Free CCSP Exam Braindumps

- (Exam Topic 4)
There are many situations when testing a BCDR plan is appropriate or mandated. Which of the following would not be a necessary time to test a BCDR plan?

1. A. After software updates
2. B. After regulatory changes
3. C. After major configuration changes
4. D. Annually

Correct Answer: B
Regulatory changes by themselves would not trigger a need for new testing of a BCDR plan. Any changes necessary for regulatory compliance would be accomplished through configuration changes or software updates, which in turn would then trigger the necessary new testing. Annual testing is crucial to any BCDR plan. Also, any time major configuration changes or software updates are done, the plan should be evaluated and tested to ensure it is still valid and complete.

- (Exam Topic 3)
Which of the following systems is used to employ a variety of different techniques to discover and alert on threats and potential threats to systems and networks?

1. A. IDS
2. B. IPS
3. C. Firewall
4. D. WAF

Correct Answer: A
An intrusion detection system (IDS) is implemented to watch network traffic and operations, using predefined criteria or signatures, and alert administrators if anything suspect is found. An intrusion prevention system (IPS) is similar to an IDS but actually takes action against suspect traffic, whereas an IDS just alerts when it finds anything suspect. A firewall works at the network level and only takes into account IP addresses, ports, and protocols; it does not inspect the traffic for patterns or content. A web application firewall (WAF) works at the application layer and provides additional security via proxying, filtering service requests, or blocking based on additional factors such as the client and requests.

- (Exam Topic 1)
What type of PII is regulated based on the type of application or per the conditions of the specific hosting agreement?

1. A. Specific
2. B. Contractual
3. C. regulated
4. D. Jurisdictional

Correct Answer: B
Contractual PII has specific requirements for the handling of sensitive and personal information, as defined at a contractual level. These specific requirements will typically document the required handling procedures and policies to deal with PII. They may be in specific security controls and configurations, required policies or procedures, or limitations on who may gain authorized access to data and systems.

- (Exam Topic 4)
In addition to battery backup, a UPS can offer which capability?

1. A. Breach alert
2. B. Confidentiality
3. C. Communication redundancy
4. D. Line conditioning

Correct Answer: D
A UPS can provide line conditioning, adjusting power so that it is optimized for the devices it serves and smoothing any power fluctuations; it does not offer any of the other listed functions.

- (Exam Topic 3)
Audits are either done based on the status of a system or application at a specific time or done as a study over a period of time that takes into account changes and processes.
Which of the following pairs matches an audit type that is done over time, along with the minimum span of time necessary for it?

1. A. SOC Type 2, one year
2. B. SOC Type 1, one year
3. C. SOC Type 2, one month
4. D. SOC Type 2, six months

Correct Answer: D
SOC Type 2 audits are done over a period of time, with six months being the minimum duration. SOC Type 1 audits are designed with a scope that's a static point in time, and the other times provided for SOC Type 2 are incorrect.