Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP > Cloud Concepts Architecture and Design > Flashcards

Cloud Concepts Architecture and Design Flashcards

1
Q

What are the main part of the NIST cloud definitions ?

A

Cloud has five essential characteristics, three service models and four deployment models

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the essential characteristics of the cloud ?

A
  • Broad Network
  • Access Resource Pooling
  • Multitenancy
  • Rapid Elasticity and Scalability
  • Metered Service
  • On Demand Service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the idea behind the concept of orchestration in the Cloud ?

A

It is mainly the responsibility of the Cloud Provider to provide access to the cloud without forcing cloud customer to adopt vendor specfic components such as browser plugins.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the function of the hypervisor in virtualization ?

A

To allocate CPU and RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the two types of hypervisor ?

A

Type 1 : Bare Metal - Runs on Hardware no OS

Type 2: Runs on the OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is guest escape ?

A

The ability in a multi tenanted environment to access other customers data or software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is resource pooling ?

A

Characteristic that allows the cloud provider to meet various demands of customers while remaining financially viable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are five cost benefits from moving to cloud.

A
  1. Reduction in Capital Expense
  2. Reduction in Personnel Costs
  3. Reduction in Operation Costs
  4. Transfer of Regulatory Costs
  5. Reduction in Archival and Backup costs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a capital expense ?

A

If an Organisation buys a server for example then that is a capital expense and the company is going to incur a cost from either under utilisation or under capacity. Because buying a service is an operational expense some of this cost is tax deductible as a legal expense.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the benefit of reducing Personnel costs ?

A

IT Personnel are expensive to hire and train. By switching to the cloud you can offload some of this expense to the cloud provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the advantage of regulatory transfer costs ?

A

Some cloud providers will be compliant in their hardware setup for example against certain standards such as PCI DSS this means the cloud customer can save this cost and concentrate on making other areas compliant such as their processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

As a cloud customer can I transfer my PII data responsibility to the cloud provider ?

A

No ultimately the cloud customer is still responsible for PII data. There may be cases where the cloud customer can sue the provider if they can prove negligence but they are still responsible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the difference between elasticity and scalability in Cloud computing ?

A

Elasticity is about handling short term fluctuations in demand whereas scalability is a more medium too long term ability to cope with increasing customer base of a company.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the difference between a cloud customer and a cloud user ?

A

A cloud customer is buying services directly from the cloud provider whereas a cloud user is using those purchased services. For example if I but a cloud enable phone app I am a cloud user not a cloud customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the three main service model in the cloud ?

A

IAAS, PAAS, SAAS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is IAAS ?

A

Most basic of the offerings basically only the machine it is your responsibility to install the OS. This is a good option if you want to have control over patching and security of the data you put on these machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is PaaS ?

A

PaaS is where the cloud provider gives you the OS and patching and maintains a responsibility for it.

You are responsible for what you install on top of the OS. Software houses like this option as they want to develop software not maintain an OS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is SaaS ?

A

Software as a service is where you just consume the service as an end user. You have very little control on the security and placement of the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the Public cloud deployment model ?

A

Software as a service is where you just consume the service as an end user. You have very little control on the security and placement of the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the private cloud deployment model ?

A

Resources are dedicated to a single customer. It might be owned and maintained by the customer of its services but it may also be some services offered by the public cloud provider but are made available solely for that customer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the community cloud deployment model ?

A

Cloud is owned and operated by an affinity group. People and organisations come together to perform similar tasks and operations.

An example is the Playstation network.

A community cloud can also be provisioned by a third party on behalf of members of that community.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the hybrid cloud deployment model ?

A

A combination of other deployment models

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a cloud service broker

A

A company that purchases services from the cloud provider who then resells them to its own customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the role Cloud access security broker do ?

A

A third party entity offering independent IAM services to cloud customers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does the term cloud portability mean >

A

The ability to move applications and associated data between providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is FIPS 140-2

A

Describes the process fir accrediting and describing cryptosystems for use by the federal government

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is NIST 800-53

A

A guidance document with the primary goal of ensuring that appropriate security requirements and controls are applied to all US Federal government information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the trusted cloud initiative reference model ?

A

A guide for cloud providers allowing them to create a holistic architecture so that cloud customers can purchase services with confidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is vendor lock out

A

Occurs when a customer is unable to recover access to thier own data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is vendor lock in ?

A

Vendor lock in when a customer is unable to leave a provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the five foundation concepts for the cloud ?

A
  1. Sensitive Data
  2. Virtualization
  3. Encryption
  4. Auditing and Compliance
  5. Cloud Service Provider Contracts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Why is auditing difficult in the cloud ?

A

Cloud providers are extremely reluctant to allow physical access to their facilities or to share network diagrams or list of controls. Instead Cloud providers often offer an assertion of thier own audit success

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the Cloud Service Provider Contracts

A

The SLAs on performance and provision snd penalties for failure to do so

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the capacity issues for private cloud ?

