最新Managing-Cloud-Securityテスト材料には有効なManaging-Cloud-Securityテストエンジン
Managing-Cloud-Security更新された試験問題集で[2026年最新] 練習には有効な試験問題集
質問 # 49
Which role in cloud computing provides products or services that interact with the primary offering of a cloud service provider?
- A. Cloud service developer
- B. Customer
- C. Cloud service partner
- D. Regulator
正解：C
解説：
A cloud service partner plays a complementary role by offering products or services that enhance or interact with the primary cloud provider's offerings. Examples include managed service providers, value-added resellers, or software vendors that integrate their solutions with the core infrastructure or platform of a cloud service provider.
The customer is the end user of cloud services, regulators ensure compliance with laws, and developers create applications but do not represent an independent ecosystem role. Partners, on the other hand, extend the value of the primary offering by providing additional tools, support, or integrations that enhance customer experience.
This ecosystem role is recognized by major cloud frameworks, such as the Cloud Security Alliance, which notes the importance of partners in ensuring interoperability, extending services, and supporting shared responsibility. For customers, this means greater flexibility and choice in tailoring cloud solutions to business needs.
質問 # 50
After selecting a new vendor, what should an organization do next as part of the vendor onboarding process?
- A. It should evaluate and determine whether the vendor meets the organization's requirements by evaluating its security policies.
- B. It should terminate the relationship with the vendor and dissolve technical agreements, data transfers, and other connections with the vendor.
- C. It should monitor the practices of the vendor by performing audits and confirming that the vendor is meeting its contractual agreements.
- D. It should confirm contractual details and arrange other details such as technical agreements, data transfers, and encryption standards with the vendor.
正解：D
解説：
Once a vendor has been chosen, the onboarding phase requires confirmingcontractual details and arranging technical agreements. This includes specifying encryption standards, data transfer methods, SLAs, and compliance responsibilities. These discussions establish a clear foundation for the partnership.
Auditing and monitoring occur later, during ongoing vendor management. Evaluating requirements and policies occurs earlier, during vendor selection. Terminating a relationship is an offboarding activity, not onboarding.
Clarifying technical and contractual details at onboarding ensures a secure, compliant, and efficient partnership. It reduces risks of miscommunication and enforces accountability from the beginning.
質問 # 51
An organization's security architects determined that all authentication and authorization requests need to be validated before any employee can access corporate resources. Because of this, the organization needs to implement a system that stores and manages the employees' credential information and then validates any requests sent. Which system would allow the organization to meet the architects' requirements?
- A. Identity provider (IdP)
- B. Zero trust
- C. Bastion host
- D. Hardware security module (HSM)
正解：A
解説：
AnIdentity Provider (IdP)is a system that stores and manages identity information and validates authentication and authorization requests. IdPs are critical in cloud and hybrid environments, supporting protocols such as SAML, OAuth, and OpenID Connect for federated access.
An HSM manages encryption keys, not identities. Zero Trust is a security philosophy requiring continuous verification, but the system that enforces authentication is the IdP. A bastion host provides secure administrative access but does not manage identity.
By using an IdP, organizations centralize credential management, enforce multifactor authentication, and integrate with Single Sign-On (SSO). This reduces password fatigue, increases security, and ensures consistent access control policies across applications and services.
質問 # 52
An organization wants to ensure that all entities trust any certificate generated internally in the organization.
What should be used to generate these certificates?
- A. Individual users' private keys
- B. The organization's certificate repository server
- C. The organization's certificate authority server
- D. Individual systems' private keys
正解：C
解説：
Trust in digital certificates comes from their issuance by aCertificate Authority (CA). A CA is a trusted entity that validates identities and signs certificates. In internal environments, organizations often operate a private CAto issue certificates for users, systems, and services.
If certificates were generated by individual private keys or systems without central authority, there would be no unified trust chain, and validating authenticity across the organization would be impossible. A certificate repository server only distributes certificates but cannot establish trust.
By using an organizational CA server, all certificates are linked to a root of trust. Systems configured to trust the organization's CA will trust any certificate it issues. This allows secure internal communications (TLS, VPN, email signing) and ensures scalability as new services come online. It also supports compliance with enterprise PKI policies.
質問 # 53
When should a cloud service provider delete customer data?
- A. After the specified retention period
- B. When the cloud provider oversubscribes its storage space
- C. After a scheduled data review
- D. When the data has not been accessed in the last 30 days
正解：A
解説：
The correct time for data deletion isafter the specified retention perioddefined by contractual agreements, regulatory frameworks, or internal policies. Retention policies ensure that data is kept for as long as necessary for business, legal, or compliance reasons but not longer than required.
Oversubscription, inactivity, or review cycles are not valid triggers because they may conflict with compliance mandates such as GDPR, HIPAA, or PCI DSS. Deleting data prematurely could result in legal penalties or business risks, while keeping it longer than necessary could increase exposure.
By deleting data only after the retention period, providers demonstrate adherence to data governance principles and protect customer rights while minimizing storage costs and liability.
質問 # 54
A cloud provider that processes third-party credit card payments is unable to encrypt its customers' cardholder data because of constraints on a legacy payment processing system. What should it implement to maintain Payment Card Industry Data Security Standard (PCI DSS) compliance?
- A. Privacy control
- B. Compensating control
- C. Risk acceptance
- D. Protection levels
正解：B
解説：
When a required PCI DSS control cannot be implemented due to technical limitations, the organization must apply acompensating control. A compensating control is an alternative safeguard that meets the intent and rigor of the original requirement.
Risk acceptance is insufficient under PCI DSS, as compliance demands enforceable safeguards. Privacy controls and protection levels may enhance data security but do not formally replace mandatory encryption requirements.
For example, a provider may use strict access controls, network segmentation, or monitoring to mitigate risks from unencrypted cardholder data. Documenting these compensating controls is essential during audits, ensuring compliance despite system limitations.
質問 # 55
Which privacy issue does the Clarifying Lawful Overseas Use of Data (CLOUD) Act address?
- A. Data breach notification requirements
- B. Collection and use of genetic information
- C. Use of digital surveillance by multinational employers
- D. Conflicting regulations in different jurisdictions
正解：D
解説：
TheCLOUD Actaddresses conflicts that arise when law enforcement in one jurisdiction seeks access to data stored in another country. It clarifies how U.S. authorities can compel cloud providers to produce data, even if stored overseas, and establishes a framework for resolving jurisdictional conflicts through bilateral agreements.
The Act does not regulate genetic data, breach notifications, or employer surveillance. Its central purpose is to handle the challenge of cross-border data access in the era of globalized cloud computing.
For organizations, this means carefully evaluating how and where data is stored, and ensuring contracts and compliance strategies account for potential conflicts between U.S. law and foreign privacy regulations like GDPR. Awareness of CLOUD Act obligations is crucial in multinational cloud deployments.
質問 # 56
An organization's leadership team gathered managers and key team members in each division to help create a disaster recovery plan. They realize they lack a complete understanding of the infrastructure and software needed to formulate the plan. Which action should they take to correct this issue?
- A. They should identify the key roles in a disaster.
- B. They should determine the criteria of a disaster.
- C. They should create a checklist of the necessary tasks.
- D. They should perform an inventory of assets.
正解：D
解説：
Without a clear understanding of infrastructure and software, the leadership team must first conduct an inventory of assets. An asset inventory provides a comprehensive list of hardware, software, and services that support business operations.
Creating checklists, defining criteria, and assigning roles are important, but they rely on knowing what assets exist. Without an inventory, the disaster recovery plan would miss critical dependencies, making recovery incomplete or impossible.
Performing an inventory supports business impact analysis, risk assessments, and recovery prioritization. It ensures that all critical systems are accounted for and appropriate recovery strategies can be designed. Asset inventories are a foundational best practice for disaster recovery and continuity planning.
質問 # 57
As part of training to help the data center engineers understand different attack vectors that affect the infrastructure, they work on a set of information about access and availability attacks that was presented. Part of the labs requires the engineers to identify different threat vectors and their names. Which threat prohibits the use of data by preventing access to it?
- A. Denial of service
- B. Brute force
- C. Encryption
- D. Rainbow tables
正解：A
解説：
The described threat is aDenial of Service (DoS)attack. In security contexts, a DoS attack aims to make a system, application, or data unavailable to legitimate users by overwhelming resources. Unlike brute force or rainbow table attacks, which target authentication mechanisms, or encryption, which is a defensive control, DoS focuses on disrupting availability-the "A" in the Confidentiality, Integrity, Availability (CIA) triad.
DoS can be executed in many ways: flooding a network with traffic, exhausting server memory, or overwhelming application processes. When scaled by multiple coordinated systems, it becomes a Distributed Denial of Service (DDoS) attack. In either case, the effect is the same-authorized users cannot access critical data or services.
For cloud environments, where service uptime is crucial, DoS protections such as rate limiting, auto-scaling, and upstream filtering are essential. Training data center engineers to recognize DoS helps them understand the importance of resilience strategies and ensures continuity planning includes availability safeguards.
質問 # 58
An organization wants to track how often a file is accessed and by which users. Which information rights management (IRM) solution should the organization implement?
- A. Dynamic policy control
- B. Continuous auditing
- C. Automatic expiration
- D. Persistent protection
正解：B
解説：
Continuous auditingin the context of Information Rights Management (IRM) allows organizations to monitor access events in real time. It records who accessed a file, when, and how often. This enables organizations to enforce accountability and detect unusual access patterns, which are crucial for both security monitoring and compliance reporting.
Automatic expiration sets a time limit on file availability, while dynamic policy control adjusts permissions based on context (such as location or device). Persistent protection ensures files remain encrypted and controlled wherever they travel. While each feature is valuable, only continuous auditing provides the tracking and visibility into usage required by the scenario.
This approach aligns with governance requirements, providing an audit trail that supports incident response and compliance with data protection regulations. Continuous auditing strengthens both operational security and accountability.
質問 # 59
An organization is informed by its cloud provider that a storage device containing some of the organization's data has been seized as possible evidence in a court case, but the organization itself is not involved in any ongoing court cases. Which characteristic of a cloud environment architecture makes such a scenario possible?
- A. Virtualization
- B. Platform as a service (PaaS)
- C. Multitenancy
- D. Software as a service (SaaS)
正解：C
解説：
The scenario arises because ofmultitenancy, a core cloud characteristic where multiple customers share the same physical infrastructure. If a storage device containing multiple tenants' data is seized as part of a case involving another customer, unrelated organizations may still be affected.
Virtualization enables resource abstraction, but multitenancy specifically introduces shared infrastructure risks. SaaS and PaaS are service models, not architectural characteristics.
Multitenancy offers efficiency and cost benefits but raises challenges for data sovereignty, legal jurisdiction, and evidentiary control. Providers mitigate these risks through encryption, logical isolation, and contractual terms. Customers must understand these implications when handling regulated or sensitive data in cloud environments.
質問 # 60
After creating a backup set, an engineer stores the backups according to company policy. Which action should the engineer take periodically to ensure the backed-up data is viable?
- A. The engineer should compare the old backups with newer ones.
- B. The engineer should replace the old backups with newer ones.
- C. The engineer should delete backups according to company policy.
- D. The engineer should test the backups according to company policy.
正解：D
解説：
Backups are only valuable if they can be successfully restored when needed. Testing backups on a periodic basis is the only reliable way to validate their viability. Simply storing backups without testing may create a false sense of security, because corruption, misconfiguration, or incomplete backup sets can go unnoticed until a disaster occurs.
Industry best practices, such as those recommended by NIST and ISO 27031, emphasize regular backup testing as part of disaster recovery and business continuity planning. Testing involves restoring data to a test environment, verifying its integrity, and ensuring that applications can use the restored data as expected.
Deleting, comparing, or replacing backups might help in managing storage efficiency, but these actions do not confirm whether the backups are usable. Periodic testing ensures alignment with company policy, regulatory requirements, and internal risk management controls. It also provides confidence to management that recovery objectives, such as RTO (Recovery Time Objective) and RPO (Recovery Point Objective), can be met.
質問 # 61
Which term describes data elements that, when combined with other information, are used to single out an individual?
- A. Direct identifiers
- B. Data subjects
- C. Indirect identifiers
- D. Personal details
正解：C
解説：
Indirect identifiersare pieces of information that may not identify an individual on their own but, when combined with other data, can uniquely identify someone. Examples include birthdate, ZIP code, or gender.
Together, these can re-identify a person, even when names or direct identifiers are removed.
Direct identifiers (such as Social Security numbers) uniquely identify an individual alone. Data subjects are the individuals to whom the data refers, while personal details is too broad and not a formal term.
Understanding indirect identifiers is essential in privacy regulations like GDPR and HIPAA, where pseudonymization or anonymization must account for potential re-identification risks. Safeguarding indirect identifiers reduces the chance of privacy violations and unauthorized profiling.
