Chapter 02: System and Network Architecture

Question 1

Serverless Computing

Answer 1

In a broad sense, this is cloud computing, but it also refers to FaaS (function as a service)

FaaS
* A cloud service model that supports severless software architecture by provisioning runtime containers in which code is executed in a particular programming language

Serverless computing relies on a system that executes functions as they’re called—when an action needs to be performed, the function is run (a functional call)

EX: AWS Lambda, Google’s App Engine, Azure

The same types of security controls used for software dev and cloud computing environments (access controls and rigts) need to be applied to the FaaS environment

Monitoring and resource management are also necessary for secure deployment

Advantages include:
* Reduced costs (billed as-is vs constantly running)
* Reduced server maintenance and management overhead
* Eliminates the need to manage physical or virtual servers
* No patching, admininistration, or file system monitoring

Security concerns:
* Ensure that the clients accessing the services haven’t been compromised
* The devs are the big ones here, not the end-users at home
* Focused on the code to make sure it’s secure more than anything

NOTE: Severless depends on orchestration

Cloud Deployment Models
Public Cloud
* A service provider makes resources available to the end users over the internet
* Deployed for shared use by multiple independent tenants
* Public clouds provide solid redundancy and availability
* Only have logical access
* EX: AWS is a public cloud

Private Cloud
* Where an org creates its own cloud environment that only it can utilize as an internal enterprise resource
* Can be hosted internally or externally
* You own it, have access to it, and can touch it physically and logically
* Private should be your choice when security is more important than cost
* EX: AWS GovCloud (US)—servers purchased just for the government

Community Cloud
* Uses shared resources and costs among different orgs that have common service needs
* Deployed for shared use by cooperating tenants
* These are secure when the orgs involved have strong interoperability agreements (I want level 10 security, but you want level 2—we need a baseline everyone can work with)

Hybrid Cloud
* Combines public, private, and community clouds as well as on-prem infrastructure to meet an org’s needs
* Challenges of Hybrid: Greater complexity, absence of data redundancy, demonstrating compliance, security management

Multicloud
* Cloud consumer uses multiple public cloud services
* EX: Using Google Cloud, AWS, and Azure

Question 2

Virtualization

Answer 2

The use of software to run virtual computers on underlying real hardware

You can run multiple systems, each running multiple OS, all of which act as if they’re on their own hardware

This provides additional control of resource usage and what hardware is presented to the guest OS

Allows for efficient use of the underlying hardware because you can leverage shared resoruces

Question 3

VDI

Answer 3

Virtual Desktop Infrastructure

Virtualization is used to implement VDI, which runs desktop OS on central hardware, and then streams the desktops across the network to systems

The security challenge is in determining how to monitor, secure, and respond to issues in a virtual environment

Dion’s Notes
* A virtualization implementation that separates the personal computing environment from a user’s physical computer

Question 4

Container Security

Answer 4

Containerization platforms share many security considerations with virtualization platforms

They must enforce isolation between containers to prevent operational and security issues that might occur if an app running in one container is able to accidentally or intentionally interact with resoruces assigned to another container

Traditional host-based security may work for the underlying containerization server, but the containers themselves must be addressed differently

Since many containers run on the same server, threats to the host OS can impact containerized services

Tools exist to sign container images, and monitor and patch containers

Traditional hardening, application and service monitoring, and auditing tools can be useful as well

NOTE: When addressing containerized systems, think about the shared underlying host as well as the rapid deployment models typically used with containers

Security must be baked into the service and software development life cycle as well as the systeam maintenance and management process

Page 39 + 40 for in depth

Question 4

Containerization

Answer 4

An alternative to virtualizing an entire system whereby apps are permitted to run in their own environment with their own required components (libraries, confg files, dependancies) in a dedicated container

EX: Kubernetes and Docker

Containers provide app-level virtualization

Instead of creating complex virtual machines that require their own OS, containers package apps and allow them to be treated as units of virtualization that become portable across OS and hardware platforms

