Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 101:

  What factors should you understand about the data specifically due to legal, regulatory, and jurisdictional factors?

  A. The physical location of the data and how it is accessed

  B. The fragmentation and encryption algorithms employed

  C. The language of the data and how it affects the user

  D. The implications of storing complex information on simple storage systems

  E. The actual size of the data and the storage format

  Correct Answer: A

• Question 102:

  Who is responsible for the security of the physical infrastructure and virtualization platform?

  A. The cloud consumer

  B. The majority is covered by the consumer

  C. It depends on the agreement

  D. The responsibility is split equally

  E. The cloud provider

  Correct Answer: E

• Question 103:

  CCM: In the CCM tool, a _____________________ is a measure that modifies risk and includes any process, policy, device, practice or any other actions which modify risk.

  A. Risk Impact

  B. Domain

  C. Control Specification

  Correct Answer: C

• Question 104:

  All assets require the same continuity in the cloud.

  A. False

  B. True

  Correct Answer: A

• Question 105:

  Which type of application security testing tests running applications and includes tests such as web vulnerability testing and fuzzing?

  A. Code Review

  B. Static Application Security Testing (SAST)

  C. Unit Testing

  D. Functional Testing

  E. Dynamic Application Security Testing (DAST)

  Correct Answer: E

  E. Dynamic Application Security Testing (DAST)

  Dynamic Application Security Testing (DAST) is a type of application security testing that involves testing running applications to identify vulnerabilities and security weaknesses. It simulates real-world attacks on the application and examines how it responds to those attacks. DAST typically includes tests such as web vulnerability scanning, penetration testing, and fuzzing. DAST tools send various inputs and payloads to the application, analyze the responses, and identify potential vulnerabilities such as injection flaws, cross-site scripting (XSS), and insecure configurations. Unlike Static Application Security

  Testing (SAST), which analyzes the application's source code, DAST focuses on the application in its deployed state. Therefore, the correct answer is E. Dynamic Application Security Testing (DAST).

• Question 106:

  CCM: The Cloud Service Delivery Model Applicability column in the CCM indicates the applicability of the cloud security control to which of the following elements?

  A. Mappings to well-known standards and frameworks

  B. Service Provider or Tenant/Consumer

  C. Physical, Network, Compute, Storage, Application or Data

  D. SaaS, PaaS or IaaS

  Correct Answer: D

  FROM CCM Table Typical Control Applicability and Ownership IaaS PaaS SaaS

• Question 107:

  Any given processor and memory will nearly always be running multiple workloads, often from different tenants.

  A. False

  B. True

  Correct Answer: B

  7.4.1 How Cloud Changes Workload Security

  Any given processor and memory will nearly always be running multiple workloads, often from different tenants.

• Question 108:

  In which deployment model should the governance strategy consider the minimum common set of controls comprised of the Cloud Service Provider contract and the organization's internal governance agreements?

  A. Public

  B. PaaS

  C. Private

  D. IaaS

  E. Hybrid

  Correct Answer: E

  Typo

• Question 109:

  What is known as the interface used to connect with the metastructure and configure the cloud environment?

  A. Administrative access

  B. Management plane

  C. Identity and Access Management

  D. Single sign-on

  E. Cloud dashboard

  Correct Answer: B

  As stated in Security-Guidance-v4.0, Pg 69 “cloud computing is the act of taking physical assets (like networks and processors) and using them to build resource pools. Metastructure is the glue and guts to create, provision, and deprovision the pool. The management plane includes the interfaces for building and managing the cloud itself, but also the interfaces for cloud users to manage their own allocated resources of the cloud”. Thus, the correct answer is B.

• Question 110:

  What does it mean if the system or environment is built automatically from a template?

  A. Nothing.

  B. It depends on how the automation is configured.

  C. Changes made in production are overwritten by the next code or template change.

  D. Changes made in test are overwritten by the next code or template change.

  E. Changes made in production are untouched by the next code or template change.

  Correct Answer: C

  10.1.3.4 If the system or environment is built automatically from a template, likely from a CI/ CD pipeline, then any changes made in production will be overwritten by the next code or template change.