Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 31:

  When investigating an incident in an Infrastructure as a Service (IaaS) environment, what can the user investigate on their own?

  A. The CSP server facility

  B. The logs of all customers in a multi-tenant cloud

  C. The network components controlled by the CSP

  D. The CSP office spaces

  E. Their own virtual instances in the cloud

  Correct Answer: E

  When investigating an incident in an Infrastructure as a Service (IaaS) environment, the user can investigate:

  E. Their own virtual instances in the cloud.

  In an IaaS environment, users have control over their own virtual instances or virtual machines deployed within the cloud infrastructure. They have the ability to access and investigate their own virtual instances to gather logs, analyze configurations, review security settings, and identify any potential issues or indicators of compromise.

  However, it is important to note that users typically do not have access to investigate other customers' virtual instances or the underlying infrastructure controlled by the cloud service provider (CSP). Investigating the CSP server facility, logs of other customers in a multi-tenant cloud, network components controlled by the CSP, or the CSP office spaces would generally be outside the user's scope of investigation.

• Question 32:

  The containment phase of the incident response lifecycle requires taking systems o ine.

  A. False

  B. True

  Correct Answer: B

  B. True

  In the incident response lifecycle, the containment phase involves taking systems offline as a measure to prevent further damage or spread of the incident. By isolating affected systems or network segments, organizations can limit the impact and reduce the risk of additional compromise or data loss. Taking systems offline during the containment phase allows security teams to assess the situation, investigate the incident, and implement necessary remediation measures without the interference of ongoing malicious activity. It also helps to

  prevent the incident from spreading to other parts of the infrastructure or affecting additional systems or users.

  While the specific actions taken during the containment phase may vary depending on the nature of the incident and organizational policies, temporarily taking systems offline is a common and effective step to contain and control the situation.

• Question 33:

  If in certain litigations and investigations, the actual cloud application or environment itself is relevant to resolving the dispute in the litigation or investigation, how is the information likely to be obtained?

  A. It may require a subpoena of the provider directly

  B. It would require a previous access agreement

  C. It would require an act of war

  D. It would require a previous contractual agreement to obtain the application or access to the environment

  E. It would never be obtained in this situation

  Correct Answer: A

  rom the Security Guidance document: On occasion, an actual cloud application or environment could itself be relevant to resolving a dispute. In these circumstances, the application and environment will likely be outside the control of the client and require that a subpoena or other discovery process be served on the provider directly.

• Question 34:

  What is a potential concern of using Security-as-a-Service (SecaaS)?

  A. Lack of visibility

  B. Deployment exibility

  C. Scaling and costs

  D. Intelligence sharing

  E. Insulation of clients

  Correct Answer: A

• Question 35:

  Select the statement below which best describes the relationship between identities and attributes

  A. Attributes belong to entities and identities belong to attributes. Each attribute can have multiple identities but only one entity.

  B. An attribute is a unique object within a database. Each attribute it has a number of identities which help de ne its parameters.

  C. An identity is a distinct and unique object within a particular namespace. Attributes are properties which belong to an identity. Each identity can have multiple attributes.

  D. Attributes are made unique by their identities.

  E. Identities are the network names given to servers. Attributes are the characteristics of each server.

  Correct Answer: C

  From Security Guidance:

  Identity: the unique expression of an entity within a given namespace. An entity can have multiple digital identities, such as a single individual having a work identity (or even multiple identities, depending on the systems), a social media

  identity, and a personal identity. For example, if you are a single entry in a single directory server then that is your identity

  Attributes: facets of an identity. Attributes can be relatively static (like an organizational unit) or highly dynamic (IP address, device being used, if the user authenticated with MFA, location, etc.)

• Question 36:

  Which cloud security model type provides generalized templates for helping implement cloud security?

  A. Conceptual models or frameworks

  B. Design patterns

  C. Controls models or frameworks

  D. Reference architectures

  E. Cloud Controls Matrix (CCM)

  Correct Answer: D

• Question 37:

  ENISA: Which is a potential security benefit of cloud computing?

  A. More efficient and timely system updates

  B. ISO 27001 certification

  C. Provider can obfuscate system O/S and versions

  D. Greater compatibility with customer IT infrastructure

  E. Lock-In

  Correct Answer: A

• Question 38:

  The Software Defined Perimeter (SDP) includes which components?

  A. Client, Controller, and Gateway

  B. Client, Controller, Firewall, and Gateway

  C. Client, Firewall, and Gateway

  D. Controller, Firewall, and Gateway

  E. Client, Controller, and Firewall

  Correct Answer: A

• Question 39:

  What is true of a workload?

  A. It is a unit of processing that consumes memory

  B. It does not require a hardware stack

  C. It is always a virtual machine

  D. It is configured for specific, established tasks

  E. It must be containerized

  Correct Answer: A

• Question 40:

  ENISA: Which is not one of the five key legal issues common across all scenarios:

  A. Data protection

  B. Professional negligence

  C. Globalization

  D. Intellectual property

  E. Outsourcing services and changes in control

  Correct Answer: C