Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Managing Cloud Security - D320 > Chapter 7 – Cloud Application Security > Flashcards

Chapter 7 – Cloud Application Security Flashcards

1
Q

What is Forklifting?

A

Moving an entire application to the cloud without significant changes; often self-contained stand-alone applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Cloud-Secure SDLC?

A

A Software Development Lifecycle focusing on security throughout the development phases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the focus during the Defining phase of SDLC?

A

To identify the business requirements of the application and describe aspects of the business needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is developed during the Designing phase of SDLC?

A

User stories, interface design, and requirements for APIs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What occurs during the Development phase of SDLC?

A

The phase where the code is written.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What activities are involved in the Testing phase of SDLC?

A

Initial penetration testing and vulnerability scanning; includes DAST and SAST.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Functional Testing?

A

Ensures the software performs its intended tasks completely and accurately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Security Testing?

A

Ensures that the controls included in the software are working effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What begins the Secure Operations phase?

A

When thorough testing is complete and the environment is secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What happens during the Disposal phase?

A

Software must be securely disposed of when it reaches end of life or is replaced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is QA (Quality Assurance)?

A

Management/inspection to reduce the possibility of introducing errors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does ISO/IEC 27034-1 Standards for Secure Application Development provide?

A

An approach for tracking security controls used in software and an overview of application security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ONF (Organizational Normative Framework)?

A

A framework for all components of application security controls and best practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is ANF (Application Normative Framework)?

A

Subsets of ONF for each specific application, sharing applicable parts needed for security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the relationship between ANF and ONF?

A

ANF-to-ONF is one-to-one; ONF-to-ANF is one-to-many.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is IAM (Identity and Access Management)?

A

About the people, processes, and procedures used to manage identities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Identity Management?

A

The process of associating user rights with a given identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Provisioning in Identity Management?

A

Issuing a unique identity assertion and a password for authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does Access Management deal with?

A

Controlling access to resources and identifying user permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are Identity Repositories?

A

Stores of information or attributes of identities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are Directory Services?

A

How identities and attributes are managed; examples include X.500 and LDAP.

22
Q

What is Federated Identity Management?

A

Used to manage identities across disparate organizations; a SSO for multiple orgs.

23
Q

What is the Web of Trust Model?

A

Each member of the federation reviews and approves each other member for inclusion.

24
Q

What is a trusted third-party model of federation (CASB)?

A

Outsources the review and approval task to a trusted third party.

25
Q

What is SAML (Security Assertion Markup Language)?

A

A federation standard for communication authentication and authorization across organizations.

26
Q

What is SAML 2.0?

A

Standard used to pass security assertions across the internet.

27
Q

What does WS-Federation allow?

A

Orgs to trust each other’s identity information across organizations.

28
Q

What is OAuth?

A

Used in authorization with mobile apps to provide limited access to HTTP services.

29
Q

What is OpenID Connect?

A

An interoperable authentication protocol based on OAuth 2 specification.

30
Q

What does Stateful Packet Inspection do?

A

Prevents inbound traffic unless the connection has been initiated from inside the network.

31
Q

What are WAFs (Web Application Firewalls)?

A

Protect specific web-based applications and can protect against DoS/DDoS attacks.

32
Q

What is DAM (Database Activity Monitoring)?

A

Protects the database from unusual requests or activity.

33
Q

What are API Gateways?

A

Impose controls as an API proxy and implement access control.

34
Q

What is an XML Gateway?

A

Works around how sensitive data and services are exposed to APIs.

35
Q

What is XACML (eXtensible Access Control Markup Language)?

A

An attribute-based access control policy language designed to express security policies.

36
Q

What are APIs (Application Programming Interfaces)?

A

Coding components that allow applications to communicate through a web interface.

37
Q

What are RESTful APIs?

A

Relies on stateless, client-server communications and is scalable.

38
Q

What are the characteristics of RESTful APIs?

A

Low processing, uses simple URLs, not reliant on a single programming language.

39
Q

What is SCIM (System for Cross-domain Identity Management)?

A

Open standard designed to manage user identity information with a RESTful API.

40
Q

What is SOAP (Simple Object Access Protocol)?

A

Protocol specification for the exchange of structured information in web services.

41
Q

What are the characteristics of SOAP?

A

Standards-based, reliant on XML, and has built-in error handling.

42
Q

What is SDK (Software Development Kits)?

A

A collection of software development tools in one package to facilitate application creation.

43
Q

What is TLS (Transport Layer Security)?

A

Protocol to ensure privacy during communication between applications.

44
Q

What is SSL (Secure Socket Layer)?

A

Same use as TLS, but has been replaced by TLS.

45
Q

What is Whole-Instance Encryption?

A

Encrypts all system’s data at rest in one instance.

46
Q

What is the STRIDE Model?

A

A standardized way of describing threats by their attributes.

47
Q

What is CSRF (Cross-Site Request Forgery)?

A

Manipulates a logged-on user’s browser to send a forged HTTP request.

48
Q

What is White-Box Testing?

A

Static Application Security Testing; reviewing the source code.

49
Q

What is Black-Box Testing?

A

Dynamic testing of the program as it functions in runtime without reviewing source code.

50
Q

What is Application Orchestration?

A

When two or more applications must interact to complete a business process.

51
Q

What are the two approaches to Application Orchestration?

A

Linking elements directly or abstracting functions for distinct input/output handling.

52
Q

What is Authentication?

A

Confirms the identity assertion belongs to the entity presenting it.

Managing Cloud Security - D320 (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions