assurance that all of the contract terms are being met. This is a(n) _______________ issue.RegulatoryPrivacyResiliencyAuditability77 Encryption is an essential tool for affording security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud, why might that not be the optimum choice for an organization?Key length variances don’t provide any actual additional security.It would cause additional processing overhead and time delay.It might result in vendor lockout.The data subjects might be upset by this.
78 Encryption is an essential tool for affording security to cloud-based operations. While it is possible to encrypt every system, piece of data, and transaction that takes place on the cloud, why might that not be the optimum choice for an organization?It could increase the possibility of physical theft.Encryption won’t work throughout the environment.The protection might be disproportionate to the value of the asset(s).Users will be able to see everything within the organization.
79 Which of the following is not an element of the identification component of identity and access management (IAM)?ProvisioningManagementDiscretionDeprovisioning
80 Which of the following entities is most likely to play a vital role in the identity provisioning aspect of a user’s experience in an organization?The accounting departmentThe human resources (HR) officeThe maintenance teamThe purchasing office
81 Why is the deprovisioning element of the identification component of identity and access management (IAM) so important?Extra accounts cost so much extra money.Open but unassigned accounts are vulnerabilities.User tracking is essential to performance.Encryption has to be maintained.
82 All of the following are reasons to perform review and maintenance actions on user accounts except _______________.To determine whether the user still needs the same accessTo determine whether the user is still with the organizationTo determine whether the data set is still applicable to the user’s roleTo determine whether the user is still performing well
83 Who should be involved in review and maintenance of user accounts/access?The user’s managerThe security managerThe accounting departmentThe incident response team
84 Which of the following protocols is most applicable to the identification process aspect of identity and access management (IAM)?Secure Sockets Layer (SSL)Internet Protocol Security (IPSec)Lightweight Directory Access Protocol (LDAP)Amorphous ancillary data transmission (AADT)
85 Privileged user (administrators, managers, and so forth) accounts need to be reviewed more closely than basic user accounts. Why is this?Privileged users have more encryption keys.Regular users are more trustworthy.There are extra controls on privileged user accounts.Privileged users can cause more damage to the organization.
86 The additional review activities that might be performed for privileged user accounts could include all of the following except _______________.Deeper personnel background checksReview of personal financial accounts for privileged usersMore frequent reviews of the necessity for accessPat-down checks of privileged users to deter against physical theft
87 If personal financial account reviews are performed as an additional review control for privileged users, which of the following characteristics is least likely to be a useful indicator for review purposes?Too much money in the accountToo little money in the accountThe bank branch being used by the privileged userSpecific senders/recipients
88 How often should the accounts of privileged users be reviewed?AnnuallyTwice a yearMonthlyMore often than regular user account reviews
89 Privileged user account access should be _______________.TemporaryPervasiveThoroughGranular
90 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA’s Notorious Nine list, data breaches can be _______________.Overt or covertInternational or subterraneanFrom internal or external sourcesVoluminous or specific
91 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, an organization that operates in the cloud environment and suffers a data breach may be required to _______________.Notify affected usersReapply for cloud serviceScrub all affected physical memoryChange regulatory frameworks
92 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, an organization that suffers a data breach might suffer all of the following negative effects except _______________.Cost of compliance with notification lawsLoss of public perception/goodwillLoss of market shareCost of detection
93 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, in the event of a data breach, a cloud customer will likely need to comply with all the following data breach notification requirements except _______________.Multiple state lawsContractual notification requirementsAll standards-based notification schemesAny applicable federal regulations
94 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, data loss can be suffered as a result of _______________ activity.Malicious or inadvertentCasual or explicitWeb-based or stand-aloneManaged or independent
95 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, all of the following activity can result in data loss except _______________.Misplaced crypto keysImproper policyIneffectual backup proceduresAccidental overwrite
96 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, service traffic hijacking can affect which portion of the CIA triad?ConfidentialityIntegrityAvailabilityAll of the triad
97 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. The CSA recommends the prohibition of _______________ in order to diminish the likelihood of account/service traffic hijacking.All user activitySharing account credentials between users and servicesMultifactor authenticationInterstate commerce
98 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, which aspect of cloud computing makes it particularly susceptible to account/service traffic hijacking?ScalabilityMetered serviceRemote accessPooled resources
99 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insecure interfaces and APIs is so prevalent in cloud computing?Most of the cloud customer’s interaction with resources will be performed through APIs.APIs are inherently insecure.Attackers have already published vulnerabilities for all known APIs.APIs are known carcinogens.
100 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insecure interfaces and APIs is so prevalent in cloud computing?Cloud customers and third parties are continually enhancing and modifying APIs.APIs can have automated settings.It is impossible to uninstall APIs.APIs are a form of malware.
101 The Cloud Security Alliance (CSA) publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insecure interfaces and APIs is so prevalent in cloud computing?APIs are always used for administrative access.Customers
