Domain 3

Question 1

Generator

Answer 1

sustained period of power loss

Question 2

Management Plane

Answer 2

The management plane of a cloud service provider’s datacenter should be reserved for use by that provider’s own engineers.

Question 3

RFID - Track items in a facility

Answer 3

Radio frequency identification (RFID) technology is a cost-effective way to track items in a facility.

Question 4

DR Sites: Cold site, Warm site, Hot site

Answer 4

Hot site: A fully functional data center that’s usually kept ready around the clock. It’s a near duplicate of an organization’s primary site, with complete backups of user data and full computer systems. Hot sites are the most expensive option and are best for businesses with zero tolerance for downtime and data loss

Warm site: A data center that’s equipped with some or all of the hardware, software, and network services found in a working data center, but doesn’t have live data. Warm sites are a good option for businesses with a lower budget and a need for flexible and fast recovery

Cold site: An empty operational space with basic facilities like air conditioning, power, and communication lines. Cold sites have no or little equipment or hardware, and no network connectivity or data synchronization. Before a cold site can be used, backup data and additional hardware must be sent to the site and installed.

Question 5

Partitioning of the virtual machines: Hypervisor

Answer 5

All of these technologies play some role in tenant partitioning. However, this question asked specifically about the partitioning of virtual machines belonging to different tenants. This is the responsibility of the hypervisor on a virtualization platform.

Question 6

SIEM Versus SOAR

Security Information and Event Management (SIEM)

security orchestration, automation, and response (SOAR) platforms

Answer 6

SOARs use machine learning-driven automation to prioritize and respond to security incidents, while SIEMs simply identify them

Question 7

RTO < MTD

the recovery time objective (RTO)
the maximum tolerable downtime (MTD)

Answer 7

the recovery time objective (RTO) data, she needs to ensure that the organization can recover from an outage in less than 30 minutes based on the maximum tolerable downtime (MTD) of 30 minutes.

Question 8

A content delivery network (CDN)

can handle DDoS attacks

Answer 8

A content delivery network (CDN) run by a major provider can handle large-scale DDoS attacks more easily than any of the other solutions

Question 9

business impact analysis (BIA)

Answer 9

The business impact analysis (BIA) is designed for this purpose: to determine the critical path of assets/resources/data within the organization. It is a perfect tool to use in shaping the BC/DR plan.

Question 10

Well designed data center

Answer 10

A well-designed datacenter should have redundant systems and capabilities for each critical part of its infrastructure. That means that power, cooling, and network connectivity should all be redundant. Kim should determine how to ensure that a single system failure cannot take her datacenter offline.

Question 11

ultimate responsibility (CEO)

for the success of the disaster recovery plan

Answer 11

The key to successfully answering this question is noticing that it asks who bears “ultimate responsibility.” The chief executive officer (CEO) bears ultimate responsibility for the success of the organization and, therefore, will be the one held accountable if the business fails.

Question 12

The hypervisor

Answer 12

The hypervisor is responsible for coordinating access to physical hardware and enforcing isolation between different virtual machines running on the same physical platform.

Question 13

VLAN : Data center -
network segmentation

Answer 13

Virtual local area networks (VLANs) are used to create logical separation between systems in a datacenter and are the most cost-effective way to provide network segmentation.

Question 14

Risk - opportunity : balance

Answer 14

Risk should always be considered from a business perspective. When a risk is accepted, it should be balanced by a corresponding

Question 15

DC Tiers - availability %

Answer 15

Tier 1 datacenters are expected to achieve 99.671% availability.

Tier 2 datacenters are expected to achieve 99.741% availability.

Tier 3 datacenters are expected to achieve 99.982% availability.

Tier 4 datacenters are expected to achieve 99.995% availability.

Question 16

recovery point objective (RPO)

Answer 16

The recovery point objective (RPO) is a measure of data that can be lost in an outage without irreparably damaging the organization. Data replication strategies will most affect this metric, as the choice of strategy will determine how much recent data is available for recovery purposes.

Question 17

Recovery time objective (RTO)

Answer 17

Recovery time objective (RTO) is a measure of how long an organization can endure an outage without irreparable harm. This may be affected by the replication strategy, but not as much as the RPO.

Question 18

The maximum allowable downtime (MAD)

Answer 18

The maximum allowable downtime (MAD) is how long an organization can suffer an outage before ceasing to be an organization. This is not dependent on the RPO, and the data replication strategy won’t have much effect on it at all.

Question 19

The mean time to failure (MTTF)

Answer 19

The mean time to failure (MTTF) is a measure of how long an asset is expected to last (usually hardware), as determined by the manufacturer/vendor. The data replication strategy will have no bearing on this whatsoever.

Question 20

the northbound interface (NBI)

Answer 20

In software-defined networking (SDN), the northbound interface (NBI) usually handles traffic between the
SDN controllers and SDN applications

Question 21

Ping, Power, Pipe

Cloud data center characteristic

Answer 21

Ping is a term used to describe the ability of customers to access their systems remotely. Power is shorthand for electrical power to the systems. Pipe refers to the network connectivity that supports servers’ connections to the internet.

Question 22

SDN allows n/w admins n architects to

Answer 22

Software-defined networks allow administrators to perform a variety of automated functions. These include rerouting traffic based on current customer demand, creating logical subnets without having to change any physical connections, and filtering access to resources based upon specific rules or settings

Question 23

Disk Volumes - block storage
Disk volumes - when snapshot - store in less expensive object storage

Answer 23

Disk volumes used to support virtual machines are typically stored on block storage. However, when snapshotting is used to create backups of those disks, the backups are commonly stored in less expensive object storage. Dedicated disks are not generally used in cloud environments

Question 24

Most accurate reconstruction of user activity —

full packet capture

Answer 24

full packet capture provides the most accurate reconstruction of user activity, but it is costly to implement due to data storage requirements.

Question 25

IMP —-Managed service arrangement - sometimes restrict port scan and pen test

Answer 25

Many cloud providers restrict activities that are common for administrative and security purposes but can also be construed/used for hacking; this includes port scanning and penetration testing. These restrictions can reduce the customer’s ability to perform basic security functions. Customers should review these practices with service providers and confirm that they are allowed to conduct routine security activities.

Question 26

No physical access - cloud data centers

Answer 26

Cloud providers may be reluctant to grant physical access, even to their customers, on the assumption that allowing access would disclose information about security controls. In some cases, cloud customers won’t even know the location(s) of the datacenter(s) where their data is stored.

Question 27

VM Config mgmt tools should —
log file generation

Answer 27

Virtual machine (VM) configuration management (CM) tools should require that managed systems perform

Question 28

Human Safety

Answer 28

Health and human safety is a paramount goal of security; all facilities must have multiple emergency egress points