Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP > Domain 1 and Some 2 > Flashcards

Domain 1 and Some 2 Flashcards

1
Q

Many different customers accessing cloud resources hosted on shared hardware.

A

Multitenancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Only Matthew’s company has access to any resources hosted on the same physical hardware.

A

Private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Matthew’s organization is combining resources of public and private cloud computing.

A

Hybrid cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Resource use is limited to members of a particular group.

A

Community cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A strong sanitization technique that involves encrypting data with a strong encryption engine and then taking the keys generated in that process, encrypting them with a different encryption engine, and destroying the resulting keys of the second round of encryption.

A

Cryptographic erasure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cryptographic erasure is effective on:

A

Magnetic and solid-state drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

T/F: Degaussing and overwriting are not effective on SSDs

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

T/F: Containers provide easy portability.

A

False, because they are dependent on the host operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Hypervisors are used to:

A

Host virtual machines on a device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A platform as a service model that allows cloud customers to run their own code on the provider’s platform without provisioning servers.

A

Serverless computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Virtual machines are self-contained and have their own internal operating system, which can be moved between:

A

different host operating systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Responsibilities of the customer

A

Use cloud services
perform service trials
monitor services
administer service security
provide billing and usage reports
handle problem reports
administer tenancies
perform business administration
select and purchase service
request audit reports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The ability of a system to dynamically grow and shrink based on the current level of demand.

A

Elasticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The ability of a system to grow as demand increases but does not require the ability to shrink.

A

Scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Zero trust decisions are not based on network location, such as IP address. Instead, it’s based on:

A

User’s identity, the nature of the requested access, and the user’s geographic (not network!) location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Bare-metal (Type 1) hypervisor is preferable to the hypervisor that runs off the OS (Type 2) because:

A

It will offer less attack surface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Network security groups provide functionality equivalent to:

A

Network firewalls for cloud-hosted server instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

_____ restrict traffic that might reach a server instance.

A

Network Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

T/F Only cloud provider can modify network firewalls

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Restrict the geographic locations from which users may access the servers.

A

Geofencing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

_____ may be used to examine the traffic reaching the instance.

A

Traffic inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Susceptible to disk failures and user error that may unintentionally destroy or modify data.

Vulnerable to ransomware attacks that infect systems with access to the object store and then encrypt data stored on the service.

A

Object storage flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Geofencing may be used to trigger actions, such as an alert, when:

A

a user or device leaves a defined geographic area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Geotagging annotates log records or other data with:

A

the geographic location of the user performing an action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The Cloud Security Alliance (CSA) provides an enterprise architecture reference guide that offers vendor-neutral _____.

A

design patterns for cloud security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The use of an API is an example of accessing data programmatically during the _____ phase of the lifecycle

A

Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Storage that is available as disk volumes.

A

Block storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Object storage maintains files in:

A

Buckets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

T/F Virtualized servers are storage capabilities.

A

F, Compute capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Network capacity is used to connect _____ to each other

A

Servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The sudo command allows a normal user account to execute administrative commands and is an example of

A

Privileged access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Service access is the access to resources by:

A

system services, rather than individual people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What protects against the risk of a lost device?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

________ is when the recipient of a message can prove the originator’s identity to a third party.

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

________ is a means of proving one’s identity.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

_____ demonstrates that information has not been modified since transmission.

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

_____ are often used in business impact assessment to capture the impact on intangible factors

A

Qualitative tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Quantitative tools, such as the computation of annualized loss expectancies and single loss expectancies, are only appropriate for:

A

easily quantifiable risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

EAL2 assurance applies when the system has been

A

structurally tested. It is the second-to-lowest level of assurance under the Common Criteria.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

These tools manage workloads and seamlessly shift them between cloud service providers.

A

Orchestration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Virtualization platforms allow a cloud provider to host:

A

virtual server instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Databases are a cloud service offering that allows for

A

the organized storage of relational data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Cloud access service brokers (CASBs) allow for the consistent enforcement of _____ across cloud providers.

A

security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Governs the storage, processing, and transmission of credit card information.

A

The Payment Card Industry Data Security Standard (PCI DSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Regulates the financial reporting of publicly traded corporations.

A

The Sarbanes–Oxley (SOX) Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Protects personal financial information.

A

The Gramm–Leach–Bliley Act (GLBA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Bring all of an organization’s cloud activities under more centralized control.

They serve as a screening body helping to ensure that cloud services used by the organization meet technical, functional, and security requirements.

They also provide a centralized point of monitoring for duplicative services, preventing different business units from spending money on similar services when consolidation would reduce both costs and the complexity of the operating environment.

A

Cloud governance programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

use a pair of keys for each user.

A

Asymmetric cryptosystems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

use a pair of keys for each user.

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Hybrid cloud strategies combine public and private cloud resources,

A

not resources from multiple public cloud providers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Email is an application-level service that is offered by cloud providers as a software as a

A

service (SaaS) capability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Block storage and network capacity are infrastructure as a service

A

(IaaS) offerings and are infrastructure capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Serverless computing is a _____ offering.

A

PaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Occurs when a customer (not a service provider) purchases more capacity than they need.

A

Overprovisioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

a mix of public cloud and private cloud services. is an example of a

A

hybrid cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

a mix of public cloud and private cloud services. is an example of a

A

hybrid cloud environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

In an infrastructure as a service environment, security duties are a _____.

A

shared responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

When Lucca reviews the RTO, he needs to ensure that the organization can recover from an outage in less than two hours based on _____.

A

the maximum tolerable downtime (MTD) of two hours.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How does the recipient of a message that was encrypted using asymmetric cryptography decrypt a message?

A

Using their own private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

The sender using asymmetric cryptography would have previously encrypted

A

using the recipient’s public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

organization that helps cloud service customers use the services offered by cloud service providers.

A

cloud service partner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

cloud service providers who offer a managed identity and access management service to cloud customers that integrates security requirements across cloud services.

A

Cloud service brokers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

applies specifically to the use of controlled unclassified information (CUI).

A

NIST 800-171

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

provide a certification process for hardware and software products.

A

Common Criteria (CC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

the Security Requirements for Cryptographic Modules. This guidance is specific to cryptographic requirements.

A

FIPS 140-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Services should be able to integrate and work together

A

Interoperability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is the highest level of assurance under the Common Criteria?

A

EAL7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What does EAL7 ensure?

A

A system has been formally verified, designed, and tested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Technology that uses cryptography to create a distributed immutable ledger.

A

Blockchain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Blockchain is the technical foundation behind ________.

A

Cryptocurrency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

An emerging technology that uses principles of particle physics to perform computing.

A

Quantum computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Moves compute power to IoT devices located at the edge of the network.

A

Edge computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What’s the difference b/w verification and certification?

A

Verification can involve a 3P testing service and compile results that may be trusted by many different organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

An area of research into methods for protecting data in use through the protection provided by a trusted execution environment (TEE)

A

Confidential computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

The act of management formally accepting (not evaluating) an evaluating system

A

Accreditation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Verification and certification process both

A

validate security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is one of the core capabilities of IaaS?

A

providing servers on a vendor-managed virtualization platform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Web-based payroll and email systems are examples of

A

SaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Does the CP’s brand influence the cost-benefit analysis?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

An application platform managed by

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

T/F: The provider absorbs the cost when the customer requests a modification of the SLA.

A

False. The customer pays for all costs associated w/ modifications to the SLA. These are chargeable expenses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Creating computer resources to solve a particular problem and then getting rid of them when you no longer need them.

A

Ephemeral computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Guaranteeing that the service will be available 99% of the time

A

availability committment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Ability of a system to withstand failures

A

resiliency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Why do users have the most control over the environments hosted on IaaS?

A

because they are able to manually adjust the resources assigned to an application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What standard provides the security controls that should be implemented by cloud service providers

A

ISO 27017

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What standard provides the security controls that should be implemented for a cybersecurity program

A

ISO 27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What standard provides the security controls that should be implemented to provide control guidance for privacy programs?

A

ISO 27701

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What standard provides a cloud reference architecture and does not offer specific security guidance?

A

ISO 17789

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Who oversees the PCI DSS

A

Payment Card Industry Security Standards Council (PCI SSC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Cloud computing where the customer only provides application code for execution on a vendor-supplied computing platform are examples of

A

PaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Providing fully functional application to customers as a cloud service

A

SaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

CaaS is a subcategory of ____

A

IaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

In risk acceptance strategy:

A

the org does nothing but document the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Purchasing insurance is what type of risk strategy

A

Risk transference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Relocating a data center would be what kind of risk strategy

A

risk avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Reengineering a facility would be what kind of risk strategy

A

risk mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Using existing data to predict future events

A

Predictive analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

A style of analytics that describes data

A

Descriptive analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

A style of analytics that optimizes our behavior by simulating scenarios

A

Prescriptive analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What allows CPs to meet various demands from customers while remaining financially viable?

A

Resource pooling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

The model that allows customers to scale their compute and/or storage needs w/ little or no intervention the provider

A

On-demand self service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Documents, in formal terms, expectations for availability, performance, or other parameters.

A

SLAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

An internal agreement b/w service organizations

A

OLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

The ability to back out of a change.

A

Reversibiity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Capability to move workloads easily between environments

A

Portability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

T/F: The customer has no access to or ability to maintain the operating system in the PaaS environment.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

What is block storage used for?

A

To provide disk volumes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is object storage used for?

A

To store individual files. But they cannot be mounted as a disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

When should archival storage be used?

A

Only in cases where data does not need to be frequently accessed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

What is the least disruptive type of disaster recovery test?

A

Checklist review.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Each team member reviews the content of their disaster recovery checklist and suggest necessary changes.

A

Checklist review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Team members come together and walk through a scenario without making any changes to information systems.

A

tabletop exercise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

The team activates the disaster recovery site for testing while primary site remains operational.

A

parallel test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Team takes down primary site and confirms the disaster recovery site is capable of handling regular operations. Most thorough test but also most disruptive.

A

full interruption test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

In SaaS solution, the vendor manages:

A

the physical infrastructure and complete application stack so customer accesses a fully managed application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

PaaS offerings provide customers with an environment where customers can:

A

execute their own code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

CaaS is a subcategory of IaaS for:

A

computing resources provided as a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Security baselines provide a:

A

starting point to scope and tailor security controls to your orgs needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

T/F: Security baselines ensure systems are always secure and prevent liability.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Integrating software development, operations, and quality assurance.

A

DevOps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What is ITIL?

A

A collection of best practices for managing IT orgs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

T/F: Customers should have access to underlying infrastructure in a PaaS environment.

A

False. But IaaS offers.

122
Q

What is RPO?

A

The amount of data loss that’s acceptable due to an incident.

123
Q

The amount of downtime that the business can safely withstand.

A

MTO - maximum tolerable outage

124
Q

What is OpenID Connect?

A

An authentication layer that works w/ OAuth 2.0 as its underlying authorization framework. Used widely by CSPs.

125
Q

SAML, RADIUS, and Kerberos are:

A

authentication technologies but don’t have the same seamless integration w/ OAuth.

126
Q

A vendor offering a fully functional application as a web-based service is an example of:

A

SaaS

127
Q

The customer provides their own software in:

A

IaaS, Compute as a Service (CaaS), and PaaS

128
Q

Where does edge computing service model place computing power?

A

At the sensor, minimizing the data that is sent back to the cloud over limited connectivity network links.

129
Q

What is the best choice for providing authentication and authorization information?

A

SAML

130
Q

What is used to exchange user information for SSO?

A

SPML

131
Q

What is XACML used for?

A

access control policy markup

132
Q

T/F: In IaaS, the customer is not responsible for server security operations

A

False

133
Q

T/F: In SaaS, a fully developed and hosted application is provided to the customer.

A

True

134
Q

Managing security settings, host firewalls, and configuring server access controls are examples of what?

A

Server security operations

135
Q

T/F: In PaaS, the customer provides application code for execution on a vendor-supplied computing platform.

A

True

136
Q

T/F: IaaS provides complex infrastructure building blocks to customers?

A

False, it’s basic building blocks

137
Q

Function as a Service is a subcategory of _____ for ______

A

PaaS for serverless computing applications

138
Q

What are more traditional methods of software development that aren’t commonly used with DevOps and DevSecOps

A

waterfall, modified waterfall, spiral models

139
Q

What’s the purpose of a CASB?

A

to enforce security policies consistently across cloud services

140
Q

Are DLP and DRM solutions effective at consistently enforcing security policies across cloud platforms?

A

No

141
Q

IPS are designed to:

A

detect and block malicious activity

142
Q

What is the vendor responsible for in IaaS?

A

hardware and network related responsibilities

143
Q

Configuring network firewalls, maintaining the hypervisor, and managing physical equipment are the responsibility of:

A

Vendor

144
Q

In IaaS, who’s responsible for patching OS on VMs?

A

Customer

145
Q

What is it called when a single platform is shared among many different customers?

A

Multitenancy

146
Q

T/F: IaaS allows you to set up infrastructure as quickly as you can deploy and pay for it?

A

True

147
Q

T/F: Security groups are different from firewall rules for IaaS?

A

False

148
Q

T/F: You cannot configure IaaS networking.

A

False, it’s done thru use of network security groups and bandwidth provisioning.

149
Q

Who has responsibility for configuring OS securely in serverless computing?

A

Vendor

150
Q

What is the framework created by government to assess security of systems?

A

NIST 800-37

151
Q

What is the list of security controls created by government?

A

NIST 800-53

152
Q

What is the payment card industry’s framework of compliance for all entities accepting credit cards?

A

PCI DSS

153
Q

What is portability?

A

The capability to move workloads easily b/w environments

154
Q

T/F: Services that are scalable are always elastic?

A

F: Services that are elastic are scalable but scalable not always elastic b/c scalability doesn’t shrink

155
Q

In IaaS, the customer has to maintain the

A

OS

156
Q

T/F: Additional security means measurable less operational capability

A

True, there’s always a tradeoff b/w security and productivity

157
Q

The minimal amount of effort required to perform your duty to others. This is care a cloud customer is required to demonstrate to protect the data it owns.

A

Due care

158
Q

T/F: Due diligence and due care are the same thing.

A

False, due diligence is activity taken in support of furthering due care.

159
Q

Confidential computing protects data in use by

A

using a TEE - Trusted Execution Environment. Can also use TPMs, HSMs, and PKIs, but they don’t protect date in use.

160
Q

What provides a general certification process for computing hardware?

A

The common criteria

161
Q

What provides certification process for hardware but is not specific to cryptographic models or used for generalized hardware?

A

FIPS 140-2

162
Q

What provides a certification process for cloud computing services?

A

FedRAMP

163
Q

What is the nomenclature for all entries in an LDAP environment?

A

The distinguished name (DN)

164
Q

Databases are used to store collected info into

A

related tables

165
Q

Are networking and virtualization technologies used to store data?

A

No.

166
Q

What is confidential computing designed to support?

A

The protection of data actively stored in memory

167
Q

T/F: The cloud customer is ultimately responsible for all legal repercussions involving data security and privacy.

A

True

168
Q

What service model allows an org to retain the most control of their IT assets in the cloud?

A

IaaS

169
Q

In IaaS, what is the customer responsible for?

A

OS, apps, and data

170
Q

What model allows org to retain greatest degree of governance?

A

Private

171
Q

Placing IoTs on a dedicated subnet or network prevents what?

A

Other users from accessing the devices directly.

172
Q

Does public cloud use vendor datacenters?

A

Yes

173
Q

Hypervisors enforce isolation b/w:

A

VMs and are susceptible to escape attacks

174
Q

HSMs and Trusted Platform Modules:

A

store and manage cryptographic keys

175
Q

Are databases vulnerable to escape attacks?

A

No.

