Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP > 1.Architectural Concepts > Flashcards

1.Architectural Concepts Flashcards

1
Q

Cloud security considerations :

Security n privacy considerations

A

security n privacy considerations:
1. Confidentiality seeks to protect assets (information and systems) from unauthorized access.
2. Integrity seeks to protect those same assets against unauthorized modification.
3. Availability seeks to ensure that assets are available for authorized use when needed without disruption.

  1. Privacy

three new concerns: governance, auditability, and regulatory oversight.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ISO/IEC 27034

A

ISO/IEC 27034 is the standard for integrating security throughout
the life cycle of applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ISO/IEC 15408

A

ISO/IEC 15408 (Common Criteria) is the standard for expressing
IT security functional and assurance requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISO/IEC 17789 - Cloud Computing Reference Architecture (CCRA)

A

ISO/IEC 17789 Cloud Computing Reference Architecture (CCRA)
is specific to the cloud. It may be used to organize the components of a cloud architecture
into a set of common elements using common terminology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO/IEC 27017:2015

A

ISO/IEC 27017 provides guidance on the information security
aspects of cloud computing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO/IEC 17788

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ISO/IEC 18788

A

This ISO standard offers a framework and provides the principles
and requirements for the establishment, operations and management of security operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ISO/IEC 19441

A

This standard is about portability and interoperability of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ISO/IEC 20000-1

A

This ISO standard is about establishing requirements for
implementing, maintaining and continually improving a service management system (SMS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ISO 27002

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO/IEC 27001

A

ISO/IEC 27001 standard is about the establishment,
implementation, operation, monitoring, reviewing, and maintaining an Information Security
Management System (ISMS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

5 rules of evidence

A

Be authentic, accurate, complete, convincing and admissible in court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Privacy Level Agreement (PLA)

A

A PLA is similar in concept to an SLA in that it defines roles and
responsibilities as well as clearly defining service commitments for the protection of privacy
information between a service provider and consumer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The Cloud Controls Matrix (CCM)

A

The Cloud Controls Matrix (CCM) by Cloud Security Alliance (CSA)
is an example of a framework that can be used to determine applicable controls and their
effectiveness. This framework’s elements are specific to the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISO/IEC 12207

A

ISO/IEC 12207 provides a framework around lifecycle processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NIST SP 800-209

A

(SP) 800-209 provides specific guidance on storage security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

NIST SP 800-88

A

NIST SP 800-88 provides guidelines for media sanitization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NIST SP 800-92

A

Guide to
Computer Security Log Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data stewards

A

Data stewards
typically ensure that data is collected correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Strategic supplier

A

Strategic suppliers are deemed to be mission critical and cannot
be easily replaced if they become unavailable. While companies typically do business with a
few of these types of partners, they are the most crucial to the success or failure of the
enterprise cloud architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Tactical supplier

A

Tactical suppliers supplement strategic and commodity suppliers
to manage emerging unforeseen issues and incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Commodity supplier

A

Commodity suppliers, in contrast to strategic suppliers, are
those that provide goods and services that can easily be replaced and sourced from a
variety of suppliers, if necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Consensus Assessments Initiative Questionnaire (CAIQ)

A

(CAIQ) is a
survey provided by the Cloud Security Alliance (CSA) for cloud consumers and auditors to
assess the security capabilities of a cloud service provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The CLOUD Act

A

The CLOUD Act gives broad powers to U.S. law enforcement
officials to force U.S.-based technology providers to release data regardless of where the
company stores data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Sarbanes-Oxley Act (SOX)

A

This U.S. legislation was enacted to protect shareholders and the
general public from accounting errors and fraudulent practices in the enterprise.

26
Q

Data sovereignty

A

refers to the idea that a country or jurisdiction has the authority and right to govern and control the data generated within its borders.

The implied or explicit right to decide what treatment, care
or disposition (embargo or movement) a nation or state can determine on data by
means of its laws

27
Q

GAPP (10 Principles)
Generally accepted privacy principles

A

MNCCUADSQM

Management
Notice
Choice and Consent
Collection
Use, Retention, and Disposal
Access
Disclosure to Third Parties
Security for Privacy
Quality
Monitoring and Enforcement

28
Q

Correct order for an audit plan

A

Define audit objectives, define audit scope, refine audit processes
based on lessons learned, fieldwork, analysis, reporting

29
Q

Secure Data lifecycle phases

A

Create, store, use, share, archive and destroy

30
Q

Data dispersion

A

When using the data dispersion technique, each storage block is
fragmented and the storage application writes each bit into different physical storage
containers to achieve greater information assurance, just like the old-fashioned RAID system,
only scattered across different physical devices and/or geographical locations.

31
Q

Consumer DRM, Enterprise DRM

A

Consumer DRM aims at controlling copying, execution and
alteration of media such as audio, video and e-books.

Enterprise DRM Focuses on
protecting enterprise assets such as documents and email through implementation of usage
rights policies.

32
Q

Data: Static masking

A

In static masking, a new copy of the data is created with the
masked values.
Static masking is typically efficient when creating clean, nonproduction
environments.

33
Q

Data: Dynamic masking

A

This type of masking is efficient when protecting production
environments; in other words, dynamic masking can hide the full credit card number from
customer service representatives, but the data remains available for processing

34
Q

SSD versus HDD

A

SSD: Faster , more expensive,nonmechanical(flash), shock resistent, best for storing OS, Gaming apps, frequently used files

HDD: slower, cheaper, mechanical(moving parts),fragile, best for storing extra data, movies, audio, video, photos, backup

35
Q

Software-Defined Networking (SDN) planes (3)

A

SDN planes are the management plane, control plane and data
plane.

