Get ready to pass the CCSK Exam right now using our Cloud Security Knowledge Exam Package
A fully updated 2021 CCSK Exam Dumps exam guide from training expert Prep4King
How much Certificate of Cloud Security Knowledge (CCSK) Exam Cost
The Certificate of Cloud Security Knowledge (CCSK) Exam costs USD 395 which includes two attempts for the candidates. In case of failure, each further attempt will cost USD 395. Candidates may incur other costs during the preparation phase of the exam like purchasing the CCSk dumps pdf and then practicing for the exam via the CCSK practice test.
NEW QUESTION 153
The most pragmatic option for data disposal in the cloud is which of the following?
- A. Melting
- B. Overwriting
- C. Crypto shredding
- D. Cold fusion
Answer: C
NEW QUESTION 154
Which of the following is key benefit of private cloud model?
- A. Assurance of Data Location
- B. Off-loading IT Management
- C. Less expensive
- D. Distributed data location
Answer: A
Explanation:
One of the key challenges in cloud computing is its distributed environment and dispersed data centers across the globe. It is very difficult to trace data location in public clouds.
Therefore. Assurance of data location is key advantage of private cloud.
NEW QUESTION 155
An important consideration when performing a remote vulnerability test of a cloud-based application is to
- A. Obtain provider permission for test
- B. Use techniques to evade cloud provider's detection systems
- C. Use network layer testing tools exclusively
- D. Use application layer testing tools exclusively
- E. Schedule vulnerability test at night
Answer: A
NEW QUESTION 156
APIs and web services require extensive hardening and must assume attacks from authenticated and unauthenticated adversaries.
- A. False
- B. True
Answer: B
NEW QUESTION 157
Which cloud-based service model enables companies to provide client-based access for partners to databases or applications?
- A. Desktop-as-a-service (DaaS)
- B. Identity-as-a-service (IDaaS)
- C. Platform-as-a-service (PaaS)
- D. Software-as-a-service (SaaS)
- E. Infrastructure-as-a-service (IaaS)
Answer: C
NEW QUESTION 158
ANF and ONF are referred in which of the following ISO standards?
- A. ISO 27032
- B. ISO 27001
- C. ISO 27005
- D. ISO 27034-1
Answer: D
Explanation:
ISO/ IEC 27034-1, "Information Technology - Security Techniques - Application Security," provides one of the most widely accepted set of standards and guidelines for secure application development. IS0/ IEC27034-1 is a comprehensive set of standards that cover many aspects of application development. A few of the key elements include the organizational normative framework (ONF), the application normative framework (ANF), and the application security management process (APSM).
NEW QUESTION 159
Which communication methods within a cloud environment must be exposed for partners or consumers to access database information using a web application?
- A. Software Development Kits (SDKs)
- B. Application Binary Interface (ABI)
- C. Extensible Markup Language (XML)
- D. Application Programming Interface (API)
- E. Resource Description Framework (RDF)
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 160
Cloud customer can do vulnerability assessment of their whole infrastructure on cloud just like they conduct vulnerbility assessment of their traditional infrastructure.
- A. False
- B. True
Answer: A
Explanation:
It is false.
Customer will have to take permission and give notification to cloud service provider.
The cloud owner (public or private) will typically require notification of assessments and place limits on the nature of assessments. This is because they may be unable to distinguish an assessment from a real attack without prior warning.
Ref: CSA Security Guidelines V4.0
NEW QUESTION 161
Which of the below hypervisors are 0S based and are more attractive to attackers?
- A. Type III
- B. Type V
- C. Type I
- D. Type II
Answer: D
Explanation:
Type II hypervisors are 0S-based and more attractive to attackers. There are lot of vulnerabilities which are found not only on 0S but also in applications residing on the 0S.
NEW QUESTION 162
Which term is used to describe the use of tools to selectively degrade portions of the cloud to continuously test business continuity?
- A. Chaos Engineering
- B. Planned Outages
- C. Resiliency Planning
- D. Expected Engineering
- E. Organized Downtime
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 163
Which is the correct sequence of Cloud Data lifecycle phases?
- A. Create, Share, Use, Store, Archive, Destroy
- B. Create, Use, Share, Store, Archive, Destroy
- C. Create, Store, Use, Share, Archive, Destroy
- D. Create, Use, Store, Archive, Share, Destroy
Answer: C
Explanation:
The correct order of data lifecycle is Create, Store, Use, Share, Archive, Destroy
NEW QUESTION 164
An agreed-upon description of the attributes of a product. at a point in time that serves as a basis for defining change is called:
- A. Baseline
- B. Trusted Module
- C. Secured Server
- D. Standardization
Answer: A
Explanation:
A baseline is an agreed-upon description of the attributes of a product. at a point in time that serves as a basis for defining change.
NEW QUESTION 165
Which of the following document includes responsibilities and mechanisms for governance in cloud environment?
- A. Service Level Agreement
- B. Governance memo
- C. Operational level Agreement
- D. Contract
Answer: D
Explanation:
Cloud computing changes the responsibilities and mechanisms for implementing and managing governance. Responsibilities and mechanisms for governance are defined in the contract. as with any business relationship. If the area of concern isnt in the contract. there are no mechanisms available to enforce. and there is a governance gap. Governance gaps dont necessarily exclude using the provider, but they do require the customer to adjust their own processes to close the gaps or accept the associated risks.
Ref: Security Guidance v4.0 Copyright2017, Cloud Security Alliance (used for educational purpose here)
NEW QUESTION 166
The key focus of any business continuity or disaster recovery should be:
- A. Health and human safety
- B. Critical infrastructure
- C. Critical assets
- D. Financial documents
Answer: A
Explanation:
The primary goal of whole business continuity and disaster recovery exercise should be health and human safety.
NEW QUESTION 167
What is the key difference between Business Continuity and Business Continuity Management?
- A. They are same concepts used interchangeably
- B. None of the above
- C. Business Continuity is the holistic process whereas Business Continuity Management is the capability of the organization
- D. Business Continuity is the capability of the organization whereas Business Continuity Management is the holistic process.
Answer: D
Explanation:
Definitions:
Business continuity: The capability of the organisation to continue delivery of products or services at acceptable predefined levels following a loss of service.
Business continuity management: A holistic management process that identifies potential threats to an organisation and the impacts to business operations those threats, if realised, might cause. It provides a framework for building organisational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand, and value-creating activities
NEW QUESTION 168
Enterprise Risk Management is part of over all information Risk Management of the organization
- A. False
- B. True
Answer: A
Explanation:
It is False and it is other way round. Information Risk management is part of Enterprise Risk.
NEW QUESTION 169
Dynamic Application Security Testing (DAST) might be limited or require pre-testing permission from the provider.
- A. False
- B. True
Answer: B
NEW QUESTION 170
When virtual machines may communicate with each other over a hardware backplane, Rather than a network, It gives rise to:
- A. DDoS
- B. Inter VM attack
- C. Multi-tenancy
- D. Blind spot
Answer: D
Explanation:
It's the definition of Blind spot and it is very difficult to monitor this traffic.
NEW QUESTION 171
ln which of the following cloud service models is the customer required to maintain the operating system?
- A. SaaS
- B. IaaS
- C. Public Cloud
- D. PaaS
Answer: B
Explanation:
According to "The NIST Definition of Cloud Computing," in IaaS, "the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include OSs and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over OSs, storage, and deployed applications; and possibly limited control of select networking components (e.g, host firewalls)."
NEW QUESTION 172
"Cloud provider acquisition" as a risk fall under which of the following categories?
- A. Legal Risk
- B. Technical risk
- C. Policy and Organizational Risk
- D. Environmental Risk
Answer: C
Explanation:
Cloud provider acquisition comes under Policy and Organizational Risk and can be categorised as follows.
As in any new IT market, competitive pressure, an inadequate business strategy, lack of financial support, etc, could lead some providers to go out of business or at least to force them to restructure their service portfolio offering. In other words, it is possible that in the short or medium term some cloud computing services could be terminated.
NEW QUESTION 173
......
Master 2021 Latest The Questions Cloud Security Knowledge and Pass CCSK Real Exam!: https://www.prep4king.com/CCSK-exam-prep-material.html
Practice To CCSK - Prep4King Remarkable Practice On your Certificate of Cloud Security Knowledge (v4.0) Exam Exam: https://drive.google.com/open?id=10n8DevzjwU0jYYfmfZbf7VQJ4upuTGil
