to the oversight of processes and systems, ensuring compliance with specific policies and regulations. It encompasses the frameworks, structures, and processes for managing and controlling cloud services across organizational boundaries.
Why the other options are wrong
- B. Regulatory requirements are specific rules but not the oversight aspect itself.
- C. Service-level agreements define performance metrics but are not the primary governance oversight function.
- D. Auditability relates to the ability to audit but is not the aspect overseeing compliance processes and systems.
Question 98
Which data point that auditors always desire is very difficult to provide within a cloud environment?
Show answer and explanation
Correct answer: B. Systems architecture
Systems architecture is difficult for auditors to obtain and verify in cloud environments because cloud providers typically do not fully disclose their internal infrastructure, system designs, or architectural details due to proprietary concerns and security practices. This lack of transparency makes comprehensive auditing challenging.
Why the other options are wrong
- A. Access policies can typically be documented and provided by cloud providers.
- C. Baselines can be established, though they may be difficult; they are not the most consistently unavailable data point.
- D. Privacy statements are standard documents that cloud providers publish.
Question 99
Which of the following is NOT one of the main intended goals of a DLP solution?
Show answer and explanation
Correct answer: A. Showing due diligence
Data Loss Prevention (DLP) solutions are designed to prevent data breaches by stopping unauthorized data transmission, ensuring regulatory compliance, managing insider threats, and minimizing organizational risk. While 'showing due diligence' may be a byproduct of implementing DLP, it is not a primary intended goal; the other three options directly reflect DLP's core objectives.
Why the other options are wrong
- B. Preventing malicious insiders is a primary DLP goal, as these solutions monitor and block unauthorized data access or exfiltration by internal actors.
- C. Regulatory compliance is a main DLP objective, helping organizations meet requirements like HIPAA, PCI-DSS, and GDPR.
- D. Managing and minimizing risk is a core DLP goal, directly addressing data security threats and organizational vulnerability.
Question 100
Which United States law is focused on accounting and financial practices of organizations?
Show answer and explanation
Correct answer: C. SOX
SOX (Sarbanes-Oxley Act) is the primary United States law focused on accounting practices, financial reporting, and corporate governance. It was enacted to improve corporate accountability and financial disclosure following major accounting scandals.
Why the other options are wrong
- A. Safe Harbor is a framework for data transfer and privacy, not accounting and financial practices.
- B. GLBA (Gramm-Leach-Bliley Act) addresses financial institutions' privacy practices, not general accounting and financial practices for all organizations.
- D. HIPAA focuses on health records and healthcare privacy, not accounting and financial practices.
Question 101
When dealing with PII, which category pertains to those requirements that can carry legal sanctions or penalties for failure to adequately safeguard the data and address compliance requirements?
Show answer and explanation
Correct answer: C. Regulated
Regulated requirements are those imposed by government laws and regulations that carry legal sanctions or penalties for non-compliance. This category encompasses mandatory compliance obligations where failure to protect PII and meet requirements can result in fines, litigation, and other legal consequences.
Why the other options are wrong
- A. Contractual requirements stem from business agreements between parties and carry contractual penalties, not legal/regulatory sanctions.
- B. Jurisdictional refers to the geographic scope of legal applicability, not the type of requirement category itself.
- D. Legal is too broad and overlapping; 'Regulated' is the specific category for legally-mandated requirements with statutory penalties.
Question 102
What are the two protocols that TLS uses?
Show answer and explanation
Correct answer: A. Handshake and record
TLS operates using two primary protocols: the Handshake Protocol (for establishing secure connections and authentication) and the Record Protocol (for encrypting and transmitting application data). These are the fundamental sublayers of the TLS architecture that work together to provide secure communication.
Why the other options are wrong
- B. Transport and initiate are not the standard protocol names for TLS; TLS operates at the transport layer but uses specific handshake and record protocols.
- C. While handshake is correct, transport is not the proper name for the second protocol; it should be record.
- D. Transmit is not a TLS protocol; the correct protocols are handshake and record, not record and transmit.
Question 103
Which type of audit report does many cloud providers use to instill confidence in their policies, practices, and procedures to current and potential customers?
Show answer and explanation
Correct answer: B. SOC 2
SOC 2 (Service Organization Control 2) is the audit report type most commonly used by cloud providers to demonstrate compliance with security, availability, processing integrity, confidentiality, and privacy controls to customers and stakeholders. It replaced the older SAS-70 standard and is specifically designed for service providers offering cloud and SaaS solutions.
Why the other options are wrong
- A. SAS-70 is outdated and has been replaced by SOC reports; cloud providers no longer use it.
