Exam Dumps VCE

This is false, because, unless, specified cloud customer is legally liable for any loss to data

Under this principle of “Right to be forgotten”, any individual can notify any entity that has PII fort hat individual and instruct that entity to delete and destroy all of that individual’s PII in that entity’s control.
This is a very serious and powerful individual right, and compliance can be extremely difficult.

Buying insurance is most common method of transferring risk.

Cloud provider acquisition comes under Policy and Organizational Risk and can be categorised as follows.
As in any new IT market, competitive pressure, an inadequate business strategy, lack of financial support, etc, could lead some providers to go out of business or at least to force them to restructure their service portfolio offering. In other words, it is possible that in the short or medium term some cloud computing services could be terminated.

ISO 270017 provides guidance on the information security aspects of cloud computing. recommending and assisting with the implementation of cloud-specific information security controls supplementing the guidance in ISO/IEC 27002 and other ISO 27k standards.

Explanation:
This type of question are asked to create confusion.
Following are the five phases of SDLC:
1. Planning and requirements analysis: Business and security requirements and standards are being determined. This phase is the main focus of the project managers and stakeholders. Meetings with managers, stakeholders, and users are held to determine requirements. The software development lifecycle calls for all business requirements(functional and nonfunctional)to be defined even before initial design begins. Planning for the quality-assurance requirements and identification of the risks associated with the project are also conducted in the planning stage. The requirements are then analyzed for their validity and the possibility of incorporating them into the system to be developed.
2. Defining: The defining phase is meant to clearly define and document the product requirements to place them in front of the customers and get them approved. This is done through a requirement specification document, which consists of all the product requirements to be designed and developed during the project lifecycle.
3. Designing: System design helps in specifying hardware and system requirements and helps in defining overall system architecture. The system design specifications serve as input for the next phase of the model. Threat modeling and secure design elements should be undertaken and discussed here.
4. Developing: Upon receiving the system design documents, work is divided into modules or units and actual coding starts. This is typically the longest phase of the software development lifecycle. Activities include code review, unit testing, and static analysis.
5. Testing: After the code is developed, it is tested against the requirements to make sure that the product is actually solving the needs gathered during the requirements phase. During this phase, unit testing, integration testing, system testing, and acceptance testing are conducted.

It is true. This is how Private cloud is defined.
Private Cloud: The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or by a third party and may be located on-premises or off-premises.

ISO 17788 has a cloud reference architecture

Orchestration is the difference between cloud computing and traditional virtualization; virtualization abstracts resources. but it typically lacks the orchestration to pool them together and deliver them to customers on demand. instead relying on manual processes.
Ref: CSA Security Guidelines V4.0

Resource sharing is not one of the key characteristics of Cloud Computing

This is false. Please read the question carefully.
Question: is asking
On Demand “Shelf” Service where the correct characteristic is “0n Demand Self Service”

Definitions:
SAST- Static application security testing(SAST) is a type of security testing that relies on inspecting the source code of an application. ln general, SAST involves looking at the ways the code is designed to pinpoint possible security flaws.
DAST- Dynamic application security testing(DAST) technologies are designed to detect conditions indicative of a security vulnerability in an application in its running state

Thats the definition of vulnerbility

Ephemeral storage: This type of storage is relevant for SaaS instances and exists only as long as its instance is up. It is typically used for swap files and other temporary storage needs and is terminated with its instance.

With compliance inheritance, the cloud provider’s infrastructure is out of scope fora customer’s compliance audit, but everything the customer configures and builds on top of the certified services is still within scope.
Reference: CSA Security GuidelinesV.4 (reproduced here for the educational purpose)