176
Q

What allows examination of contents of encrypted HTTPS traffic and detect sensitive info?

A

Traffic inspection

177
Q

Can port blocking detect a security violation?

A

No.

178
Q

T/F: Cloud minimizes DR costs?

A

True, you can configure but not activate resources until needed

179
Q

Verifying a user is who they claim to be:

A

Authentication

180
Q

Granting access based on user identity:

A

Authorization

181
Q

Not allowing a participant in a transaction to deny they particpated:

A

Non-repudiation

182
Q

T/F: In symmetric encryption, all data is encrypted and decrypted with the same key.

A

True

183
Q

How do you validate the authenticity of a digital certificate?

A

By using the CA’s public key

184
Q

Using computing assets on a temporary basis:

A

Ephemeral computing

185
Q

Confidential computing uses ____ to protect data in ____

A

TEE, use

186
Q

Parallel computing uses ______ ________ to perform _________.

A

multiple processors, different parts of a calculation simultaneously

187
Q

Business continuity ensures

A

business can function during disruptive event

188
Q

Support the return to normal operations

A

Disaster recovery

189
Q

T/F: BC and DR use RTO and RPO as metrics to determine success.

A

True

190
Q

What is paramount in all security efforts?

A

Health and human safety.

191
Q

What is MTD in disaster recovery?

A

Maximum tolerable downtime.

192
Q

Identifying the key, user, and how it is used would support what?

A

Accountability for usage

193
Q

What is the issue with overwriting SSDs and volumes?

A

Remnant data

194
Q

Tokenization relies on:

A

two databases, one with tokenized data and one with actual data

195
Q

T/F: Tokenization requires id practices, encryption, and specifies FIPS 140 requirements.

A

False, it does not

196
Q

What is FIPS 140?

A

The 140 series of Federal Information Processing Standards are U.S. government computer security standards that specify requirements for cryptographic modules.

197
Q

T/F: You can tokenize data by hashing

A

True

198
Q

What is tokenizing data?

A

The process of substituting a sensitive data element with a non-sensitive equivalent.

199
Q

What helps you see how data is created, moves, and is used thru org?

A

Dataflow diagrams

200
Q

Classification, creation, and date/time are all captured in:

A

Data labeling

201
Q

Data types, fields/names, services, systems, ports, protocols, and security detail are all included in:

A

Dataflow diagrams

202
Q

Includes retention periods, reg/comp requirements, data classification impacts on retention, how/when data should be deleted, archiving/retrieval processes.

A

Retention policies

203
Q

An IRM should maintain a:

A

certificate revocation list

204
Q

What is an IRM system?

A

IT security technology used to protect documents containing sensitive information from unauthorized access.

205
Q

How does an IRM system perform provisioning?

A

Provides rights based on roles and responsibilities.

206
Q

What does a business impact analysis determine?

A

What data is needed to continue the operations of the business. An assessment of data criticality.

207
Q

Data mapping matches:

A

fields in databases.

208
Q

BIAs assess:

A

the importance of data to an organization’s work

209
Q

Data classification describes:

A

Data based on things like sensitivity, jurisdiction, and criticality

210
Q

Installing a local agent for an IRM system ensures data is properly handled on _____.

A

Endpoint systems

211
Q

What is a local agent?

A

A program that collects information or performs a task in the background at a particular schedule.

212
Q

Examples of unstructured data

A

images, audio, video, word processing files

213
Q

T/F: Ingress and egress fees are cheap

A

False

214
Q

T/F: Working with the original drive is a best practice.

A

False, not a forensic best practice

215
Q

T/F: IRM cannot prevent copying, printing, and making copies

A

False, this is what it does.

216
Q

T/F: Discovery can be conducted using local tools in each region.

A

True

217
Q

It is common to archive data to a _____ storage tier

A

lower cost and lower performance

218
Q

The ____ phase often includes modification of data.

A

Use

219
Q

What is the encryption protocol of choice for web app traffic?

A

TLS - Transport layer security (replaced SSL)

220
Q

MD5 and SHA-1 are _______ algorithms.

A

Hashing

221
Q

Uses both asymmetric and symmetric encryption to protect the confidentiality and integrity of data-in-transit

A

TLS

222
Q

Used to establish a secure session between a client and a server. Public key cryptography.

A

asymmetric encryption

223
Q

What is symmetric encryption?

A

Used to exchange data within a secured session created by asymmetric encryption. You use the same key to encrypt and decrypt.

224
Q

How does asymmetric encryption work?

A

Uses a mathematically related pair of keys for encryption and decryption: a public key and a private key. If the public key is used for encryption, then the related private key is used for decryption. If the private key is used for encryption, then the related public key is used for decryption.

225
Q

What is a public key?

A

A key made available to anyone to encrypt data.

226
Q

What is a piece of information used for scrambling data so that it appears random; often represented by a large number, or string of numbers and letters?

A

Key

227
Q

What’s another word for unencrypted data?

A

Plaintext

228
Q

What is a private key?

A

The key used to put encrypted information back into plaintext.

229
Q

Plaintext + key =

A

Ciphertext

230
Q

Where can you find a public key?

A

In a website’s SSL/TLS certificate

231
Q

Where is the private key installed?

A

On the origin server

232
Q

What uses public key cryptography to authenticate the identity of the origin server and exchange data that is used for generating the session keys.

A

TLS handshake

233
Q

How are bad actors prevented from decrypting communications, even if they identify or steal one of the session keys from a previous session?

A

Clients and servers agree upon new session keys for each communication session

234
Q

What is spreading data across different storage areas and potentially different cloud providers spread across geographic boundaries?

A

Data dispersion

235
Q

What is the technique of splitting up and storing encrypted information across different cloud storage services?

A

Bit splitting. Used by criminals to hide data across the cloud and makes it extremely difficult for forensics to find and obtain.

236
Q

Ephemeral storage is wiped and reclaimed for reallocation only when:

A

An instance is terminated, not just shut down. For shut downs, it’s retained until the system is reactivated.

237
Q

Ephemeral data is kept for ______ periods of time?

A

Short (like 45 days)

238
Q

What does it take to complete the destruction process for crypto-shredding?

A

Securely erasing all copies of the encryption key. Just erasing the key deletes all data associated with it.

239
Q

Deleting replicated data (especially in a relational database - which could accidentally delete a lot of unintentional data), data in a backup, and deleting the right data are all problems solved by _____.

A

crypto-shredding

240
Q

What is cloud security?

A

How cloud affects confidentiality, integrity, and availability

241
Q

What does an IRM system rely on to identify systems?

A

Certificates

242
Q

What can be issued centrally, managed, and used for digital signatures and encryption?

A

Certificates

243
Q

What is a unique, digitally signed document which authoritatively identifies the identity of an individual or organization.

A

Certificate

244
Q

________ uses a one-way cryptographic function to replace data with values that can be referenced without exposing the actual data.

A

Hashing

245
Q

What is long-term storage often used for?

A

Logs and data storage

246
Q

What storage is allocated as a virtual drive/device w/in cloud?

A

Volume-based storage

247
Q

What is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes.

A

DevOps

248
Q

What is a code used to identify and authenticate an application or user?

A

An API key

249
Q

What are processes used to restore the service if the system becomes unavailable for reasons other than regular maintenance?

A

Break-glass process

250
Q
  1. Automated backups in place and executed regularly based on # of secrets and their lifecycle
  2. Frequently test the restore procedures
  3. Encrypt backups and place on secure, monitored storage
A

OWASP’s requirements for break-glass secrets backup

251
Q

What is the amount of time before data can be accessed?

A

Retrieval time

252
Q

What compares two strings to determine if they’re the same?

A

String comparison

253
Q

What allows IRM to apply rules appropriately?

A

Tagging and labeling

254
Q

What’s one of the most important things to understand before selecting archival storage?

A

Data access patterns

255
Q

What influences cost of storage?

A

Volume of data and amount of time it needs to be stored

256
Q

How are data owners defined?

A

By data classification policies

257
Q

What do data custodians do?

A

Be responsible for the data, ensure access control, proper storage, and other operational controls

258
Q

Who processes data as part of a business process?

A

Data processors

259
Q

Are tokens encrypted?

A

No

260
Q

T/F: Versioning takes up very little space.

A

False

261
Q

T/F: Daily backups, recurring snapshots, and archiving processes are able to be quickly restored.

A

False

262
Q

T/F: You can use least privilege for secrets.

A

True

263
Q

What type of discovery searches for specific terms in unstructured data?

A

Content-based

264
Q

What type of discovery relies on data labels?

A

Label-based

265
Q

What type of discovery uses metadata information?

A

Metadata-based

266
Q

What can help DLP manage data without relying on pattern matching?

A

Tagging

267
Q

T/F: Tags are unique allowing events to be tracked to an instance.

A

True

268
Q

Which sanitization technique is best for solid-state drives (SSDs)?

A

Cryptographic erasure

269
Q

T/F: Cryptographic erasure is good for SSD and magnetic drives?

A

True

270
Q

With zero trust architecture, trust decisions are not based on _________.

A

Network location, like IP address.

271
Q

What is geolocation?

A

The geographic location of a user or computing device.

272
Q

What security control is best to restrict ports on a server?

A

Network security groups - they’re like firewalls for cloud server instances.

273
Q

Can a customer modify network firewall rules?

A

No

274
Q

What restricts locations from which users can access servers?

A

Geofencing

275
Q

Does geofencing trigger alerts?

A

Yes

276
Q

What EAL assurace level provides the system has been structurally tested?

A

EAL2

277
Q

They offer a managed IAM service to customers that integrate security requirements across cloud services.

A

cloud brokers

278
Q

What’s the highest level of assurance under Common Criteria?

A

EAL7 - verified, designed, and tested

279
Q

Functionally tested

A

EAL1

280
Q

Structurally tested

A

EAL2

281
Q

Methodically tested and checked

A

EAL3

282
Q

EAL4

A

Methodically designed, tested, and reviewed

283
Q

EAL5

A

Semi-formally designed and tested

284
Q

Semi-formally verified, designed, and tested

A

EAL6

285
Q

Formally verified, designed, and tested

A

EAL7

286
Q

What optimizes our behavior by simulating many scenarios?

A

Prescriptive analytics

287
Q

______ storage is used to provide disk volumes, which are storage areas with a single file system.

A

Block

288
Q

Storage that will be used as a disk attached to a server instance?

A

Block storage

289
Q

What is used to store individual files but can’t be mounted as a disk?

A

Object storage

290
Q

OpenID Connect works with ________.

A

OAuth 2.0

291
Q

A _____ is a condition that must be present for an event to occur.

A

Necessary condition

292
Q

A _______ is a condition or set of conditions that will produce the event.

A

Sufficient condition

293
Q

In IaaS, the provider is responsible for hardware and _____ related responsibilities.

A

Network - this includes configuring firewalls, maintaining hypervisor, and managing physical equipment

294
Q

FedRAMP provides a certification process for ____________.

A

Cloud computing services

295
Q

Common Criteria provides what?

A

General certification process for computing hardware that might be used in government applications

296
Q

In a LDAP environment, each entry in a directory server is identified by a ______.

A

Distinguished name (DN)

297
Q

What does confidential computing protect?

A

Data actively stored in memory

298
Q

What’s the most cost effective DR approach?

A

Using a cloud site without activating resources until needed.

299
Q

What are the 3 categories of infrastructure?

A
  1. compute - where processors are
  2. storage - object, block, file
  3. network - how everything talks
300
Q

GPU

A

graphics processor for ml/ai

301
Q

Compute

A

general purpose computing needs, web/app server

302
Q

HPC

A

high performance computing - things that require lots of power in small footprint

303
Q

Object storage

A

lower performance but inexpensive, general purpose storage - pictures, documents, data/graphics on web server, etc.

304
Q

Block storage

A

network storage, attaches iscuzi

305
Q

File storage

A

attaches with nfs

CCSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions