Cloud Security Alliance Cloud Security Alliance Certifications CCSK Questions & Answers

• Question 61:

  What is true of security as it relates to cloud network infrastructure?

  A. You should apply cloud firewalls on a per-network basis.

  B. You should deploy your cloud firewalls identical to the existing firewalls.

  C. You should always open traffic between workloads in the same virtual subnet for better visibility.

  D. You should implement a default allow with cloud firewalls and then restrict as necessary.

  E. You should implement a default deny with cloud firewalls.

  Correct Answer: E

• Question 62:

  Which statement best describes the impact of Cloud Computing on business continuity management?

  A. A general lack of interoperability standards means that extra focus must be placed on the security aspects of migration between Cloud providers.

  B. The size of data sets hosted at a Cloud provider can present challenges if migration to another provider becomes necessary.

  C. Customers of SaaS providers in particular need to mitigate the risks of application lock-in.

  D. Clients need to do business continuity planning due diligence in case they suddenly need to switch providers.

  E. Geographic redundancy ensures that Cloud Providers provide highly available services.

  Correct Answer: E

• Question 63:

  CCM: In the CCM tool, `Encryption and Key Management` is an example of which of the following?

  A. Risk Impact

  B. Domain

  C. Control Specification

  Correct Answer: B

• Question 64:

  In volume storage, what method is often used to support resiliency and security?

  A. proxy encryption

  B. data rights management

  C. hypervisor agents

  D. data dispersion

  E. random placement

  Correct Answer: D

• Question 65:

  Network logs from cloud providers are typically flow records, not full packet captures.

  A. False

  B. True

  Correct Answer: B

• Question 66:

  Select the best definition of `compliance` from the options below.

  A. The development of a routine that covers all necessary security measures.

  B. The diligent habits of good security practices and recording of the same.

  C. The timely and efficient ling of security reports.

  D. The awareness and adherence to obligations, including the assessment and prioritization of corrective actions deemed necessary and appropriate.

  E. The process of completing all forms and paperwork necessary to develop a defensible paper trail.

  Correct Answer: D

• Question 67:

  Which concept provides the abstraction needed for resource pools?

  A. Virtualization

  B. Applistructure

  C. Hypervisor

  D. Metastructure

  E. Orchestration

  Correct Answer: A

• Question 68:

  Which concept is a mapping of an identity, including roles, personas, and attributes, to an authorization?

  A. Access control

  B. Federated Identity Management

  C. Authoritative source

  D. Entitlement

  E. Authentication

  Correct Answer: D

• Question 69:

  ENISA: `VM hopping` is:

  A. Improper management of VM instances, causing customer VMs to be commingled with other customer systems.

  B. Looping within virtualized routing systems.

  C. Lack of vulnerability management standards.

  D. Using a compromised VM to exploit a hypervisor, used to take control of other VMs.

  E. Instability in VM patch management causing VM routing errors.

  Correct Answer: D

• Question 70:

  How can virtual machine communications bypass network security controls?

  A. VM communications may use a virtual network on the same hardware host

  B. The guest OS can invoke stealth mode

  C. Hypervisors depend upon multiple network interfaces

  D. VM images can contain rootkits programmed to bypass firewalls

  E. Most network security systems do not recognize encrypted VM traffic

  Correct Answer: A