質問 # 62
Which release management term describes the process from code implementation to code review and approval to automated testing and then to production deployment?
- A. Iteration
- B. Framework
- C. Baseline
- D. Pipeline
正解：D
解説：
Apipelinerefers to the structured process of moving code from development to production, encompassing implementation, review, automated testing, and deployment. In DevOps, this is known as a CI/CD pipeline (Continuous Integration/Continuous Deployment).
An iteration refers to a development cycle, a baseline represents a stable reference configuration, and a framework provides structure but not a deployment sequence. Only pipeline accurately captures the sequential, automated flow of code into production.
Pipelines enhance efficiency, consistency, and quality assurance by automating repetitive tasks, reducing human error, and ensuring that code changes are validated before reaching production. They are essential for modern cloud-native applications where rapid deployment is expected.
質問 # 63
Which device is used to create and manage encryption keys used for data transmission in a cloud-based environment?
- A. Memory controller
- B. RAID controller
- C. Hardware security module (HSM)
- D. Trusted platform module (TPM)
正解：C
解説：
AHardware Security Module (HSM)is a dedicated, tamper-resistant device designed for creating, managing, and storing encryption keys. In cloud environments, HSMs are essential for securing cryptographic operations, such as SSL/TLS key management, digital signatures, and secure data transmission.
TPMs are hardware chips used to secure local devices, such as laptops. Memory controllers and RAID controllers manage system performance and storage but are not cryptographic devices.
HSMs provide strong protection against key theft or misuse by isolating cryptographic functions from general- purpose computing resources. They are often certified under standards like FIPS 140-2, ensuring compliance with stringent security requirements. In cloud services, customers can use provider-managed HSMs or deploy dedicated virtual HSM instances for secure key management.
質問 # 64
Developers need to be aware of a common application programming interface (API) threat that occurs when attackers send malicious code through a form input to a web application so that it may then be executed.
Which type of attack represents this API threat?
- A. Injection
- B. Denial-of-service
- C. Credential
- D. On-path
正解：A
解説：
The described scenario is aninjection attack. Injection occurs when unvalidated input-such as SQL commands, script code, or OS instructions-is sent to an application through API forms or parameters. If the application fails to sanitize input, the attacker's code may be executed with full system privileges.
On-path attacks intercept communication, credential attacks target authentication, and denial-of-service floods services. None involve code execution via unvalidated input.
Injection is a top risk in OWASP API Security Top 10. Developers must implement input validation, parameterized queries, and least privilege principles to mitigate this risk. API gateways and WAFs provide additional layers of protection but cannot replace secure coding practices.
質問 # 65
An organization is considering using vendor-specific application programming interfaces (APIs) and internal tools to set up a new service. However, the engineers are against this plan and are advocating for a new policy to prevent issues that could arise. Which common concern in cloud applications are the engineers concerned about?
- A. Reliability
- B. Availability
- C. Portability
- D. Scalability
正解：C
解説：
The engineers are concerned aboutportability. Vendor-specific APIs and tools create a dependency on a single provider, leading to vendor lock-in. This limits the ability to migrate services or workloads to another provider without significant rework.
Reliability and availability refer to service uptime and continuity, while scalability addresses performance under demand. Although important, none of these directly relate to cross-platform flexibility. Portability ensures that services, data, and applications can be easily moved or integrated across environments.
By adopting portable solutions-such as open standards, containerization, and multi-cloud strategies- organizations reduce long-term risks, increase negotiation power with providers, and enhance resilience.
質問 # 66
An organization is planning for an upcoming Payment Card Industry Data Security Standard (PCI DSS) audit and wants to ensure that only relevant files are included in the audit materials. Which process should the organization use to ensure that the relevant files are identified?
- A. Normalization
- B. Anonymization
- C. Tokenization
- D. Categorization
正解：D
解説：
Categorizationis the process of systematically identifying and classifying files according to content and relevance. In preparation for a PCI DSS audit, it is critical to identify which files fall within scope-those that contain cardholder data or impact its security.
Normalization adjusts data format, tokenization substitutes sensitive data with tokens, and anonymization removes identifiers. While useful, none directly address the task of isolating "relevant files" for audit.
Categorization ensures that files are grouped correctly, allowing auditors to focus on the proper scope and preventing unnecessary exposure of unrelated data.
