Understand Design Principles of Secure Cloud Computing CCSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a BIA, how is the return on investment (ROI) for a security control typically calculated?

   • ABy measuring the number of security alerts generated
   • BBy comparing the cost of the control to the avoided losses from prevented incidents
   • CBy evaluating the speed of the cloud network
   • DBy calculating the total storage capacity used
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A large enterprise is adopting cloud services across multiple business units. The CISO wants to ensure that cloud security controls are aligned with the organization's business goals and compliance requirements. The organization uses the CSA Enterprise Architecture reference model. Which activity best demonstrates the application of this model?

   • ADeploying a cloud access security broker (CASB) to monitor all cloud traffic.
   • BSelecting a single cloud provider for all business units to simplify security management.
   • CImplementing the same security controls across all cloud services regardless of the data they process.
   • DMapping each cloud service to the business process it supports and identifying the security controls required for that process.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial services firm runs a trading application in a single cloud region. A BIA determined that the maximum tolerable downtime is 15 minutes and the maximum tolerable data loss is 5 minutes. The application is stateful and requires synchronous writes to a database. The firm is evaluating two recovery designs: (1) active-passive with a warm standby in a second region and asynchronous replication, or (2) active-active with synchronous replication across two regions. Which design should the firm choose, and why?

   • AActive-active with asynchronous replication, because it provides high availability and the RPO can be relaxed during a disaster.
   • BActive-active with synchronous replication, because it can meet both the 15-minute RTO and the 5-minute RPO, despite higher cost and complexity.
   • CActive-passive with cold standby and periodic batch backups, because it is the most cost-effective and the firm can accept longer recovery.
   • DActive-passive with warm standby and asynchronous replication, because it meets the RPO with lower cost and complexity.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a SaaS-based file-sharing service to collaborate with external partners. The company's security policy requires that sensitive documents be protected during the share stage of the data lifecycle. The documents contain personally identifiable information (PII). Which control is most appropriate for the share stage?

   • ARequiring multi-factor authentication (MFA) for all users accessing the file-sharing service.
   • BRetaining audit logs of all file-sharing activities for compliance purposes.
   • CEnforcing data loss prevention (DLP) policies that block sharing of documents containing PII with unauthorized domains.
   • DEncrypting the documents at rest in the SaaS provider's storage.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which security control is most critical during the 'destroy' stage of the cloud data lifecycle?

   • AData classification
   • BSecure erasure or cryptographic deletion
   • CEncryption in transit
   • DAccess logging
   Reveal Solution Discussion Select an answer first