Chapter 3 Domain 3: Cloud Platform and Infrastructure Security (Ben Malisow) Flashcards

Question 1

Q

You are in charge of creating the business continuity and disaster recovery (BC/DR) plan and procedures for your organization. Your organization has its production environment hosted in a cloud environment. You are considering using cloud backup services for your BC/DR purposes as well. What would probably be the best strategy for this approach, in terms of redundancy and resiliency?

A. Have your cloud provider also provide BC/DR backup.
B. Keep a BC/DR backup on the premises of your corporate headquarters.
C. Use another cloud provider for the BC/DR backup.
D. Move your production environment back into your corporate premises, and use your cloud provider to host your BC/DR backup.

Answer

A

C. Use another cloud provider for the BC/DR backup.

Explanation:
C. It’s best to have your backup at another cloud provider in case whatever causes an interruption in service occurs throughout your primary provider’s environment; this will be more complicated and expensive, but it provides the best redundancy and resiliency. Using the same provider for production and backup is not a bad option, but it entails the risk of the same contingency affecting both copies of your data. Having either the backup or the production environment localized does not provide the best protection, so neither option B nor option D is desirable.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 246). Wiley. Kindle Edition.

Question 2

Q

You are in charge of creating the business continuity and disaster recovery (BC/DR) plan and procedures for your organization. You decide to have a tabletop test of the BC/DR activity. Which of the following will offer the best value during the test?

A. Have all participants conduct their individual activities via remote meeting technology.
B. Task a moderator well versed in BC/DR actions to supervise and present scenarios to the participants, including randomized special events.
C. Provide copies of the BC/DR policy to all participants.
D. Allow all users in your organization to participate.

Answer

A

B. Task a moderator well versed in BC/DR actions to supervise and present scenarios to the participants, including randomized special events.

Explanation:
A trained and experienced moderator can guide the participants through the activity, enhancing their training and noting pitfalls and areas for improvement. Option A is not preferable because having the participants gathered together ensures their full attention and provides interaction that remote participation might not yield. Option C is a baseline; all participants should have copies of the policy as a matter of course. Option D is not useful in a tabletop exercise; only critical participants in the organization should take part in the tabletop.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 246). Wiley. Kindle Edition.

Question 3

Q

You are in charge of creating the business continuity and disaster recovery (BC/DR) plan and procedures for your organization. Your organization has its production environment hosted by a cloud provider, and you have appropriate protections in place. Which of the following is a significant consideration for your BC/DR backup?

A. Enough personnel at the BC/DR recovery site to ensure proper operations
B. Good cryptographic key management
C. Access to the servers where the BC/DR backup is stored
D. Forensic analysis capabilities

Answer

A

B. Good cryptographic key management

Explanation:
This is a difficult question that requires a great deal of thought. Option B is correct because appropriate cloud data security practices will require encrypting a great deal of the data, and having the keys will be necessary during contingency operations in order to access the backup; without the keys, you won’t be able to access your data. Option A is not correct because using the cloud for BC/DR will allow personnel to access the backup from anywhere they can get broadband connectivity, not specifically a recovery site. Option C is not correct because the customer will rarely have physical access to servers in the cloud environment. Option D is not correct because forensic analysis is not a significant consideration in BC/DR; it is much more important for incident response.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 246). Wiley. Kindle Edition.

Question 4

Q

You are in charge of creating the business continuity and disaster recovery (BC/DR) plan and procedures for your organization. You are going to conduct a full test of the BC/DR plan.
Which of the following strategies is an optimum technique to avoid major issues?

A. Have another full backup of the production environment stored prior to the test.
B. Assign all personnel tasks to perform during the test.
C. Have the cloud provider implement a simulated disaster at a random moment in order to maximize realistic testing.
D. Have your regulators present at the test so they can monitor performance.

Answer

A

A. Have another full backup of the production environment stored prior to the test.

Explanation:
A full test will involve both the production environment and the backup data; it is possible to create an actual disaster during a full test by ruining the availability of both. Therefore, it is crucial to have a full backup, distinct from the BC/DR backup, in order to roll back from the test in case something goes horribly wrong. Option B is incorrect because not all personnel will have tasks to perform; most personnel will have to evacuate from the facility only during a full test. Option C is incorrect because the cloud provider should not initiate the test, and the test should not take place at a random moment. Option D is not correct because the regulators’ presence will not add any value to the test.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 5

Q

A Security Assertion Markup Language (SAML) identity assertion token uses the ___________________ protocol.

A. Extensible Markup Language (XML)
B. Hypertext Transfer Protocol (HTTP) Hypertext
C. Markup Language (HTML)
D. American Standard Code for Information Interchange (ASCII)

Answer

A

A. Extensible Markup Language (XML)

Explanation:
Security Assertion Markup Language (SAML) is based on XML. HTTP is used for port 80 web traffic; HTML is used to present web pages. ASCII is the universal alphanumeric character set.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 6

Q

The minimum essential characteristics of a cloud data center are often referred to as “ping, power, pipe.” What does this term mean?

A. Remote access for customer to racked devices in the data center; electrical utilities; connectivity to an Internet service provider (ISP)/the Internet
B. Application suitability; availability; connectivity
C. Inrastructure as a service (IaaS); software as a service (SaaS); platform as a service (PaaS)
D. Anti-malware tools; controls against distributed denial-of-service (DDoS) attacks; physical/environmental security controls, including fire suppression

Answer

A

A. Remote access for customer to racked devices in the data center; electrical utilities; connectivity to an Internet service provider (ISP)/the Internet

Explanation:
Option A is the definition of the term;the other answers are not.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 7

Q

To support all aspects of the CIA triad (confidentiality, integrity, availability), all of the following aspects of a cloud data center need to be engineered with redundancies except ___________________.

A. Power supply
B. HVAC
C. Administrative offices
D. Internet service provider (ISP)/connectivity lines

Answer

A

C. Administrative offices

Explanation:
The administrative offices of a cloud data center rarely are part of the critical functions of the operation; a data center could likely endure the loss of the administrative offices for a considerable length of time, so redundancy here is probably not cost effective. All the other items are part of the critical path and need redundancies.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 8

Q

Who is the cloud carrier?

A. The cloud customer
B. The cloud provider
C. The regulator overseeing the cloud customer’s industry
D. The ISP between the cloud customer and provider

Answer

A

D. The ISP between the cloud customer and provider

Explanation:
Option D is the definition of a cloud carrier, from National Institute of Standards and Technology (NIST) Special Publication (SP) 500-292. All the other options are incorrect, as defined by NIST SP 500-292.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 9

Q

Which of the following terms describes a means to centralize logical control of all networked nodes in the environment, abstracted from the physical connections to each?

A. Virtual private network (VPN)
B. Software-defined network (SDN)
C. Access control lists (ACLs)
D. Role-based access control (RBAC)

Answer

A

B. Software-defined network (SDN)

Explanation:
The question describes a software-defined network (SDN). A VPN is used for creating an encrypted communications tunnel over an untrusted medium, so option A is incorrect. ACLs are used as centralized repositories for identification, authentication, and authorization purposes, so option C is incorrect. RBAC is an access control model used to assign permissions based on job functions within an organization, so option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 10

Q

In software-defined networking (SDN), the northbound interface (NBI) usually handles traffic between the ___________________ and the ___________________.

A. Cloud customer; ISP
B. SDN controllers; SDN applications
C. Cloud provider; ISP
D. Router; host

Answer

A

B. SDN controllers; SDN applications

Explanation:
B. The NBI usually handles traffic between the SDN controllers and SDN applications. Options A and C are incorrect because neither of those options lists any of the SDN infrastructure, be that the controllers or the applications. Option D may be arguably correct, as there might be an NBI handling that traffic between those nodes, but option B is more specific and always true for this definition, so it is the better choice.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 11

Q

Software-defined networking (SDN) allows network administrators and architects to perform all the following functions except ___________________.

A. Reroute traffic based on current customer demand
B. Create logical subnets without having to change any actual physical connections
C. Filter access to resources based on specific rules or settings
D. Deliver streaming media content in an efficient manner by placing it closer to the end user

Answer

A

D. Deliver streaming media content in an efficient manner by placing it closer to the end user

Explanation:
D. Option D is really a definition of a CDN (content delivery network). All the other options are aspects of SDNs.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 12

Q

Which of the following is a device specially purposed to handle the issuance, distribution, and storage of cryptographic keys?

A. Key management box (KMB)
B. Hardware security module (HSM)
C. Ticket-granting ticket (TGT)
D. Trusted computing base (TCB)

Answer

A

B. Hardware security module (HSM)

Explanation:
The question describes an HSM. KMB is a nonsense term used as a distractor, so it is incorrect. TGT is a term associated with Kerberos single sign-on systems and is incorrect.
The TCB includes the elements of hardware and software (usually in the operating system) that ensure that a system can only be controlled by those with the proper permissions (i.e., admins with root control), so it is also incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 247). Wiley. Kindle Edition.

Question 13

Q

When discussing the cloud, we often segregate the data center into the terms compute, storage, and networking. Compute is made up of ___________________ and ___________________.

A. Routers; hosts
B. Application programming interface (APIs); northbound interface (NBIs)
C. Central processing unit (CPU); random-access memory (RAM)
D. Virtualized; actual hardware devices

Answer

A

C. Central processing unit (CPU); random-access memory (RAM)

Explanation:
The compute nodes of a cloud data center can be measured in terms of how many central processing units (CPUs) and how much random access memory (RAM) is available within the center. Option A is incorrect because routers would be considered a part of the networking of a data center (and because option C is a better answer). Option B involves applications and how traffic flows between them and storage controllers; it has nothing to do with the compute nodes and is therefore wrong.
Option D might obliquely be considered correct because it’s technically true (compute nodes will include both virtual and hardware machines), but option C is a much better and more accurate choice.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 14

Q

All of the following can be used to properly apportion cloud resources except ___________________.

A. Reservations
B. Shares
C. Cancellations
D. Limits

Answer

A

C. Cancellations

Explanation:
Cancellations is not a term used to describe a resource allotment methodology. All of the other options are such terms.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 15

Q

Which of the following is a method for apportioning resources that involves setting guaranteed minimums for all tenants/customers within the environment?

A. Reservations
B. Shares
C. Cancellations
D. Limits

Answer

A

A. Reservations

Explanation:
The question is the definition of reservations. Options B and D are also resource apportioning methods, but they do not fall under the definition described in the question. Option C is incorrect because it has no meaning in this context.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 16

Q

Which of the following is a method for apportioning resources that involves setting maximum usage amounts for all tenants/customers within the environment?

A. Reservations
B. Shares
C. Cancellations
D. Limits

Answer

A

D. Limits

Explanation:
The question describes limits.
Options A and B are also resource apportioning methods, but they do not fall under the definition described in the question. Option C is because it has no meaning in this context.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 17

Q

Which of the following is a method for apportioning resources that involves prioritizing resource requests to resolve contention situations?

A. Reservations
B. Shares
C. Cancellations
D .Limits

Answer

A

B. Shares

Explanation:
The question describes shares. Options A and D are also resource apportioning methods, but they do not fall under the definition described in the question. Option C is incorrect because it has no meaning in this context.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 18

Q

A bare-metal hypervisor is Type ___________________.

A. 1
B. 2
C. 3
D. 4

Answer

A

A. 1

Explanation:
A bare-metal hypervisor is a Type 1 hypervisor. Option B describes another type of hypervisor; the other options are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 19

Q

A hypervisor that runs inside another operating system (OS) is a Type ___________________ hypervisor.

A. 1
B. 2
C. 3
D .4

Answer

A

B. 2

Explanation:
The question describes a Type 2 hypervisor.
Option A describes another type of hypervisor; the other options are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 20

Q

A Type ___________________ hypervisor is probably more difficult to defend than other hypervisors.

A. 1
B. 2
C. 3
D. 4

Answer

A

B. 2

Explanation:
A Type 2 hypervisor relies on the underlying operating system (OS) to operate properly; the underlying OS offers a large attack surface for aggressors. A Type 1 hypervisor boots directly from the hardware; it’s much easier to secure a machine’s Basic Input/Output System (BIOS) than an entire OS, so option B is better than option A. Options C and D are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 248). Wiley. Kindle Edition.

Question 21

Q

One of the security challenges of operating in the cloud is that additional controls must be placed on file storage systems because ___________________.

A. File stores are always kept in plain text in the cloud
B. There is no way to sanitize file storage space in the cloud
C. Virtualization necessarily prevents the use of application-based security controls
D. Virtual machines are stored as snapshotted files when not in use

Answer

A

D. Virtual machines are stored as snapshotted files when not in use

Explanation:
VMs are snapshotted and simply stored as files when they are not being used; an attacker who gains access to those file stores could ostensibly steal entire machines in highly portable, easily copied formats. Therefore, these cloud storage spaces must include a significant amount of controls. Options A and C are simply untrue. Option B is untrue when crypto-shredding is utilized.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 22

Q

What is the main reason virtualization is used in the cloud?

A. Virtual machines (VMs) are easier to administer.
B. If a VM is infected with malware, it can be easily replaced.
C. With VMs, the cloud provider does not have to deploy an entire hardware device for every new user.
D. VMs are easier to operate than actual devices.

Answer

A

C. With VMs, the cloud provider does not have to deploy an entire hardware device for every new user

Explanation:
While options A and B are both also true, C is the most significant reason cloud data centers use VMs. If the cloud provider had to purchase a new box for every user, the cost of cloud services would be as much as running a traditional environment (or likely cost even more), and there would be no reason for any organization to migrate to the cloud, especially considering the risks associated with disclosing data to a third party. Option D is simply untrue. VMs are not easier to operate than actual devices.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 23

Q

Orchestrating resource calls is the job of the ___________________.

A. Administrator
B. Router
C. VM
D .Hypervisor

Answer

A

D .Hypervisor

Explanation:
The question describes what the hypervisor does. (Note that the answer “operating system” would also work here but was not one of the options.) Option A is incorrect; the allocation of resources is not performed manually. The router directs traffic between networks; it does not apportion resources. Therefore, option B is incorrect. A VM makes resource calls; option C is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 24

Q

Which of the following terms describes a cloud storage area that uses a filesystem/hierarchy?

A. Volume storage
B. Object storage
C. Logical unit number (LUN)
D. Block storage

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 64). Wiley. Kindle Edition.

Answer

A

B. Object storage

Explanation:
Object storage is, literally, a means of storing objects in a hierarchy such as a file tree. All the other options are terms used to describe cloud storage areas without file structures.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 25

Q

Typically, which form of cloud storage is used in the near term for snapshotted virtual machine (VM) images?

A. Volume storage
B. Object storage
C. Logical unit number (LUN)
D. Block storage

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 64). Wiley. Kindle Edition.

Answer

A

B. Object storage

Explanation:
Snapshotted VM images are usually kept in object storage, as files. All the other options are incorrect and option C is not a type of storage.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 26

Q

Who operates the management plane?

A. Regulators
B. End consumers
C. Privileged users
D. Privacy data subjects

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 64). Wiley. Kindle Edition.

Answer

A

C. Privileged users

Explanation:
Only the most trusted administrators and managers will have access to the cloud data center’s management plane. These will usually be cloud provider employees, but some cloud customer personnel may be granted limited access to arrange their organization’s cloud resources. Regulators do not operate a customer’s management plane, so option A is incorrect. Option B is ambiguous. However, a consumer of data is unlikely to have been given the elevated privileges necessary of operate the management plane in a cloud environment. Option B is incorrect. Option D is also an ambiguous answer. Only the most trusted administrators and managers have access to the cloud data center’s management plane. A privacy data subject is neither a most trusted administrator nor a trusted manager. Therefore, option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 27

Q

What is probably the optimum way to avoid vendor lock-in?

A. Use nonproprietary data formats.
B. Use industry-standard media.
C. Use strong cryptography.
D. Use favorable contract language.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 64). Wiley. Kindle Edition.

Answer

A

D. Use favorable contract language.

Explanation:
The contract is probably the cloud customer’s best tool for avoiding vendor lock-in; contract terms will establish how easy it is to migrate your organization’s data to another provider in a timely, cost-effective manner. Options A and B are also important ways to avoid vendor lock-in, but D is the best answer. Option C is incorrect and will not aid in avoiding vendor lock-in.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 249). Wiley. Kindle Edition.

Question 28

Q

Who will determine whether your organization’s cloud migration is satisfactory from a compliance perspective?

A. The cloud provider
B. The cloud customer
C. The regulator(s)
D. The Internet service provider (ISP)

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

C. The regulator(s)

Explanation:
The regulator(s) overseeing your industry/organization will make the final determination as to whether your cloud configuration is suitable to meet their requirements. It is best to coordinate with your regulator(s) when first considering cloud migration. Cloud providers, cloud customers, and ISPs are not particularly concerned about whether an organization’s migration is satisfactory from a compliance perspective. The words, The regulator(s) overseeing your industry/organization will make the final determination as to whether your cloud configuration is suitable to meet their requirements. It is best to coordinate with your regulator(s) when first considering cloud migration. Cloud providers, cloud customers, and ISPs are not particularly concerned about whether an organization’s migration is satisfactory from a compliance perspective. The words, “compliance perspective” should automatically bring to mind regulators.
Options A, B, and D are therefore incorrect answers.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 29

Q

What is probably the best way to avoid problems associated with vendor lock-out?