A

A customer can exceed them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How does community cloud and regulation work ?

A

If a community is bound by a regulation such as HIPPAA then it makes sense for them to pay the cloud provider to create a community cloud where the infrastructure is compliant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the main cloud considerations ?

A
  1. Auditability
  2. Interoperability
  3. Regulatory
  4. Portability
  5. Security
  6. Performance
  7. Governance
  8. Privacy
  9. Resiliency
  10. Reverability
  11. Maintenance
  12. Availability
  13. SLAs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the main risk of quantum computing for security ?

A

Makes many brute force tasks cheap and available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

For a software company moving to the cloud which is the greatest security concern multitenancy or remote access

A

multitenancy is the primary concern as it directly affects their core business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Under PCI Dss legislation what information can never be stored ?

A

Card CCV Number

40
Q

What should be covered by a Business Continuity and Disaster Recovery contract ?

A

Which party is responsible for initiating the recovery

How the response is to be initiated

How much a new cloud provider is to charge if data has to be ported

NOT: How soon data is to be ported to a new provider if current provider cant provide the service

41
Q

Who bears the cost if a customer want to change a current in place SLA ?

A

Customer

42
Q

Out of the following costs which are the most likely to be reduced when moving from On Prem to cloud ? Utility Costs, Security Costs, Landscaping costs or Travel costs ?

A

Utility costs

43
Q

Why might security controls and countermeasures be prohibitive to moving from on-premis to cloud ?

A

The cloud can mandate to use additional security measures and features such as IDS/IPS and SIEM which adds to the base cost of moving to the cloud.

44
Q

Which type of technology does ISO 27001 favour ?

A

Open Source

45
Q

If I wanted the benefit of international acceptance do I prefer ISO or NIST ?

A

ISO

46
Q

Why might NIST be an important factor for you in moving to the cloud ?

A

PRICE To implement NIST on private cloud or community or on premise is expensive but many public vendors offer compliance to this standard out of the box

47
Q

Service Operation control reports are derived from which standard published by American Institute of certifed Public accountants ?

A

Sherwood Applied Business Security Architecture (SABSA)

48
Q

Which US Federal law covers banking and insurance

A

Gramm-Leach-Bliley Act (GLBA)

49
Q

What type of organisations are affected by Sarbannes Oxley

A

Publicaly Traded

50
Q

In encryption what is meant by the term work factor ?

A

The amount of time and resources used to decrypt without using the key i.e. brute force.

51
Q

In cryptography what is meant by the term initialisation vector ?

A

The addition of random text to the plaintext prior to encryption.

Adding this randomness stops attackers who are listening from seeing patterns in the encryption process. So if I am seeing the same encryption pattern at specific points in the day I can start to make deductions about it.

52
Q

What is the best practice around initialisation vectors ?

A

Add a randomized vector everytime when doing encryption.

53
Q

What are the key features of Symmetric cryptography ?

A

Fast

Only gives Confidentiality

Does not scale well

Out of Band Key Distribution

54
Q

Besides Confidentialty what else does assymetric encryption offer

A

Non Repudiation

55
Q

How can we use asymmetric cryptography to provide both confidentiality and non-repudiation?

A
56
Q

What is session key cryptography ?

A

It represents the best of both worlds we communicate a symmettric public key using assymetric encryption and then we can use with confidence the faster symmetric key protocol

57
Q

What are PCIDSS Merchant levels ?

A

Merchant Levels are a way of accessing risk and are based on the total amount of transactions within a year.
* Level 1: Merchants with over 6 million transactions a year, across all channels or any merchant that has had a data breach
* Level 2: Merchants with between 1 million and 6 million transactions annually, across all channels
* Level 3: Merchants with between 20,000 and 1 million online transactions annually.
* Level 4: Merchants with fewer than 20,000 online transactions a year or any merchant processing up to 1 million regular transactions per year

58
Q

Can PCIDSS non compliance result in Jail >

A

No because it is a voluntary standard

59
Q

Does PCIDSS only cover the technical aspects of security requirements ?

A

No it covers Non Technical as well

60
Q

What are the common criteria evaluation levels ?

A

The Common Criteria enable an objective evaluation to validate that a particular product or system satisfies a defined set of security requirements.

61
Q

What are the jurisdictional data challenges within the cloud ?

A

Data and resource are sometimes dynamically spun up and can cross jurisdictional boundaries.

62
Q

What is Information Rights Management ?

A

The legal controls as to who has rights to the data

63
Q

What is copyright

A

Copyright is the legal protection for the expressions of ideas. It normally covers books, art, films etc. It does not cover ideas, words or formulae

64
Q

What are the typical time periods covered by copyright ?

A

70 years after creators death or 120 years after publication of a hired work

65
Q

Is copyright always granted to the person who created the item to be copyrighted ?

A

In most jurisdictions yes but there are some jurisdictions where copyright is granted to the person who registers

66
Q

What is a trademark ?

A

Trademarks target specific words and graphics as the representation of an organisations brand. Trademarks last for perpetuity as long as they are still used. Trademark infringement is actionable.

67
Q

What is a patent ?

A

Patents cover inventions, processes, plant life. It gives the patent owner exclusivity in the production, sale and importation of the patented property.

Patents typically last for twenty years from the time of the application.

You can apply for a patent at the World Intellectual Property Office under the Patent Cooperation Treaty.

68
Q

How long does a patent usually last for

A

20 years

69
Q

What is a trade secret ?

A

Trade secrets can be aggregations of information such as a recipe. They cannot be disclosed to the public and effort need to be put in place to maintain this. The legal protection covers illicit stealing of the secret but not if the secret becomes public. The last in perpetuity as long as they are still in use.

70
Q

If I discover a trade secret by accident or other non illegal means am I prosecutable ?

A

No

71
Q

What are rudimentary reference checks ?

A

The content itself can check for proper usage and ownership. For example asking for input of a phrase or keyword from a page in the reference manual

72
Q

What are online reference checks ?

A

With online checks the users enters in for example a product key that the product periodically checks the validity online.

73
Q

What are local agent checks in IRM ?

A

A local agent check is a piece of downloaded software that checks the users system against an online licensing database. Steam is a gaming platform that uses this form of checking.

74
Q

In IRM what is presence of licensed media ?

A

The system requires the presence of licensed media such as a CD rom within a drive. The IRM engine is on the media and is often installed with a cryptographic engine that identifies the unique disk.

75
Q

What is support based licensing

A

This is where the content needs to be supported such as patching which is only accessible by having a valid license.

76
Q

With IRM what is the Replication Restriction problem ?

A

IRM is often about preventing duplication and cloning and this can become a problem within a cloud based system which spins up and down resources multiple times.

77
Q

In IRM what are the agents issues ?

A

Software that requires an agent to be running in the background may not work in the dynamic nature of the cloud.

78
Q

In IRM what is the concept of persistent protection ?

A

In IRM the means to protect rights must always follow the content its protecting.

79
Q

In IRM what is dynamic content control ?

A

The IRM tool should allow content creators and data owners to modify acls and permissions for the protected data under control.

80
Q

In IRM what is automatic expiration ?

A

THe IRM restrictions should automatically expire when there is a time limit on the protection

81
Q

What is remote revocation in IRM ?

A

The content author should be able to revoke rights automatically whenever there has been an infringement.

82
Q

What is a data retention period ?

A

The retention period is the length of time that an organisation should keep its data. This usually referes to data being stored in long term storage.

83
Q

What is a data retention format requirement ?

A

This is the format that data is stored in, what type of media and handling considerations. Some regulations for example require data to be stored in an Encrypted manner.

84
Q

What should a data policy say about retention monitoring and enforcement ?

A

The data policy should list in detail how often data will be reviewed and amended by whom and the consequences for failing to do so and which entity within the organisation is responsible for enforcement.

85
Q

Why is data retention in the cloud difficult ?

A

It can be very difficult to determine if the cloud provider is holding on to data

86
Q

When in the data lifecycle does data retention kick in ?

A

Archival

87
Q

What is a legal hold ?

A

A legal hold is an obligation to hold on to data that supersedes regulatory requirements. Comes into force during an investigation. In the USA the federal rules of evidence sets out the legal hold and this cuts across regulations such as HIPAA.

88
Q

In Data Retention what is data audit ?

A

This is primarily concerned with logging. There are four main challenges around logging

Log Review and Analysis is often not a priority
Log Review is mundane and repetitive
Log Review needs experienced practitioners
Log Review should be done by those who understand the operations being logged

Although a popular concept is to log everything this is not often a good thing due to increased storage and collection and also the security implications of having large amounts of data stored.

89
Q

Why is data destruction in the cloud difficult?

A

Because a lot of the techniques require you to have access to the physical hardware

90
Q

What is the physical destruction of hardware in data destruction ?

A

This is the actual destruction of the storage media. It can be carried out by melting, burning, grinding and drilling. This is the most preferred method of data destruction.

91
Q

What is degaussing

A

Involves running magnetic waves over the media. Does not word for SSD storage.

92
Q

What is overwriting

A

Multiple passes of random data with a final pass of all zeros. Very time consuming for large data stores and does not work for SSD drives.

93
Q

What is cryptoshredding ?

A

Encrypting data with an encryption engine and then encrypting keys with a second encryption engine and deleting the keys from second round of encryption.

94
Q

What is the most viable data destruction technique open to cloud customers ?

A

Crypto shredding

95
Q

Does a delete operation delete data ?

A

No it merely removes logical pointers to the data

96
Q

What should the data policy cover with regards data deletion

A

The process for data disposal

Applicable regulations

When data should be destroyed.

97
Q

Who acts as the data processor in the cloud ?

A

Cloud Provider

CCSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions