Questions tagged [ccsp]
Certified Cloud Security Professional. A certification by ISC2 structured around cloud security and cloud computing.
20 questions
2
votes
1
answer
367
views
Is it reasonable to consider logs as a "technical control"?
I'm studying for the CCSP exam and one of the examples of technical controls (referenced in the course training material) confuse me:
Technical controls, also referred to as logical controls, are ...
- 3,498
3
votes
2
answers
1k
views
Is there a difference between "risk tolerance" and "risk appetite"?
I'm studying for the CCSP exam and I'm a little confused on the difference between "Risk Appetite" and "Risk Tolerance". Is there a clear and discernible difference? Can the terms be used ...
- 3,498
1
vote
1
answer
100
views
Is this description of the term "event" accurate within the context of Business Continuity and Disaster recovery?
I'm studying for the CCSP exam and I came across this description:
An event is any unscheduled adverse impact to the operating
environment. An event is distinguished from a disaster by the
...
- 3,498
3
votes
1
answer
1k
views
Is there a difference between "Maximum Tolerable Downtime" and "Maximum Allowed Downtime"?
I'm studying for the CCSP exam and one of the BC/DR terms that is referenced in my study material is "Maximum Allowable Downtime". The definition for it is:
MAD (Maxium Allowable Downtime) How ...
- 3,498
0
votes
1
answer
536
views
What's the difference between "directory services" and "identity repositories"?
I'm studying for the CCSP exam and the study material references two different terms which seems very similar:
Directory Services A system for managing identities and attributes. These allow the ...
- 3,498
0
votes
2
answers
149
views
Are there any standards that *require* companies to use specific Uptime Institute Tiers for data centers?
I'm studying for the CCSP exam and am currently reviewing The Uptime Institute Tiers. The tiers themselves make sense but from a practical perspective, I'm curious if any standards/regulations ...
- 3,498
0
votes
1
answer
3k
views
What's the difference between "Organization normative framework" and "Application normative framework"?
I'm studying for the CCSP exam and I'm confused with some of the terminologies between Organization normative framework and application normative framework.
The training material defines them as:
...
- 3,498
3
votes
1
answer
915
views
Does "crypto offloading" require the use of ASICs? Can the concept be applied elsewhere?
I'm studying for the CCSP exam and the training material is a little vague on the term "crypto offloading".
The term was mentioned in passing while describing TLS:
TLS is a protocol designed to ...
- 3,498
3
votes
2
answers
6k
views
What's the difference between an API gateway and XML gateway?
I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states:
API gateways are also an important part of a ...
- 3,498
3
votes
1
answer
5k
views
What's the difference between an "application-aware firewall" and a "web application firewall"?
I'm studying for the CCSP and my training material isn't very clear on the definition between "application-aware firewall" and "web application firewall".
The training material states:
Early on, ...
- 3,498
0
votes
1
answer
107
views
Are there general guidelines (or better yet, compliance standards) for assessing the risks of a cloud-based API?
I'm studying for the CCSP exam and one part of the training material stuck out.
It behooves the cloud customer to formalize a policy and process for
vetting, selecting, and deploying only those ...
- 3,498
1
vote
2
answers
209
views
What drives security controls in cloud models: Business requirements? Or SLAs?
I'm preparing for the CCSP exam and another test question is throwing me off.
The question reads:
In all cloud models, security controls are driven by which of the
following:
A. ...
- 3,498
1
vote
1
answer
307
views
Does a SOC 2 SSAE report not come with a "seal of approval" from a certified auditor?
I'm studying for the CCSP exam and I'm confused with a test prep question in my study materials.
The question reads:
"Which kind of SSAE report comes with a seal of approval from a
certified ...
- 3,498
1
vote
1
answer
161
views
How/why can Cloud Access Security Brokers be superior to managing access controls locally?
I'm studying for the CCSP exam and I'm a little confused on why outsourcing access controls to a third party CASB would be appropriate. Could someone please explain the rationale there (and ideally ...
- 3,498
3
votes
1
answer
272
views
Why would a goal of DLP solution implementation include "loss of mitigation"?
I'm studying for the CCSP exam and a practice question read:
The goals of DLP solution implementation include all of the following,
except:
A. Policy enforcement
B. Elasticity
C. Data ...
- 3,498
7
votes
3
answers
8k
views
What's a practical example of encryption "in use" or "in process"?
I'm studying for the CCSP and from a high-level, I keep hearing encryption described in three forms:
Protecting data at rest.
Protecting data in transit.
Protecting data in use.
The first two make ...
- 3,498
1
vote
1
answer
379
views
How is cryptoshredding a "sole pragmatic option for data disposal in the cloud"?
I'm studying for the CCSP exam and I think I'm missing something here...
In reviewing data destruction/disposal methods, I'm aware that an on-premise IT environment has several options:
Physical ...
- 3,498
1
vote
1
answer
297
views
Is it possible for digital forensic evidence to be multiple types of evidence at the same time?
I'm studying for the CCSP certification and the online training course I'm taking is a little vague on the topic of evidence types (within the context of digital forensics).
Specifically, I'd like ...
- 3,498
3
votes
2
answers
575
views
What's a practical example of how volatile information can be preserved in a digital forensics investigation?
I'm taking a study course on CCSP and am going over a section on the digital forensics investigation process. In particular, the instructor discussed the following:
I'm curious on two bullet points ...
- 3,498
6
votes
2
answers
957
views
What's the difference between "load testing" and "stress testing" within the context of a security audit?
I'm preparing for the CCSP examine and am trying to wrap my mind around the concepts of "load testing" and "stress testing" within the context of security.
I think the difference here is that:
...
- 3,498