Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 141:

  Why do blind spots occur in a virtualized environment, where network-based security controls may not be able to monitor certain types of traffic ?

  A. The network stack is out of alignment

  B. Clouds do not occur in networked environments

  C. Traffic is undetectable in virtual machines

  D. Virtual machines may communicate with each other over a virtual network all on the same host rather than a physical network between servers

  E. None of the above

  Correct Answer: D

  Blind spots occur in a virtualized environment because virtual machines (VMs) can communicate with each other over a virtual network within the same host rather than sending traffic over a physical network between separate physical servers. This means that network-based security controls that are designed to monitor traffic on physical networks may not be able to detect or monitor traffic between virtual machines on the same host.

  Options A, B, and C are not accurate explanations for the occurrence of blind spots in virtualized environments.

• Question 142:

  When associating the functions to an actor, what is used to restrict a list of possible actions dowr to allowed actions?

  A. Permissions

  B. Controls

  C. Location

  D. Functions

  E. Actions

  Correct Answer: B

  page 65 : Controls: A control restricts a list of possible actions down to allowed actions. The table below shows one way to list the possibilities, which the user then maps to controls.

• Question 143:

  Which type of application security testing should incorporate checks on API calls to the cloud service?

  A. Dynamic Application Security Testing (DAST)

  B. Unit Testing

  C. Functional Testing

  D. Static Application Security Testing (SAST)

  E. All of the above

  Correct Answer: D

  Static Application Security Testing (SAST) is On top of the normal range of tests, these should ideally incorporate checks on API calls to the cloud service. Hence, Correct answer is D.

• Question 144:

  Which facet is focused on protecting the management plane components, such as web and API servers, from attacks?

  A. Authorization and entitlements

  B. Logging and alerting

  C. Customer authentication

  D. Perimeter security

  E. External authentication

  Correct Answer: D

  Page 72: Perimeter security: Protecting from attacks against the management plane's components itself,

  such as the web and API servers. It includes both lower-level network defenses as well as

  higher-level defenses against application attacks.

• Question 145:

  In a cloud environment, how can you best determine data/information security risks and potential controls?

  A. understand the cloud storage architecture in use

  B. run a search on user data le

  C. encrypt everything

  D. identify the major operating system(s)

  E. understand the related regulatory requirements

  Correct Answer: A

• Question 146:

  What is it called when a customer's information and/or processes are compromised by the actions of another customer in a multi-tenancy environment?

  A. Information leakage

  B. Data loss

  C. Failure to thrive

  D. Relationship failure

  E. Isolation failure

  Correct Answer: E

  E. Isolation failure

  When a customer's information and/or processes are compromised by the actions of another customer in a multi-tenancy environment, it is referred to as an isolation failure. Isolation failure occurs when the mechanisms that are meant to

  keep the resources and data of different customers isolated from each other are breached, leading to unauthorized access or interference between tenants' data or applications.

  The other options (A, B, C, D) do not specifically describe this scenario of a security breach due to the actions of another customer in a multi-tenancy environment.

• Question 147:

  What are the three main aspects for data security controls?

  A. Controlling, monitoring, and managing

  B. Controlling, encrypting, and managing

  C. Managing, securing, and enforcing

  D. Gating, encrypting, and backing up

  E. Controlling, protecting, and enforcing

  Correct Answer: E

  11.1.1 Data Security Controls Controlling, Protecting, Enforcing

• Question 148:

  Which SDP component is used for authentication and authorization?

  A. Client

  B. Controller

  C. Access Manager

  D. Gateway

  E. Firewall

  Correct Answer: B

  B: Controller

  SecGui Pg.82 - The SDP controller for authenticating and authorizing SDP clients and configuring the connections to SDP gateways.

• Question 149:

  While the cloud consumer is responsible for implementing the security controls, the cloud provider implements the security of the workload.

  A. True

  B. False

  Correct Answer: B

  Should be a shared responsibility between cloud provider and consumer.

• Question 150:

  Which of the following items is one of the major regulatory compliance problems associated with cloud environments?

  A. The lowered cost of cloud services may violate computer service embargoes

  B. The advent of applications as a service may violate software licensing agreements

  C. Transparency is improved through consolidated and centralized management platforms

  D. The distributed nature of cloud storage may result in regulated information being sent across geographical boundaries

  E. The multi-tenancy model allows cloud customers to unfairly share hard drives that would otherwise have been purchased individually

  Correct Answer: D

  D. The distributed nature of cloud storage may result in regulated information being sent across geographical boundaries

  One of the major regulatory compliance problems associated with cloud environments is that the distributed nature of cloud storage can potentially lead to regulated information, such as sensitive or confidential data, being stored and processed in locations that might cross geographical boundaries. This can raise concerns about data sovereignty, privacy regulations, and compliance with laws that restrict where certain types of data can be stored or processed.

  The other options do not accurately represent the significant compliance challenges often associated with cloud environments.