Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSK Combined > CCSK-Combined > Flashcards

CCSK-Combined Flashcards

1
Q

What are the five essential characteristics of cloud computing as defined by NIST?

A

Broad Network AccessRapid ElasticityMeasured ServiceOn-Demand Self ServiceResource Pooling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The level of attention and scrutiny paid to enterprise risk assessments should be directly related to what?

A

The value at risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In the majority of data protection laws, when the data is transferred to a third party custodian, who is ultimately responsible for the security of the data?

A

The Data Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the most important reason for knowing where the cloud service provider will host the data?

A

So that it can address the specific restrictions that foreign data protection laws may impose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the six phases of the data security lifecycle?

A

CreateStoreUseShareArchiveDestroy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Why is the size of data sets a consideration in portability between cloud service providers?

A

The sheer size of data may cause an interruption of service during a transition, or a longer transition period than anticipated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the four D’s of perimeter security?

A

DeterDetectDelayDeny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In which type of environment is it impractical to allow the customer to conduct their own audit, making it important that the data center operators are required to provide auditing for the customers?

A

In multiñtenant environments the operator or provider cannot normally accommodate visits by every customer to conduct an audit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What measures could be taken by the cloud service provider (CSP) that might reduce the occurrence of application level incidents?

A

SaaS providers that generate extensive customerñspecific application logs and provide secure storage as well as analysis facilities will ease the IR burden on the customer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How should an SDLC be modified to address application security in a Cloud Computing environment?

A

Organizations must adopt best practices for development, either by having a good blend of processes, tools, and technologies of their own or adopting one of the maturity models.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the most significant reason that customers are advised to maintain inñhouse key management?

A

To be able to prove that all data has been deleted from the public cloud environment when exiting that environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What two types of information will cause additional regulatory issues for all organizations if held as an aspect of an Identity?

A

PII ñ Personal Identifiable InformationSPI ñ Sensitive Personal Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Why do blind spots occur in a virtualized environment, where networkñbased security controls may not be able to monitor certain types of traffic?

A

Virtual machines may communicate with each other over a hardware backplane, rather than a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When deploying Security as a Service in a highly regulated industry or environment, what should both parties agree on in advance and include in the SLA?

A

Agreement on the metrics defining the service level required to achieve regulatory objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Economic Denial of Service (EDOS), refers to…

A

The destruction of economic resources; the worst case scenario would be bankruptcy of the customer or a serious economic impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How does SaaS alleviate much of the consumer’s direct operational responsibility?

A

The provider is not only responsible for the physical and environmental security controls, but it must also address the security controls on the infrastructure, the applications, and the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In Europe, name the group that has enacted data protection laws and the principles on which they follow.

A

The European Economic Area (EEA) Member States follow principles set forth in the 1995 European Union (EU) Data Protective Directive and the 2002 ePrivacy Directive as amended in 2009.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the minimum that U.S. state laws require when using a Cloud Service Provider?

A

Written contract with the service provider with reasonable security measures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What must be included between an organization and a Cloud Service Provider when the organization has contractual obligations to protect the personal information of their clients, contacts or employees, to ensure that the data are not used for secondary use and are not disclosed to third parties?

A

The organization must ensure contractually that it will have the continued ability to meet the promises and commitments that it made in its privacy notice(s) or other contracts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a clickñwrap agreement?

A

A nonñnegotiated contract

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How does an organization respond to the evolving nature of the cloud environment?

A

Periodic monitoring, testing, and evaluation of the services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What must a U.S. litigant provide during eñdiscovery?

A

All documents that pertain to the case whether favorable to its case or the other litigant’s case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is ESI?

A

Electronically Stored Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are four considerations for a cloud customer to understand in reference to regulatory compliance?

A

ñ Crossñborder or multiñjurisdictionñ Assignment of compliance responsibilities including the CSP’s providersñ CSP capability to show complianceñ Relationship between all parties including customer, CSP, auditors and CSP’s providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What role do audits perform in the cloud relationships?

A

Audits must be independently conducted and should be robustly designed to reflect best practice, appropriate resources, and tested protocols and standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

At what stage should compliance be addressed between an organization and CSP?

A

Requirements identification stage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is multiñtenancy?

A

Use of same resources or application by multiple customers that may belong to the same organization or a different organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does a cloud service model need to include for multiñtenancy consumers?

A

Policyñdriven enforcementSegmentationIsolationGovernanceService LevelsChargeback/billing models

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What services can be shared in multiñtenancy cloud service models?

