CSA Cert CCSK Certificate of Cloud Security Knowledge Online Training
CSA Cert CCSK Online Training
The questions for CCSK were last updated at Nov 19,2024.
- Exam Code: CCSK
- Exam Name: Certificate of Cloud Security Knowledge
- Certification Provider: CSA Cert
- Latest update: Nov 19,2024
ENISA: A reason for risk concerns of a cloud provider being acquired is:
- A . Arbitrary contract termination by acquiring company
- B . Resource isolation may fail
- C . Provider may change physical location
- D . Mass layoffs may occur
- E . Non-binding agreements put at risk
Which statement best describes the Data Security Lifecycle?
- A . The Data Security Lifecycle has six stages, is strictly linear, and never varies.
- B . The Data Security Lifecycle has six stages, can be non-linear, and varies in that some data may never pass through all stages.
- C . The Data Security Lifecycle has five stages, is circular, and varies in that some data may never pass through all stages.
- D . The Data Security Lifecycle has six stages, can be non-linear, and is distinct in that data must always pass through all phases.
- E . The Data Security Lifecycle has five stages, can be non-linear, and is distinct in that data must always pass through all phases.
Which of the following is one of the five essential characteristics of cloud computing as defined by NIST?
- A . Multi-tenancy
- B . Nation-state boundaries
- C . Measured service
- D . Unlimited bandwidth
- E . Hybrid clouds
What is known as the interface used to connect with the metastructure and configure the cloud environment?
- A . Administrative access
- B . Management plane
- C . Identity and Access Management
- D . Single sign-on
- E . Cloud dashboard
When deploying Security as a Service in a highly regulated industry or environment, what should both parties agree on in advance and include in the SLA?
- A . The metrics defining the service level required to achieve regulatory objectives.
- B . The duration of time that a security violation can occur before the client begins assessing regulatory fines.
- C . The cost per incident for security breaches of regulated information.
- D . The regulations that are pertinent to the contract and how to circumvent them.
- E . The type of security software which meets regulations and the number of licenses that will be needed.
Which term is used to describe the use of tools to selectively degrade portions of the cloud to continuously test business continuity?
- A . Planned Outages
- B . Resiliency Planning
- C . Expected Engineering
- D . Chaos Engineering
- E . Organized Downtime
If there are gaps in network logging data, what can you do?
- A . Nothing. There are simply limitations around the data that can be logged in the cloud.
- B . Ask the cloud provider to open more ports.
- C . You can instrument the technology stack with your own logging.
- D . Ask the cloud provider to close more ports.
- E . Nothing. The cloud provider must make the information available.
CCM: A hypothetical start-up company called "ABC" provides a cloud based IT management solution. They are growing rapidly and therefore need to put controls in place in order to manage any changes in their production environment.
Which of the following Change Control & Configuration Management production environment specific control should they implement in this scenario?
- A . Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant)-impacting (physical and virtual) applications and system-
system interface (API) designs and configurations, infrastructure network and systems components. - B . Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or
managed user end-point devices (e.g. issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. - C . All cloud-based services used by the company’s mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.
- D . None of the above
How is encryption managed on multi-tenant storage?
- A . Single key for all data owners
- B . One key per data owner
- C . Multiple keys per data owner
- D . The answer could be A, B, or C depending on the provider
- E . C for data subject to the EU Data Protection Directive; B for all others
Vulnerability assessments cannot be easily integrated into CI/CD pipelines because of provider restrictions.
- A . False
- B . True
Latest CCSK Dumps Valid Version with 60 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
