CCSP 試験練習問題

C

Correct answer: Use phase When data is being looked at by the customer support team, it is in the use phase. The create phase is the initial creation point of the data. The Cloud Security Alliance (CSA) says in their guidance 4.0 document that the create phase also includes modification and alteration of the data. It is not necessary to agree, many do not. However, this exam is a joint venture between the CSA and ISC2, so it could be useful to know. The store phase should be entered into as soon as the data is created. If the data needs to be stored for years into the future in case of need, then that storage is referred to as archival, or the archive phase.(ISC)² CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition. Pg 67. The Official (ISC)² CCSP CBK Reference, 4th Edition. Pg 59-60.

B

Correct answer: Securing sensitive information such as API keys The secrets manager is used to manage sensitive pieces of information such as passwords and API keys. Password and API keys should not be hard coded into the software source code nor the API. If they are, it is more likely that they will be compromised. Uber had a large breach because they had passwords in their source code. Access to the secrets manager should be strictly controlled. It is best if the application has access to a secrets server that then issues a secret to access the real secrets server. Then and only then does the application obtain the secret that it needs (password or API key) to be able to log in to the real server. Sounds convoluted? In a way, yes, but it is kind of like trying to get to a secured room in a building. You need your badge to get into the building, then you need a PIN to get into the secured room, except the PIN to get into the room is changed regularly and you need to speak to the guard for today's PIN. The secrets manager does not optimize resources. Something like Dynamic Optimization (DO) can do that. The secrets manager does not log API usage. It is a good idea to make sure the logging is turned on, and the logs are sent to the syslog server (or equivalent). The secrets manager does not manage access control policies for the API. That needs to be done by the cloud administrators and operators. All access to the secrets manager does need to be logged. Policies do need to be created, and somewhere someone needs to optimize resource use, but not here.Practical Cloud Security: A Guide for Secure Design and Deployment, 2nd Edition. Pg 75-77.

A

Correct answer: Well-architected frameworks A well-architected framework is a structured set of best practices and design principles that CSPs such as AWS, Azure, and GCP publish to guide customers in building secure systems. In cloud security, these frameworks ensure customers follow proven strategies to reduce risks and improve compliance. Reference architectures are standardized templates or blueprints. They are more narrowly focused than the broader, principle-based frameworks that CSPs provide. Responsibility matrices clarify the shared responsibility model but do not give security design best practices. SSAE certifications are third-party audit reports of CSP controls, not guidelines for customers.(ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition (ISBN: 978-1119909378). Pg 114-115. The Official (ISC)² CCSP CBK Reference, 4th Edition (ISBN: 978-1119909019). Pg 49-51.

B

Correct answer: Database server for a web app PaaS provides a managed platform for developers to build, test, and deploy applications without managing infrastructure, and a hosted database server for application use is a classic example of PaaS. The provider manages availability, scaling, and patching, while the customer focuses on queries and application logic. An employee collaboration tool is software as a service (SaaS), in which the user consumes the final application. A cloud-based word processor is also SaaS, providing a complete end-user application. A virtual private cloud is infrastructure as a service (IaaS), in which the customer has control over compute and networking resources.(ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition (ISBN: 978-1119909378). Pg 11-12. Practical Cloud Security: A Guide for Secure Design and Deployment, 2nd Edition (ISBN: 978-1098148171). Pg 8. The Official (ISC)² CCSP CBK Reference, 4th Edition (ISBN: 978-1119909019). Pg 17-18.

A

Correct answer: Regulators Some of the important roles and responsibilities in cloud computing include:(ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition. Pg 15-16. The Official (ISC)² CCSP CBK Reference, 4th Edition. Pg 3-6.