A

InfrastructureDataMetadataServicesApplications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What three cloud services make up the Cloud Reference Model?

A

Infrastructure as a Service (IaaS)Platform as a Service (PaaS)Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define IaaS

A

IaaS delivers computer infrastructure as a service along with raw storage and networking.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define PaaS

A

PaaS delivers computing platform and solution stack as a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define SaaS

A

SaaS delivers software and its associated data hosted centrally typically in the cloud and are usually accessed by users via a web browser over the Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

List the four dimensions in the Jericho Cloud Cube Model

A

ñ Internal (I) / External (E): Physical Locationñ Proprietary (P) / Open (O): State of Ownership ñ Perimeterised (Per) / Deñperimeterised (Dñp): Architectural mindsetñ Insourced / Outsourced: Who provides the cloud service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

List the four cloud deployment models

A

PublicPrivate ñ internal/externalHybridCommunity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the key takeaway for security architecture?

A

The lower down the stack the CSP stops, the more security capabilities and management consumers are responsible for implementing and managing themselves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the risks and pitfalls to consider in the Cloud Security Reference Model?

A

ñ How / where cloud service are deployedñ Manner in which cloud services are consumedñ Reñperimeterization of enterprise networksñ Types of assets, resources and information being managedñ Who manages them and howñ Which controls are selected and how they are integratedñ Compliance issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How do you determine the general security posture of a service and how it relates to an asset’s assurance and protection requirements?

A

ñ Classify a cloud service against the cloud architectural modelñ Map the security architecture and business, regulatory, and other compliance requirements as a gapñanalysis exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What do cloud service brokers provide?

A

ñ Intermediationñ Monitoringñ Transformation/portabilityñ Governanceñ Provisioningñ Integration servicesñ Relationship negotiation between CSP and consumers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are included in a Service Level Agreement (SLA)?

A

ñ Service levelsñ Securityñ Governanceñ Complianceñ Liability expectations of the service and provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are two types of Service Level Agreements (SLA)?

A

NegotiableNonñnegotiable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Name the five basic principles followed in Corporate Governance.

A

ñ Auditing supply chainsñ Board and management structure and processñ Corporate responsibility and complianceñ Financial transparency and information disclosureñ Ownership structure and exercise of control rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Define Corporate Governance

A

The set of processes, technologies, customs, policies, laws and institutions affecting the way an enterprise is directed, administered or controlled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Define Information Risk Management

A

The process of identifying and understanding exposure to risk and the capability of managing it, aligned with the risk appetite and tolerance of the data owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Define Enterprise Risk Management

A

The methods and processes used by organizations to manage risks and seize opportunities related to the achievement of their objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

List four of the specific risks identified and analyzed by management in a cloud environment.

A

ñ Avoidance: exiting the activities giving rise to riskñ Reduction: taking action to reduce the likelihood or impact related to the riskñ Share or insure: transferring or sharing a portion of the risk to finance itñ Accept: no action is taken due to a cost/benefit decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What should be specifically targeted in the assessment of a CSP’s third party service providers?

A

ñ Incident managementñ Business continuityñ Disaster recovery policies, processes and proceduresñ Review of coñlocation and backñup facilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is a CSP’s supply chain?

A

Their service provider relationships and dependencies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

How should the cost savings obtained by cloud computing services be utilized?

A

Reinvest into increased scrutiny of the security capabilities of the provider, application of security controls, and ongoing detailed assessments and audits to ensure requirements are continuously met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Define Public Cloud

A

The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Define Private Cloud

A

The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or by a third party and may be located onñpremise or offñpremise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Define Community Cloud

A

The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy or compliance considerations). It may be managed by the organizations or by a third party and may be located onñpremise or offñpremise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Define Hybrid Cloud

A

The cloud infrastructure is a composition of two or more clouds (private, community of public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for loadñbalancing between clouds).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Define Cloud Bursting

A

Where an enterprise shares the load with external cloud providers to meet peak demands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

In most jurisdictions in the U.S., what types of information are a party obligated to produce?

A

Documents and data within its possession, custody or control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What types of data hosted by a CSP could be outside the control of a client?

A

ñ Disaster recovery systemsñ Certain metadata created and maintained by the CSP to operate its environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What should a client account for during eñdiscovery?

A

Additional time and expense where a client may not have the ability or administrative rights to search or access all of the data hosted in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

In the U.S. what is generally considered to be the obligation of a client who knows or reasonably should know is relevant to a pending or reasonably anticipated litigation or government investigation?

A

To undertake reasonable steps to prevent the destruction or modification of data or information in its possession, custody or control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Who is held liable for acts of a subcontractor?

A

Government agencies, such as the FTC or the state Attorney General, have consistently held organizations liable for the activities of their subcontractors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does the GLBA and HIPAA require between an organization and their subcontractor?

A

The security and privacy rules require organizations to compel their subcontractors in written contracts to use reasonable security measures and comply with data privacy provisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What two general categories do assets supported by the cloud fall into?

A
  1. Data2. Applications/Functions/Process
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the first step in evaluating risk for the cloud?

A

Determine exactly what data or function is being considered for the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is the second step in evaluating risk for the cloud?

A

Determine how important the data or function is to the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

For each asset, what three areas are assessed if all or part of the asset is handled in the cloud?

A
  1. Confidentiality2. Integrity3. Availability requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

For each asset, what six areas are examined in how the organization would be harmed if all or part of the asset is handled in the cloud?

A
  1. If the asset became widely public and widely distributed2. If an employee of the cloud provider accessed the asset3. If the process or function were manipulated by an outsider4. If the process or function failed to provide expected results5. If the information/data were unexpectedly changed6. If the asset were unavailable for a period of time
66
Q

What is the third step in evaluating risk for the cloud?

A

Determine which deployment models are best suited to the organization

67
Q

What is the fourth step in evaluating risk for the cloud?

A

Evaluate potential cloud service providers

68
Q

How do you prevent scope creep?

A

Determine potential uses of the data or function being considered for the cloud.

69
Q

Define cloud computing

A

A model for enabling ubiquitous, convenient, onñdemand network access to a shared pool of configurable computing resources.

70
Q

Define multiñtenancy in cloud service models

A

The need for policy-driven enforcement, segmentation, isolation, governance, service levels, and chargeback/billing models for different consumer constituencies.

71
Q

Name two mechanisms to automate monitoring and testing of cloud supply chains.

A

ñ Cloud Auditñ Cloud Trust Protocol

72
Q

______ is the foundation of all cloud services as described in the Cloud Reference Model.

A

IaaS

73
Q

The Jericho Cloud Cube Model is based upon ____dimensions?

A

4

74
Q

The notion of how cloud services are ______ is often used interchangeably with where they are _______, which can lead to confusion.

A

Deployed, provided

75
Q

Amazon’s AWS EC2_______________ offering includes vendor responsibility for security up to the hypervisor.

A

Infrastructure as a service

76
Q

___________as a service provides a set of API’s, which allows management and other forms of interaction with the ______________ by consumers.

A

Infrastructure

77
Q

____ sits on top of _____ and adds an additional layer of integration with application development frameworks, middleware capabilities, and functions such as database, messaging, and queuing.

A

PaaS, IaaS

78
Q

Public or private clouds may be described as ____________, which may not be accurate in all situations.

A

External or internal

79
Q

The_________ and the erosion of trust boundaries already happening in the enterprise is amplified and accelerated by cloud computing.

A

Re-perimeterization

80
Q

A LAMP stack deployed on Amazon’s AWS EC2 would be classified as a public, off-premise, third-party managed _____ solution.

A

IaaS

81
Q

The Cloud Cube Model highlights the challenges of understanding and mapping cloud models to control frameworks and standards such as ____________

A

ISO/IEC 27002

82
Q

Security controls in cloud computing are ______________ security controls in any IT environment.

A

No different than

83
Q

An effective governance and enterprise risk management cloud computing program flows from well-developed information security governance processes as part of the organization’s overall corporate governance obligations to _______.

A

Due care

84
Q

For many cloud deployments, a major element of governance will be the agreement between__________________

A

Provider and customer.

85
Q

_______ is the set of processes, technologies, customs, policies, laws, and institutions affecting the way an enterprise is directed, administered or controlled.

A

Corporate governance

86
Q

Good governance is based on the acceptance of the rights of __________ as the true owners of the corporation, and the role of senior management as trustees.

A

Shareholders

87
Q

If that results in less confidence in a particular vendor, then further engagement with that vendor is_____

A

Less likely

88
Q

Stakeholders should carefully consider the _____________________that are appropriate and necessary for the company’s consistent performance and growth.

A

Monitoring mechanisms

89
Q

In a cloud environment, technologist selects a risk response strategy for specific risks identified and analyzed, which is typically_______.

A

Reduction

90
Q

Assessment of third party service providers should specifically target the provider’s ___________.

