Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 51:

  What is resource pooling?

  A. The provider's computing resources are pooled to serve multiple consumers.

  B. Internet-based CPUs are pooled to enable multi-threading.

  C. The dedicated computing resources of each client are pooled together in a colocation facility.

  D. Placing Internet ( cloud ) data centers near multiple sources of energy, such as hydroelectric dams.

  E. None of the above.

  Correct Answer: A

  A. The provider's computing resources are pooled to serve multiple consumers.

  Resource pooling in cloud computing refers to the practice of aggregating and sharing computing resources among multiple consumers or clients. The cloud service provider combines its computing resources, including servers, storage, and networking infrastructure, into a shared pool. These resources can then be dynamically allocated and reallocated based on the demands and needs of different consumers or applications. By pooling resources, the cloud provider can achieve higher utilization rates and optimize resource allocation, leading to improved efficiency and cost-effectiveness. Consumers benefit from this pooling by gaining access to scalable and on-

  demand computing resources without the need to manage and maintain their own dedicated infrastructure. Therefore, option A correctly describes resource pooling in cloud computing.

• Question 52:

  Which cloud storage technology is basically a virtual hard drive for instanced or VMs?

  A. Volume storage

  B. Platform

  C. Database

  D. Application

  E. Object storage

  Correct Answer: A

• Question 53:

  Which of the following items is NOT an example of Security as a Service (SecaaS)?

  A. Spam filtering

  B. Authentication

  C. Provisioning

  D. Web filtering

  E. Intrusion detection

  Correct Answer: C

• Question 54:

  How is encryption managed on multi-tenant storage?

  A. Single key for all data owners

  B. One key per data owner

  C. Multiple keys per data owner

  D. The answer could be A, B, or C depending on the provider

  E. C for data subject to the EU Data Protection Directive; B for all others

  Correct Answer: C

• Question 55:

  Which statement best describes why it is important to know how data is being accessed?

  A. The devices used to access data have different storage formats.

  B. The devices used to access data use a variety of operating systems and may have different programs installed on them.

  C. The device may affect data dispersion.

  D. The devices used to access data use a variety of applications or clients and may have different security characteristics.

  E. The devices used to access data may have different ownership characteristics.

  Correct Answer: D

• Question 56:

  What is true of companies considering a cloud computing business relationship?

  A. The laws protecting customer data are based on the cloud provider and customer location only.

  B. The con dentiality agreements between companies using cloud computing services is limited legally to the company, not the provider.

  C. The companies using the cloud providers are the custodians of the data entrusted to them.

  D. The cloud computing companies are absolved of all data security and associated risks through contracts and data laws.

  E. The cloud computing companies own all customer data.

  Correct Answer: C

• Question 57:

  Dynamic Application Security Testing (DAST) might be limited or require pre-testing permission from the provider.

  A. False

  B. True

  Correct Answer: B

• Question 58:

  When deploying Security as a Service in a highly regulated industry or environment, what should both parties agree on in advance and include in the SLA?

  A. The metrics defining the service level required to achieve regulatory objectives.

  B. The duration of time that a security violation can occur before the client begins assessing regulatory fines.

  C. The cost per incident for security breaches of regulated information.

  D. The regulations that are pertinent to the contract and how to circumvent them.

  E. The type of security software which meets regulations and the number of licenses that will be needed.

  Correct Answer: A

• Question 59:

  What is known as a code execution environment running within an operating system that shares and uses the resources of the operating system?

  A. Platform-based Workload

  B. Pod

  C. Abstraction

  D. Container

  E. Virtual machine

  Correct Answer: D

• Question 60:

  Which term is used to describe the use of tools to selectively degrade portions of the cloud to continuously test business continuity?

  A. Planned Outages

  B. Resiliency Planning

  C. Expected Engineering

  D. Chaos Engineering

  E. Organized Downtime

  Correct Answer: D