CCSK Exam Dumps - Certificate of Cloud Security Knowledge (CCSKv5.0)

Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant)-impacting (physical and virtual) applications and system-

system interface (API) designs and configurations, infrastructure network and systems components.

Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or

managed user end-point devices (e.g. issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

None of the above

Intrusion Prevention System

URL filters

Data Loss Prevention

Cloud Access and Security Brokers (CASB)

Database Activity Monitoring

Risk Impact

Domain

Control Specification

The CSP server facility

The logs of all customers in a multi-tenant cloud

The network components controlled by the CSP

The CSP office spaces

Their own virtual instances in the cloud

They are usually open source and do not require vetting

They might contain vulnerabilities that can be exploited

They fail to integrate properly with existing continuous integration pipelines

They might increase the overall complexity of the codebase

A general lack of interoperability standards means that extra focus must be placed on the security aspects of migration between Cloud providers.

The size of data sets hosted at a Cloud provider can present challenges if migration to another provider becomes necessary.

Customers of SaaS providers in particular need to mitigate the risks of application lock-in.

Clients need to do business continuity planning due diligence in case they suddenly need to switch providers.

Geographic redundancy ensures that Cloud Providers provide highly available services.

Arbitrary contract termination by acquiring company

Resource isolation may fail

Provider may change physical location

Mass layoffs may occur

Non-binding agreements put at risk

Regular file backups

Data encryption at rest

Successful login attempts

Unauthorized API calls