Free CCSP Exam Braindumps

- (Exam Topic 3)
Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user’s valid credentials?

1. A. Injection
2. B. Missing function-level access control
3. C. Cross-site scripting
4. D. Cross-site request forgery

Correct Answer: D
Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user's browser without going through any validation or sanitization processes, or perhaps the code is not properly escaped from processing by the browser. The code is then executed on the user's browser with their own access and permissions, allowing the attacker to redirect the user's web traffic, steal data from their session, or potentially access information on the user's own computer that their browser has the ability to access. Missing function-level access control exists where an application only checks for authorization during the initial login process and does not further validate with each function call. An injection attack is where a malicious actor sends commands or other arbitrary data through input and data fields with the intent of having the application or system execute the code as part of its normal processing and queries. Cross-site request forgery occurs when an attack forces an authenticated user to send forged requests to an application running under their own access and credentials.

- (Exam Topic 3)
Which aspect of cloud computing pertains to cloud customers only paying for the resources and services they actually use?

1. A. Metered service
2. B. Measured billing
3. C. Metered billing
4. D. Measured service

Correct Answer: D
Measured service is the aspect of cloud computing that pertains to cloud services and resources being billed in a metered way, based only on the level of consumption and duration of the cloud customer. Although they sound similar to the correct answer, none of the other choices is the actual cloud terminology.

- (Exam Topic 4)
Tokenization requires two distinct ________.

1. A. Personnel
2. B. Authentication factors
3. C. Encryption keys
4. D. Databases

Correct Answer: D
In order to implement tokenization, there will need to be two databases: the database containing the raw, original data, and the token database containing tokens that map to original data. Having two-factor authentication is nice, but certainly not required. Encryption keys are not necessary for tokenization. Two-person integrity does not have anything to do with tokenization.

- (Exam Topic 2)
Which security concept is based on preventing unauthorized access to data while also ensuring that it is accessible to those authorized to use it?

1. A. Integrity
2. B. Availability
3. C. Confidentiality
4. D. Nonrepudiation

Correct Answer: C
The main goal of confidentiality is to ensure that sensitive information is not made available or leaked to parties that should not have access to it, while at the same time ensuring that those with appropriate need and authorization to access it can do so in a manner commensurate with their needs and confidentiality requirements.

- (Exam Topic 3)
Which of the following actions will NOT make data part of the create phase of the cloud data lifecycle?

1. A. Modify data
2. B. Modify metadata
3. C. New data
4. D. Import data

Correct Answer: B
Modifying the metadata does not change the actual data. Although this initial phase is called "create," it can also refer to modification. In essence, any time data is considered "new," it is in the create phase. This can come from data that is newly created, data that is imported into a system and is new to that system, or data that is already present and is modified into a new form or value.