Question 4

Common System Hardening Practices

Answer 4

System hardening is the process where a host or other device is made more secure through the reduction off that device’s attack surface area

• Updating and patching the system
• Removing unnecessary software and services
• Restricting and logging admin access
• Controlling the creation of new accounts
• Enabling logging and using appropriate monitoring
• Using capabilities like disk encryption and secure boot

The CIS provides a full range of hardening guides and config benchmarks for common OS: https://www.cisecurity.org/benchmark

Dion’s 10 Hardening Best Practices Checklist
1. Remove or disable devices that aren’t needed or used
2. Install OS, application, firmware, and driver patches regularly
3. Uninstall all unnecessary network protocols—only have ports open for things you need
4. Uninstall or disable all unnecessary services and shared folders
5. Enforce ACLs on all system resources
6. Restrict user accounts to the least privilege needed
7. Secure the local admin or root account by renaming it and changing password
8. Disable unnecessary default user and group accounts
9. Verify permissions on system accounts and groups
10. Install antimalware software and update the definitions regularly

Question 4

5 Main Root Keys in the Registry

Answer 4

1. HKEY_CLASSES_ROOT (HKCR): COM object registration information, associates files type with programs
2. HKEY_LOCAL_MACHINE (HKLM): System information, including scheduled tasks and services
3. HKEY_USERS (HKU): Information about user accounts
4. HKEY_CURRENT_USER (HKCU): Information about the currently logged-in user
5. HKEY_CURRENT_CONFIG (HKCC): Current local hardware profile information storage

Each root key listed here has Registry hives, which are groups of keys and values that are connected with the root keys

Each key can have values including:
* Strings
* Binary data
* Numeric data
* Links to other Registry keys
* Windows-specific component data

Question 5

The Windows Registry

Answer 5

This is a database that contains OS settings

Programs, services, drivers, and the OS itself rely on info stored in the Registry, which makes it a ctirical resource

It also makes it a frequent target for attackers because it’s useful for persistence

Question 5

Configuration Files

Answer 5

Know where both Linux and Windows commonly store these critical config files

• Windows: Often sotred in the Registry, but additional config info might be in C:\ProgramData C:\Program Files
• Linux: Commonly stored in the /etc directory, but may be stored in other locations depending on service or program
• MacOS: The exam doesn’t focus on Mac, but they’re stored in ~/Library/Preferences

Question 5

System Processes

Answer 5

The core processes for an OS

Some vary from OS to OS, but they tend to share similar functions

• Windows: The core system process is the NT kernel, which is found in C:\Windows\System32\notskrnl.exe and always has a PID of 4

Other Windows processes include:
* The Registry process
* Memory compression
* Session manager subsystem (smss.exe)
* Windows subsystem process (crss.exe)
* Services control manager (services.exe)
* Windows logon process (winlogon.exe)
* Windows initialization process (wininit.exe)

NOTE: Focus on understanding the basic concept of system processes for the exam:
* They’re critical parts of the OS
* Attackers often name proceses to look similar to legit processes in an attempt to conceal malware
* Attackers target them to gain privileged access to the OS

Question 6

Hardware Architecture Security

Answer 6

The underlying hardware architecture of the systems that OS and software run on can have an impact on security operations in many ways

One of the most common impacts is that malware may not run on some hardware at all

While most computers run on x86 instruction set CPUs from AMD and Intel, there are an increasing number of computers and devices that that use Advanced RISC Machine (ARM) or other CPUs that don’t implement the x86 instruction set

This means that software that is not compiled and intended for other architectures is unlike to work with them

• EX: Apple M1 and M2 chips are non-x86, ARM-based architecture

Using an alternate hardware architecture isn’t a guarantee for security since attackers build malware to attack multiple hardware architectures

Still, always know what hardware architecture systems you’re responsible for defending

Question 7

x86 Instruction Set

Answer 7

The x86 instruction set refers to the set of instructions that x86-compatible microprocessors support, which are usually part of an executable program, often stored as a computer file and executed on the processor

Question 8

Importance of Time Synchronization for Logging

Answer 8

Time sync between systems is critical to log analysis

That’s because events and incidents often result in logs in multiple locatios or from multiple servers or services needing to be correlated

If time isn’t properly and accurately synced, events won’t appear in the correct order or at the right times

Question 9

NTP

Answer 9

Network Time Protocol (Port 123) and NTP servers allow for easy time syncrhonization

As part of your regular reviews of systems and services, you must always ensure that time sync is happening, and that it’s correct

Windows and Linux both have their own NTP guides that should be known for the job

Question 10

Logging Levels

Answer 10

Network device log files often have log levels associated with them

More or less, they tend to map to Cisco’s log levels:
* 0: Emergencies / Device shutdown due to failure
* 1: Alerts / Temperature limit exceeded
* 2: Critical / Software failure
* 3: Errors / Interface down message
* 4: Warning / Configuration change
* 5: Notifications / Line protocal up/down
* 6: Information / ACL violation
* 7: Debugging / Debugging messages

Understand log levels and what setting a log level can mean for data capture

If you set a logging level that doesn’t catpure the data you need, you can miss important information

If you set overly detailed log levels, like level 7, it’ll provide an overwhelming flood of detail that isn’t useful

Question 11

General Logging Considerations

Answer 11

• Logs should contain enough information to be useful and should be able to be interpreted in useful ways, and so must contain both meaning and context
• Logs should be protected so they can’t be changed
• Logs should be sent to a central location where they can be stored, analyzed, and reported on
• Logs should be validated to ensure they contain the information that would be needed in the event of an issue or incident
• Logs should be checked as part of normal system monitoring to ensure that systems that should send logs are doing so
• Unnecessary log information should be avoided to conserve space and resources
• Log retention policies and practices should be implemented as appropriate for the org and systems

Question 12

On-Premises Network Architecture

Answer 12

The routers, switches, security devices, cabling, and all other network components that make up a traditional network

Common elements of a security design linclude:
* Firewalls that control traffic flow between networks or systems

• IPS and IDS
• Content filtering and caching devices that contorl what info passes through protected devices
• NAC technology that controls which devices are able to connect to the network, assess the security state of devices, or require other information before allowing a connection
• Network scanners that can identify systems and gather information about them, includig the services they’re running, patch levels, and other details
• UTM devices that combine a number of these services like firewalls, IDS, IPS, content filters, etc

Question 13

Cloud Network Architecture

Answer 13

Unlike on-premises, cloud architectures aren’t always available for security pros to configure, test, or control

This demands a different approach for securing cloud services

Security for SaaS and PaaS is usually handled through contractual obligations

IaaS providers like AWS, Azure, Google, etc provide more access to infrastructure, so some traditional security concerns around OS config, management, and patching applies

You can take additional action to ensure your org’s security by accessing third-party security audit information like an SSAE-16 Type 1 or Type 2 report

You can also conduct a security assessment to determing whether the vendor meets your own security best practices

Shared risk assessment tools from Shared Assessments .org can help conduct an assessment before engaging with a cloud or outsourced IT vendor

Always ensure your contracts cover any legal or reulatory issues that could impact your outsourcing solutions

SaaS
* Provides all the hardware, OS, software, and apps needed for a complete app service to be delivered
* Consumer is responsible for app security, account provisioning, and authorizations

IaaS
* Provides all the hardware, OS, and backend software needed in order to develop software or services
* Consumer is responsible for security of platforms and apps
* CSP are responsible for CIA of the hardware in the resource pool

PaaS
* Provides the org with the hardware and software needed for a specific service to operate
* CSP are responsible for giving you everything except app and data
* All the consumer needs to do is code the application and bring their data
* Always consider access control, load balancing, failover, privacy, and protection of data
* Always encrypt data stored in a third party PaaS solution

Question 14

Hybrid Network Architecture

Answer 14

Combines on-premises and cloud infrastructure and systems

This can introduce complexities as each distinct environment must be secured and have a security model that’s appropriate to the entire infrastructure

These are common architectures as orgs migrate from on-premises to cloud

Question 15

Physical Segmentation

Answer 15

Running separate physical infrastructure or networks

System isolation is handled by ensuring that the infrastruce is physically separated, but it can also mean air gapping systems to ensure zero connection between infrastructure

NOTE: An air gap is only as effective as the enforcement and monitoring of what bypasses it (Stuxnet)

Question 16

Virtual Segmentation

Answer 16

Using virtualization capabilities to separate functions to virtual machines or containers

Some implementations of segmentation for virtualization also run on separate physical servers in addition to running seaprate virtual machines

Question 17

Network Segmentation

Answer 17

AKA compartmentalization

A common element of network design that providees a number of advantages:

• The number of systems that are exposed to attackers (attack surface) can be reduced by compartmentalizing systems and networks
• It can help limit the scope of regulatory compliance efforts by placing the systems, data, or unit that must be compliant in a more easily maintained environment separate from the rest of the org
• It can help increase availability by limiting the impact of an issue or attack
• It can increase network efficiency—larger numbers of systems in a single network can lead to congestion, which makes segmentation attractive as networks scale

Question 18

How to Segment Networks

Answer 18

A firewall with a carefully designed ruleset is typically used between network segments with different levels of trust or functional requirements

Network segmentation also relies on routers and switches that support VLAN tagging

Sometimes, where nuanced controls aren’t necessary, it’s done using only routers or switches

Question 19

How to Access Segmented Networks

Answer 19

Jump servers: System that resides in its own segmented environment, heavily monitored and highly secure

VPN: Provides remote access as well as access into segmented networks from different security zones

Question 20

SDN

Answer 20

Software Defined Networking

Using SDN, you can make networks programmable and control networks centrally, which allows management of network resources and traffic with more intelligence than a traditional physical network infrastructure

SDNs provide information and control through APIs like OpenFlow, which means monitoring and management can be done across disparate hardware and software vendors

Three Planes to Consider When Securing SDN
Control Plane
* Makes decisions about how traffic should be prioritized and secured, and where it should be switched
* How traffic is moving across the network

Data Plane
* Handles the actual switching and routing of traffic and imposition of ACLs for security
* Moving the data around the network

Management Plane
* Monitors traffic conditions and network status
* Configuration and administration of the network and its devices

If you’re using SDN, you’re going to be able to do automatic deployment and disaster recovery, which is great for gathering security data because everything is software code
* It can be challenging for humans to see and understand everything going on in a SDN because it’s rapidly changing all the time
* Also challenging to identify potential rogue devices because new machines are virtual and inserted as new pieces of code

Question 21

SDN-WAN

Answer 21

Sofware Defined Network Wide Area Networks

SDN-driven service models where providers use SDN tech to provide network services

They allow blended infrastructures that may combine a variety of technologies behind the scenes to deliver network connectivity to customrs

SDN-WAN implementations often provide encryption, but introduce risks like:
* Vulenrabilities of the SDN orchestration platform
* Risks related to multivendor network paths and control
* Availabilty and integrity risks as traffic flows through multiple paths

Question 22

Zero Trust

Answer 22

Each action requested and allowed must be verified and validated before it’s allowed to occur

Zero trust moves away from the strong permiter as the primary security layer and goes further toward a deeply layered security model where individual devices, apps, and user accounts are part of the design

Implementation requires a blend of tech, processes, and policies to manage, monitor, assess, and maintain a complex environment

Question 23

SASE

Answer 23

Secure Access Secure Edge

Network architecture that leverages software defined WAN and security functionality like CASB, zero trust, firewalls as a service, antimalware tools, and other capabilities to secure your network

The concept focuses on ensuring securty at the endpoint and network layer, presuming that orgs are decentralized and that datacenter-focused security models are less useful in current orgs