A. Use strong contract language.
B. Use nonproprietary data and media formats.
C. Use strong cryptography.
D. Use another provider for backup purposes.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

D. Use another provider for backup purposes.

Explanation:
Vendor lock-out occurs when the provider suddenly leaves the market, as during a bankruptcy or acquisition. The risks associated with lock-out include denial of service, because of total unavailability of your data. The best way to handle these risks is to have another, full backup of your data with another vendor and the ability to reconstitute your operating environment in a time frame that doesn’t exceed your recovery time objective (RTO). The other options do not aid in addressing vendor lock-out.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 30

Q

In a public cloud services arrangement, who creates governance that will determine which controls are selected for the data center and how they are deployed?

A. The cloud provider
B. The cloud customer
C. The regulator(s)
D. The end user

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

A. The cloud provider

Explanation:
Because the cloud provider owns and operates the cloud data center, the provider will craft and promulgate the governance that determines the control selection and usage. This is another risk the cloud customer must consider when migrating into the cloud; the customer’s governance will no longer have direct precedence over the environment where the customer’s data is located. Both the cloud customer and the regulator(s) may have specific control mandates that might require the customer to deploy additional security controls (at the customer side, within the data, as agents on the user devices, or on the provider side or in application programming interfaces [APIs] as allowed by the service model or contract), so options B and C are also partially true, but A is a better answer as it is more general. Option D untrue because the end user does not determine which controls are selected for the cloud data center and how they are deployed. That is the responsibility of the cloud provider.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 31

Q

What is the term that describes the situation when a malicious user or attacker can exit the restrictions of a virtual machine (VM) and access another VM residing on the same host?

A. Host escape
B. Guest escape
C. Provider exit
D.Escalation of privileges

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

B. Guest escape

Explanation:
The question describes a guest escape.
Options A and C are other risks of operating in the cloud. Option D can lead to A or B, but B describes the more specific situation and therefore the correct answer.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 32

Q

What is the term that describes the situation when a malicious user or attacker can exit the restrictions of a single host and access other nodes on the network?

A. Host escape
B. Guest escape
C. Provider exit
D. Escalation of privileges

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

A. Host escape

Explanation:
The question describes host escape. Options B and C are other risks of operating in the cloud. Option D can lead to A or B, but A is the more specific situation and therefore the correct answer.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 33

Q

___________________ is/are probably the main cause of virtualization sprawl.

A. Malicious attackers
B. Lack of provider controls
C. Lack of customer controls
D. Ease of use

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 65). Wiley. Kindle Edition.

Answer

A

D. Ease of use

Explanation:
D. Because most cloud users don’t see direct costs in creating new VM instances (the bills usually go to a single point of contact in the organization, not the user or the user’s office), they may tend to create additional VMs at a significant rate, without realizing the attendant cost. This is largely because it is so easy to do and has no apparent cost, from their perspective.
All the other options do not cause virtualization sprawl.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 250). Wiley. Kindle Edition.

Question 34

Q

Sprawl is mainly a(n) ___________________ problem.

A. Technical
B. External
C. Management
D. Logical

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

C. Management

Explanation:
Sprawl needs to be addressed from a managerial perspective because it is caused by allowed user actions (usually in a completely authorized capacity). Options A and D mean the same thing and could be considered as contributing to sprawl because the technological capabilities of virtualization create the ease of use that can cause sprawl. However, option C is a better answer. Option B is incorrect; sprawl occurs within the organization.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 251). Wiley. Kindle Edition.

Question 35

Q

Which of the following risks exists in the traditional environment but is dramatically increased by moving into the cloud?

A. Physical security breaches
B. Loss of utility power
C. Financial upheaval
D. Man-in-the-middle attacks

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

D. Man-in-the-middle attacks

Explanation:
Because all cloud access is remote access, the risks to data in transit are dramatically heightened in the cloud. The other options exist in both the traditional environment and the cloud but are probably actually reduced in the cloud because cloud providers can use economies of scale to invest in means to reduce those risks in ways that individual organizations would not be able to.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 251). Wiley. Kindle Edition.

Question 36

Q

A fundamental aspect of security principles, ___________________ should be implemented in the cloud as well as in traditional environments.

A. Continual uptime
B. Defense in depth
C. Multifactor authentication
D. Separation of Duties

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

B. Defense in depth

Explanation:
Defense in depth, or layered defense, is perhaps the most fundamental characteristic of all security concepts. Options A and C are security aspects of some environments, and option A is likely to be a necessary trait of managed cloud services, but they are not fundamentals—they are specifics. Option D is specifically an administrative control; the question is looking for a fundamental aspect of security. Option B is more general (it applies to all types of security, in all industries and uses) and therefore is the correct choice for this question.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 251). Wiley. Kindle Edition.

Question 37

Q

From a security perspective, automation of configuration aids in ___________________.

A. Enhancing performance
B. Reducing potential attack vectors
C. Increasing ease of use of the systems
D. Reducing need for administrative personnel

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

B. Reducing potential attack vectors

Explanation:
A secure baseline configuration, applied and maintained automatically, ensures the optimum security footprint with the least attack surface. All the other options are benefits of automated configuration but are not specifically security enhancements.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 251). Wiley. Kindle Edition.

Question 38

Q

___________________ is the most prevalent protocol used in identity federation.

A. Hypertext Transfer Protocol (HTTP)
B. Security Assertion Markup Language (SAML)
C .File Transfer Protocol (FTP)
D .WS-Federation

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

B. Security Assertion Markup Language (SAML)

Explanation:
B. The Security Assertion Markup Language (SAML) is probably the most common protocol being used for identity federation at the moment. Options A and C are not identity federation protocols. Option D is a federation specification, but it also uses SAML tokens.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 251). Wiley. Kindle Edition.

Question 39

Q

A user signs on to a cloud-based social media platform. In another browser tab, the user finds an article worth posting to the social media platform. The user clicks on the platform’s icon listed on the article’s website, and the article is automatically posted to the user’s account on the social media platform. This is an example of what?

A. Single sign-on
B. Insecure direct identifiers
C. Identity federation
D .Cross-site scripting

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 66). Wiley. Kindle Edition.

Answer

A

C. Identity federation

Explanation:
Single sign-on (SSO) is similar to federation, but it is limited to a single organization; federation is basically SSO across multiple organizations. Option A is incorrect. Options B and D are threats listed in the Open Web Application Security Project (OWASP) Top Ten; they are incorrect.

Question 40

Q

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to review each other, for compliance with security governance and standards they all find acceptable, what is this federation model called?

A. Cross-certification
B. Proxy
C. Single sign-on
D. Regulated

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 67). Wiley. Kindle Edition.

Answer

A

A. Cross-certification

Explanation:
The cross-certification federation model is also known as a web of trust. Proxy is another model for federation, so option B is incorrect.
Single sign-on is similar to federation, but it is limited to a single organization; option C is incorrect. Option D does not have relevance in this context and therefore incorrect as an answer.

Question 41

Q

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to hire a third party to review each organization, for compliance with security governance and standards they all find acceptable, what is this federation model called?

A. Cross-certification
B. Proxy
C. Single sign-on
D.Regulated

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 67). Wiley. Kindle Edition.

Answer

A

B. Proxy

Explanation:
In the proxy federation model, the third party acts on behalf of the member organizations, reviewing each to ensure that they are all acceptable to the others. Cross-certification is another model for federation, so option A is incorrect. Single sign-on is similar to federation, but it is limited to a single organization; option C is incorrect. Option D does not have relevance in this context and is therefore incorrect as an answer.

Question 42

Q

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to use the web of trust model for federation, who is/are the identity provider(s)?

A .Each organization
B. A trusted third party
C. The regulator overseeing their industry
D. All of their patients

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 67). Wiley. Kindle Edition.

Answer

A

A .Each organization

Explanation:
In a web of trust federation model, all of the participating organizations are identity providers; each organization will assign identity credentials to its own authorized users, and all the other organizations in the federation will accept those credentials. A trusted third party, regulators, and clientele are not involved in the web of trust model, so the other options are incorrect.

Question 43

Q

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to use the web of trust model for federation, who is/are the service providers?

A. Each organization
B. A trusted third party
C .The regulator overseeing their industry
D. All of their patients

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 67). Wiley. Kindle Edition.

Answer

A

A. Each organization

Explanation:
In a web of trust model, each member organization usually supplies both the access/identification credentials and the resources that the users want to access, so the organizations are both the identity providers and service providers in a web of trust federation model. A trusted third party, regulators, and clientele are not involved in the web of trust model, so the other options are incorrect.

Question 44

Q

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). In this federation, all of the participating organizations would need to be in compliance with what U.S. federal regulation?

A. Gramm-Leach-Bliley Act (GLBA)
B. Family and Medical Leave Act (FMLA)
C .Payment Card Industry Data Security Standard (PCI DSS)
D. Health Information Portability and Accountability Act (HIPAA)

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 67). Wiley. Kindle Edition.

Answer

A

D. Health Information Portability and Accountability Act (HIPAA)

Explanation:
While it’s likely the participating organizations will be subject to other federal regulations, HIPAA covers electronic patient information, so it will definitely be applicable in this case. GLBA covers financial and insurance service providers, so option A is incorrect.
FMLA dictates how employers give vacation time to employees, so option B is not correct. PCI DSS is a contractual, not regulatory, standard, so option C is incorrect.

Question 45

Q

What is the process of granting access to resources?

A. Identification
B. Authentication
C. Authorization
D. Federation

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

C. Authorization

Explanation:
The question describes authorization. Options A and B are part of the overall identity and access management (IAM) process, as is option C, but they do not specifically describe granting access to resources. Federation is a means of conducting IAM across organizations; option C is more specific, so D is incorrect.

Question 46

Q

The process of identity management includes all the following elements except ___________________.

A. Provisioning
B. Maintenance
C. Deprovisioning
D. Redaction

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

D. Redaction

Explanation:
Redacting is an editorial process of excising sensitive information from disclosed data. All the other options are elements of identity management.

Question 47

Q

Which organizational entity usually performs the verification part of the provisioning element of the identification process?

A. Information technology (IT)
B. Security
C. Human resources (HR)
D.Sales

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

C. Human resources (HR)

Explanation:
This is a complicated question and requires thinking through the portions of the identification process. Identification of personnel is usually verified during the hiring process, when HR checks identification documents (such as a passport or birth certificate) to confirm the applicant’s identity, often as part of a tax registration process. Options A and B include offices that may play a role in the identification process, but it is usually HR that does the actual verification. Option D, “Sales” is untrue. If a Sales department exists in an organization, it does not perform the verification part of the provisioning element of the identification process.

Question 48

Q

Of the following options, which is a reason cloud data center audits are often less easy to verify than traditional audits?

A. Data in the cloud can’t be audited.
B. Controls in the cloud can’t be audited.
C. Getting physical access can be difficult.
D. There are no regulators for cloud operations.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

C. Getting physical access can be difficult.

Explanation:
Cloud providers may be reluctant to grant physical access, even to their customers, on the assumption that allowing access would disclose information about security controls. In some cases, cloud customers won’t even know the location(s) of the data center(s) where their data is stored. The other options are all untrue. Data in the cloud and controls in the cloud can most certainly be audited. So, options A and B are incorrect. D is untrue; there are regulators for all industries, including those that operate in the cloud.

Question 49

Q

Of the following options, which is a reason cloud data center audits are often less easy to verify than traditional audits?

A. Cryptography is present.
B. Auditors don’t like the cloud.
C. Cloud equipment is resistant to audit.
D. They often rely on data the provider chooses to disclose.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

D. They often rely on data the provider chooses to disclose.

Explanation:
In many circumstances, a cloud audit will depend on which information a cloud provider discloses, which makes auditing difficult and less trustworthy. Option A is incorrect because cryptography is sometimes present in traditional environments and audits still take place. Option B is incorrect; auditors’ opinions are not relevant. Option C is untrue; equipment does not resist auditing—it is inanimate and unfeeling.

Question 50

Q

Of the following options, which is a reason cloud data center audits are often less easy to verify than audits in standard data centers?

A. They frequently rely on third parties.
B. The standards are too difficult to follow.
C. The paperwork is cumbersome.
D .There aren’t enough auditors.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 68). Wiley. Kindle Edition.

Answer

A

A. They frequently rely on third parties.

Explanation:
Because cloud audits are often the result of third-party assertions, recipients of cloud audit reports may be more skeptical of the results than they would have been of traditional audits, in which the recipients may have performed firsthand. Option B is untrue. The difficulty of standards is not a hindrance to audit. Option C is untrue. Paperwork does not hinder audits.
Option D is not only untrue, but also hilarious. If you have ever been involved in an audit, you know that there are plenty of auditors to go around.

Question 51

Q

The cloud customer will usually not have physical access to the cloud data center. This enhances security by ___________________.

A. Reducing the need for qualified personnel
B. Limiting access to sensitive information
C. Reducing jurisdictional exposure
D. Ensuring statutory compliance

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

B. Limiting access to sensitive information

Explanation:
B. The “sensitive information,” in this case, is whatever knowledge of the data center’s security controls and processes might be gathered by physically visiting the data center. Even though a cloud customer cannot get access to the facility, this also means that other cloud customers (some of whom may be inimical to another customer’s interests) also will not have access, so none would have advantage over the other(s). Option A is incorrect because qualified personnel are still required whether a cloud environment has limited access to their data center or not. In fact, security may be degraded by having unqualified personnel rather than qualified personnel working in the cloud data center. Option C is incorrect because reducing jurisdictional exposure does not enhance security. There may be a correlation between ensuring statutory compliance and enhancing security as it applies to limiting access to the cloud data center. However, option B is a better answer because it is certainly true. Therefore, option D is not the best answer to the question.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 253). Wiley. Kindle Edition.

Question 52

Q

Which of the following controls would be useful to build into a virtual machine baseline image for a cloud environment?

A. GPS tracking/locator
B. Automated vulnerability scan on system startup
C. Access control list (ACL) of authorized personnel
D .Write protection

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

B. Automated vulnerability scan on system startup

Explanation:
Because VMs don’t take updates when they are not in use (snapshotted and saved as image files) and updates may be pushed while the VMs are saved, it’s important to ensure that they receive updates when they are next instantiated. A physical tracking mechanism won’t be of much aid for virtual devices because they aren’t physically stolen like hardware boxes, so option A is incorrect. Having an ACL in the image baseline would create a situation where every user from every cloud customer could access every VM in the data center; option C is incorrect. Write protection is used in forensic analysis of machines (virtual or otherwise); it would not be useful in an operational baseline. Option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 253). Wiley. Kindle Edition.

Question 53

Q

Which of the following controls would be useful to build into a virtual machine baseline image for a cloud environment?

A. Automatic registration with the configuration management system
B. Enhanced user training and awareness media
C. Mechanisms that prevent the file from being copied
D .Keystroke loggers

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

A. Automatic registration with the configuration management system

Explanation:
Version control can be difficult in a virtual environment because saved VMs don’t receive updates. Ensuring that each VM is the correct version is a function of configuration management (CM), and CM controls can be built into the baseline. Each organization will have its own training and awareness program, and there is no one-size-fits-all solution that is appropriate; this does not belong in the baseline. Option B is incorrect. Having a baseline that cannot be copied is pointless; option C is incorrect. Keystroke loggers will create a huge volume of detailed, stored data that will pose more of a security risk (and may actually be a violation of customer privacy regulations) than any benefit it offers; option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 254). Wiley. Kindle Edition.

Question 54

Q

Virtual machine (VM) configuration management (CM) tools should probably include ___________________.

A. Biometric recognition
B. Anti-tampering mechanisms
C. Log file generation
D. Hackback capabilities

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

C. Log file generation

Explanation:
Event logging is essential for incident management and resolution; this can be set as an automated function of the CM tools. Not all systems need or can utilize biometrics; option A is incorrect. Usually, tampering refers to physical intrusion of a device; since the question is about VMs, it is probably not applicable. Option B is incorrect. Hackback is illegal in many jurisdictions; option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 254). Wiley. Kindle Edition.

Question 55

Q

Using a virtual machine baseline image could be very useful for which of the following options?

A. Physical security
B. Auditing
C. Training
D. Customization

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

B. Auditing

Explanation:
A specified configuration built to defined standards and with a controlled process can be used to demonstrate that all VMs within an environment include certain controls; this can greatly enhance the efficiency of an audit process.
The VM’s image has very little to do with physical security or training; options A and C are incorrect. Baseline images are the opposite of customization; option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 254). Wiley. Kindle Edition.

Question 56

Q

What can be revealed by an audit of a baseline virtual image, used in a cloud environment?

A. Adequate physical protections in the data center
B. Potential criminal activity before it occurs
C. Whether necessary security controls are in place and functioning properly
D. Lack of user training and awareness

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 69). Wiley. Kindle Edition.

Answer

A

C. Whether necessary security controls are in place and functioning properly

Explanation:
The baseline will contain the suite of security controls applied uniformly throughout the environment. A VM image audit is unlikely to involve any form of physical security; A is incorrect. Baselines won’t predictively show malicious activity; B is incorrect. Baselines also do not have anything to do with user training and awareness; option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 254). Wiley. Kindle Edition.

Question 57

Q

Using one cloud provider for your operational environment and another for your BC/DR backup will also give you the additional benefit of ___________________.

A. Allowing any custom VM builds you use to be instantly ported to another environment
B. Avoiding vendor lock-in/lock-out
C. Increased performance
D. Lower Cost

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

B. Avoiding vendor lock-in/lock-out

Explanation:
Having an additional backup with a different provider means that if your primary provider becomes unusable for any reason (including bankruptcy or unfavorable contract terms), your data is not held hostage or lost. Custom VMs may or may not work in a new environment; this is actually a risk when porting data out of the production environment; option A is incorrect. Performance probably will not increase if data is replicated to another cloud provider; in fact, you will probably lose some load balancing capability you might have had if you kept the data and backups together. Option C is incorrect. Having two providers will always be more costly than a

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 254). Wiley. Kindle Edition.

Question 58

Q

Having your BC/DR backup stored with the same cloud provider as your production environment can help you ___________________.

A. Maintain regulatory compliance
B. Spend less of your budget on traveling
C. Train your users about security awareness
D. Recover quickly from minor incidents

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

D. Recover quickly from minor incidents

Explanation:
Having the backup within the same environment can allow easy rollback to a last known good state or to reinstantiate clean VM images after minor incidents (e.g., a malware infection in certain VMs). Ease of compliance will not be determined by the location of the backup, so option A is incorrect. Traveling should not be a major cost for cloud usage; option B is incorrect. The location of the backups won’t have any effect on user training; option C is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Question 59

Q

If you use the cloud for BC/DR purposes, even if you don’t operate your production environment in the cloud, you can cut costs by eliminating your ___________________.

A. Security personnel
B. BC/DR policy
C. Old access credentials
D. Need for a physical hot site/warm site

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

D. Need for a physical hot site/warm site

Explanation:
Having your data backed up and accessible in the cloud eliminates any need for having a distinct hot site/warm site separate from your primary operating environment; instead, your personnel can recover operations from anywhere with a good broadband connection. Cloud BC/DR capability does not remove the necessity of security personnel and appropriate policies; both options A and B are incorrect.
Option C makes no sense as an answer to the question. It is unclear how you can cut costs by eliminating your old access credentials. In fact, it is difficult to imagine how that is a true statement. Therefore, option C is a poor choice and option D is the best choice.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Question 60

Q

If the cloud is used for BC/DR purposes, the loss of ___________________ could gravely affect your organization’s RTO.

A. Any cloud administrator
B. A specific VM
C. Your policy and contract documentation
D. ISP connectivity

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

D. ISP connectivity

Explanation:
Without ISP connectivity, nobody will be able to use the Internet and, thus, the cloud. Of course, realistically, without Internet connectivity not much business will get done anyway, for most organizations, regardless of whether they were operating in the cloud or on-premise. Option A is incorrect because the loss of any, single, cloud administrator is unlikely to gravely affect your organization’s RTO. The loss of a specific VM will probably not gravely affect your organization’s RTO. VMs can be reinstantiated with ease. Option B is incorrect.
The loss of your policy and contract documentation cannot gravely affect your organizations RTO.
Option C is untrue
Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Question 61

Q

What is the most important asset to protect in cloud BC/DR activities?

A. Intellectual property
B. Hardware at the cloud data center
C. Personnel
D.Data on portable media

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

C. Personnel

Explanation:
Health and human safety is always paramount in all security activity. All the other options are assets that should be protected, but nothing is as important as option C, so they are incorrect answers for this question.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Question 62

Q

When considering cloud data replication strategies (i.e., whether you are making backups at the block, file, or database level), which element of your organization’s BC/DR plan will be most affected by your choice?

A. Recovery time objective
B. Recovery point objective
C. Maximum allowable downtime
D. Mean time to failure

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 70). Wiley. Kindle Edition.

Answer

A

B. Recovery point objective

Explanation:
The recovery point objective (RPO) is a measure of data that can be lost in an outage without irreparably damaging the organization. Data replication strategies will most affect this metric, as the choice of strategy will determine how much recent data is available for recovery purposes. Recovery time objective (RTO) is a measure of how long an organization can endure an outage without irreparable harm. This may be affected by the replication strategy, but not as much as the RPO. Option A is incorrect. The maximum allowable downtime (MAD) is how long an organization can suffer an outage before ceasing to be an organization. This is not dependent on the RPO, and the data replication strategy won’t have much effect on it at all. Option C is incorrect. The mean time to failure (MTTF) is a measure of how long an asset is expected to last (usually hardware), as determined by the manufacturer/vendor. The data replication strategy will have no bearing on this whatsoever. Option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Malisow, Be n. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 255). Wiley. Kindle Edition.

Question 63

Q

In addition to BC/DR, what other benefit can your data archive/backup provide?

A. Physical security enforcement
B. Access control methodology
C. Security control against data breach
D.Availability for data lost accidentally

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 71). Wiley. Kindle Edition.

Answer

A

D.Availability for data lost accidentally

Explanation:
A data backup/archive can offer your organization an operational “reachback” capability, where admins can assist users in recovering data lost by accident or carelessness.
The backup/archive does not aid in any of the areas in the other options. So, options A, B, and C are incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Question 64

Q

Which of the following risks is probably most significant when choosing to use one cloud provider for your operational environment and another for BC/DR backup/archive?

A. Physical intrusion
B. Proprietary formats/lack of interoperability
C. Vendor lock-in/lock-out
D. Natural disasters

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 71). Wiley. Kindle Edition.

Answer

A

B. Proprietary formats/lack of interoperability

Explanation:
When using two different cloud providers, a cloud customer runs the risk that data/software formats used in the operational environment can’t be readily adapted to the other provider’s service, thus causing delays during an actual failover. Risks of physical intrusion are neither obviated nor enhanced by choosing to use two cloud providers; option A is incorrect. Using a different cloud provider for backup/archiving actually reduces the risks of outages due to vendor lock-in/lock-out and natural disasters, so options C and D are not correct.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 65

A

B. The BC/DR provider becomes the new normal production environment.

Explanation:
Theoretically, all the options are possibly true. However, option B is the most likely to occur and is fairly common in practice; the cost and risk of moving operations from one environment/provider to another is sizable, so staying with the secondary provider (making them the new primary) is a good way to reduce some of the risk involved in returning to normal.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 66

A

A. Business drivers

Explanation:
The business requirements will determine the crucial aspects of BC/DR. All the other options may constitute some input that will influence the BC/DR, but they are not the prevailing factors, so are incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 67

A

C. Business impact analysis

Explanation:
The business impact analysis (BIA) is designed for this purpose: to determine the critical path of assets/resources/data within the organization. It is a perfect tool to use in shaping the BC/DR plan. The risk analyses options and the risk appetite option may provide input for the BIA, but they are not what is used to determine the critical assets necessary to protect in the BC/DR activity. So, options A, B, and D are incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 68

A

D. Can the backup provider meet the same SLA requirements as the primary?

Explanation:
If the contingency operation will last for any extended period of time, it is important to know whether all the same service expectations can be met by the backup provider as were available in the production environment. All the other questions are important, but not as crucial as option D, so they are incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 69

A

C. Depends on the contract

Explanation:
BC/DR responsibilities must be negotiated and codified in the contract; initiation could be something performed by provider or customer, depending on circumstances, so the parties must agree before those circumstances are realized. It is exceedingly unlikely that “any user” in a managed cloud services arrangement can invoke a BC/DR action. Option D is therefore a poor choice for the answer to the question.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 70

A

C. Perform a full-scale test.
Explanation:
Without a full test, you can’t be sure the BC/DR plan/process will work the way it is intended. Audits are good, but they will not demonstrate actual performance the way a test will, so options A and B are incorrect. It is important that the BC/DR capacity and performance be included in the contract, but that will not truly ensure that the functionality exists; a test is required, so option D is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 256). Wiley. Kindle Edition.

Answer 71

A

A. Regularly update the BC/DR plan/process.

Explanation:
All of these are important, but without regular updates, the information will soon become outdated and a lot less useful.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 257). Wiley. Kindle Edition.

Answer 72

A

C. Copies of the laws/regulations/standards governing specific elements of the plan

Explanation:
This is not an easy question, because every plan/policy should include mention of the governance documents that drive the formation of the plan/policy; however, these can be included by reference only—you don’t need to include full copies of these governance documents. All the other options should be included in the BC/DR plan/policy.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 257). Wiley. Kindle Edition.

Answer 73

A

D. Someone with requisite skills

Explanation:
This question is difficult. You want your BC/DR plan/process to include sufficient detail such that it could be followed by someone with the right background (perhaps IT for certain roles, security for others, etc.) but without any experience or specific training in that role. This is because a contingency of the scope that would require initiation of BC/DR activities might involve dramatic, significant external forces to the point where the personnel normally tasked with BC/DR actions are not available (for instance, natural disasters, fire, civil disruption, etc.), so the tasks may need to be completed by whoever is available at the time.
The BC/DR plan/process should be written and documented in such a way that someone with the requisite skills can use it. It is unlikely that typical users or regulators have the requisite skills to perform many of the BC/DR activities. Therefore options A and C are poor choices for answers to the question. It is tempting to choose option B, however, option D is a better answer because it ensures that someone with the requisite skills will be able to read the BC/DR plan and perform the activities they document. Having to rely on essential BC/DR team members being present and available to follow the plan is risky. So option B is incorrect.

Malisow, Ben. (ISC)2 CCSP Certified Cloud Security Professional Official Practice Tests (p. 257). Wiley. Kindle Edition.

Answer 74

A

C. Returning to normal operations too soon

Explanation:
A premature return to normal operations can jeopardize not only production, but personnel; if the contingency that caused the BC/DR action is not fully complete/addressed, there may still be danger remaining. The BC/DR plan/process should take into account both the absence of essential personnel and telecommunications capabilities, so options A and D are incorrect. Option B does present a serious problem for the organization, but C is still a greater risk, so B is incorrect.

Answer 75

A

C. Returning to normal operations too late

Explanation:
Not returning to normal operations in a timely fashion can cause you to exceed the RTO and the MAD. During a contingency, some of the requirements your organization faces may relax somewhat; for instance, if a life-threatening natural disaster occurs, regulators will likely understand if some of the normal compliance activities/controls are not fully incorporated while personnel and assets are moved to safety (depending on the nature of the industry, of course). Options A and B are therefore incorrect; option C poses a greater risk.

Answer 76

A

D. It doesn’t matter. Data can be saved anywhere without consequence.

Explanation:
Depending on your industry and the nature of your data, moving information into another jurisdiction may affect or invalidate your regulatory compliance. Cloud providers, wherever they are located, should compensate for environmental and physical security factors, so this should have no impact on your potential risk; options B and C are incorrect. Option D is incorrect because it is blanket statement that is not always true. In fact, for some organizations, the physical location where

Answer 77

A

C. Reduce the risk of regulatory noncompliance

Explanation:
ENISA’s approach to cloud risk assessments does not specifically address this type of assurance, probably because of the wide variety of possible regulators and the difficulty in crafting a risk assessment that would address them all.
All the other options are assurance efforts that ENISA’s cloud risk assessment is meant to enhance, so they are incorrect answers for this question.

Answer 78

A

D. Programmatic management

Explanation:
ENISA includes “programmatic management” as a defining trait of cloud computing, even specifying “through WS API.” This is not included in the definition published by (ISC)2 (or by NIST). All the other characteristics are included in the (ISC)2 (and NIST) definitions.

Answer 79

A

D .Opportunity

Explanation:
The only reason organizations accept any level of risk is because of the potential benefit also afforded by a risky activity. Profit is not the hallmark of every opportunity (or every organization—many organizations are nonprofit or government-based), so option A is incorrect. Likewise, not all risky activities offer a chance to enhance performance, so option B is incorrect. Cost is not a benefit, so that doesn’t even make sense in the context of the question; option C is not correct and a distractor.

Answer 80

A

D. Sending the data outside the traditional environment for collaborative purposes

Explanation:
The cloud greatly enhances opportunities for collaboration between organizations, mostly by giving external parties some limited access to the owner’s data in the cloud. While there is risk in this situation, the truly comparable risk in the traditional environment would result from sending data outside the organization to external collaborators. (Furthermore, the organization has to balance this risk against the cost of business of not being able to collaborate, if data is never shared with third parties.) Option A is ridiculous; data should be secured whether it is in an on-premise environment or in the cloud. Option B does not create a true equivalence; disclosing data under controlled conditions is not the same as public disclosure. Option C is not equivalent to the costs/benefits of the other forms of collaboration; it would be too cumbersome for the organization to truly benefit from collaboration in a modern business environment.

Answer 81

A

C. Some risks cannot be transferred to a cloud provider

Explanation:
Under current legal frameworks, some risks (such as legal liability for privacy data breaches) cannot be transferred to a contracted party, so the data owners (that is, cloud customers) will still retain those risks. Option A is ridiculous; risks can and should be mitigated, even in the cloud. Option B is not correct; cloud migration will require some risk acceptance, but that is true for everything except avoided risk. Option D is incorrect; cloud providers can choose not to offer services or not to accept certain clients.

Answer 82

A

C. Software as a service (SaaS)

Explanation:
As the models increase in level of abstraction and service, the customer’s control over the environment decreases.

Answer 83

A

B. Multitenancy

Explanation:
Sharing resources with other, unknown customers (some of whom may be competitors of or even hostile to the organization) is a risk not faced by organizations that maintain their own, on-premise data centers. All the other answers are threats that exist in both environments and are therefore incorrect.

Answer 84

A

C. Any vendor the cloud customer previously used in the on-premise environment

Explanation:
Because supply chain dependencies can affect service, the cloud customer will need assurance that any third-party reliance is secure. Regulators and end users do not provide security to the enterprise, so options A and B are incorrect. The vendors used for on-premise security will no longer affect the data, so option C is incorrect.

Answer 85

A

D. Resource exhaustion

Explanation:
It is possible that a cloud provider will be unable to handle an increased load during contingency situations where all its customers are demanding additional resources far beyond
their usual contracted rate. While this is unlikely (many cloud providers, especially the major operators in the market, have resources that greatly exceed any possible demand by their customers), it could conceivably occur if a significant number of customers experience an immediate and dramatic need for capacity, such as during a major BC/DR event (a region-wide natural disaster or a physical attack on a city). This is not something that would affect an on-premise solution; your organization’s data center is not affected by others’ demand for resources (although the on-premise environment may be affected by the same contingency that causes cloud resource exhaustion, of course). All the other options portray risks faced by both cloud and on-premise environments.

Answer 86

A

B. Private cloud

Explanation:
Guest escape (a malicious user leaving the confines of a VM and able to access other VMs on the same machine) is less likely to occur and to have a significant impact in an environment provisioned for and used by a single customer. In a public cloud, this is more likely and would be more significant, so option A is incorrect.
The service model doesn’t specifically dictate the likelihood of occurrence or impact (both PaaS and IaaS could be in a private or public cloud, which is the more important factor), so both options C and D are incorrect.

Answer 87

A

B. Legal seizure of another firm’s assets

Explanation:
Because of multitenancy and shared resources in the cloud, law enforcement may seize a cloud customer’s assets (a physical device, a data set, etc.) and inadvertently capture assets belonging to another, unsuspected/innocent organization. This could not happen in a situation where all individual organizations only kept their own assets on their own premises. All the other options include risks that exist in the traditional, on-premise environment, as well as the cloud, so they are incorrect.

Answer 88

A

C. Strong contractual clauses

Explanation:
This is not an easy question; the simple answer seems to be option A, which is true for data stored/saved/migrated to the cloud (and property that already has been created in the cloud), but for new intellectual property created in the cloud, strong contract language in favor of the customer’s rights is very necessary. Without clear-language support about the customer’s ownership of all intellectual property created in the cloud data center, the cloud provider could, ostensibly, make a claim on such property, as the provider’s resources were used in a collaborative effort to create that property. Options B and D are security controls used to protect all sorts of assets, including intellectual property, but they are not as specifically addressing the creation of new intellectual property in the cloud the way explicit contract clauses would, so option C is still the better answer.

Answer 89

A

B. Inference attacks

Explanation:
While it is possible that one guest VM seeing the resource calls of another VM could possibly allow one guest to see the other’s data, it’s much more likely that a user seeing another user’s use of resources, rather than raw data, would allow the viewer to infer something about the victim’s behavior/usage/assets. Likewise, it may be possible for the viewer to leverage knowledge of this usage as part of a social engineering attack, but that would be subsequent to the inference itself; option B is still better than C.
Lack of resource isolation does not affect physical intrusions, which is just a distractor here

Answer 90

A

B. No social factors

Explanation:
Social factors should not/don’t affect the level of entropy in a random number generator. However, all the other factors listed in the other answers do, and that means that a malicious user in the cloud would be more likely (statistically) to guess/predict the random number used to create/seed an encryption key made in that same cloud environment.
Cloud customers should take this into account when designing/planning their cloud configuration

Answer 91

A

C. vendor lock-in

Explanation:
Without uniformity of data formats and service mechanisms, there is no assurance that a customer would be able to easily move their cloud operation from one provider to another; this can result in lock-in. All the other options are not affected by lack of standards.

Answer 92

A

A. Prohibitions on port scanning and penetration testing

Explanation:
Many cloud providers prohibit activities that are common for administrative and security purposes but can also be construed/used for hacking; this includes port scanning and penetration testing. These restrictions can reduce the customer’s ability to perform basic security functions. While geographical dispersion of cloud assets might make securing those assets more difficult in the notional sense (customer administrators can’t physically visit the devices that host their data), remoteness does not necessarily inhibit good security practices, which can be performed at a remove. This is not as detrimental as rules against port scanning/pen testing, so option B is incorrect.
There are no rules against user training or laws against securing your own assets, in the cloud or otherwise; options C and D are incorrect.

Answer 93

A

A. Brewer-Nash (Chinese Wall)

Explanation:
Brewer-Nash was specifically created for managed services arrangements, where an administrator for a given customer might also have access to a competitor’s data/environment; the model requires that administrators not be assigned to competing customers. In the modern cloud provider model, a cloud data center administrator will almost definitely have access to many customers from the same industry (i.e., competitors) but probably won’t even know it. All the other options are access control security models; cloud administrators will not (or should not) be assigning access rights, so all these options are wrong.

Answer 94

A

B. The administration/support staff building

Explanation:
Administrative and support staff are usually not part of the critical path of a data center; they are nonfunctional-requirement elements, not functional requirements. All the other options are mission-critical elements of the cloud data center and must have redundancy capabilities.

Answer 95

A

B. Ensuring that any cabling/connectivity enters the facility from different sides of the building/property

Explanation:
To avoid a situation where severing a given physical connection results in severing its backup as well (such as construction/landscaping, etc.), have redundant lines enter on different sides of the building. For health and human safety, multiple egress points from each facility is preferred (and often required by law); option A is incorrect. Emergency lighting should receive power regardless of their proximity to the power source, and parking vehicles near generators is a bad idea from a safety perspective; option C is incorrect. Not all facilities need to withstand earthquakes; this may be true of data centers in California, but not in Sydney, so it is not an industry-wide best practice. Option D is incorrect.

Answer 96

A

D. Points of personnel ingress

Explanation:
People entering the facility can be vectored through a single security checkpoint as a means of enhancing access control; multiple lines of ingress are not necessary (although multiple lines of egress are essential to ensure health and human safety).
All other options are facility elements that require redundancy

Answer 97

A

C. The risk of negative impact to both production and backup is too high.

Explanation:
A recovery from backup into the production environment carries the risk of failure of both data sets—the production set and the backup set. This can cause cataclysmic harm to the organization. Recovering in the primary facility would probably be cheaper than having a different test facility, so option A is incorrect. A proper test is worth the financial expenditure, so option B is incorrect. Option D is incorrect because any BCDR plan would account for sufficient personnel workspace.

Answer 98

A

B. You want to approximate contingency conditions, which includes not operating in the primary location.

Explanation:
Assuming your facility is not available during contingency operations allows you to better approximate an emergency situation, which adds realism to the test. Though option A is an act of benevolence on the part of the organization towards the community, option B is still a better answer for the question.
Option C is an act of benevolence on the part of the organization towards the employee, option B is still a better answer for the question. Option D is incorrect because it makes assumptions that cannot be counted upon. Regulatory oversight should not be avoided, and should always be assumed.

Answer 99

A

B. The cloud customer

Explanation:
In an infrastructure as a service (IaaS) model, the provider is only responsible for provisioning the devices and computing/storage capacity; the customer is responsible for everything else, including the security of the applications. All the other answers are incorrect because those individuals/organizations do not accept responsibility for securing cloud-based applications.

Answer 100

A

A. Create their own identity and access management (IAM) solution

Explanation:
According to ENISA, custom IAM builds can become weak if not properly implemented. Strong contract language in favor of the customer is always desirable for the customer, so option B is incorrect.
Training for specific conditions is always advisable, so option C is incorrect. There is nothing wrong with having encryption take place before data is sent to the cloud, so option D is incorrect.

Answer 101

A

D. Financial

Explanation:
With strong contract terms, the cloud customer may be able to recover monetary damages (and even penalties) from the cloud provider as a result of a loss suffered by the customer; however, legal liability remains with the cloud customer. The other answers are not relevant in this context.

Answer 102

A

B. Credential revocation

Explanation:
Revoking credentials that might be lost when a device goes missing is a way to mitigate the possibility of those credentials being used by an unauthorized person. Punishing a user and notifying law enforcement does not prevent data from being disclosed; options A and C are incorrect. Tracking devices may assist recovery efforts, but it won’t protect against data disclosures during the period the device is not under the organization’s control; option D is incorrect.

Answer 103

A

B. Transactions completed successfully

Explanation:
Of all these options, only B is not something that will reveal untoward behavior.

Answer 104

A

D. Multifactor authentication

Explanation:
Multifactor authentication offers additional protections for assets that are critical to the organization. All logins should utilize strong passwords, whether they are critical or not, so option A is incorrect. Some form of physical perimeter security is useful, but not necessarily chain-link fences, and not only for critical assets (perimeter security will protect all assets on the campus), so option B is incorrect. Homomorphic encryption is a theoretical technology; option C is incorrect.

Answer 105

A

A. Prevent unknown, unpatched assets from being used as back doors to the environment

Explanation:
An asset that is not tracked will not be maintained properly, and an improperly maintained asset provides an avenue for attack. Options B and D are management issues, not security issues; option A is preferable to both of them.
Option C is incorrect; users don’t care if their devices are catalogued and annotated. Option C is a poor choice for an answer to the question.

Answer 106

A

A. Interoperable export formats

Explanation:
Data formatted in a manner that allows its reuse in other environments is essential for portability. None of the other options are relevant to the issue of data portability.

Answer 107

A

B. Conducting service trials in an alternate cloud provider environment

Explanation:
Testing is a great way to enhance assurance that applications will work in the new environment. None of the other options are relevant to the issue of application portability.

Answer 108

A

C. Select an appropriate recovery time objective (RTO).

Explanation:
The RTO must always be less than the MAD. It is good to know that services will operate in the alternate environment and that first response contact info is current, but neither determines the speed with which services and data will be available during contingency operations; options A and B are incorrect.
Regulators will usually not dictate MAD/RTO for a given organization; option D is incorrect

Answer 109

A

D. SLA satisfaction surveys from other (current and past) cloud customers

Explanation:
Of the listed options, knowing how other customers feel about a provider may be the most valuable data point; it is the most realistic depiction of whether an organization realized projected/anticipated benefits after a migration. Options A and B are just marketing materials and should not, by themselves, be all that convincing for making a migration decision. Option C is a good factor to consider, but it is only a very small piece of what migration entails; D is still a much better option.

Answer 110

A

C. Physical location of the launch point

Explanation:
Because cloud access is remote access, pen tests will be remote tests; it doesn’t really matter what the physical origin of the simulated attack is. All the other options are items the provider will want to know before the customer launches the test.

Answer 111

A

D. Social engineering

Explanation:
Performing live deception and trickery against employees of the cloud provider (or its suppliers/vendors) could be construed as unethical and possibly illegal, especially without their knowledge and/or consent. Social engineering probably won’t be involved in penetration tests run by customers. All the other options are legitimate activities a customer might perform during a penetration test (with provider permission).

Answer 112

A

D. Prosecution

Explanation:
In most jurisdictions, the activity involved in penetration testing would be considered criminal, and quite serious, and the provider would be justified in seeking law enforcement involvement and prosecution. None of the other answers make sense with respect to the question.

Answer 113

A

B. Advanced notice removes the element of surprise.

Explanation:
Because all penetration tests launched by the customer require notifying the provider beforehand (and getting permission), the simulation loses quite a bit of realism. In the traditional environment, where the organization had full control over its own assets, penetration tests could involve double-blind status, which was much more realistic. Everyone uses remote access for cloud activity, so option A is incorrect.
Cloud customers will not be able to deploy malware as part of a test because that is a crime, so option C is wrong. Regulators are not involved in penetration tests, so option D is incorrect.

Answer 114

A

D. Virtualization

Explanation:
Virtualization allows for the scalability and cost reduction available in managed cloud services. All the other options are incorrect because they do not cite the technology that creates most of the cost saving in the cloud environment. Only virtualization provides this cost savings.

Answer 115

A

D. Sunk capital investment

Explanation:
In the traditional environment, the cloud customer must pay for a device for every user, which requires additional capacity that is almost never fully used; this represents a cost with no associated benefit. Moving into a virtualized environment allows the organization to only pay for resources that are utilized and not for underutilized or unused capacity. The risks and regulatory requirements for an organization do not go away when the organization moves into the cloud, so there is no cost savings associated with these elements. Therefore, all of the other options are incorrect.

Answer 116

A

C. Personnel

Explanation:
An organization operating in the cloud should not need as many IT personnel as would be required to operate a traditional enterprise with the same level of services for users; this can represent a significant cost savings. Moving into the cloud reduces neither risk nor data; options A and D are incorrect. Arguably, the cloud customer may realize some cost savings through cloud migration because the customer will not be solely responsible for acquiring, deploying, and managing security controls. However, security controls still exist—they are, instead, the responsibility of the cloud provider, and the price of applying them is enclosed in the cost of the cloud service. Moreover, this savings is not nearly as significant as the savings realized through reduction in personnel, so option C is still preferable.

Answer 117

A

B. The ease of transporting stolen virtual machine images

Explanation:
Because virtual machine images are stored as imaged files, an attacker able to access the stored files would have a much easier time transporting those files than transporting actual drives/machines.
Option A actually represents a risk in the physical environment that is reduced by the use of virtual machines and is incorrect. VMs are not any more or less susceptible to malware or EMP, so options C and D are incorrect.

Answer 118

A

C. Operating system (OS)

Explanation:
Both the hypervisor and the OS orchestrate access to resources (the hypervisor coordinates requests from VMs, and the OS coordinates requests from applications). Option A is incorrect because the CPU in a traditional environment performs calculations, while the operating system manages resources and performs process scheduling. The security team in a traditional environment has a narrow and focused role, not like the operating system that manages the entire system and its resources. Pretty Good Privacy is an application that performs a specific, limited role. Option D is incorrect.

Answer 119

A

D. Solid-state drives (SSDs)

Explanation:
Solid-state drives (SSDs) are currently the most efficient and durable storage technology, so cloud providers will favor them.
All the other options are older technologies that employ magnetic media in one form or another, while SSD employs electronic circuitry to store data.

Answer 120

A

C. Object

Explanation:
In object storage, data objects/files are saved in the storage space along with relevant metadata such as content type and creation date. Options A and B are different names for the same type of storage arrangement and incorrect. Option D has no meaning in this context.

Answer 121

A

C. Verizon

Explanation:
NIST’s definition of cloud carrier is “an intermediary that provides connectivity and transport of cloud services from Cloud Providers to Cloud Consumers.” Of the choices, option C best represents this definition.

Answer 122

A

D. Hypervisor

Explanation:
The hypervisor orchestrates assignment of resources and is responsible for avoiding and resolving contention. The router manages traffic flow, which might be considered as resolving contention issues for resource requests outside the local device (for example, from a given device to the storage cluster) but wouldn’t handle resource requests inside a given device (such as a VM on the device making a request to the device CPU), so option D is a better answer. An emulator virtualizes programs, not machines, and is not responsible for orchestrating resource calls, so option B is incorrect. Regulators do not manage resources, so option C is incorrect.

Answer 123

A

D. The VM is not active while in storage

Explanation:
Security controls operating on a guest VM OS are only active while the VM is active; when the VM is stored, it is snapshotted and saved as a file, so those controls won’t be active either. All user access to the VMs will be done remotely; option A is simply incorrect. Security controls on OSs that are not scanned or subject to version control may be out of date or not optimized, but they will still function (just not as well), so option D is still preferable to B and C.

Answer 124

A

A. More expensive than spinning platters

Explanation:
Solid-state drives (SSDs) are usually more expensive, per drive, than their counterparts. However, as the industry matures, this is changing rapidly. Moreover, cloud providers are usually buying devices at such a scale and under such a budget that individual price differentials for device types is not the main criteria for making purchase decisions. Size and shape are not defining criteria of SSDs or tapes; options B and C are irrelevant (and also somewhat wrong). The physical nature of the drive does not affect its vulnerability to malware; option D is incorrect.

Answer 125

A

B. Faster than magnetic drives

Explanation:
SSD technology offers a great increase in speed and efficiency. SSDs are not typically more difficult to install or administer than traditional technology, nor are they more likely to fail than other storage devices, so all the other options are incorrect.

Answer 126

A

B. Not vulnerable to degaussing

Explanation:
Because SSDs do not use magnetic properties to store data, degaussing is not a suitable means of sanitizing SSDs. All the other options are untrue and are therefore inappropriate answers.

Answer 127

A

C. Data dispersion/encryption

Explanation:
Theoretically, all combinations of security controls are preferable to any one security control used by itself (this is the principle of layered defense). All of the potential responses are therefore true. However, of this list, the pairing that makes the most sense is option C, because encrypting the data while also spreading it across multiple storage devices/locations increases the protection each one offers against certain common threats (in this case, physical theft of a storage device, failure of a device, legal seizure of a device in a multitenant environment, etc.).

Answer 128

A

C. DLP/DRM

Explanation:
Theoretically, all combinations of security controls are preferable to any one security control used by itself (this is the principle of layered defense). All of the potential responses are therefore true. However, of this list, the pairing that makes the most sense is option C, because adding another layer of access control on objects while also detecting outbound motion of objects increases the protection each one offers against certain common threats (in this case, internal threats, escalation of privilege, unauthorized or inadvertent dissemination of data, etc.).

Answer 129

A

C. Every organization

Explanation:
Every organization is responsible for performing its own risk assessment for its own particular business needs. Cloud providers will not perform risk assessments on behalf of their customers. Regulatory bodies and legislative entities do not perform risk assessments.

Answer 130

A

C. General counsel

Explanation:
The best method for avoiding vendor lock-in is to have strong contract language favorable to the customer; the entity best equipped to craft contracts is the office of the general counsel. Senior management can assist the organization to avoid vendor lock-in by tasking the correct resources (offices/personnel) to perform vendor selection activities, but option A is not as accurate as C. Security personnel will have the technical skills and knowledge to properly determine the organization’s IT needs and can inform general counsel as to what services/resources will best meet the organization’s needs, but these entities are not as adept and trained at crafting contract language as the attorneys. Options B and D are not preferable to C.

Answer 131

A

B. Using one cloud provider for primary production and another for backup purposes

Explanation:
Using distinct cloud providers for production and backup ensures that the loss of one provider, for any reason, will not result in a total loss of the organization’s data. None of the other options address vendor lock-out and are therefore unsuitable as answers.

Answer 132

A

C. Sprawl

Explanation:
Users in a cloud environment may not realize the attendant costs that come along with creating many new virtual instances, and the ease with which new instances are created allows users to do so without much effort. While DDoS and phishing may include an element of user gullibility and ignorance, at least one party (the attacker) is not engaged in inadvertent activity—their behavior is very purposeful. Options A and B are incorrect. While inadvertent action can often result in incidents, disasters are usually at a much greater scale and aren’t as likely to be the result of unknowing action; option D is incorrect.

Answer 133

A

B.Management plane breach

Explanation:
Management plane breach allows an attacker to gain full control of the environment and can affect all aspects of the CIA triad. DDoS and physically attacking the utility lines, options A and D, only affect availability, which is a significant negative impact but not as bad as option B, which can affect integrity and confidentiality as well.
Guest escape is a breach limited to a specific device and the virtual machines on that device; this is not as much impact as breaching the management plane, which gives full access to the entire environment.

Answer 134

A

A. One

Explanation:
Controlling access is optimized by minimizing access. All the other options are incorrect.

Answer 135

A

D. Mantrap structures

Explanation:
Usually, mantrap areas control access to sensitive locations within a facility, not an entrance to the facility. None of the other options address vendor lock-out and are therefore unsuitable as answers.

Answer 136

A

C. In every building on the campus

Explanation:
Health and human safety is a paramount goal of security; all facilities must have multiple emergency egress points. All the other options are distractors as they are included in option C.

Answer 137

A

B. Isolation failure

Explanation:
In the traditional environment, when all resources are owned, controlled, and used by the organization’s personnel, loss of isolation will only expose data to other members of the organization; isolation failure in the cloud environment may expose data to people outside the organization, a more significant impact. All the other options are risks that have similar likelihoods and impacts in the cloud and traditional environments and are therefore incorrect.

Answer 138

A

B. Degrade performance

Explanation:
Security and productivity/operations are always trade-offs. Option A is a generalization that may or may not be true depending on several variables. Some security controls are inexpensive to implement. Senior management approval may be required before security controls can be implemented, however, some may not need prior approval. It depends on the organization and how it is managed. Option C is incorrect. Option D is another generalization that may or may not be true. Whether a security control will work in the cloud environment as well as they worked in the traditional environment depends on the control and how it is implemented. Option B is a better choice.

Answer 139

A

A. Legal liability in multiple jurisdictions

Explanation:
Because cloud providers may use data centers that span state (or even national) borders, new legal risks may be introduced to the customer’s organization after cloud migration. All the other options are risks faced by organizations in both the cloud and traditional environments and are therefore incorrect.

Answer 140

A

A. Loss of availability due to DDoS

Explanation:
In the traditional environment, if DDoS prevented the organization’s connectivity with the Internet or other organizations, users still had access to their own data but simply could not share it or use it in external transactions; this hampered productivity, but not availability. In the cloud, without connectivity outside the organization, users cannot reach their data, which is an availability issue. DDoS does not affect value, confidentiality, or liability; all the other options are incorrect.

Answer 141

A

D. Integrity

Explanation:
DDoS prevents all these things except for data integrity. DDoS only prevents communication; it does not usually result in modified data.

Answer 142

A

C. Software licensing

Explanation: In some instances, more virtualized machines will entail a relative increase in the number of software seat licenses, which can be a significant expense. Typically, cloud customers do not pay extra for additional consumption of floor space or power usage for the number of virtual machines; these costs are rolled into the per-instance price, so options A and B are incorrect. Option D is incorrect; users don’t require more training if they have more virtual assets.

Answer 143

A

D. BC/DR tests

Explanation:
When performing BC/DR tests, it is useful to create scenarios that are unpredictable and vary from previous tests so as to better approximate conditions of an actual disaster. All the other answers represent elements that should avoid variables as much as possible and are incorrect.

Brainscape's Knowledge GenomeTM

Chapter 3 Domain 3: Cloud Platform and Infrastructure Security (Ben Malisow) Flashcards

Brainscape's Knowledge Genome^TM