Cloud Security

Question 1

Hyperconvergence

Answer 1

an IT framework that combines storage, computing, and networking into a single system that can reduce data center complexity and increase scalability

Question 2

Virtual Desktop Infrastructure: VDI

Answer 2

VDI allows a cloud provider to offer a full desktop operating system to an end user from a centralized server

Question 3

Secure Enclaves

Answer 3

Secure Enclaves:
All data is encrypted in memory and decrypted only while being used inside the CPU. The data is still completely protected, even if the operating system, hypervisor or root user are compromised.

Question 4

Security as a Service: SECaaS

Answer 4

Provides your organization with various types of security services without the need to maintain a cybersecurity staff

Question 5

Sandboxing

Answer 5

cybersecurity practice where you run and analyze code in a virtual network that mimics end-user operating environments.

Question 6

Virtual Private Cloud: VPC

Answer 6

private cloud within a public cloud made available to a single cloud consumer within a public cloud

Question 7

Cloud Access Security Broker: CASB

Answer 7

sits between cloud service users and cloud applications, and monitors all activity and enforces security policies.

Question 8

Cloud access security broker - CASB: Forward Proxy vs reverse proxy

Answer 8

A reverse proxy is a server that sits in front of one or more web servers, intercepting, checking, and approving requests from clients. This is different from a forward proxy, where the proxy sits in front of the clients.

Reverse proxy is positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with policy

Question 9

Cloud access security broker - CASB: API

Answer 9

Application Programming Interface:

A method that uses the brokers connections between the cloud service and the cloud consumer

Question 10

Application Programming Interface - API

Answer 10

A library of programming utilities used to enable software developers to access functions of another application

APIs allow for the automated administration, management, and monitoring of a cloud service

Question 11

Function as a Service: FaaS

Answer 11

A cloud service model that supports serverless software architecture by provisioning runtime containers in which code is executed in a particular programming language

Question 12

Serverless

Answer 12

A software architecture that runs functions within virtualized runtime containers in a cloud rather than on server

Question 13

Cloud Threats: Insecure API

Answer 13

API must only be used over an encrypted channel (HTTPS)

Data received by an API must pass service-side validation routines

Implement throttling/rate-limiting mechanisms to protect from a DoS

Question 14

Cloud Threats: Improper Key Management

Answer 14

APIs should use secure authentication and authorization before accessing data

Do not create one key with full control to access an application’s functions

Question 15

Cloud Threats: Insufficient Logging/Monitoring

Answer 15

WARNING: Software as a service may not supply access to log files or monitoring tools

Logs must be copied to non-elastic storage for long-term retention

Question 16

Cloud Threats: Cross Origin Resource Sharing Policy (CORS Policy)

Answer 16

is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. A web page may freely embed cross-origin images, stylesheets, scripts, iframes, and videos.

this can be a threat

Question 17

Security Groups

Answer 17

Don´t learn
Firewall for compute instances
Layer 4 (TCP/UDP)
Layer 3 address

Question 18

Instance Awareness

Answer 18

Don´t learn
Granular security controls
Identify/manage specific data flows

Define & set policies
Allows uploads to the corporate file share
Deny certain uploads to personal file share
Deny files with sensitive data
Quarantine file & send alert

Question 19

Next-gen SWG (Secure Web Gateway)

Answer 19

secure web gateway (SWG) is a security solution that prevents unsecured internet traffic from entering an organization’s internal network.

a Next Gen SWG deals in both cloud and web traffic, whereas the former only deals in web traffic and is blind to cloud-enabled threats and data risks for personal instances of managed apps