Domain 3 Flashcards
What is the primary requirement for cloud functionality?
ISP connectivity
What provides immediate, battery-driven power for a short period of time?
UPS - uninterruptible power supplies
What’s the best option for providing backup power for a sustained period of time?
Generators
Redundant arrays of inexpensive disks (RAID) and redundant servers are examples of what kind of controls?
high-availability
What identifies sensitive information stored on endpoint systems or in transit over a network?
DLP systems
What is a duplicate of your system – including lines of communication and network devices – that can act as your business’s main operating system if your primary server goes down for any reason?
Redundant server
What creates a single usable data disk, where several physical disks are combined into an array for better speed and fault tolerance.
Redundant arrays of inexpensive disks (RAID)
What are the following key concepts for:
* Mirroring: copying data to more than one disk
* Striping: splitting data across more than one disk
* Error correction (fault tolerance): redundant data is stored to allow problems to be detected and possibly fixed
RAID
Is RAID a backup solution?
No
What is a network encryption protocol used to protect sensitive information?
TLS
Can TLS identify sensitive information?
No
T/F: The management plane of a cloud service provider’s datacenter should be reserved for use by the provider’s own engineers.
True
What does traffic on the management plane control?
Operation of the infrastructure
What’s a cost-effective way to track items in a facility?
RFID - Radio frequency identification technology
What type of site includes the basic capabilities required for datacenter operations, like space, power, HVAC, and communications?
Cold site, but it lacks hardware required to restore operations
What is the most simplistic type of disaster recovery site consisting of elements providing power, networking capability, and cooling
Cold site
What type of DR site has storage hardware such as tape or disk drives, servers, and switches but has to have data transported for use in recovery?
Warm site
What type of DR site is ideal but challenging to attain that is a fully functional backup site that already has important data mirrored to it?
Hot site
What is the maximum acceptable delay between the interruption of service and restoration of service. This determines an acceptable length of time for service downtime.
RTO - recovery time objective
What is the maximum acceptable amount of time since the last data recovery point. This determines what is considered an acceptable loss of data.
RPO - recovery point objective
Every region consists of multiple __________.
Availability zones
What DR strategy is when data is live, services are idle, and some resources are provisioned and scaled after event?
Pilot light
What DR strategy is always running, business critical, and scales AWS resources after event?
Warm standby
What DR strategy has real-time RPO and RTO, zero downtime, near zero data loss, and is for mission critical services?
Multi-site, active/active
What provides the best redundancy and resiliency for backup?
Having your backup at another cloud provider
What is a set of platform as a service products that use OS-level virtualization to deliver software in packages called containers.
Docker
What packages software into standardized units called containers that have everything the software needs to run including libraries, system tools, code, and runtime.
Docker
What is the highest priority in security?
Human safety
What allows every resource on the server to be placed in a partition and can be used to achieve multitenancy, logical separation of data, scalability, and geographic sharding?
Tenant partitioning
What partitions virtual machines belonging to different tenants on a virtualization platform?
Hypervisor
Where should datacenters be located?
In the core of a building
What principle states an individual should react in a situation using the same level of care expected from any reasonable person?
Due care principle
What states an individual assigned a responsibility should exercise due care to complete it accurately and in a timely manner?
Due care
In what service model is the vendor responsible for hardware related and network related responsibilities?
IaaS
*configuring network firewalls
*maintaining hypervisor
*managing physical equipment
Are three _____ responsibilities in _____.
vendor / IaaS
What is customer responsible for in IaaS?
Patching OS on VM and managing ingress/egress via NSGs.
What data is included in incremental backup?
Only the data modified since the most recent incremental backup
What data is included in differential backup?
All data modified since last full backup
What data is included in the full backup?
All data on the server
What are transaction log backups designed to support?
Database servers, not effective on file server
A computer responsible for the storage and management of data files so that other computers on the same network can access the file.
What is a file server
What is a machine running database software dedicated to providing database services.
Database servers
What do SIEMs do?
Correlate info from multiple sources and perform analysis on data
What does SOAR stand for?
Security orchestration, automation, and response
What do SOAR platforms provide?
automated playbook responses
What do intrusion prevention platforms do?
Block traffic based on analysis performed by the IPS itself.
Do log repositories perform analysis?
No, they just collect log info
Do SIEM solutions create an audit trail?
Yes
What does an audit trail show you?
Sequential record of all the activity on a specific system
What analyzes and blocks suspicious network traffic?
IPS
What monitors endpoints for malware and responds to malware infections?
Endpoint detection and response platforms
The process of protecting devices like desktops, laptops, mobile phones, and tablets from malicious threats and cyberattack
Endpoint security
What are physical devices that connect to a network system such as mobile devices, desktop computers, virtual machines, embedded devices, and servers.
Endpoints
Who enforces an org’s security policies across cloud providers?
CASB - Cloud access security broker
What can handle large-scale DDoS attacks?
Content delivery network
What is a network of servers that distributes content from an origin server by caching content close to where each end user is accessing the internet via a web-enabled device.
CDN - content delivery network. It speeds up webpage loading for data-heavy applications.
What is designed to overwhelm a system until it can no longer process legitimate requests?
DoS attack
What principle does DDoS affect?
Availability
Is an IPS an example of risk mitigation?
Yes
What determines the critical path of assets, resources, and data w/in an org?
BIA - business impact plan - useful in shaping BC/DR plan
What should be redundant in a well-designed datacenter?
power, cooling, and network connectivity
What allows for the programmatic interaction w/ services and platforms?
APIs
What is a file that generally contains a short self-contained set of instructions, i.e., lines of code, that perform a specific task.
Python script
What do the following do:
Use HTTPS
Activate Authentication & Authorization
Validate User Input
Limit Access to Sensitive Data
Monitor and Log API Activity
Keep Software and Libraries Up-to-date
Perform Regular Security Audits
Secure the backend
What are the elements of hardware and software that ensure that a system can only be controlled by those w/ proper permissions
TCB - Trusted Computing Base
What coordinates access to physical hardware and enforces isolation b/w different virtual machines running on the same physical platform?
Hypervisor
What’s the most cost-effective way to provide network segmentation that’s used to create logical separation b/w systems in a datacenter?
Virtual local area networks (VLANs)
What’s used to connect remote users and sites over an insecure network?
VPN - virtual private network
What’s an option to route traffic b/w network sites?
BGPs - border gateway protocol
What tier is expected to achieve 99.741% availability?
Tier 2
What tier is expected to achieve 99.671% availability?
Tier 1
What tier is expected to achieve 99.982% availability?
Tier 3
What tier is expected to achieve 99.995% availability?
Tier 4
Does running unnecessary services on a server increase the attack vector?
Yes
How are compute nodes measured?
In terms of how many CPUs/how much RAM is available in the center
Do compute nodes include virtual and hardware machines?
Yes
T/F: Block storage provides disk volumes for use by servers.
True
What is a named logical area of the physical disk?
Volume
B/c entire machines could be stolen in highly-portable, easily copied formats, _____ must be protected?
VM file stores
What is a common attack vector that uses malicious SQL code for backend database manipulation to access PI?
SQL Injection
What is a programming language for storing and processing information in a relational database?
SQL
What attack executes code on a remote user’s system?
Cross-site scripting
What attack exploits trust relationships by tricking systems into authorizing unauthorized activity?
Cross-site request forgery and server-side request forgery
What is a measure of data that can be lost in an outage w/out damaging the organization?
RPO
What strategy most affects RPO?
Data replication
What’s a measure of how long an org can endure an outage w/out irreparable harm?
RPO
This is how long an org can suffer an outage before ceasing to be an org
MAD - maximum allowable downtime
What technology performs the following:
Encryption: hides the data being transferred from third parties
Authentication: ensures that the parties exchanging information are who they claim to be
Integrity: verifies that the data has not been forged or tampered with
TLS
What’s the primary protocol used to implement HTTPS for secure communication?
TLS
What is separating and storing data in separate logical partitions or storage areas, even if those partitions or storage are on the same physical device.
Logical separation
What is separating and storing data on different physical systems or networks.
Physical separation
What is a protocol used to implement VPNs?
IPsec
What is a group of protocols for securing connections between devices that helps keep data sent over public networks secure. It is often used to set up VPNs?
IPsec
What works by encrypting IP packets, along with authenticating the source where the packets come from to secure connections b/w devices?
IPsec
What is it called when you assign users only the permissions they need to perform their job responsibilities?
Least privilege
What is the unintentional accumulation of privileges over time?
Aggregation or privilege creep
What is it called when two people must work together to perform a sensitive action?
Two-person control
What is the reliance upon secrecy of security mechanisms to provide security for a system or process?
Security through obscurity
What hypervisor provides a greater degree of security b/c they run directly on top of hardware, decreasing the attack surface?
Type 1 (bare-metal)
What’s the major driver to lease space in a colocation facility?
A reduction in cost achieved by sharing cost among multiple clients.
At a minimum, the Uptime Institute requires it to offera UPS; a designated space for IT systems; dedicated cooling equipment that runs outside of office hours; and an engine generator.
Tier 1 datacenters
What is a voltage regulator that protects sensitive electronics, such as computers, lab equipment, home theaters from voltage fluctuations and power surges?
Line conditioners
Dual-power supplies are a requirement for what datacenter tier?
Tier 3
What handles traffic b/w SDN controllers and SDN applications?
NBI - northbound interface
What is used to access the SDN controller and allows a network administrator to access the SDN to configure it or to retrieve information from it?
NBI - northbound interface
In what do applications often need to communicate with network controllers to query or modify the current state of the network?
SDN - Software defined networking
What is an approach to networking that uses software-based controllers or application programming interfaces (APIs) to communicate with underlying hardware infrastructure and direct traffic on a network?
SDN - Software defined networking
What is basically SSO across multiple organizations?
Federation
What is a method of linking a user’s identity across multiple separate identity management systems allowing users to quickly move between systems while maintaining security.
Federated identity
What are hardened, tamper-resistant hardware devices that secure cryptographic processes by generating, protecting, and managing keys used for encrypting and decrypting data and creating digital signatures and certificates.
Hardware security modules
What technology provides for the management of physical keys?
KMBs - Key management boxes
Components of Kerberos authentication process.
TGT - ticket granting tickets
