Free CCSP Exam Braindumps (page: 13)

Page 12 of 129

Which of the following is not a risk management framework?

  1. COBIT
  2. Hex GBL
  3. ISO 31000:2009
  4. NIST SP 800-37

Answer(s): B

Explanation:

Hex GBL is a reference to a computer part in Terry Pratchett’s fictional Discworld universe. The rest are not.



Which of the following threat types involves the sending of untrusted data to a user's browser to be executed with their own credentials and access?

  1. Missing function level access control
  2. Cross-site scripting
  3. Cross-site request forgery
  4. Injection

Answer(s): B

Explanation:

Cross-site scripting (XSS) is an attack where a malicious actor is able to send untrusted data to a user's browser without going through any validation or sanitization processes, or where the code is not properly escaped from processing by the browser. The code is then executed on the user's browser with the user's own access and permissions, allowing an attacker to redirect their web traffic, steal data from their session, or potentially access information on the user's own computer that their browser has the ability to access.



How is an object stored within an object storage system?

  1. Key value
  2. Database
  3. LDAP
  4. Tree structure

Answer(s): A

Explanation:

Object storage uses a flat structure with key values to store and access objects.



Which of the following is NOT a regulatory system from the United States federal government?

  1. PCI DSS
  2. FISMA
  3. SOX
  4. HIPAA

Answer(s): A

Explanation:

The payment card industry data security standard (PCI DSS) pertains to organizations that handle credit card transactions and is an industry regulatory standard, not a governmental one.






Post your Comments and Discuss ISC CCSP exam with other Community members:

CCSP Exam Discussions & Posts