Chapter 4 Implementing Cloud Security Flashcards
The process of organizing information into different tiers or categories is referred to as ___ ___ ?
Data Classification
Dividing your cloud fleet of servers into smaller discrete areas for the purpose of applying a granular security policy is known as ___ ?
Segmentation
Data that is obfuscated on a RAID 5 storage is ___ ___ encryption.
At rest
Multifactor authentication includes something you ___ and something you ___.
know, have
Hands-off programmatically driven cloud configuration change is commonly referred to as ___.
Automation
___ allow for a defined machine-to-machine software interaction to enable automation.
API (application programming interface)
The ___ ___ ___ is a user-friendly front end interface to a service’s APIs.
Graphical User Interface
Network-based ___ ___ ___ take active security breach counter-measures.
Intrusion Prevention System
Cloud-based security places a load on a virtual machine’s ___?
CPU
Security ___ can allow code to replace many processes that had to be performed manually in the past
Automation
Robert has been asked to create a security implementation that segments his employer's e-commerce design to allow for policy enforcement. What are some of the the areas that he is investigating? (Choose three). A. Network B. Automation C. Storage D. Compute E. APIs F. JSON/XML
Network, Storage, Compute
Cloud segmentation is the process of dividing up your cloud deployment into sections that allow for granular security. Common segments include compute, network, and storage.
APIs, JSON, and XML are software constructs to enable automation.
MFA tokens can be obtained where? (Choose two) A. Python app B. Smartphone app C. Automation systems D. Keyfob E. Cloud vendor management dashboard
Smartphone app, Keyfob
One-time numerical tokens are generated on keyfob hardware devices and smartphone soft-token applications.
Hank just completed running some security automation scripts on his new fleet of application virtual machines. After applying intrusion detection, virus, and malware protection on the Linux images, he notices an increase in which VM metric on his management dashboard? A. DMA B. BIOS C. CPU D. IPSec E. I/O
CPU
Applying security applications on a virtual server will cause an increase in CPU usage.
What technology was instrumental in the growth of cloud services? A. XML B. Python C. Automation D. Authentication E. Scripting F. workflow services G. Encryption
Automation
Automation of cloud deployments was instrumental in the growth of cloud-based services.
Carl is planning his cloud migration and must meet HIPPA requirements for confidential storage of cloud data at rest and in use in the cloud. What services must be addressed by Carl? (Choose two.) A. Virtual private network B. Storage C. Client-side D. Database
Storage, Database
Storage systems and database applications are both examples of data at rest or being processed in the cloud. While VPNs and client encryption are valid security systems, they are not associated with your internal cloud security posture.
What is a common cloud-based GUI used to get an overview of your security operations? A. Puppet automation B. Gemalto system C. Dashboard D. Vendor-based security appliance
Dashboard
A dashboard is a graphical portal that provides updates and an overview of operations.
Who does responsibility for stored data integrity in the cloud belong to? A. Cloud provider B. Compliance agency C. Cloud customer D. Shared responsibility
Cloud customer
Ultimately the responsibility for data in the cloud belongs to the organization that owns the data.
What are complex software systems that automate cloud operations and are offered by companies such as Chef and Puppet called? A. Authentication B. Federations C. Orchestration D. Ephemeral
Orchestration
Orchestration systems are software packages or services that automate cloud operations.
RESTful APIs using XML and JSON on southbound interfaces can be used to orchestrate and automate what cloud-based services? (Choose all that apply.) A. Firewalls B. Load balancers C. Virtual machines D. DNS servers E. Durable storage volumes
All of the above
All of these cloud services have APIs that can be accessed for configuration and monitoring using standard RESTful XML and/or JSON interfaces.
Jim has a critical server in the application tier of his cloud-based deployment. He is looking at a device-specific security solution to add defense-in-depth capabilities to his currently deployed network-based security defenses. He has been researching ways to mitigate potential hacking attempts. What is a good solution for him? A. DMZ B. IDS C. IPS D. Classification automation E. HIDS
HIDS
A host intrusion detection system (HIDS) is a software that monitors the device on which it is installed to identify deviations from an established security policy.
A constantly changing six-digit numerical token is used in what type of cloud service? A. XML B. TLS C. SSL D. MFA E. JSON
MFA
Multifactor authentication (MFA) services use a token that is generated on a schedule and can be a numerical value. The other answers offered are not valid to the question.
Samantha has been asked to meet FedRamp compliance for her customer's new contract. Where should she integrate compliance in her project? (Choose four.) A. Hand-off B. Design C. Implementation D. Automation rollout E. Planning F. Validation G. HIDS H. JSON/XML scripting
Planning, Design, Implementation, Validation
All compliance requirements should be integrated into the complete life cycle of a project including the design, planning, implementation and validation phases of the project.
Sharon is investigating a standards-based construct to enable automation on her load balancers. What is a good lightweight data-interchange format standard that is easily readable and for computing systems to parse and to generate? (Choose two.) A. XML B. JSON C. REST D. Python
XML, JSON
Extensible Markup Language (XML) and JavaScript Object Notation (JSON) provide a flexible way to describe data and create information formats and electronically share structured data between computing systems. Both are lightweight data-interchange formats that are easily readable for computing systems to parse and to generate.
Your company has purchased a specialized intrusion prevention system that is virtualized and designed for cloud-based network micro segmentation deployments. When reading the documentation, Sam notices a link to download a Java-based application to monitor and configure the IPS. What kind of automation system is this? A. CLI B. GIU C. Vendor based D. API E. RESTful
Vendor based
Based on the information given, the description is for a vendor-based management application.
Vendors will publish a document detailing their APIs interfaces and how to interact with their products programmatically for automation and management.
(page 138)