- C. SOC 1 focuses on financial reporting controls, not the operational and security controls relevant to cloud services.
- D. SOX (Sarbanes-Oxley) applies to publicly traded companies' financial reporting, not cloud provider operational audits.
Question 104
Different certifications and standards take different approaches to data center design and operations. Although many traditional approaches use a tiered methodology, which of the following utilizes a macro-level approach to data center design?
Show answer and explanation
Correct answer: A. IDCA
The IDCA (International Data Center Authority) utilizes a macro-level approach to data center design and operations. In contrast, traditional methodologies like BICSI (Building Industry Consulting Services International), Uptime Institute, and NFPA typically use tiered or detailed component-based approaches to standardize data center infrastructure.
Why the other options are wrong
- B. BICSI uses a tiered, detailed methodology for infrastructure design.
- C. Uptime Institute implements a tiered classification system for data center standards.
- D. NFPA (National Fire Protection Association) focuses on detailed fire and safety codes rather than macro-level design.
Question 105
Which of the following is NOT a key area for performance monitoring as far as an SLA is concerned?
Show answer and explanation
Correct answer: B. Users
Users is not a standard key area for SLA performance monitoring. Standard SLA performance metrics focus on infrastructure resources like CPU, Memory, and Network that directly impact system availability and performance. Users are stakeholders affected by performance but are not themselves a monitored technical metric.
Why the other options are wrong
- A. CPU utilization is a key SLA monitoring metric affecting system performance.
- C. Memory utilization is a key SLA monitoring metric affecting system performance.
- D. Network performance is a key SLA monitoring metric affecting system availability and responsiveness.
Question 106
The REST API is a widely used standard for communications of web-based services between clients and the servers hosting them. Which protocol does the REST API depend on?
Show answer and explanation
Correct answer: A. HTTP
REST (Representational State Transfer) is an architectural style built on top of HTTP/HTTPS protocols. REST APIs fundamentally depend on HTTP as the underlying transport protocol for all client-server communications, using standard HTTP methods like GET, POST, PUT, and DELETE.
Why the other options are wrong
- B. SSH is a secure shell protocol used for remote access, not the underlying protocol for REST APIs.
- C. SAML is a security assertion markup language for authentication and authorization, not the transport protocol for REST.
- D. XML is a data format that may be used within REST API payloads, but it is not the protocol that REST depends on.
Question 107
You are working for a cloud service provider and receive an eDiscovery order pertaining to one of your customers. Which of the following would be the most appropriate action to take first?
Show answer and explanation
Correct answer: D. Notify the customer
When a cloud service provider receives an eDiscovery order, the most appropriate first action is to notify the customer. The provider must inform the customer of the legal hold and discovery request to maintain transparency, allow the customer to take necessary actions, and preserve the legal relationship. Only after notification should technical measures like snapshots, key escrow, or data copying be initiated.
Why the other options are wrong
- A. Taking snapshots before notifying the customer bypasses transparency and may violate contractual notification requirements.
- B. Escrowing encryption keys is a technical measure that should follow customer notification and legal review.
- C. Copying data should not be the first action; notification establishes the legal framework and ensures proper procedures are followed.
Question 108
Which entity requires all collection and storing of data on their citizens to be done on hardware that resides within their borders?
Show answer and explanation
Correct answer: A. Russia
Russia has enacted strict data localization laws requiring that data about Russian citizens be stored and processed on servers physically located within Russian borders. This reflects Russia's approach to data sovereignty and control over citizen information.
Why the other options are wrong
- B. France has privacy regulations but does not have the same strict data residency requirement as Russia.
- C. Germany has strong privacy protections (GDPR compliance) but not the specific mandatory domestic data storage requirement.
- D. The United States does not require citizen data to be stored only within its borders.
Question 109
Over time, what is a primary concern for data archiving?
Show answer and explanation
Correct answer: C. Recoverability
Recoverability is the primary long-term concern for data archiving. As technology evolves, formats become obsolete, systems change, and storage media degrade, the ability to reliably retrieve and restore archived data becomes increasingly challenging. Ensuring archived data remains accessible and usable over extended periods is critical to archiving strategy.
Why the other options are wrong
- A. While archive size is a consideration, modern storage solutions handle large volumes effectively and it is not the primary concern.
- B. Format considerations are important but are addressed through format standardization and migration strategies rather than being the central concern.
- D. Regulatory changes affect policy but the underlying technical challenge of recoverability persists regardless of regulatory environment.
Question 110
Which type of testing uses the same strategies and toolsets that hackers would use?
Show answer and explanation
Correct answer: A. Penetration
Penetration testing deliberately emulates the mindset, strategies, tactics, and toolsets of real attackers in order to discover exploitable weaknesses in a live environment. The tester performs reconnaissance, enumeration, and controlled exploitation using the same commercial and open-source tools that hackers use, which is what distinguishes it from other assessment techniques.
Why the other options are wrong
- B. Dynamic testing exercises running software for functional and security flaws but is a software-testing technique, not an adversary emulation exercise.
- C. Static testing reviews source code and design artifacts without executing the application, so it employs no attacker tooling.
- D. "Malicious testing" is not a recognized assessment category in security practice.
Question 111
Which of the following is NOT a focus or consideration of an internal audit?
Show answer and explanation
Correct answer: A. Certification
Certification is NOT typically a focus of internal audits. Internal audits focus on operational efficiency, design effectiveness, and cost management to ensure organizations operate effectively and comply with policies. Obtaining certifications (like ISO or SOC 2) is an external or compliance objective, not an internal audit focus.
Why the other options are wrong
- B. Design evaluation is a key focus of internal audits assessing control effectiveness.
- C. Costs and cost management are examined in internal audits for efficiency.
- D. Operational efficiency is a primary focus area of internal audit functions.
Question 112
Which of the following does NOT relate to the hiding of sensitive data from data sets?
Show answer and explanation
Correct answer: B. Federation
Federation relates to distributed identity and access management across multiple systems and domains, not to hiding or protecting sensitive data within datasets. Obfuscation, masking, and anonymization are all direct techniques used to hide, obscure, or de-identify sensitive data in datasets.
Why the other options are wrong
- A. Obfuscation deliberately obscures data to make it unreadable while maintaining format.
- C. Masking replaces sensitive data with fictitious or redacted values to protect it.
- D. Anonymization removes personally identifiable information to prevent identification of individuals.
Question 113
Which of the following storage types is most closely associated with a database-type storage implementation?
Show answer and explanation
Correct answer: D. Structured
Structured storage is most closely associated with database-type implementations. Databases organize data in structured formats with defined schemas, tables, and relationships. Structured storage provides organized, queryable data with predefined formats, which is the defining characteristic of database systems.
Why the other options are wrong
- A. Object storage is designed for unstructured data like images and videos, not database implementations.
- B. Unstructured storage refers to data without predefined schema, which is opposite to database requirements.
- C. Volume storage provides block-level storage but is not specifically associated with database-type implementations.
Question 114
What is the first stage of the cloud data lifecycle where security controls can be implemented?
Show answer and explanation
Correct answer: D. Create
The creation stage is the first point in the data lifecycle where security controls can be implemented. From the moment data is created, organizations can apply encryption, classification, access controls, and other security measures. While storage, use, and sharing are subsequent stages where additional controls apply, the earliest and most fundamental opportunity to implement security controls is at data creation, where decisions about data handling, sensitivity levels, and initial protections are established.
Why the other options are wrong
- A. Use occurs after creation and is not the first stage.
- B. Storage occurs after creation and is not the first stage.
- C. Share occurs after creation and is not the first stage.
Question 115
Which of the following represents a minimum guaranteed resource within a cloud environment for the cloud customer?
Show answer and explanation
Correct answer: A. Reservation
A reservation in cloud computing represents a guaranteed minimum level of resources (compute, memory, storage) that the provider commits to provide to the customer. This is a contractual guarantee that ensures the customer will have access to at least that amount of resources. Shares, limits, and provisions are related concepts but do not represent the same minimum guarantee, shares allocate available resources proportionally, limits cap usage, and provisions assign resources without guaranteed minimums.
Why the other options are wrong
- B. A share allocates a proportion of available resources but does not guarantee a minimum absolute amount.
- C. A limit sets a maximum ceiling on resource usage, not a minimum guarantee.
- D. Provision assigns resources but without the same contractual guarantee of availability as a reservation.
Question 116
Which of the following statements accurately describes VLANs?
Show answer and explanation
Correct answer: A. They are not restricted to the same data center or the same racks.
VLANs are logical network segments that can span across multiple physical locations, racks, and even data centers through technologies like VLAN trunking and routing. They are not constrained by physical infrastructure boundaries and can be configured across geographically distributed hardware.
Why the other options are wrong
- B. VLANs are not limited to a single data center; they can span multiple data centers.
- C. VLANs are specifically designed to transcend rack and data center boundaries through logical networking.
- D. While VLANs can span multiple switches, this understates their capability to extend beyond even data center boundaries.
Question 117
Which technology can be useful during the "share" phase of the cloud data lifecycle to continue to protect data as it leaves the original system and security controls?
Show answer and explanation
Correct answer: C. DLP
Data Loss Prevention (DLP) is specifically designed to protect sensitive data as it moves outside the original system during the share phase, preventing unauthorized disclosure through monitoring and controlling data in transit. IPS and IDS are network security tools; WAF protects web applications, none of which are specifically designed for protecting shared data.
Why the other options are wrong
- A. Intrusion Prevention System (IPS) detects and blocks network attacks but does not specifically protect data being shared.
- B. Web Application Firewall (WAF) protects web applications from attacks, not data in transit during sharing.
- D. Intrusion Detection System (IDS) detects attacks but does not prevent data loss or protect shared data.
Question 118
Which of the cloud cross-cutting aspects relates to the requirements placed on a system or application by law, policy, or requirements from standards?
Show answer and explanation
Correct answer: A. regulatory requirements
Regulatory requirements is the cloud cross-cutting aspect that directly addresses constraints placed on systems by law, policy, or standards requirements. This encompasses compliance obligations that organizations must meet in their cloud deployments.
Why the other options are wrong
- B. Auditability refers to the ability to audit systems, not the requirements themselves.
- C. Service-level agreements define performance commitments, not regulatory or legal requirements.
- D. Governance is broader than regulatory requirements, though regulatory requirements fall under governance; the most specific answer is regulatory requirements.
Question 119
You just hired an outside developer to modernize some applications with new web services and functionality. In order to implement a comprehensive test platform for validation, the developer needs a data set that resembles a production data set in both size and composition. In order to accomplish this, what type of masking would you use?
Show answer and explanation
Correct answer: C. Static
Static data masking creates a masked copy of production data that is stored and used for testing without changing. This approach is ideal when you need a representative dataset that resembles production in size and composition but is permanently masked for security, allowing repeated use in development and testing environments.
Why the other options are wrong
- A. Development masking is not a standard data masking category.
- B. Replicated masking refers to copying data, not masking it for security purposes.
- D. Dynamic masking masks data on-the-fly during runtime queries, not creating a stored test dataset.
Question 120
With an API, various features and optimizations are highly desirable to scalability, reliability, and security. What does the REST API support that the SOAP API does NOT support?
Show answer and explanation
Correct answer: B. Caching
REST APIs leverage HTTP standards including HTTP caching mechanisms, which allow responses to be cached at various levels (client, intermediate proxies, CDNs) to improve performance and reduce server load. SOAP APIs do not benefit from standard HTTP caching because SOAP messages are typically sent via HTTP POST, which is not cacheable by default, and SOAP's strict protocol doesn't leverage HTTP caching features.
Why the other options are wrong
- A. Acceleration is not a standard feature distinction between REST and SOAP; both can be accelerated through various means.
- C. Redundancy is an architectural consideration applicable to both API types and is not a REST-specific advantage.
- D. Encryption is supported by both REST and SOAP APIs through HTTPS/TLS and is not a distinguishing feature.
Question 121
What does the "SOC" acronym refer to with audit reports?
Show answer and explanation
Correct answer: C. Service Organizational Control
SOC stands for Service Organization Control in the context of audit reports. This is the framework developed by the American Institute of CPAs (AICPA) for auditing service organizations, including cloud providers. SOC reports assess how well a service organization's controls address user entity needs related to security, availability, processing integrity, confidentiality, and privacy.
Why the other options are wrong
- A. Service Origin Confidentiality is not the correct expansion of the SOC acronym.
- B. System Organization Confidentiality is not the correct expansion of the SOC acronym.
- D. System Organization Control is a plausible-sounding alternative but incorrect; the standard terminology is Service Organization Control, not System Organization Control.
Question 122
What type of segregation and separation of resources is needed within a cloud environment for multitenancy purposes versus a traditional data center model?
Show answer and explanation
Correct answer: D. Logical
In cloud environments, logical segregation is the primary method used to separate resources and data between multiple tenants within the same physical infrastructure. This involves virtual machines, containers, network segmentation, and access controls that create distinct logical boundaries without requiring physical separation, which is the key differentiator from traditional data centers where physical separation is more common.
Why the other options are wrong
- A. Virtual segregation is too broad and generic; logical segregation is the specific term for the separations used in multitenancy.
- B. Security segregation describes protective measures but not the primary segregation mechanism for multitenancy separation.
- C. Physical segregation contradicts the cloud model's efficiency and is not the typical approach for multitenancy in cloud environments.
Question 123
Which protocol allows a system to use block-level storage as if it was a SAN, but over TCP network traffic instead?
Show answer and explanation
Correct answer: B. iSCSI
iSCSI (Internet Small Computer Systems Interface) allows a system to use block-level storage as if it were a SAN (Storage Area Network), but it operates over TCP network traffic rather than requiring dedicated Fibre Channel infrastructure. This enables cost-effective storage networking over standard Ethernet.
Why the other options are wrong
- A. SATA is a direct-attached storage interface used within systems, not a network protocol for block-level storage access.
- C. TLS is a security protocol for encrypting communications, not a storage protocol.
- D. SCSI is a local bus protocol for direct device communication, not a network protocol for remote block-level storage access.
Question 124
Which of the following pertains to a macro level approach to data center design rather than the traditional tiered approach to data centers?
Show answer and explanation
Correct answer: A. IDCA
IDCA (Integrated Data Center Architecture) represents a macro-level approach to data center design that moves away from the traditional tiered architecture model. It emphasizes integration and holistic design principles at a broader scale rather than the compartmentalized tier-based approach.
Why the other options are wrong
- B. NFPA (National Fire Protection Association) standards address fire safety, not data center architectural design approaches.
- C. BICSI (Building Industry Consulting Services International) provides design standards but focuses on infrastructure cabling and installation, not macro-level architectural approaches.
- D. Uptime Institute provides data center tier classifications and certifications, which represent the traditional tiered approach, not the macro-level alternative to it.
Question 125
What does the REST API use to protect data transmissions?
Show answer and explanation
Correct answer: D. TLS
REST APIs use TLS (Transport Layer Security), formerly known as SSL, to protect data transmissions. TLS encrypts data in transit between the client and server, ensuring confidentiality and integrity of API communications. This is the standard security protocol for protecting REST API endpoints over HTTP/HTTPS.
Why the other options are wrong
- A. NetBIOS is a legacy networking protocol for name resolution and not relevant to REST API security.
- B. VPN creates a virtual private network but is not the primary mechanism REST APIs use; TLS is the standard transport-layer protection.
- C. Encapsulation is a general networking concept but does not specifically describe the security mechanism REST APIs use for data protection.
Question 126
Which of the following threat types can occur when an application does not properly validate input and can be leveraged to send users to malicious sites that appear to be legitimate?
Show answer and explanation
Correct answer: A. Unvalidated redirects and forwards
Unvalidated redirects and forwards occur when an application fails to properly validate redirect parameters, allowing attackers to redirect users to malicious sites that may impersonate legitimate applications. The attacker exploits the lack of input validation on redirect parameters to send users to phishing or malware sites appearing to originate from the trusted application.
Why the other options are wrong
- B. Insecure direct object references involve access control and direct object manipulation, not redirect manipulation.
- C. Security misconfiguration relates to baseline application and system hardening, not input validation.
- D. Sensitive data exposure involves improper protection of data, not redirect manipulation.
Question 127
What concept does the "D" represent with the STRIDE threat model?
Show answer and explanation
Correct answer: B. Denial of service
In the STRIDE threat model, the 'D' represents Denial of Service (DoS). STRIDE is an acronym where S=Spoofing, T=Tampering, R=Repudiation, I=Information Disclosure, D=Denial of Service, and E=Elevation of Privilege. Denial of Service threats focus on attacks that make systems or services unavailable to legitimate users.
Why the other options are wrong
- A. Data loss is not what 'D' represents in STRIDE; it relates more to Information Disclosure (I) or Tampering (T).
- C. Data breach is related to Information Disclosure (I), not the 'D' in STRIDE.
- D. Distributed is not a threat category in STRIDE; while DDoS exists, 'D' specifically means Denial of Service, not distributed.
Question 128
GAAPs are created and maintained by which organization?
Show answer and explanation
Correct answer: B. AICPA
Generally Accepted Accounting Principles (GAAPs) are created and maintained by the American Institute of Certified Public Accountants (AICPA). The AICPA establishes the standards that guide accounting practices in the United States.
Why the other options are wrong
- A. ISO/IEC creates international standards for information technology and security, not accounting principles.
- C. The PCI Council maintains Payment Card Industry Data Security Standards, not GAAPs.
- D. ISO is a generic reference; the specific organization is the AICPA, which is the authoritative body for U.S. accounting standards.
That was 128 of 512.
The full ISC2 CCSP pack has all 512 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 256 free as one PDF by email. Get the Half Pack →