Verified CCSP &As – Provide CCSP with Correct Answers [Q370-Q385] – Unlimited Lifetime Access Free Exams PDF

Rate this post

Verified CCSP Exam Dumps Q&As – Provide CCSP with Correct Answers

Pass Your CCSP Dumps Free Latest ISC Practice Tests

Q370. Which of the following threat types involves the sending of untrusted data to a user’s browser to be executed with their own credentials and access?

Missing function level access control

Cross-site scripting

Cross-site request forgery

Injection

Explanation
Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user’s browser without going through any validation or sanitization processes, or where the code is not properly escaped from processing by the browser. The code is then executed on the user’s browser with the user’s own access and permissions, allowing an attacker to redirect their web traffic, steal data from their session, or potentially access information on the user’s own computer that their browser has the ability to access.

Q371. DLP solutions can aid in deterring loss due to which of the following?

Inadvertent disclosure

Natural disaster

Randomization

Device failure

Explanation
DLP solutions may protect against inadvertent disclosure. Randomization is a technique for obscuring data, not a risk to data. DLP tools will not protect against risks from natural disasters, or against impacts due to device failure.

Q372. Which of the following would NOT be considered part of resource pooling with an Infrastructure as a Service implementation?

Storage

Application

Mamory

CPU

Explanation
Infrastructure as a Service pools the compute resources for platforms and applications to build upon, including CPU, memory, and storage. Applications are not part of an IaaS offering from the cloud provider.

Q373. Tokenization requires at least ____ database(s).

One

Two

Three

Four

Q374. What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement?

Specific

Contractual

regulated

Jurisdictional

Explanation
Contractual PII has specific requirements for the handling of sensitive and personal information, as defined at a contractual level. These specific requirements will typically document the required handling procedures and policies to deal with PII. They may be in specific security controls and configurations, required policies or procedures, or limitations on who may gain authorized access to data and systems.

Q375. Which of the following would be a reason to undertake a BCDR test?

Functional change of the application

Change in staff

User interface overhaul of the application

Change in regulations

Explanation/Reference:
Explanation:
Any time a major functional change of an application occurs, a new BCDR test should be done to ensure the overall strategy and process are still applicable and appropriate.

Q376. The most pragmatic option for data disposal in the cloud is which of the following?

Cryptoshredding

Overwriting

Cold fusion

Melting

Explanation
We don’t have physical ownership, control, or even access to the devices holding the data, so physical destruction, including melting, is not an option. Overwriting is a possibility, but it is complicated by the difficulty of locating all the sectors and storage areas that might have contained our data, and by the likelihood that constant backups in the cloud increase the chance we’ll miss something as it’s being overwritten.
Cryptoshredding is the only reasonable alternative. Cold fusion is a red herring.

Q377. What is a data custodian responsible for?
Response:

The safe custody, transport, storage of the data, and implementation of business rules

Data content, context, and associated business rules

Logging and alerts for all data

Customer access and alerts for all data

Q378. In order to prevent cloud customers from potentially consuming enormous amounts of resources within a cloud environment and thus having a negative impact on other customers, what concept is commonly used by a cloud provider?

Limit

Cap

Throttle

Reservation

A limit puts a maximum value on the amount of resources that may be consumed by either a system, a service, or a cloud customer. It is commonly used to prevent one entity from consuming enormous amounts of resources and having an operational impact on other tenants within the same cloud system.
Limits can either be hard or somewhat flexible, meaning a customer can borrow from other customers while still having their actual limit preserved. A reservation is a guarantee to a cloud customer that a certain level of resources will always be available to them, regardless of what operational demands are currently placed on the cloud environment. Both cap and throttle are terms that sound similar to limit, but they are not the correct terms in this case.

Q379. What are third-party providers of IAM functions for the cloud environment?

AESs

SIEMs

DLPs

CASBs

Data loss, leak prevention, and protection is a family of tools used to reduce the possibility of unauthorized disclosure of sensitive information. SIEMs are tools used to collate and manage log data. AES is an encryption standard.