A

Incident management

91
Q

Reinvest the cost savings obtained by cloud computing services into __________________capabilities of the provider, application of security controls, and ongoing detailed assessments and audits to ensure requirements are continuously met.

A

Increased scrutiny of the security

92
Q

Each of these laws includes a security requirement and places on the __________ the burden of ensuring the protection and security of personal data wherever the data are located, and especially when transferring to a third party.

A

Data custodian

93
Q

PCI applies to credit card data anywhere in the world, including data processed by subcontractors has similar requirements to other regulatory bodies.

A

PCI

94
Q

When data is transferred to a cloud, the ultimate responsibility for protecting and securing the data typically remains with the ______________, even if in some circumstances, this responsibility may be shared with others.

A

Data owner

95
Q

Before entering into a cloud computing arrangement, the most important issue a company should evaluate is _____________associated with a proposed cloud computing transaction.

A

Compliance requirements

96
Q

Depending on the nature of the services, the contract may commonly be in the form of a _____________ agreement, which is never negotiated.

A

Click-wrap

97
Q

One of the particularities of the ________ judicial system - in great contrast to most other countries - is that a litigant must provide its adversary with ALL documents that pertain to the case.

A

American

98
Q

In certain litigations and investigations, the ___________ could itself be relevant to resolving the dispute in the litigation or investigation.

A

Cloud application

99
Q

_____________________ can require that large volumes of data be retained for extended periods.

A

Preservation

100
Q

________ of a cloud data source is generally difficult or impossible.

A

Bit-by-bit imaging

101
Q

All stakeholders expect organizations to proactively comply with regulatory guidelines and requirements across multiple _________.

A

Jurisdictions

102
Q

______ is focused on aligning with external requirements while _______ is focused on aligning with internal requirements.

A

Compliance, governance

103
Q

By leveraging cloud services, sub-scale organizations can achieve ___________of compliance as much larger and highly resources entities.

A

The same level

104
Q

The role of __________________ needs to be carefully considered, and responsibility for including them in governance, indirectly or directly, should be explicitly assigned within the customer organization.

A

External providers

105
Q

Audit must be____________________ and should be robustly designed to reflect best practice, appropriate resources, and tested protocols and standards.

A

Independently conducted

106
Q

Particularly important to outsourcing and regulations is __________ requirements and obligations.

A

Chained

107
Q

Any information processed, transmitted, stored, or viewed that is identified as_______________ information faces a plethora of compliance regulation worldwide that may vary country or state.

A

Personal Identifiable Information

108
Q

____________ is a technique that is commonly used to improve data security, but without the use of encryption mechanisms.

A

Data Dispersion

109
Q

The Data Security Lifecycle in order is

A

Create, Store, Use, Share, Archive, Destroy

110
Q

Unlike with _________ the goal isn’t to label every piece of data in the organization, but rather to define high-level categories.

A

Data classification

111
Q

File Activity Monitoring provides similar protection to _________________.

A

Database Activity Monitoring

112
Q

In cloud deployments, and throughout the different service models, it’s important to protect data in transit. This includes:

A

Between cloud vendors

113
Q

________ mandates that those components should be replaceable by new or different components from different providers and continue to work, as should the exchange of data between systems.

A

Interoperability

114
Q

A lack of interoperability can lead to __________.

A

Lock-in

115
Q

Using open standards for Identity such as ________________ will help to ensure portability.

A

SAML

116
Q

Encryption keys should be escrowed _______________.

A

Locally

117
Q

_______________ may cause an interruption of service during a transition, or a longer transition period than anticipated.

A

The size of data

118
Q

A common scenario is “___________”, where an enterprise shares the load with external cloud providers to meet peak demands.

A

Cloud bursting

119
Q

The Four D’s of Perimeter Security consists of _____________.

A

Deter, Detect, Delay and Deny

120
Q

Segregation of duties originated in _________.

A

Accounting and financial management

121
Q

The data center should be equipped with specific environmental support equipment according to published internal standards such as:

A

Uninterruptible power supply

122
Q

The composition of the Emergency Response Team, Crisis Management Team and Incident response team should be reviewed in detail along with ________

A

Crisis communication procedure

123
Q

The Restoration plan should incorporate and quantify the _____

A

Recovery Point Objective

124
Q

Cloud providers should consider adopting as a security baseline the______________ requirements of any customer, such that systems, facilities, and procedures are at a system high level.

A

Most stringent

125
Q

Organizations building cloud data centers should incorporate management processes, practices, and software to understand and react to technology running _______.

A

Inside the data center

126
Q

Given the controls in the Cloud Control Matrix the data center being built or purchased must conform to _____.

A

Physical and asset security requirements

127
Q

Use _________ techniques to ensure availability, security, and asset delivery and management.

A

IT service management

128
Q

Cloud computing does not necessitate a new conceptual framework for Incident Response; rather it requires that the organization appropriately_________

A

Maps its extant IR

129
Q

________offered by cloud infrastructures, may dramatically complicate the IR process, especially the forensic activities carried out as part of the incident analysis.

A

Resource pooling

130
Q

In a ____ solution, response activities will likely reside almost entirely with the CSP, whereas in ____ a greater degree of responsibility and capability for detecting and responding to security incidents may reside with the customer.

A

SaaS, IaaS

131
Q

The most important part of preparing for an incident is ____ the plan.

A

Testing

132
Q

_____________ examines the code as it executes in a running cloud application.

A

Dynamic code analysis

133
Q

The type of cloud model has a huge impact on the penetration testing or in deciding if penetration test is possible. Generally,__are likely to permit penetration testing.

A

SaaS, PaaS

134
Q

Often user authentication and authorization is delegated to the customer’s user management system using a ______ standard.

A

Federation

135
Q

____________________ refers to establishing/asserting the identity to the application.

A

Authentication

136
Q

The user determines the access for their resources, and the service provider acts as ____________

A

Policy Enforcement Point

137
Q

For unstructured files that must be protected when stored or shared in the cloud use data-centric encryption you should ___

A

Apply protection directly to files

138
Q

_____ can be avenues for data leakage.

A

Log files and metadata

139
Q

When choosing encryption, Use open, validated formats and avoid__________________ wherever possible.

A

Proprietary encryption formats

140
Q

As the industry expands identity systems from single computers into global enterprises and then into cloud deployment models, the ability to identify all the entities involved in a transaction become significantly more difficult. This is a _

A

Scaling problem

141
Q

_____ is the interconnection of disparate Directories Services.

A

Federation

142
Q

The PDP and PEP will be part of an authorization eco-system that uses

A

XACML

143
Q

In most cloud based systems, the Authorization layer is likely to be a _______ or the point that evaluates and issues authorization decisions, and the Access Management layer, the____, the point that enforces the___’s decision.

A

PDP, PEP, PDP

144
Q

Implementers should, where possible, use federation based on open standards such as _________

A

SAML and Oauth

145
Q

The primary concerns for enterprises and virtualization users should be ____

A

The proper management of configuration and operations

146
Q

Virtual machines may communicate with each other over _______, rather than a network.

A

A hardware backplane

147
Q

Installing security software designed for physical servers onto a virtualized server can result in _____

A

Degradation in performance

148
Q

When a VM is moved from one physical server to another, enterprises need assurances that no bits are left behind on the disk that could be recovered by another user or when the disk is de-provisioned. _______are solutions to this problem.

A

Zeroing or encryption

149
Q

Implement data automated discovery and labeling solutions to augment the data classification and control between virtual machines and environments. This is better know as:

A

DLP

150
Q

Security in the cloud environment is often based on the concern that_____ security controls implemented means systems are not locked down as well as they are in traditional data centers.

A

Lack of visibility into

151
Q

Security as a Service providers recognize the _____ of the relationship and often go to extreme lengths to ensure that their environment is locked down as much as possible.

A

Fragility

152
Q

_______ presents concerns of data leakage between virtual instances.

A

Multi-tenancy

153
Q

Companies that employ third party security service providers gain a competitive edge over their peers due to ____

A

Early access to information

154
Q

Due to the ______________ delivered via the cloud, customers need only pay for the amount of security they require.

A

Elastic model of services

155
Q

Isolation Failure is due to

A

Shared resources

156
Q

An attacker uses a public channel to use up the customer’s metered resources from the cloud, this is a(n)

A

EDOS

157
Q

Licensing conditions, such as _______ may become unworkable in a cloud environment.

A

Per-seat agreements, and online licensing checks

158
Q

The ability of the cloud provider to dynamically reallocate resources for filtering, traffic shaping, authentication, encryption, etc., to defend against:

A

DDOS

159
Q

The five key legal issues common across all scenarios according to ENISA are

A

Data protection, Confidentiality, Intellectual property, Professional negligence, Outsourcing services

160
Q

We do not recommend that the customer look to be able to restrict ________by the cloud provider.

A

The outsourcing of services

CCSK Combined (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions