Question 1

- (Exam Topic 4)
Which of the following is considered a physical control?

Accepted Answer

Fences are physical controls; carpets and ceilings are architectural features, and a door is not necessarily a control: the lock on the door would be a physical
security control. Although you might think of a door as a potential answer, the best answer is the fence; the exam will have questions where more than one answer
is correct, and the answer that will score you points is the one that is most correct.

Question 2

- (Exam Topic 4)
The cloud customer will have the most control of their data and systems, and the cloud provider will have the least amount of responsibility, in which cloud
computing arrangement?

Accepted Answer

IaaS entails the cloud customer installing and maintaining the OS, programs, and data; PaaS has the customer installing programs and data; in SaaS, the
customer only uploads data. In a community cloud, data and device owners are distributed.

Question 3

- (Exam Topic 4)
Which of the following areas of responsibility always falls completely under the purview of the cloud provider, regardless of which cloud service category is used?

Accepted Answer

Regardless of the cloud service category used, the physical environment is always the sole responsibility of the cloud provider. In many instances, the cloud
provider will supply audit reports or some general information about their physical security practices, especially to those customers or potential customers that may
have regulatory requirements, but otherwise the cloud customer will have very little insight into the physical environment. With IaaS, the infrastructure is a shared
responsibility between the cloud provider and cloud customer. With all cloud service categories, the data and governance are always the sole responsibility of the
cloud customer.

Question 4

- (Exam Topic 4)
When data discovery is undertaken, three main approaches or strategies are commonly used to determine what the type of data, its format, and composition are
for the purposes of classification.
Which of the following is NOT one of the three main approaches to data discovery?

Accepted Answer

Hashing involves taking a block of data and, through the use of a one-way operation, producing a fixed-size value that can be used for comparison with other data.
It is used primarily for protecting data and allowing for rapid comparison when matching data values such as passwords. Labels involve looking for header
information or other categorizations of data to determine its type and possible classifications. Metadata involves looking at information attributes of the data, such
as creator, application, type, and so on, in determining classification. Content analysis involves examining the actual data itself for its composition and classification
level.

Question 5

- (Exam Topic 4)
The most pragmatic option for data disposal in the cloud is which of the following?

Accepted Answer

We don’t have physical ownership, control, or even access to the devices holding the data, so physical destruction, including melting, is not an option. Overwriting
is a possibility, but it is complicated by the difficulty of locating all the sectors and storage areas that might have contained our data, and by the likelihood that
constant backups in the cloud increase the chance we’ll miss something as it’s being overwritten. Cryptoshredding is the only reasonable alternative. Cold fusion
is a red herring.

Question 6

- (Exam Topic 4)
Web application firewalls (WAFs) are designed primarily to protect applications from common attacks like:

Accepted Answer

WAFs detect how the application interacts with the environment, so they are optimal for detecting and refuting things like SQL injection and XSS. Password
cracking, syn floods, and ransomware usually aren’t taking place in the same way as injection and XSS, and they are better addressed with controls at the router
and through the use of HIDS, NIDS, and antimalware tools.

Question 7

- (Exam Topic 4)
A data custodian is responsible for which of the following?

Accepted Answer

A data custodian is responsible for the safe custody, transport, and storage of data, and the implementation of business roles.

Question 8

- (Exam Topic 4)
Data labels could include all the following, except:

Accepted Answer

All the others might be included in data labels, but we don’t usually include data value, since it is prone to change frequently, and because it might not be
information we want to disclose to anyone who does not have need to know.

Question 9

- (Exam Topic 4)
Tokenization requires two distinct ________.

Accepted Answer

In order to implement tokenization, there will need to be two databases: the database containing the raw, original data, and the token database containing tokens
that map to original data. Having two-factor authentication is nice, but certainly not required. Encryption keys are not necessary for tokenization. Two-person
integrity does not have anything to do with tokenization.

Question 10

- (Exam Topic 4)
A variety of security systems can be integrated within a network--some that just monitor for threats and issue alerts, and others that take action based on
signatures, behavior, and other types of rules to actively stop potential threats.
Which of the following types of technologies is best described here?

100% Valid and Newest Version CCSP Questions & Answers shared by Certleader
/CCSP-dumps.html (512 Q&As)

Accepted Answer

An intrusion prevention system (IPS) can inspect traffic and detect any suspicious traffic based on a variety of factors, but it can also actively block such traffic.
Although an IDS can detect the same types of suspicious traffic as an IPS, it is only design to alert, not to block. A firewall is only concerned with IP addresses,
ports, and protocols; it cannot be used for the signature-based detection of traffic. A proxy can limit or direct traffic based on more extensive factors than a network
firewall can, but it's not capable of using the same signature detection rules as an IPS.