Free Preparation Discussions
MENU
ISC2 CCSP Exam Questions
- Topic 1: Understand Cloud Computing Concepts/ Cloud Computing Definitions
- Topic 2: Cloud Computing Roles/ Key Cloud Computing Characteristics/ Building Block Technologies
- Topic 3: Describe Cloud Reference Architecture/ Cloud Service Capabilities/ Cloud Deployment Models
- Topic 4: Understand Security Concepts Relevant to Cloud Computing/ Data and Media Sanitization/ Cryptography and Key Management
- Topic 5: Understand Design Principles of Secure Cloud Computing/ Virtualization Security
- Topic 6: Design and Implement Cloud Data Storage Architectures/ Functional Security Requirements/ Cloud Data Life Cycle Phases
- Topic 7: Design and Apply Data Security Technologies and Strategies/ Encryption and Key Management/ Data De-identification
- Topic 8: Design and Implement Auditability, Traceability and Accountability of Data Events/ Definition of Event Sources and Requirement of Identity Attribution
- Topic 9: Comprehend Cloud Infrastructure Components Physical Environment, Network and Communications
- Topic 10: Analyze Risks Associated with Cloud Infrastructure/ Cloud Vulnerabilities, Threats and Attacks
- Topic 11: Use Verified Secure Software»Approved Application Programming Interfaces (API)/ Virtualization Systems Protection
- Topic 12: Advocate Training and Awareness for Application Security/ Physical and Environmental Protection
Free ISC2 CCSP Exam Actual Questions
Note: Premium Questions for CCSP were last updated On Apr. 24, 2025 (see below)
Which of the following areas of responsibility would be shared between the cloud customer and cloud provider within the Software as a Service (SaaS) category?
With SaaS, the application is a shared responsibility between the cloud provider and cloud customer. Although the cloud provider is responsible for deploying, maintaining, and securing the application, the cloud customer does carry some responsibility for the configuration of users and options. Regardless of the cloud service category used, the physical environment is always the sole responsibility of the cloud provider. With all cloud service categories, the data and governance are always the sole responsibility of the cloud customer.
Within a federated identity system, which of the following would you be MOST likely to use for sending information for consumption by a relying party?
The Security Assertion Markup Language (SAML) is the most widely used method for encoding and sending attributes and other information from an identity provider to a relying party.WS-Federation, which is used by Active Directory Federation Services (ADFS), is the second most used method for sending information to a relying party, but it is not a better choice than SAML. XML is similar to SAML in the way it encodes and labels data, but it does not have all of the required extensions that SAML does. HTML is not used within federated systems at all.
Which data state would be most likely to use TLS as a protection mechanism?
TLS would be used with data in transit, when packets are exchanged between clients or services and sent across a network. During the data-in-use state, the data is already protected via a technology such as TLS as it is exchanged over the network and then relies on other technologies such as digital signatures for protection while being used. The data-at-rest state primarily uses encryption for stored file objects. Archived data would be the same as data at rest.
Configurations and policies for a system can come from a variety of sources and take a variety of formats. Which concept pertains to the application of a set of configurations and policies that is applied to all systems or a class of systems?
Baselines are a set of configurations and policies applied to all new systems or services, and they serve as the basis for deploying any other services on top of them. Although standards often form the basis for baselines, the term is applicable in this case. Hardening is the process of securing a system, often through the application of baselines. Leveling is an extraneous but similar term to baselining.
What concept does the "D" represent with the STRIDE threat model?
Any application can be a possible target of denial-of-service (DoS) attacks. From the application side, the developers should minimize how many operations are performed for non-authenticated users. This will keep the application running as quickly as possible and using the least amount of system resources to help minimize the impact of any such attacks.
Topic 3, Exam Pool C
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Lashawnda
3 hours agoMari
1 months agoJovita
2 months agoCandra
3 months agoAnnmarie
3 months agoInocencia
4 months agoFanny
5 months agoTimothy
5 months agoLeslee
5 months agoShaquana
5 months agoTarra
6 months agoFrederic
6 months agoKenia
6 months agoLevi
6 months agoMerlyn
6 months agoMalcolm
7 months agoGregg
7 months agoWilliam
7 months agoJeffrey
7 months agoPearly
7 months agoDaren
8 months agoLazaro
8 months agoTiera
8 months agoWilletta
8 months agoMarshall
9 months agoMargarett
9 months agoEmogene
10 months agoJosphine
10 months agoBelen
10 months agoLashaunda
11 months ago