Dion’s Notes
* Uses SDN to provide security and networking services from the cloud, rather than from traditional hardware based appliances
* SASE provides a more secure and efficient way of connecting users and their devices to the apps they want to use, regardless of the location or the device type

Question 24

IAM

Answer 24

Identity and Access Management

Security process that provides identification, authentication, and authorization mechanisms for users and computers

Every unique subject in the organization is identified and associated with an account, and unique subjects can be:
* Personnel
* Endpoints
* Servers
* Software
* Roles

NOTE: Each unique subject has its own IAM credentials

IAM systems contain technical components like directory serrvices and repositories, access management tools, and systems that audit and report on ID management capabilities

Things That Happen as Part of the IAM System
* Creating and deprovisioning accounts
* Managing accounts
* Auditing accounts
* Evaluating identity-based threats
* Maintaining compliance

IAM Risks Revolve Around Accounts
* User accounts
* Privileged accounts
* Shared accounts

Page 53 full description

Question 25

MFA

Answer 25

Multifactor Authentication

One of the most important security measures put in place to authenticate users

MFA relies on two distinct authentication factors like a password, token, smartcard, biometric factor, or location

These two factors need to be from different areas (something you are, know, etc) to be effective

Question 26

Types of MFA

Answer 26

• Knowledge factors (something you know)
• Possession factors (something you have)
• Biometric factors (something you are)
• Location factors (somewhere you are)
• Something you can do
• Something you exhibit
• Someone you know

Question 27

Passwordless Authentication

Answer 27

Alows user to log in without a password

In most implementations, this means that users enter a username or user ID, then a USB token / authenticator app / or other device

Unlike MFA, passwordless typically only relies on a single factor that’s designed to be more secure

Question 28

SSO

Answer 28

Single Sign On

Allows users to authenticate once and then use multiple systems or services without having to use different usernames or passwords

Security benefits:
* The potential to reduce the occurrence of password reuse
* Can reduce the likelihood of crednetial exposure via third-party sites when users do reuse credential sets
* Cost savings from fewer password resets and support calls

Security risks:
* If attackers get credentials, easier to access multiple systems
* Easier for attackers to exploit additional systems once they control a user’s browser or system since they’re not required to log in again

DEFENSE: Require reauthentication and the use of 2FA for critical systems

SSO vs Federation
* SSO uses a cryptographic hash of credentials that’s passed between two systems
* In federation, the sign on is provided as a service by the identity provider

Question 29

Shared Authentication Schemes

Answer 29

Similar to SSO, and allow an identity to be reused on multiple sites while relying on authentication via a single identity provider

Shared authentication systems require users to enter credentials when authenticating to each site, unlike SSO

Security benefits:
* Allow users to use their credntials without having to create new accounts on each site, reduces password fatigue
* Users are informed about the types of data that will be released to the relaying party

Question 30

Federation

Answer 30

The process of linking an identity and its related attributes between multiple identity management systems

EX: Use your MS, Google, FB, LI account to access sites not hosted by those service providers

Each site allows use of their credentials as well as a set of attributes by third party sites

SSO vs Federation
* SSO uses a cryptographic hash of credentials that’s passed between two systems
* In federation, the sign on is provided as a service by the identity provider

Question 31

Federated Identity Security Considerations

Answer 31

Federated identities move trust boundaries outside of your own orgnization, which brings new concerns when designing, implementing, or using federated identity

You need to look at federated security from three points of view:

IDP (identity provider)
* Must provide identities, make assertions about those identities to relying parties, and release information to relying parties about identity holders
* The identities and related data must be kept secure
* Identities and attributes have to be validated to a level that fits the needs of the federation, and may have user-level controls applied
* Service providers may be responsible for providing IR coordination for the federation, comms between federation members, etc due to their role in the federation

RP (relying party) or SP (service provider)
* Must provide services to members of the federation
* Should handle the data from both users and identity providers securely

Consumer
* May be asked to make decisions about attribute release and to provide validation information about their identity claims to the IDP

NOTE: If you’re part of a federation, consider how much you trust the organizational security practices and policies of the other federation members. That should drive the rights and access that you provide to holders of federated identities, as well as how you monitor their actions.”

