For third-party audits or attestations, what is critical for providers to publish and customers to evaluate?

AScope of the assessment and the exact included features and services for the assessment

BProvider infrastructure information including maintenance windows and contracts

CNetwork or architecture diagrams including all end point security devices in use

DService-level agreements between all parties

EFull API access to all required services

Answer : C

When designing an encryption system, you should start with a threat model.

AFalse

BTrue

Answer : B

What type of information is contained in the Cloud Security Alliance's Cloud Control Matrix?

ANetwork traffic rules for cloud environments

BA number of requirements to be implemented, based upon numerous standards and regulatory requirements

CFederal legal business requirements for all cloud operators

DA list of cloud configurations including traffic logic and efficient routes

EThe command and control management hierarchy of typical cloud company

Answer : B

Vulnerability assessments cannot be easily integrated into CI/CD pipelines because of provider restrictions.

AFalse

BTrue

Answer : A

How can key management be leveraged to prevent cloud providers from inappropriately accessing customer data?

AUse strong multi-factor authentication

BSecure backup processes for key management systems

CSegregate keys from the provider hosting data

DStipulate encryption in contract language

ESelect cloud providers within the same country as customer

Answer : C

Free Practice Questions for CSA CCSK Exam