CCSP Practice Test 1

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. What is the term for this kind of arrangement?

• Public-key infrastructure (PKI)

• Portability

• Federation

• Repudiation

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. You want to connect your organization to 13 other organizations. You consider using the cross-certification model but then decide against it. What is the most likely reason for declining that option?

• It is impossible to trust more than two organizations.
• If you work for the government, the maximum parties allowed to share data is five.
• Trying to maintain currency in reviewing and approving the security governance and configurations of that many entities would create an overwhelming task
• Data shared among that many entities loses its inherent value.

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. In order to pass the user IDs and authenticating credentials of each user among the organizations, what protocol, language, or technique will you most likely utilize?

• Representational State Transfer (REST)
• Security Assertion Markup Language (SAML)
• Simple Object Access Protocol (SOAP)
• Hypertext Markup Language (HTML)

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. If you don't use cross-certification, what other model can you implement for this purpose?

• Third-party identity broker
• Cloud reseller
• Intractable nuanced variance
• Mandatory access control (MAC)

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources.If you are in the United States, one of the standards you should adhere to is

• National Institute of Standards and Technology (NIST) 800-53
• Payment Card Industry (PCI)
• ISO 27014
• European Union Agency for Network and Information Security (ENISA)

You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. If you are in Canada, one of the standards you will have to adhere to is .

• FIPS 140-2
• PIPEDA
• HIPAA
• EFTA

You are the security policy lead for your organization, which is considering migrating from your on-premises, traditional IT environment into the cloud. You are reviewing the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) as a tool for your organization. Which of the following benefits will the CSA CCM offer your organization?

• Simplifying regulatory compliance
• Collecting multiple data streams from your log files
• Ensuring that the baseline configuration is applied to all systems
• Enforcing contract terms between your organization and the cloud provider

You are the security policy lead for your organization, which is considering migrating from your on-premises, traditional IT environment into the cloud. You are reviewing the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) as a tool for your organization. Which of the following regulatory frameworks is not covered by the CCM?

• ISACA's Control Objectives for Information and Related Technologies (COBIT)
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) privacy law
• The ALL-TRUST framework from the environmental industry
• The U.S. Federal Risk and Authorization Management Program (FedRAMP)

You are the security policy lead for your organization, which is considering migrating from your on-premises, traditional IT environment into the cloud. You are reviewing the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) as a tool for your organization. Which tool, also available from the CSA, can be used in conjunction with the CCM to aid you in selecting and applying the proper controls to meet your organization's regulatory needs?

• The Consensus Assessments Initiative Questionnaire (CAIQ)
• The Open Web Application Security Project (OWASP) Top Ten
• The Critical Security Controls (CSC) list
• National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 140-2

You are the security policy lead for your organization, which is considering migrating from your on-premises, traditional IT environment into the cloud. You are reviewing the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) as a tool for your organization. What is probably the best benefit offered by the CCM?

• The low cost of the tool
• Allowing your organization to leverage existing controls across multiple frameworks so as not to duplicate effort
• Simplicity of control selection from the list of approved choices
• Ease of implementation by choosing controls from the list of qualified vendors