Guaranteed Success in Cloud Security Knowledge CCSK Exam Dumps [Q53-Q68]

Rate this post

Guaranteed Success in Cloud Security Knowledge CCSK Exam Dumps

Cloud Security Alliance CCSK Daily Practice Exam New 2024 Updated 120 Questions

QUESTION 53
Which cloud storage technology is basically a virtual hard drive for instanced or VMs?

Volume storage

Platform

Database

Application

Object storage

QUESTION 54
Which of the following is not an abuse or misuse of cloud services?

Launching DDoS Attacks

Email Spam

Data Deletion

Phishing campaigns

Please note here and understand the meaning of phrase “abuse or misuse of cloud Services”. This phrase means to launch attacks or campaign by using cloud as a platform, mostly, public cloud.

QUESTION 55
What is true of companies considering a cloud computing business relationship?

The laws protecting customer data are based on the cloud provider and customer location only.

The confidentiality agreements between companies using cloud computing services is limited legally to the company, not the provider.

The companies using the cloud providers are the custodians of the data entrusted to them.

The cloud computing companies are absolved of all data security and associated risks through contracts and data laws.

The cloud computing companies own all customer data.

QUESTION 56
Which of the following is one of the five essential characteristics of cloud computing as defined by NIST?

Multi-tenancy

Nation-state boundaries

Measured service

Unlimited bandwidth

Hybrid clouds

QUESTION 57
According to ISO 27018. data processor has explicit control over how CSPs are to use PII.

True

False

In ISO 27018, it is the customer who has explicit right over how CSPs will use their information

QUESTION 58
An important consideration when performing a remote vulnerability test of a cloud-based application is to

Obtain provider permission for test

Use techniques to evade cloud provider’s detection systems

Use application layer testing tools exclusively

Use network layer testing tools exclusively

Schedule vulnerability test at night

QUESTION 59
An incident in which sensitive, protected or confidential information is released, viewed, stolen or used by an individual who is not authorized to do so, is called:

Data Dispersion

Data Breach

Data Denial

Data Disclosure

It is the definition of Data breach. It should not be confused with data disclosure. The incident can lead to information disclosure but incident, itself, will be termed as Data Breach.

QUESTION 60
CCM: The Cloud Service Delivery Model Applicability column in the CCM indicates the applicability of the cloud security control to which of the following elements?

Mappings to well-known standards and frameworks

Service Provider or Tenant/Consumer

Physical, Network, Compute, Storage, Application or Data

SaaS, PaaS or IaaS

QUESTION 61
A defining set of rules composed of claims and attributes of the entities in a transaction, which is used to determine their level of access to cloud-based resources is called what?

An entitlement matrix

A support table

An entry log

A validation process

An access log

QUESTION 62
Which of the following is an assurance program and documentation registry for cloud provider assessments?

CSA Cloud Controls Matrix

CSA Consensus Assessments Initiative Questionnaire

CSA Star

CSA governance charter

The Cloud Security Alliance STAR Registry is an assurance program and documentation registry or cloud provider assessments based on the CSA Cloud Controls Matrix and Consensus Assessments Initiative Questionnaire. Some providers also disclose documentation for additional certifications and assessments(including self-assessments).
Ref: Security Guidance v4.0 Copyright2017, Cloud Security Alliance(used for educational purpose here)

QUESTION 63
The process which frees the resources from their physical constraints to enable pooling is called:

Automation

Abstraction

Orchestration

Classification

Abstraction. often via virtualization. frees the resources from their physical constraints to enable pooling. Then a set of core connectivity and delivery tools(orchestration)ties these abstracted resources together. creates the pools. and provides the automation to deliver them to customers.
Ref: CSA Security Guidelines V4.0

QUESTION 64
What is the most significant security difference between traditional infrastructure and cloud computing?

Management plane

Intrusion detection options

Secondary authentication factors

Network access points

Mobile security configuration options

QUESTION 65
Which of the following is not one of the essential characteristics of Cloud Computing?

On-demand self service

Broad network access

Resource Sharing

Rapid elasticit

Resource sharing is not one of the key characteristics of Cloud Computing

QUESTION 66
Cloud Service Provider and Cloud Customer are jointly responsible for ownership of the all risks in shared responsibility model for security across all service models.

True

False

This is false. This is again a tricky question and one should be careful when answering this type of question. It is the cloud customer is who is ultimately responsible for the ownership of risk in the cloud environment. Consumer just passes some of risk management responsibilities to the cloud service provider.

QUESTION 67
Under the new EU data protection rules. data destruction and corruption of personal data.

does not attract any additional penalty

does not guarantee damages that can claimed by cloud customer.

are considered forms of data breaches and require notification

does not need notification but cloud service provider is legally liable

They are considered as forms of data breached and require notification. Further cloud customer is legally liable.

QUESTION 68
ENISA: An example high risk role for malicious insiders within a Cloud Provider includes

Sales

Marketing

Legal counsel

Auditors

Accounting