Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 121:

  The key concern of data backup and recovery schemes is:

  A. Data aggregation should not cause breaches

  B. They must prevent data loss, unwanted data overwrite and destruction

  C. Assurance that cloud provider has multiple data centers for disaster recover

  D. Assurance that deleted data is in fact unrecoverable

  E. Data should not be commingled with other customers

  Correct Answer: B

  B. They must prevent data loss, unwanted data overwrite and destruction

  The key concern of data backup and recovery schemes is to ensure that data is protected from loss, accidental overwrites, and destruction. Backup and recovery strategies aim to create copies of data that can be restored in the event of data loss due to various factors such as hardware failure, human error, software bugs, or cyberattacks.

  While the other options (A, C, D, E) might also be relevant considerations in data management and security, option B specifically addresses the primary objective of data backup and recovery schemes, which is to prevent data loss and ensure the ability to restore data effectively.

• Question 122:

  Which regulation affects data controllers with business in Japan?

  A. Personal Information Protection and Electronic Documents Act (PIPEDA)

  B. General Data Protection Regulation (GDPR)

  C. 1995 Data Protection Directive

  D. Privacy Act 1988

  E. Act on the Protection of Personal Information

  Correct Answer: E

  E. Act on the Protection of Personal Information

  The regulation that affects data controllers with business in Japan is the "Act on the Protection of Personal Information" (APPI). This regulation is specific to Japan and is designed to protect the personal information of individuals in the country. It establishes rules and requirements for the handling, processing, and protection of personal information by organizations operating in Japan.

• Question 123:

  Which component is a key part of software container systems?

  A. Operating system

  B. Workload tools

  C. An automated controller.

  D. The execution environment

  E. A client

  Correct Answer: D

  D: SecGuiv4, P.85: Containers: Containers are code execution environments that run within an operating system (for now), sharing and leveraging resources of that operating system. While a VM is a full abstraction of an operating system, a container is a constrained place to run segregated processes while still utilizing the kernel and other capabilities of the base OS. Multiple containers can run on the same virtual machine or be implemented without the use of VMs at all and run directly on hardware. The container provides code running inside a restricted environment with only access to the processes and capabilities defined in the container configuration. This allows containers to launch incredibly rapidly, since they don't need to boot an operating system or launch many (sometimes any) new services; the container only needs access to already-running services in the host OS and some can launch in milliseconds.

• Question 124:

  CCM: What is the role of the Scope Applicability column in the CCM?

  A. It show which architectural elements are related to a given control

  B. It describes the applicability of the overall domain

  C. It maps the existing industry standards to the controls in the domains

  D. It describes the applicability of the controls in the domains

  E. None of the above

  Correct Answer: D

  Scope Applicability column: This column in the Cloud Controls Matrix (CCM) identifies the specific cloud elements that a control applies to.

  Architectural elements: While some controls may be relevant to broader architectural considerations, the Scope Applicability column focuses on specific aspects of the cloud environment where the control needs to be implemented.

  Overall domain: The applicability of the overall domain is typically addressed in the domain description itself, not in the Scope Applicability column.

  Industry standards: The mapping of existing industry standards to the controls is often provided in a separate section of the CCM, not within the Scope Applicability column.

• Question 125:

  When considering business continuity and disaster recovery with a cloud provider, which layer of the logical stack includes code and message queues?

  A. Applistructure

  B. Datastructure

  C. Infostructure

  D. Infrastructure

  E. Metastructure

  Correct Answer: A

• Question 126:

  What factor(s), if any, allows for more efficient and effective containment and recovery in a cloud environment than in a non-cloud environment.

  A. encrypted data files

  B. no part of incident response is easier in a cloud environment

  C. frequent backup routines

  D. multitenancy and software as a service models

  E. Virtualization technologies, and the elasticity inherent in cloud computing platforms

  Correct Answer: E

  pg: 106 The cloud often provides a lot more flexibility in this phase of the response, especially for IaaS. Software-defined infrastructure allows you to quickly rebuild from scratch in a clean environment, and, for more isolated attacks, inherent cloud characteristics-such as auto-scale groups, API calls for changing virtual network or machine configurations, and snapshots—can speed quarantine, eradication, and recovery processes. For example, on many platforms you can instantly quarantine virtual machines by moving the instance out of the auto-scale group, isolating it with virtual firewalls, and replacing it.

• Question 127:

  What is true of cloud built-in firewalls?

  A. They operate exclusively outside of the hypervisor

  B. Whichever features are not provided in the firewall, the cloud provider has an alternative

  C. They operate exclusively outside of the SDN

  D. They typically offer fewer features that newer physical firewalls

  E. They provide identical configurations to physical firewalls

  Correct Answer: D

  D. They typically offer fewer features that newer physical firewalls SecGuiV4, P.96: All modern cloud platforms offer built-in firewalls, which may offer advantages over corresponding physical firewalls. These are software firewalls that may operate within the SDN or the hypervisor. They typically offer fewer features than a modern, dedicated next-generation firewall, but these capabilities may not always be needed due to other inherent security provided by the cloud provider.

• Question 128:

  What are the NIST defined essential characteristics of cloud computing?

  A. Rapid elasticity, compliance readiness, and resource pooling

  B. Broad network access, measured service, multifactor configurability, and resource pooling

  C. Broad network access, automatic patching, compliance readiness, and resource pooling

  D. Broad network access, rapid elasticity, measured service, on-demand self-service, and resource pooling

  E. Broad network access, rapid elasticity, automatic patching, and resource pooling

  Correct Answer: D

  D. Broad network access, rapid elasticity, measured service, on-demand self-service, and resource pooling Option D includes all five of these essential characteristics as defined by NIST.

• Question 129:

  Generally speaking, in the United States, a party is obligated to take reasonable steps to prevent the destruction or modification of data in its possession that it reasonably should know, is relevant to an anticipated litigation or government investigation.

  A. False

  B. True

  Correct Answer: B

  B. True

  In the United States, it is generally true that a party is obligated to take reasonable steps to prevent the destruction or modification of data in its possession that it reasonably should know is relevant to an anticipated litigation or government investigation. This legal concept is known as the duty to preserve evidence or the duty to preserve relevant information, and it applies to various legal proceedings, including litigation and regulatory investigations. Failure to preserve relevant data could result in legal consequences such as spoliation sanctions or adverse inferences against the party not fulfilling their preservation duty.

• Question 130:

  Which of the following is NOT a common storage option with Infrastructure as a Service?

  A. Object Storage

  B. Volume Storage

  C. Content Delivery Network

  D. Big Data as a Service

  E. SSD based volume storage

  Correct Answer: D

  11.1.2 Cloud Data Storage Types

  Application/platform: Examples of these would be a content delivery network (CDN), files stored in SaaS, caching, and other novel options.