Chapter 3 Cloud Security Compliance & Configurations Flashcards
Which of the following regulatory requirements concerns a business’s nonfinancial reporting controls for the availability, confidentiality, privacy, processing, integrity, and security of a system?
A. SOC 1
B. SOC 2
C. SOC 3
D. ISO 27001
SOC 2
The Service Organization Controls 2 (SOC2) reports concerns of business’s nonfinancial reporting controls for the availability, confidentiality, privacy, processing integrity, and security of a system.
The SOC1 report outlines the internal controls of financial reporting operations.
The SOC 3 report is for the public disclosure of financial controls and security reporting.
ISO 27001 is the International Organization for Standardization (ISO) standards for quality that ensure the cloud provider meets all regulatory and statutory requirements for its product and service offerings
As a security administrator of an enterprise data center, you need to check the operating systems that are being used in the company. You find one of the operating systems originally loads with unneeded services such as printing, various networking services such as DHCP, and an FTP server enabled. These services might expose the operating system to potential malicious activity. What will you do to harden the operating system?
A. Remove the service that are not is use.
B. Disable the services that are not in use.
C. Install antivirus.
D. Implement host-based firewall security.
Disable the services that are not in use.
If an operating system originally loads with unneeded services such as printing, various networking services such a DHCP, and the web or FTP server enabled, they should be disabled so there is no longer any exposure for attacks on those entry points.
Removing the services is not an appropriate solution for the given scenario.
Antivirus software is an application that runs on a computer that can identify and remove viruses or malicious software from a system.
Implementing host-based firewall security would not solve the problem.
Jarleen is a consultant tasked with migrating Health Med Records Inc. customer to cloud-based service offering a long-term archival system. Which U.S. compliance mandate must her company align with?
A. SOC3
B. HIPAA
C. MPAA
D. ISA 2701
HIPAA
The Health Insurance Portability and Accountability Act defines the standards for protecting medical data.
The Service Organization Control 3 (SOC3) reports are for public disclosure of financial controls and security reporting.
The Motion Picture Society of America Act (MPAA) published a set of best practices for storing, processing, and delivering protected media and content securely over the Internet.
The Internal Security At (ISA 2701) allows for detention without trial or criminal charges under limited, legally defined circumstances.
Cathy is preparing her company’s migration plan from a private to a hybrid cloud. She wants to outline firewall and DDoS requirements. What document should she create?
A. DIACAP
B. Security policy
C. Service level agreement
D. SOC 2
Security Policy
The security policy outlines all aspect of your cloud security posture.
DIACAP (Department of Defense Information Assurance Certification and Accreditation Process) is the process for computer systems IT security.
The service level agreement is a document that outlines specific metrics and the minimum performance or availability level and outlines the penalties for failing to meet the metrics.
The SOC2 (Service Organization Controls 2) report concerns a business’s nonfinancial reporting controls for the availability, confidentiality, privacy, processing integrity, and a security of a system.
Allison is working on her company's new e-commerce rollout at a large public cloud provider. She wants to secure all web traffic between the client and her site when a user proceeds to checkout and places orders. What security protocol would she be implementing? ' A. MDS B. SSL/TLS C. IPSec D. VPN
SSL/TLS
SSL/TLS is commonly used in browsers and smartphone applications for secure web access.
MD5 is a hash algorithm therefore, it does not apply to the question.
IPSec is a security framework, therefore, it does not apply to the question.
VPNs are not as common as SSL/TLS for the scenario given.
You are a web server administrator of your company. You want to authenticate the end user for all the applications the user has been given rights to and eliminates further prompts when the user switches applications during the same session. Which approach of access control should you use?
A. Multifactor authentication
B. Single sign-on
C. Role-based access control
D. Mandatory access control
Single Sign-On (SS0)
You should use single sign-on (SSO), which is a session and user authentication service that permits a user to use one set of login credentials to access multiple applications. It authenticates the end user for all the application the user has been giver rights to and eliminates further prompts when the user switches applications during the same session. it is helpful for logging user activities as well as monitoring user accounts.
Multifactor authentication is an access control technique that requires several pieces of information to be granted access.
Role-based access control (RBAC) is a method in which access rights are granted to, or restricted from, users based on which roles they perform in an organization.
Mandatory access control (MAC) approach is often found in high-security environments where access to sensitive data needs to be tightly controlled
Which of the following low-level security methods do the cloud provider use on their storage area network and storage head-end controllers?
Each correct answer represents a complete solution. Choose two.
A. ACL
B. VSAN
C. PKI
D. LUN Masking
VSAN, LUN Masking
Virtual storage area network (VSAN) is implemented at the SAN level and LUN masking is configured on storage controllers, and they are low-level storage access methods.
Access control list (ACL) is a set of data (usernames, passwords, time and date, IP address, MAC address, and so on) used to control access to a resource, such as a device, file, or network.
Public Key Infrastructure (PKI) is a standardized set of roles, policies, and procedures used to create, manage, distribute, use, store, and revoke digital certificates and manage public/private key encryption.
Harry is the cloud administrator for a company that stores object-based data in a public cloud. Because of regulatory restrictions on user access to sensitive security data, what type of access control would you suggest he implement to meet his company’s security policies?
A. Discretionary
B. Mandatory
C. RBAC
D. Nondiscretionary
Mandatory
The mandatory access control approach is often found in high-security environments where access to sensitive data needs to be highly controlled. Using the mandatory access control approach, a user will authenticate, or log into, a system. Based on the user’s identity and security levels of the individual, access rights will be determined by comparing that data against the security properties of the system being accessed.
Discretionary access control is different from mandatory access control by giving users the ability to grant or assign rights to objects and make decisions for themselves as compared to the centrally controlled method used by mandatory access controls.
Role-based access control (RBAC) is a method in which access rights are granted to, or restricted from, users based on which roles they perform in an organization.
Nondiscretionary access control defines a set of rules to allow or deny access to an object, system, or service in the cloud.
Brad has been tasked with encrypting data in flight into his e-commerce presence in a community cloud. He is investigating a standards-based secure solution that web customers can easily implement to ensure secure transactions. What is a good solution that you would recommend to Brad?
A. ARP
B. 3DES
C. SSL
D. IPSec
SSL
Secure Sockets Layer (SSL) makes up a protocol group that operates on top of TCP to provide an encrypted session between the client and the server. It is commonly seen on websites implemented as the Hypertext Transport Protocol Secure (HTTPS) protocol.
Address Resolution Protocol (ARP) is a communication protocol that performs the translation between IP and MAC addresses.
Triple-Data Encryption Standard (3DES) is a symmetric encryption algorithm that encrypts data by processing each block of data three times using a different key each time.
Internet Protocol Security (IPSec) is a protocol used to protect data flow between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.
What is the National Institute of Standards & Technology publication that coordinates the requirements and standards for cryptography modules?
A. FISMA
B. FedRAMP
C. FIPS 140-2
D. PCI-DSS
FIPS140-2
FIPS140-2 is a National Institute of Standards & Technology (NIST) publication that coordinates the requirements and standards for cryptography modules. Cryptographic systems can be either hardware or software created in the public sector and are registered in FIPS-140-2 as approved for US government use.
The Federal Information Security Management Act (FISMA) outlines the framework to protect federal government information, operations, and facilities.
The Federal Risk and Authorization Management Program (FedRAMP) outlines the standards for security assessments, authorization, and continuous monitoring for cloud products and services.
The Payment Card Industry Data Security Standard (PCI-DSS) sets the requirements to guarantee that companies that process, store, or transmit credit card information offer secure processing and handling of credit card data.
What is a report for the public disclosure of financial controls and security reporting that does not contain sensitive and technical information called?
A. SOC 1
B. SOC 2
C. SOC 3
D. FISMA
SOC 3
The SOC 3 report is for the public disclosure of financial controls and security reporting. Since the SOC 2 report can contain sensitive and technical information, the SOC 3 report was created to offer a diluted, marketing-oriented, or nontechnical summary of the SOC 2 report.
The SOC 1 report outlines the internal controls of financial reporting operations.
The SOC 2 report concerns a business’s nonfinancial reporting controls for the availability, confidentiality, privacy, processing integrity, and security of a system.
The Federal Information Security Management Act (FISMA) outlines the framework to protect federal government information, operation and facilities.
To secure data center interconnect between your company’s Sydney and Berlin regions, you are being asked what a common solution is that allows interoperability between the various vendor’s firewalls and routers in each region. What is a good solution for securing interconnects over the Internet between dissimilar hardware and software security devices?
A. AES
B. SOC 3
C. IPSec
D. RC5
IPSec
IPSec implementation are found in routers and firewalls with VPN services to provide a secure connection over an insecure network such as the Internet and are standards based to allow for interoperability.
AES is the Advanced Encryption Standard which is a symmetrical block cipher that has options to use three lengths, including 128, 192, and 256 bits.
SOC 3 (Service Organization Controls 3) reports are for public disclosure of financial controls and security reporting.
RC5 (Rivest Cipher 5) is the replacement for RC 4. It is also a symmetrical block cipher algorithm that uses a variable-length key.
Which US federal government policy and standard would you focus on to help secure information systems (computers and networks)?
A. FedRAMP
B. RMF
C. FISMA
D. Section 405.13 for DoD rule A286
RMF
The Risk Management Framework (RMF) is a US federal government policy and standards to help secure information systems (computers and networks) developed by National Institute of Standards & Technology (NIST).
The Federal Risk & Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.
Federal Information Security Management Act (FISMA) is a US federal law that outlines the framework to protect federal government information, operations, and facilities.
Department of Defense (DoD) rule outsources commercial interconnections to the DoD and other systems.
James has allowed access to a development server for certain hours of the day, granting another user complete control over a server fleet or storage system for administrative purposes. What type of access control is this?
A. Discretionary Access Control
B. Nondiscretionary Access Control
C. Mandatory Access Control
D. Role-Based Access Control
Nondiscretionary Access Control
The given scenario is an example of nondiscretionary access. Nondiscretionary access control defines a set of rules to allow or deny access to an object, system, or service in the cloud. It is a method of access control that allows the objects to be accessed based on rules, privileges, and roles that define access.
Discretionary access controls differ from mandatory access controls by giving users the ability to grant or assign rights to objects and make decisions for themselves as compared to the centrally controlled method used by the mandatory access controls.
The mandatory access control (MAC) approach is often found in high security environments where access to sensitive data needs to be tightly controlled.
The role-based access control (RBAC) is a method in which access rights are granted to or restricted from users based on which roles they perform in an organization.
Fluentes is a security consultant for a day trading company that must implement strong encryption of data at rest for their storage tiers. What is the best option that meets most security regulations for the encryption of stored data?
A. 3DES
B. RSA
C. AES-256
D. Rivest Cipher 5
AES-256
Advanced Encryption Standard is a symmetrical block cipher that has option to use three lengths, including 128, 192, and 256 bits. AES-256 is a very secure standard, and it would take an extremely long time and a lot of processing power to even come close to breaking the code.
3DES is a symmetric-key block cipher, which applies the DES cipher algorithm three times to each data block.
RSA is an asymmetrical encryption implementation that uses private key an a public key.
Rivest Cipher 5 is the replacement for RC4. It is also a symmetrical block cipher algorithm that uses a variable-length key.
