CCM: A hypothetical company called: `CertBus4Sure` is located in the United States and provides cloud based services for tracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. CertBus4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document to potential clients. Which of the following approach would be most suitable to assess the overall security posture of CertBus4Sure's cloud service?
A. The CCM columns are mapped to HIPAA/HITECH Act and therefore CertBus4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.
B. The CCM domain controls are mapped to HIPAA/HITECH Act and therefore CertBus4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company's overall security posture in an efficient manner.
C. The CCM domains are not mapped to HIPAA/HITECH Act. Therefore CertBus4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.
A defining set of rules composed of claims and attributes of the entities in a transaction, which is used to determine their level of access to cloud-based resources is called what?
A. An entitlement matrix
B. A support table
C. An entry log
D. A validation process
E. An access log
Big data includes high volume, high variety, and high velocity.
A. False
B. True
Which of the following is NOT a cloud computing characteristic that impacts incidence response?
A. The on demand self-service nature of cloud computing environments.
B. Privacy concerns for co-tenants regarding the collection and analysis of telemetry and artifacts associated with an incident.
C. The possibility of data crossing geographic or jurisdictional boundaries.
D. Object-based storage in a private cloud.
E. The resource pooling practiced by cloud services, in addition to the rapid elasticity offered by cloud infrastructures.
CCM: The following list of controls belong to which domain of the CCM?
GRM 06 `" Policy GRM 07 `" Policy Enforcement GRM 08 `" Policy Impact on Risk Assessments GRM 09 `" Policy Reviews GRM 10 `" Risk Assessments GRM 11 `" Risk Management Framework
A. Governance and Retention Management
B. Governance and Risk Management
C. Governing and Risk Metrics
Which attack surfaces, if any, does virtualization technology introduce?
A. The hypervisor
B. Virtualization management components apart from the hypervisor
C. configuration and VM sprawl issues
D. All of the above
APIs and web services require extensive hardening and must assume attacks from authenticated and unauthenticated adversaries.
A. False
B. True
Which cloud-based service model enables companies to provide client-based access for partners to databases or applications?
A. Platform-as-a-service (PaaS)
B. Desktop-as-a-service (DaaS)
C. Infrastructure-as-a-service (IaaS)
D. Identity-as-a-service (IDaaS)
E. Software-as-a-service (SaaS)
All cloud services utilize virtualization technologies.
A. False
B. True
If there are gaps in network logging data, what can you do?
A. Nothing. There are simply limitations around the data that can be logged in the cloud.
B. Ask the cloud provider to open more ports.
C. You can instrument the technology stack with your own logging.
D. Ask the cloud provider to close more ports.
E. Nothing. The cloud provider must make the information available.
Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Cloud Security Alliance exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your CCSK exam preparations and Cloud Security Alliance certification application, do not hesitate to visit our Vcedump.com to find your solutions here.