This step aligns with PCI DSS requirements that limit scope to systems and data directly affecting cardholder data security. Proper categorization streamlines audits and demonstrates effective data governance.
質問 # 67
Which data destruction technique involves encrypting the data, followed by encrypting the resulting keys with a different engine, and then destroying the keys resulting from the second encryption round?
- A. Degaussing
- B. Overwriting
- C. One-way hashing
- D. Cryptographic erasure
正解：D
解説：
Cryptographic erasure is a secure data sanitization technique that relies on encryption. The process involves encrypting the data, encrypting the keys with a second layer, and then destroying the encryption keys.
Without the keys, the encrypted data becomes unreadable and is effectively destroyed, even though the storage media remains intact.
One-way hashing is used for password storage, not full data destruction. Degaussing is for magnetic media, and overwriting involves physically writing new data over existing sectors.
Cryptographic erasure is widely used in cloud environments where physical media cannot be easily destroyed or reclaimed by customers. It ensures compliance with data retention and privacy regulations while maintaining environmental sustainability by allowing reuse of storage hardware.
質問 # 68
Which design pillar encompasses the ability to support development and run workloads effectively, gain insights into operations, and continuously improve supporting processes to deliver business value?
- A. Reliability
- B. Sustainability
- C. Operational excellence
- D. Performance efficiency
正解：C
解説：
TheOperational Excellencepillar emphasizes practices that allow organizations to develop, deploy, and operate workloads effectively. It includes monitoring operations, responding to incidents, and continuously improving processes. By embedding feedback loops, organizations enhance agility and ensure that technology supports business value.
Performance efficiency deals with using computing resources efficiently, reliability ensures system availability, and sustainability focuses on environmental responsibility. While important, these do not encompass the process-driven improvements at the heart of operational excellence.
Operational excellence ensures that organizations can adapt quickly to changes, implement automation, and drive consistent improvements across cloud workloads. It is a key principle in cloud frameworks like AWS Well-Architected, Microsoft CAF, and Google's Reliability Engineering practices.
質問 # 69
Which group should be notified for approval when a planned modification to an environment is scheduled?
- A. Event management team
- B. Problem management team
- C. Executive management board
- D. Change management board
正解：D
解説：
TheChange Management Board (CMB), also called the Change Advisory Board (CAB), is the formal authority responsible for reviewing, assessing, and approving planned modifications to IT environments. This group ensures that proposed changes align with business objectives, do not introduce unnecessary risks, and comply with security and regulatory requirements.
Event management teams focus on monitoring events, problem management teams handle root-cause analysis, and executive boards provide strategic direction but are not operational approval authorities. Only the CMB has the explicit role of validating technical and security implications before implementation.
By involving the CMB, organizations enforce structured governance, minimize disruptions, and establish accountability. This practice is central in ITIL and ISO/IEC 20000 standards, ensuring that operational integrity and security are preserved during change cycles.
質問 # 70
Which U.S. law requires all publicly traded corporations in the United States to provide information about their financial status and implements controls to ensure the accuracy of the disclosed information?
- A. The General Data Protection Regulation (GDPR)
- B. The Clarifying Lawful Overseas Use of Data (CLOUD) Act
- C. The Gramm-Leach-Bliley Act (GLBA)
- D. The Sarbanes-Oxley (SOX) Act
正解：D
解説：
TheSarbanes-Oxley (SOX) Act of 2002was enacted to restore investor confidence after major corporate accounting scandals. It requires publicly traded corporations to maintain accurate financial reporting and implement internal controls to safeguard the integrity of disclosed information.
GLBA focuses on protecting consumer financial data, GDPR is a European regulation governing privacy, and the CLOUD Act addresses cross-border law enforcement access to data. Only SOX directly mandates financial disclosure and corporate accountability.
SOX compliance includes maintaining audit trails, securing data integrity, and ensuring that executives certify financial statements. Failure to comply carries severe penalties, both civil and criminal. For cloud environments, SOX compliance extends to ensuring IT systems used for financial data are secure, monitored, and auditable.
質問 # 71
......
Managing-Cloud-Securityサンプルには正確な更新された問題：https://www.jpntest.com/shiken/Managing-Cloud-Security-mondaishu
Managing-Cloud-Security試験情報と無料練習テストを提供します：https://drive.google.com/open?id=1LHjRNVGUwggiQKZtnKNDb1Q1aQFSorCu