Q380. Data center and operations design traditionally takes a tiered, topological approach.
Which of the following standards is focused on that approach and is prevalently used throughout the industry?

IDCA

NFPA

BICSI

Uptime Institute

The Uptime Institute publishes the most widely known and used standard for data center topologies and tiers.
The National Fire Protection Association (NFPA) publishes a broad range of fire safety and design standards for many different types of facilities. Building Industry Consulting Services International (BICSI) issues certifications for data center cabling. The International Data Center Authority (IDCA) offers the Infinity Paradigm, which takes a macro-level approach to data center design.

Q381. Which process serves to prove the identity and credentials of a user requesting access to an application or data?

Repudiation

Authentication

Identification

Authorization

Authentication is the process of proving whether the identity presented by a user is true and valid.
This can be done through common mechanisms such as user ID and password combinations or with more secure methods such as multifactor authentication.

Q382. Which kind of SSAE audit report is most beneficial for a cloud customer, even though it’s unlikely the cloud provider will share it?

SOC 3

SOC 1 Type 2

SOC 2 Type 2

SOC 1 Type 1

Explanation
The SOC 3 is the least detailed, so the provider is not concerned about revealing it. The SOC 1 Types 1 and 2 are about financial reporting and not relevant. The SOC 2 Type 2 is much more detailed and will most likely be kept closely held by the provider.

Q383. Which of the following threat types can occur when baselines are not appropriately applied or when unauthorized changes are made?

Security misconfiguration

Insecure direct object references

Unvalidated redirects and forwards

Sensitive data exposure

Explanation
Security misconfigurations occur when applications and systems are not properly configured or maintained in a secure manner. This can be due to a shortcoming in security baselines or configurations, unauthorized changes to system configurations, or a failure to patch and upgrade systems as the vendor releases security patches. Insecure direct object references occur when code references aspects of the infrastructure, especially internal or private systems, and an attacker can use that knowledge to glean more information about the infrastructure. Unvalidated redirects and forwards occur when an application has functions to forward users to other sites, and these functions are not properly secured to validate the data and redirect requests, allowing spoofing for malware or phishing attacks. Sensitive data exposure occurs when an application does not use sufficient encryption and other security controls to protect sensitive application data.

Q384. Which of the following threat types involves an application developer leaving references to internal information and configurations in code that is exposed to the client?

Sensitive data exposure

Security misconfiguration

Insecure direct object references

Unvalidated redirect and forwards

Explanation
An insecure direct object reference occurs when a developer has in their code a reference to something on the application side, such as a database key, the directory structure of the application, configuration information about the hosting system, or any other information that pertains to the workings of the application that should not be exposed to users or the network. Unvalidated redirects and forwards occur when an application has functions to forward users to other sites, and these functions are not properly secured to validate the data and redirect requests, allowing spoofing for malware of phishing attacks. Sensitive data exposure occurs when an application does not use sufficient encryption and other security controls to protect sensitive application data.
Security misconfigurations occur when applications and systems are not properly configured or maintained in a secure manner.

Q385. In a cloud environment, encryption should be used for all the following, except:

Long-term storage of data

Near-term storage of virtualized images

Secure sessions/VPN

Profile formatting

Loading …

The benefits of Obtaining the ISC CCSP Exam Certification

ISC CCSP is used to voluntarily certify information system professional who meets specific qualifications. The ISC serves the public interest by providing credible, vendor-neutral certification that can be used globally, supporting international standards of proficiency, and serving as an indicator of expertise proficiency.
ISC experts have developed the ISC CCSP Certification program to best serve individuals, organizations, employers, and cybersecurity leaders. The program is a provider of global sites of credentials across various industries including education, healthcare, government agencies, and businesses in order to boost professionalism within the company while giving assurance to potential employers or clients.

The benefits of obtaining this certification by doing preparation from CCSP Dumps includes: