Chapter 16 Managing Security Operations

Question 1

What policy creates a checks-and-balances system where two or more users verify each other’s actions and must work in concert to accomplish necessary work

Answer 1

separation of duties

Question 2

What policy grant specific processes only the privileges necessary to perform certain
functions,

Answer 2

Separation of privilege

Question 3

What policy applies to all public companies that have registered equity or debt securities with the Securities and Exchange Commission (SEC) ?

Answer 3

Sarbanes-Oxley Act of 2002 (SOX)

Question 4

The goal of Sarbanes-Oxley Act of 2002 (SOX) is :

a) Separation of privilege
b) Segregation of duties
c) Separation of duties

Answer 4

Segregation of Duties

Question 5

What is The need to know principle ?

Answer 5

The need to know principle imposes the requirement to grant users access only to data or
resources they need to perform assigned work tasks.

Question 6

What is aggregation ?

Answer 6

aggregation refers to the amount of privileges

that users collect over time.

Question 7

What is the goal of Segregation of duties ?

Answer 7

to ensure that individuals do not have

excessive system access that may result in a confl ict of interest.

Question 8

What policy states that personnel responsible for auditing, monitoring, and reviewing security do not have other operational duties related to what they are auditing, monitoring, and reviewing.

Answer 8

segregation of duties

Question 9

________ ensures that no single person

has sufficient privileges to compromise the security of the environment.

Answer 9

Split knowledge

Question 10

What does the control plane do ?

Answer 10

The control plane uses protocols to decide where to send traffic,

Question 11

What does the data plane do ?

Answer 11

data plane includes rules that decide whether traffi c will be forwarded.

Question 12

The _______ manages the VMs, virtual data storage, and virtual network components.

Answer 12

hypervisor

Question 13

On-demand access to computing resources available from almost anywhere is called what ?

Answer 13

Cloud computing

Question 14

What models provide fully functional applications typically accessible via a web browser ?

a) Platform as a Service (PaaS)
b) Infrastructure as a Service (IaaS)
c) Software as a Service (SaaS)

Answer 14

Software as a Service (SaaS)

Question 15

CSP provide consumers with hardware, an operating system, and applications.

a) Platform as a Service (PaaS)
b) Infrastructure as a Service (IaaS)
c) Software as a Service (SaaS)

Answer 15

Platform as a Service (PaaS)

Question 16

CSP provides servers, storage, and in some cases, networking resources. Consumers install operating systems and applications and perform all required maintenance on the operating systems and applications.

a) Platform as a Service (PaaS)
b) Infrastructure as a Service (IaaS)
c) Software as a Service (SaaS)

Answer 16

Infrastructure as a Service (IaaS)

Question 17

In what cloud service do consumers not manage or control any of the cloud-based assets ?

Answer 17

Software as a Service (SaaS)

Question 18

In what cloud service do consumers manage their applications and possibly some configuration settings on the host ?

Answer 18

Platform as a Service (PaaS)

Question 19

In what cloud service do consumers install operating systems and applications and perform all required maintenance on the operating systems and applications ?

Answer 19

Infrastructure as a Service (IaaS)

Question 20

Which cloud model provides cloud-based assets to two or more organizations ?

Answer 20

community cloud deployment model

Question 21

In which cloud model do organizations create and host private clouds using their own resources and is responsible for all maintenance ?

Answer 21

private cloud deployment model

Question 22

Which cloud model includes assets available for any consumers to rent or lease and is hosted by an external CSP ?

Answer 22

public cloud model

Question 23

What is the primary risks from USB flash drives ?

Answer 23

malware infections and data theft.

Question 24

What are the tasks within a change management process ?

Answer 24

1. Request the change.
2. Review the change.
3. Approve/reject the change.
4. Schedule and implement the change.
5. Document the change.