Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 41:

  Which communication methods within a cloud environment must be exposed for partners or consumers to access database information using a web application?

  A. Software Development Kits (SDKs)

  B. Resource Description Framework (RDF)

  C. Extensible Markup Language (XML)

  D. Application Binary Interface (ABI)

  E. Application Programming Interface (API)

  Correct Answer: E

• Question 42:

  ENISA: An example high risk role for malicious insiders within a Cloud Provider includes

  A. Sales

  B. Marketing

  C. Legal counsel

  D. Auditors

  E. Accounting

  Correct Answer: D

• Question 43:

  What are the primary security responsibilities of the cloud provider in the management infrastructure?

  A. Building and properly configuring a secure network infrastructure

  B. Configuring second factor authentication across the network

  C. Properly configuring the deployment of the virtual network, especially the firewalls

  D. Properly configuring the deployment of the virtual network, except the firewalls

  E. Providing as many API endpoints as possible for custom access and configurations

  Correct Answer: A

  A. Building and properly configuring a secure network infrastructure.

  The cloud provider is responsible for building and maintaining a secure network infrastructure to ensure the overall security of the cloud environment. This includes implementing appropriate security measures such as firewalls, intrusion detection systems, network segmentation, access controls, and other network security mechanisms. The provider should configure the network infrastructure in a way that minimizes vulnerabilities and protects against unauthorized access, data breaches, and other security threats.

  While the other options listed may also be important security considerations, building and properly configuring a secure network infrastructure is a fundamental responsibility of the cloud provider to ensure the overall security and protection of the cloud environment.

  Therefore, option A, building and properly configuring a secure network infrastructure, is the correct answer for the primary security responsibilities of the cloud provider in the management infrastructure.

• Question 44:

  A cloud deployment of two or more unique clouds is known as:

  A. Infrastructures as a Service

  B. A Private Cloud

  C. A Community Cloud

  D. A Hybrid Cloud

  E. Jericho Cloud Cube Model

  Correct Answer: D

  Hybrid cloud. The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together.

• Question 45:

  ENISA: A reason for risk concerns of a cloud provider being acquired is:

  A. Arbitrary contract termination by acquiring company

  B. Resource isolation may fail

  C. Provider may change physical location

  D. Mass layoffs may occur

  E. Non-binding agreements put at risk

  Correct Answer: E

  The acquisition of the cloud provider (R.6) can also have a similar effect, since it increases the likelihood of sudden changes in provider policy and non-binding agreements such as terms of use (ToU).

• Question 46:

  What is the best way to ensure that all data has been removed from a public cloud environment including all media such as back-up tapes?

  A. Allowing the cloud provider to manage your keys so that they have the ability to access and delete the data from the main and back-up storage.

  B. Maintaining customer managed key management and revoking or deleting keys from the key management system to prevent the data from being accessed again.

  C. Practice Integration of Duties (IOD) so that everyone is able to delete the encrypted data.

  D. Keep the keys stored on the client side so that they are secure and so that the users have the ability to delete their own data.

  E. Both B and D.

  Correct Answer: E

  Option B suggests maintaining customer-managed key management and revoking or deleting keys from the key management system to prevent the data from being accessed again. By managing their own keys and ensuring the revocation or deletion of those keys, customers can effectively control access to their data and prevent unauthorized access or retrieval.

  Option D suggests keeping the keys stored on the client side, ensuring their security, and granting users the ability to delete their own data. By having the keys securely stored and giving users control over their data, they can actively delete their data and ensure its removal from the cloud environment.

  By combining both options B and D, customers can exercise strong control over their data, including the ability to revoke access through key management and allowing users to delete their own data. This approach ensures that the data is properly removed from the public cloud environment, including any associated media such as backup tapes

• Question 47:

  ENISA: Lock-in is ranked as a high risk in ENISA research, a key underlying vulnerability causing lock in is:

  A. Lack of completeness and transparency in terms of use

  B. Lack of information on jurisdictions

  C. No source escrow agreement

  D. Unclear asset ownership

  E. Audit or certification not available to customers

  Correct Answer: A

  The key underlying vulnerability causing lock-in, as ranked by ENISA, is:

  A. Lack of completeness and transparency in terms of use.

  Lock-in refers to the situation where a customer becomes dependent on a particular cloud service provider and faces challenges or barriers in migrating to another provider or bringing the services back in-house. ENISA research identifies lock-in as a high-risk factor in cloud computing.

  One of the key vulnerabilities that contribute to lock-in is the lack of completeness and transparency in terms of use. This means that the terms and conditions, contractual agreements, and service-level agreements provided by the cloud service provider may not adequately disclose all the relevant information and restrictions that could impact the customer's ability to migrate or switch providers. Without a clear understanding of the terms of use and potential limitations, customers may unintentionally become locked into the services of a specific provider.

• Question 48:

  Which of the following is NOT normally a method for detecting and preventing data migration into the cloud?

  A. Intrusion Prevention System

  B. URL filters

  C. Data Loss Prevention

  D. Cloud Access and Security Brokers (CASB)

  E. Database Activity Monitoring

  Correct Answer: A

• Question 49:

  In which type of environment is it impractical to allow the customer to conduct their own audit, making it important that the data center operators are required to provide auditing for the customers?

  A. Multi-application, single tenant environments

  B. Long distance relationships

  C. Multi-tenant environments

  D. Distributed computing arrangements

  E. Single tenant environments

  Correct Answer: C

  The type of environment in which it is impractical to allow the customer to conduct their own audit, making it important for data center operators to provide auditing for the customers is:

  C. Multi-tenant environments

  In multi-tenant environments, multiple customers or tenants share the same physical infrastructure, such as servers, storage, and networking resources, provided by the cloud service provider. Due to the shared nature of the infrastructure, it can be challenging or impractical for individual customers to conduct their own audits of the underlying infrastructure.

  In such environments, data center operators play a crucial role in ensuring the security and compliance of the infrastructure. They are responsible for implementing appropriate security measures, maintaining regulatory compliance, and providing auditing capabilities to meet the requirements of different customers. The data center operators are expected to have robust auditing processes in place, allowing customers to verify the security controls and compliance measures implemented within the multi-tenant environment.

• Question 50:

  Your SLA with your cloud provider ensures continuity for all services.

  A. False

  B. True

  Correct Answer: B

  B. True The statement is true: Your SLA (Service Level Agreement) with your cloud provider ensures continuity for all services. A Service Level Agreement (SLA) is a contractual agreement between a service provider and a customer that defines the level of service and performance guarantees. In the context of cloud computing, an SLA typically outlines the

  availability, reliability, and continuity of the services provided by the cloud provider.

  A well-drafted SLA ensures that the cloud provider commits to maintaining continuity for all the services they offer. This includes measures to minimize downtime, ensure data redundancy and backup, implement disaster recovery plans, and address any disruptions or incidents promptly. By signing an SLA, customers can have the assurance that their cloud provider is responsible for maintaining the continuity of the services as specified in the agreement. This helps establish a level of trust and accountability between the

  provider and the customer.

  Therefore, it is true that your SLA with your cloud provider ensures continuity for all services.