36
Q

The ISO/IEC TS 22237 standard describes 4 availability classes for data centers.

A

Availability Class-1: Basic Site Infrastructure (basic infrastructure required to support an organization that wants to conduct IT operations)

Availability Class-2: Redundant Capacity Component Site Infrastructure (facilities provide more redundancy than Tier 1 facilities)

Availability Class-3: Concurrently Maintainable Site Infrastructure (concurrently maintainable site infrastructure)

Availability Class-4: Fault Tolerant Site Infrastructure (highest level described by the Uptime Institute)

37
Q

Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
framework

A

provides real-world observations about tactics and techniques used by
many of the advanced persistent threat (APT) operators.

The ATT&CK framework is a database of adversary tactics and
techniques and provides valuable data to incident responders.

38
Q

Security Groups & ACLs

A

While network ACLs operate at the subnet level, security groups
operate at the instance level.

39
Q

FIPS 140-2
Federal Information Processing Standard (FIPS) 140-2

A

describes the process used to approve cryptographic implementations

40
Q

cloud management
platform (CMP)

A

Cloud orchestration is typically delivered by a cloud management
platform (CMP).

41
Q

Security Assertion Markup Language (SAML)

A

SAML defines an XML-based framework for describing and
exchanging security information between online business relationships.

42
Q

RTO , MPTD :
maximum tolerable period
of disruption (MTPD),

A

RTO is less than MTPD

43
Q

Firmware vulnerabilities

A

In a SaaS deployment, firmware vulnerabilities are the
responsibility of the cloud service provider and are not a concern of the consumer.

44
Q

Five facets of cloud interoperability :

A

policy, behavioral,
transport, syntactic and semantic data.

45
Q

ISO/IEC TS 22237

A

This standard provides availability class ratings and protection
class ratings for data centers related to the criteria enumerated below :

the building construction, power distribution, environmental controls,
telecommunication cabling and security systems in data centers

46
Q

Volume Storage

A

volume storage is most suitable for files
that change frequently, like operating system files.

47
Q

Microsegmentation

A

A fundamental design requirement of microsegmentation is
understanding the protection requirements for east-west (traffic within
a data center) and north-south (traffic to and from the internet) traffic
flows.

48
Q

OWASP Cornucopia

A

is a card game used to help derive application security requirements during the software development life cycle

49
Q

Application Security Verification Standard (ASVS)

A

It consists of three levels of security verification,
from Level 1’s low assurance level that can be done entirely through penetration testing to Level 3’s critical applications security validation that requires in-depth validation and testing.

level 1: The baseline level for most web applications, this level is mostly automated and can be assessed through interactions with the application. It aligns with standard penetration testing methodology

level 2: This level is recommended for most applications, especially those that store or process sensitive data. It requires a more comprehensive review of the development and security processes than Level 1, and involves a collaborative review

level 3: This is the most rigorous level of security requirements, and is intended for the most critical applications. These applications may perform high value transactions, contain sensitive medical data, or require the highest level of trust.

50
Q

ISO/IEC 27034

A

ISO/IEC 27034 is the standard for integrating security throughout
the life cycle of applications.

51
Q

Cloud Security Alliance’s report,

The Egregious Eleven, among the top concerns and threats for cloud computing

A
  • Insufficient identity, credential, access and key management (#4)
  • Insecure interfaces and APIs (#7)
  • Misconfiguration and inadequate change control (#2)
  • Lack of cloud security architecture and strategy (#3)
  • Insecure software development
  • Unsecure third-party resources
  • System vulnerabilities
  • Accidental cloud data disclosure/disclosure
  • Misconfiguration and exploitation of serverless and container workloads
  • Organized crime/hackers/APT
  • Cloud storage data exfiltration
52
Q

Microsoft SDL

A

consisting of a set of 12 processes
that follow the product life cycle, intending to help development teams with the
construction of secure software by introducing security and privacy considerations in
every phase of the development process

53
Q

STRIDE

A
  • Spoofing
  • Tampering
  • Repudiation
  • Information Disclosure
  • Denial of Service
  • Elevation of Privilege
54
Q

DREAD

A

Damage
Reproducibility
Exploitability
Affected Users
DiscoverabilityHow easily can the threat be discovered?

55
Q

ATASM

A

ATASM, or Architecture, Threats, Attack Surfaces, and Mitigations.

56
Q

PASTA

A

PASTA, the Process for Attack Simulation and Threat Analysis, is a seven-stage framework

57
Q

Change requests (CR)

A

Standard, normal and emergency changes are three types of
change that must be managed differently.

58
Q

Security Content Automation Protocol (SCAP)

A

SCAP is a suite of specifications that standardize the format and
nomenclature by which software flaw and security configuration information is
communicated, both to machines and humans

SCAP is a multipurpose framework of specifications that support
automated configuration, vulnerability and patch checking, technical
control compliance activities and security measurement.

59
Q

DNSSEC

A

It can validate zone transfers with a digital signature to thwart attackers that falsify responses to DNS queries.

60
Q

DNS Shadowing threat

A

Malicious actors compromising the domain owner’s account and
creating subdomains to host their malicious pages

61
Q
A

CCSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions