Which of the following threat types involves an application that does not validate authorization for portions of itself after the initial checks?

• A.Injection
• B.Missing function-level access control
• C.Cross-site request forgery
• D.Cross-site scripting

Comment: *

Name: *

Email: *

Verification: *

Your boss has tasked your team with getting your legacy systems and applications connected with new cloud-based services that management has decided are crucial to customer service and offerings.
Which role would you be assuming under this directive?

• A.Cloud service administrator
• B.Cloud service user
• C.Cloud service integrator
• D.Cloud service business manager

Comment: *

Name: *

Email: *

Verification: *

What does the "SOC" acronym refer to with audit reports?

• A.Service Origin Confidentiality
• B.System Organization Confidentiality
• C.Service Organizational Control
• D.System Organization Control

Comment: *

Name: *

Email: *

Verification: *

In a federated identity arrangement using a trusted third-party model, who is the identity provider and who is the relying party?

• A.The users of the various organizations within the federations within the federation/a CASB
• B.Each member organization/a trusted third party
• C.Each member organization/each member organization
• D.A contracted third party/the various member organizations of the federation

Comment: *

Name: *

Email: *

Verification: *

SOC Type 1 reports are considered "restricted use," in that they are intended only for limited audiences and purposes.
Which of the following is NOT a population that would be appropriate for a SOC Type 1 report?

• A.Current clients
• B.Auditors
• C.Potential clients
• D.The service organization

Comment: *

Name: *

Email: *

Verification: *