CCSP Assessment Test Review / 錯題複習講義

Test Source / 題庫來源: ISC2 CCSP LearnZapp — Assessment Test (30 questions)
Score / 得分: 20/30 (66%)
Focus / 範圍: Wrong-question concept correction only

1. Test Overview / 測驗概覽

2. Domain Performance / 領域表現

3. Wrong-Question Summary / 錯題總表

4. Key Concepts / 重點概念

4.1 Regulations & Standards / 法規與標準

English

Chinese

Mnemonics / 記憶口訣

4.2 Cloud Deployment Models / 雲端部署模型

English

Chinese

4.3 Cloud Actors / Roles / 雲端角色

English

Chinese

4.4 IaaS Value Proposition / IaaS 商業價值

English

The primary business driver for adopting IaaS is transfer of ownership cost — converting capital expenditure (CapEx) to operational expenditure (OpEx). Customers pay only for what they use instead of bearing the full implementation cost.

Other benefits (scalability, metered service, energy/cooling efficiencies) are secondary, not the primary driver.

Chinese

採用 IaaS 的核心商業驅動力是擁有成本轉移（transfer of ownership cost） — 將資本支出（CapEx）轉換為營運支出（OpEx）。客戶只需按使用量付費，無需負擔完整建置成本。

其他效益（可擴展性、按量計費、能源與冷卻效率）皆為次要，非主要驅動力。

4.5 Cloud Data Disposal / 雲端資料銷毀

English

Chinese

4.6 Encryption Architecture / 加密架構

English

Chinese

TDE Architecture / TDE 架構

Application → DBMS (TDE Engine) → Encrypted Data
                    ↕
            KMS (Key Management)
                    ↕
            HSM (Secure Storage)

4.7 Data Protection: DRM / IRM / 資料保護

English

Chinese

5. Error Pattern Analysis / 錯因模式分析

5.1 Regulation & Standard Name Confusion / 法規與標準名稱混淆

Rule / 規則:

• GLBA → U.S. financial institutions + customer private information
• PCI DSS → payment card data security (not a federal privacy law)
• SSAE 18 → attestation/audit standard
• SOC 1 / SOC 2 → report types derived from SSAE 18

Root Cause / 根本原因: Memorizing names without distinguishing category (law vs standard vs report vs organization).

5.2 Cloud Model & Role Boundary / 雲端模型與角色邊界

Rules / 規則:

• Public cloud → general public / open use
• Private cloud → single organization exclusive use
• Broker → intermediary, aggregation, integration, management
• Reseller → buys service, resells to own customers
• IaaS primary benefit → transfer of ownership cost (CapEx → OpEx)

Decision Flow / 判斷順序:

1. Does the scenario mention general public / open use? → Public cloud
2. Does it mention exclusive use by one organization? → Private cloud
3. Does it mention resale / own customers? → Reseller
4. Does it ask about primary benefit / business driver? → Ownership cost transfer

5.3 Cloud Disposal & Encryption / 雲端銷毀與加密

Rules / 規則:

• Cloud: physical destruction, degaussing, overwriting may not be feasible
• Encryption / crypto-erasure is the most universally applicable disposal method
• TDE encryption engine → database / DBMS layer (not KMS)
• KMS → manages key lifecycle (not the encryption engine itself)
• HSM → tamper-resistant hardware for key storage and crypto operations

5.4 DRM vs Enterprise DRM / IRM

Rules / 規則:

• DRM = broad: prevents unauthorized copying, restricts distribution to authorized users
• Enterprise DRM / IRM = enterprise-focused subset of DRM
• Bit splitting = data dispersion (not rights management)
• Degaussing = media sanitization (not rights management)

6. One-Liner Rule Table / 一句話規則表

7. Study Drills / 複習演練

Drill A: Regulations & Standards (10 min)

Quick daily Q&A:

• What does GLBA govern?
• What does PCI DSS govern?
• Is SSAE 18 a report or a standard?
• What are SOC 1 and SOC 2 oriented toward respectively?
• Is ISO/IEC a law, a standards organization, or a report?

快速問答：

• GLBA 管什麼？
• PCI DSS 管什麼？
• SSAE 18 是報告還是標準？
• SOC 1 與 SOC 2 分別偏重什麼？
• ISO/IEC 是法律、標準組織、還是報告？

Drill B: Cloud Actors (10 min)

Quickly distinguish:

• CSP vs CSC vs CSN
• Cloud broker vs cloud reseller
• Cloud carrier vs cloud auditor

快速分辨：

• CSP / CSC / CSN
• Cloud broker / Cloud reseller
• Cloud carrier / Cloud auditor

Drill C: Encryption Architecture (15 min)

Be able to clearly explain:

• TDE vs application-level encryption
• KMS vs HSM
• Encryption vs tokenization vs masking
• Crypto-erasure vs degaussing vs physical destruction

必須能講清楚：

• TDE 與應用層加密的差異
• KMS 與 HSM 的差異
• 加密、代碼化、遮罩的區別
• 加密銷毀、消磁、物理銷毀的比較

8. Conclusion / 結論

English

This 66% score does not indicate overall readiness failure — the sample is only 30 questions, and D4/D5 performed well. However, it reveals a clear issue: in mixed assessments, regulation/standard terminology, cloud roles, and D2 encryption/disposal boundaries are easily disrupted by distractor options.

Priorities:

1. Stop chasing new questions.
2. Fix wrong-question concepts in D1 / D2 / D6 first.
3. Verify with a 30–50 question mixed quiz.
4. Before attempting a full 100–125 question timed practice, bring D1/D2/D6 mini-quiz scores back to 75–80%.

Chinese

本次 66% 不代表整體準備失敗 — 樣本只有 30 題，且 D4/D5 表現良好。但此分數指出一個明確問題：在混合測驗中，法規／標準名詞、雲端角色、D2 加密與資料銷毀邊界容易被干擾選項帶走。

後續優先策略：

1. 不再大量追新題。
2. 先修正 D1 / D2 / D6 的錯題概念。
3. 用 30–50 題小型 mixed quiz 檢查修正效果。
4. 進入 100–125 題完整計時練習前，先讓 D1/D2/D6 的小測成績回到 75–80%。

9.

複習主軸

優先順序

Assessment 錯題中明確出現 GLBA、public cloud、cloud disposal、SSAE 18、IaaS benefit、mobile cloud storage、cloud reseller、transparent encryption、HSM、DRM 等錯誤點。

A. D6 法規 / 合規 / 審計名詞

A1. 法規與產業規範

明天要背的最小集合

GLBA = 金融個資PCI DSS = 支付卡資料HIPAA = 醫療 PHISOX = 財報內控GDPR = EU 個資FedRAMP = 美國聯邦雲服務授權FISMA = 美國聯邦資訊系統安全

A2. 審計標準 / 報告 / Assurance

易混淆規則

SSAE 18 = 標準SOC 1 / SOC 2 / SOC 3 = 報告ISO 27001 = ISMS 認證ISO 27002 = 控制指引ISO 27017 = 雲端安全ISO 27018 = 公有雲 PIICSA CCM = 控制矩陣CAIQ = 問卷

B. 法律流程 / 證據 / 調查名詞

這一區通常不是工程師日常用語，但 CCSP 很常用來考 D6。

秒殺對比

Residency = 資料放在哪裡Sovereignty = 資料受誰的法律管Localization = 法律要求資料必須留在某地Legal hold = 先保留，不要刪eDiscovery = 找電子證據Chain of custody = 證據保管流程可證明

C. 合約 / 供應商治理 / 責任邊界名詞

常見陷阱

Outsourcing 不等於責任全部轉移。SLA 是服務水準承諾，不是完整安全保證。Right to audit 是 assurance 能力，不是技術控制。Due diligence 偏事前調查；due care 偏持續合理注意。

D. D2 資料安全 / 加密 / 銷毀 / 權限保護名詞

D1：資料銷毀與媒體處理

秒殺規則

Cloud disposal 問 always safe / cloud environment：優先想 encryption / crypto-erasure。不要優先選 degaussing / physical destruction。

D2：加密與金鑰管理

秒殺規則

TDE = encryption engine at DB/DBMS layerKMS = 管 key，不是 encryption engineHSM = 硬體保護 keyBYOK = 自帶 keyHYOK = 自己保管 key

D3：資料保護技術

E. D1 雲模型 / 雲角色 / 架構名詞

E1. Cloud deployment models

E2. Cloud service models

IaaS 商業價值

IaaS primary benefit = transfer ownership cost / CapEx → OpEx不是 energy/cooling efficiency。

E3. Cloud actors

Broker vs Reseller

Reseller = buys and resellsBroker = intermediary / aggregation / integration / management

F. 明天完整複習清單

版本 A：2 小時版

版本 B：3 小時版

G. 明天必背的一句話規則

GLBA = 金融機構個資；PCI = 支付卡資料。SSAE 18 = attestation standard；SOC 1/2/3 = report。SOC 1 = 財報控制；SOC 2 = trust services controls；SOC 3 = public summary。ISO 27001 = ISMS certification；27002 = controls guidance；27017 = cloud；27018 = public cloud PII。Legal hold = 先保留，不刪除。eDiscovery = 找電子證據。Chain of custody = 證據保管鏈。Residency = 資料放哪；Sovereignty = 受誰法律管；Localization = 必須留在哪。TDE = database/DBMS layer encryption。KMS = 管 key；HSM = 硬體保護 key。Cloud disposal 優先想 encryption / crypto-erasure。DRM = 廣義防拷貝與授權分發；IRM = 企業資訊權限控管。Public cloud = open to general public。Reseller = buys and resells；Broker = intermediary / aggregation / integration。IaaS benefit = transfer ownership cost / CapEx to OpEx。Outsourcing 不等於責任完全轉移。