Question 32

Federated Identity Design Choices

Answer 32

The first question to ask: what trust model do you want to use wit the federated identity provider?

Comon providers include Google, LinkedIn, and Amazon, but there are countless commercial and private federations including those operated by governments and higher ed

Page 59 + 60 full description READ IT

Question 33

Federated Identity Technologies

Answer 33

There are 4 major technologies that serve as the core of federated identity for current federations:

1. SAML (Security Assertion Markup Language)
2. AD FS (Active Directory Federation Services)
3. OAuth
4. OpenID Connect

All 4 technologies here provide ways for identity providers to integrate with service providers in a secure manner without having to know details about how the service provider implements their service or their own use of the identity

Page 61 table compares all 4

Question 34

SAML

Answer 34

Secure Assertion Markup Language
An XML-based langauge used to send authentication and authorization data betwen identity providers and service providers

Frequently used to enable SSO for web apps and services, because it allows identity providers to make assertions about principals to service providers, so they can make decisions about a user

• Authorization: Yes
• Authentication: Yes
• Potential Security Risks: Protocol usage and processing risks, DoS
• Common Uses: Enteprise authentication and authorization, particularly in Linux-centric environments

Page 62 diagram

Question 35

OpenID Connect

Answer 35

Paired with OAuth to provide authentication

It allows the authorization server to issue an ID token in addition to the authorization token provided by OAuth

This allows services to know that the action was authorized and that the user authenticated with the identity provider

• Authorization: No
• Authentication: Yes
• Potential Security Risks: Redirect manipulation, message confidentiality, replay attacks, CSRF/XSS, phishing
• Common Uses: Authentication

Question 36

OAuth2

Answer 36

The OAuth 2.0 protocol provides an authorization framework designed to allow third-party apps to access HTTP-based services

Developed by the IETF (Internet Engineering Task Force) and supports web clients, desktops, mobile devices, and a broad range of embedded and mobile tech as well as service providers that they connect to

OAuth flows recognize four parties:
* Clients: The apps that users want to use
* Resource Owners: The end users
* Resource Servers: Servers provided by a service that the resource owner wants the app to use
* Authorization Servers: Servers ownec by the identity provider

Rundown:

• Authorization: Yes
• Authentication: Partial
• Potential Security Risks: Redirect manipulation, message confidentiality, authorization or resource server impersonation
• Common Uses: API and service authorization

Page 64 diagram

Question 37

AD FS

Answer 37

Active Directory Federation Services

The Microsoft answer to federation, AD FS provides authentication and identity information as claims to third-party partner sites

Partner sites use trust policies to match claims to claims support by a service, and then it uses those claims to make authorization decisions

• Authorization: Yes
• Authentication: Yes
• Potential Security Risks: Token attacks (replay, capture)
• Common Uses: Enterprise authentication and authorization, particularly in Windows-centric environments

Page 63 process flow

Question 38

PAM

Answer 38

Privileged Access Management

The tech and practices used to manage and secure privileged accounts, access, and permissions for systems, users, and apps through an organization

PAM relies on the principle of least privilege

Privileged accounts aren’t just root, admin, or other superuser accounts, they’re also:

• Service accounts
• App accounts
• Local and domain admin accounts
• Helpdesk accounts used to addrss password changes or other privileged tasks
• Emergency access “break glass” accounts

PAM addresses many issues like:

• Overprovisioning of privileges
• Livecycle management and prevention of privilege creep
• The use of embedded or hard-coded credentials

Question 39

CASB

Answer 39

Cloud Access Security Broker

A cloud security tool that serves as a policy enforcement point, existing either locally or in the cloud

CASBs are used to enforce secuirty policies when cloud resources and services are used

They can help with:
* Data security
* Antimalware functionality
* Service usage and access visibility
* Risk management

Dion’s Notes
Enterprise management software designed to mediate access to cloud services by users across all types of devices
* They provide visibility into how clients and other network nodes use cloud services

Benefits of CASB
* SSO
* Malware and rogue device detection
* Monitor/audit user activity
* Mitigate data exfiltration

CASB Forward Proxy
* A security appliance or host positioned at the client network edge that forwards user traffic to the cloud network if the contents of that traffic comply with policy
* Users can evade the proxy by connecting directly to sites

CASB Reverse Proxy
* An appliance positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with policy
* This can only be used if the cloud app has proxy support

CASB API
* A method that uses the broker’s connections between the cloud server and cloud consumer
* It’s dependent on the API supporting the functions that your policies demand

Question 40

Best Practices to Secure Network Appliances

Answer 40

1. Use ACLs to restrict access to designated host devices: Have a limited number of laptops and desktops that have the ability to go into management areas, like if you’re allowing SSH access
2. Monitor the number of designated interfaces: Are you going to allow anyone to connect over any port, or will you allow only 5 ports with connections to them
3. Deny internet acccess for remote management: If you need a tech to work on devices remotely, they should connect over VPN first, then into management LAN, and then get in that way

Question 41

Suspicious Processes and What To Do With Them

Answer 41

Anything that’s suspicious doesn’t inherently mean bad, it just means you should look into it further:

1. Any process name that you don’t recognize
2. Any process name that’s similar to a legitimate system process
3. Processes that appear without an icon, version information, description, or company name
4. Processes that are unsigned, especailly if from a well known company like Microsoft
5. Any process whose digital signature doesn’t match the identified publisher
6. Any process that doesn’t have a parent-child relationship with a principal Windows process
7. Any process hosted by Windows utilities like Explorer, Notepad, Task Manager, etc
8. Any process that’s packed or compressed

When you find one of these suspicious processes:
1. Identify how the process interacts with the Registry and file system
2. Find how the process is launched (did the user, a service, or scheduled task do it?)
3. Find if the image file located in the system folder or the temp folder
4. Find what files are being maniuplated by the process
5. See if the process restores itself upon reboot after deletion
6. See if a system privilege or service gets blocked if you delete the process
7. See if the process is interacting with the network

Question 42

VPC

Answer 42

Virtual Private Cloud (A Type Of IaaS)
* A private network segment made available to a single cloud consumer within a public cloud
* When using VPC, the consumer is responsible for configuring the IP space and routing within the cloud
* Doesn’t have same security as a fully private cloud, but less expensive and you’re still getting decent security
* VPC is typically used to provision internet-accessible apps that need to be accessed from geographically remote sites

Question 43

Cloud Deployment Models

Answer 43

Public Cloud
* A service provider makes resources available to the end users over the internet
* Deployed for shared use by multiple independent tenants
* Public clouds provide solid redundancy and availability
* Only have logical access
* EX: AWS is a public cloud

Private Cloud
* Where an org creates its own cloud environment that only it can utilize as an internal enterprise resource
* Can be hosted internally or externally
* You own it, have access to it, and can touch it physically and logically
* Private should be your choice when security is more important than cost
* EX: AWS GovCloud (US)—servers purchased just for the government

Community Cloud
* Uses shared resources and costs among different orgs that have common service needs
* Deployed for shared use by cooperating tenants
* These are secure when the orgs involved have strong interoperability agreements (I want level 10 security, but you want level 2—we need a baseline everyone can work with)

Hybrid Cloud
* Combines public, private, and community clouds as well as on-prem infrastructure to meet an org’s needs
* Challenges of Hybrid: Greater complexity, absence of data redundancy, demonstrating compliance, security management

Multicloud
* Cloud consumer uses multiple public cloud services
* EX: Using Google Cloud, AWS, and Azure