ISC2 CCSP Exam Questions Instant Access - No Installation Required

Question 1

Within an Infrastructure as a Service model, which of the following would NOT be a measured service?

ACPU

BStorage

CNumber of users

DMemory

Answer : C

Within IaaS, the number of users on a system is not relevant to the particular hosting model in regard to cloud resources. IaaS is focused on infrastructure needs of a system or application. Therefore, a factor such as the number of users that could affect licensing requirements, for example, would apply to the SaaS model, or in some instances to PaaS.

Question 2

Why does a Type 1 hypervisor typically offer tighter security controls than a Type 2 hypervisor?

AA Type 1 hypervisor also controls patching of its hosted virtual machines ensure they are always secure.

BA Type 1 hypervisor is tied directly to the bare metal and only runs with code necessary to perform its specific mission.

CA Type 1 hypervisor performs hardware-level encryption for tighter security and efficiency.

DA Type 1 hypervisor only hosts virtual machines with the same operating systems as the hypervisor.

Answer : B

Type 1 hypervisors run directly on top of the bare metal and only contain the code and functions required to perform their purpose. They do not rely on any other systems or contain extra features to secure.

Question 3

The different cloud service models have varying levels of responsibilities for functions and operations depending with the model's level of service.

In which of the following models would the responsibility for patching lie predominantly with the cloud customer?

ADaaS

BSaaS

CPaaS

DIaaS

Answer : D

With Infrastructure as a Service (IaaS), the cloud customer is responsible for deploying and maintaining its own systems and virtual machines. Therefore, the customer is solely responsible for patching and any other security updates it finds necessary. With Software as a Service (SaaS), Platform as a Service (PaaS), and Desktop as a Service (DaaS), the cloud provider maintains the infrastructure components and is responsible for maintaining and patching them.

Question 4

What is the primary reason that makes resolving jurisdictional conflicts complicated?

ADifferent technology standards

BCosts

CLanguage barriers

DLack of international authority

Answer : D

With international operations, systems ultimately cross many jurisdictional boundaries, and many times, they conflict with each other. The major hurdle to overcome for an organization is the lack of an ultimate international authority to mediate such conflicts, with a likely result of legal efforts in each jurisdiction.

Question 5

Which type of audit report is considered a "restricted use" report for its intended audience?

ASAS-70

BSSAE-16

CSOC Type 1

DSOC Type 2

Answer : C

SOC Type 1 reports are considered 'restricted use' reports. They are intended for management and stakeholders of an organization, clients of the service organization, and auditors of the organization. They are not intended for release beyond those audiences.

Question 6

Which of the following threat types involves the sending of commands or arbitrary data through input fields in an application in an attempt to get that code executed as part of normal processing?

ACross-site scripting

BMissing function-level access control

CInjection

DCross-site forgery

Answer : C

An injection attack is where a malicious actor will send commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries. This can trick an application into exposing data that is not intended or authorized to be exposed, or it could potentially allow an attacker to gain insight into configurations or security controls. Missing function-level access control exists where an application only checks for authorization during the initial login process and does not further validate with each function call. Cross-site request forgery occurs when an attack forces an authenticated user to send forged requests to an application running under their own access and credentials. Cross-site scripting occurs when an attacker is able to send untrusted data to a user's browser without going through validation processes.

Question 7

What concept does the "I" represent with the STRIDE threat model?

AIntegrity

BInformation disclosure

CIT security

DInsider threat

Answer : B

Perhaps the biggest concern for any user is having their personal and sensitive information disclosed by an application. There are many aspects of an application to consider with security and protecting this information, and it is very difficult for any application to fully ensure security from start to finish. The obvious focus is on security within the application itself, as well as protecting and storing the data.

ISC2 Certified Cloud Security Professional CCSP Exam Questions