Domain 5 Flashcards
What defines service-level targets and responsibilities for IT service provider?
SLAs
What’s an internal agreement b/w the IT service provider and another part of the same org and supports the service provider’s delivery of the service.
OLAs - operational level agreement
What’s used to determine whether a service meets its quality and functionality goals?
SAC - service acceptance criteria
What defines the requirements of a service from the customer’s perspective?
SLR - service level requirement
Reactive communications are used for:
data breach notification, regulatory compliance, and problem management
T/F: Major cloud vendors provide their own customized versions of Linux that include additional agents and tools that help them work better w/ the provider’s infrastructure?
True
When managing systems at scale in the cloud, is it best to use the cloud IaaS vendor’s tools?
Yes
Why is it best to use the cloud IaaS vendor’s tools when managing systems at scale in the cloud?
B/c they’re designed to handle OS that may have special features to work in the vendor’s environment and applications.
Do CSPs allow direct or 3P audits of their systems?
No - but they will provide audit results
What is used to create, store, and manage secrets?
HSM - hardware security module
What uses code and config files or variables to allow rapid deployment using scripts and automated tools?
Infrastructure as code design
What’s used to access data from services?
APIs
What are two practices to improve service continuity?
- Understanding the number of business practices that have continuity planning in place.
- Assessing which gaps in coverage are critical.
Are Agile and DevOps well-suited to rapid release cycles w/ CI/CD delivery processes?
Yes
T/F: Agile and DevOps are better with CI/CD than Waterfall and Spiral
True
What is the first step in ITIL 4 continual service improvement process?
Identify strategy for improvement
What comes after you identify strategy for improvement in ITIL 4 continual service improvement process?
Define what to measure
What happens after you define what to measure in ITIL 4 continual service improvement process?
Gather data
What happens after you gather data in ITIL 4 continual service improvement process?
Process the data
What happens after you process the data in ITIL 4 continual service improvement process?
Analyze the information and data
What happens after you analyze the information and data in ITIL 4 continual service improvement process?
Present and use the information
What’s the last step in ITIL 4 continual service improvement process?
Implement improvement
What mode migrates VMs to other hosts or waits until they are powered down to allow for hardware or other maintenance.
Maintenance
What does centralized log collection, analysis, and detection?
SIEM tools
What is used to detect and stop attacks?
IPS - intrusion prevention system
What is a government funded research organization w/ a heavy focus on security work?
MITRE
What is an encryption protocol used to secure data in transit?
TLS
What’s used to logically separate network segments?
VLANs
What’s intended to provide security to domain name system requests?
DNSSEC
What provides IP addresses and other network config info to systems automatically?
DHCP
Will the default SSH port stop attackers and 3Ps from accessing SSH as long as it hasn’t been changed to a port outside of port 22?
Yes
What stores config management and info about relationships b/w configuration items?
Configuration Management Database
Who patches PaaS environments?
The vendor
What are designing services for availability, availability testing, and availability monitoring and reporting?
ITIL subprocesses for availability management
Do customers need to tell their vendors about breaches?
No
Do vendors need to tell their customers about breaches?
Yes
What’s necessary to establish a configuration management database?
Having an inventory to create a baseline.
What can you do once a baseline is ceated?
Establish CMB, deploy new assets configured to meet baseline, and document deviations.
What adds functionality like use of GPUs (graphics processing unit), shared clipboards, and drag and drop b/w guest OS, shared folders, and similar features that require additional integration b/w guest OS and underlying hypervisor?
Guest OS virtualization tools
What focuses on whether security practices and procedures align to risk tolerance for the org and includes verification and testing like SOC2 Type 2 audit does.
Security review objective
What topics does the security review objective cover?
Design, testing, and incident management
Is manual static code review a good fit for CI/CD?
No b/c of speed requirements
Do WAFs and IPSs test code and make application more secure?
No
Who is responsible for network-based risks in IaaS?
Customer and provider
What does configuration management start with?
Baselining
What is the critical factor when transaction volume is key?
Network latency
Azure’s best practices suggest creating disk snapshots for VM’s OS and data disks and then ______.
Safely storing the snapshots and then comparing hashes b/w images and originals
Will comparing hashes of a snapshot validate it against the original?
No
Can VMs be exported as hashes?
No
Do businesses manage customer capacity?
No, they assess their own capacity, known as business capacity mgmt
What do data breach regulations typically focus on?
Customer notification
What is the process for preserving data for legal action?
Legal hold
What is a critical part of instance scheduling?
Tagging
What allows schedules to be easily applied to all instances w/ the proper tags?
Tagging
Is adding new hardware to increase performance an element of hardening?
No
What is the process of provisioning a specific element against an attack?
Hardening
Do audits protect against attacks?
No, they detect and direct responses to attacks
Are humans in the loop for patching?
Yes, and they can be installed in non-production environments to be validated before further installation
What speeds patching and patch accuracy via automation?
Automated patching systems
What controls the entirety of the virtual environment?
Management systems, and they should be isolated physically and virtually.
Does ITIL 4 categorize deployment management as part of release management?
Yes
Who is responsible for the fit for purpose for continual service improvement?
Process owner
Who improves ITSM processes and services?
CSI (continual service improvement) managers
Who ensures processes work together and support each other effectively?
Process architects
What performs firewall-like rules-based filtering?
Network security groups
What captures and observes attacker behaviors?
Honeypots
What detects and prevents attacks based on behaviors and signatures, respectivly?
IDSs and IPSs
Hardware redundancy, local sharing and balancing, and failure mode design are all:
common practices when designing redundancy into cloud datacenters
Will vendors allow customers to conduct PCI assessments of their underlying infrastructure?
No
Will IaaS vendors allow customers to scan their own internal systems?
Yes, but they may recommend that instances w/ lower resources are not scanned to avoid disruption
Are scanning tools required to be used in an IaaS environment?
No
Is external scanning prohibited?
Yes, b/c it can affect other customers
Is scheduling a time or date required for advanced/specialized testing?
Yes
Using load balancing to drain load from existing systems and then replacing them w/ new, patched instances is a common best practice for _____.
Cloud-hosted service environment patching
Could manual and scripting patching and re-IPing cause outages?
Yes, as systems are swapped over
- Transferring users
- Preventing new connections
- Notifying customers
common practices for maintenance mode
Are HSMs used for boot security?
No
What allows you to add TPM 2.0 virtual crypto processor to a VM?
A virtual trusted platform module vTPM
What provides hardware-based, security-related functions such as random number generation, attestation, and key generation?
vTPM
What enables the guest operating system to create and store keys that are private, while not exposing the keys to the guest operating system and thereby reducing the virtual machine attack surface?
vTPM
What runs on top of an OS?
Type 2 hypervisor
What’s ITIL’s overall goal?
Restore service as soon as possible after an incident
What are top focuses of ITIL?
Identification, containment, resolution, and maintenance
What’s an interruption of normal service, including reductions in the quality of services that may violate an SLA?
Incidents
What resolves the cause of problems?
Problem management
What restores services to normal levels?
Incident response
Is the number of individuals impacted a useful KPI for availability?
No
What is the basis of security management in ITIL?
Infosec policies - more specifically “underpinning infosec policies”
In what is automated testing conducted and code must pass testing before it’s released?
CI/CD pipeline
Is human intervention/approval required for CI/CD pipelines?
No
What’s the most common means of capturing disk images from VMs in an IaaS environment?
Snapshots
What makes using forensic image acquisition tools difficult in a cloud environment?
A lack of access to the underlying hardware
What is DBAN?
A wiping tool
Do copy utilities provide a complete forensically sound copy?
No
TerraForm, CloudFormation, Ansible, Chef, and Puppet are what kind of tools?
Infrastructure as Code
What ISO describes service management?
20000-1
What ISO describes an information security management system?
27001
What’s the best tool to centralize logs and incident information?
SIEM
What can block legitimate traffic if it’s improperly identified?
IPS
Which needs to be placed in-line with traffic? IDS or IPS
IPS
Do IPS and IDS use signature and behavior-based detection?
Yes
Can an IDS fail open or closed?
No, b/c it’s not in-line
A system set to ________ does not shut down when failure conditions are present.
Fail open
________ is when a device or system is set, either physically or via software, to shut down and prevent further operation when failure conditions are detected.
Failing closed
An ________ sits in line with traffic flows and inspects all traffic before permitting it to continue on to its destination.
IPS
What shows which IP address contacted another IP address, source/destination ports, and volume of data?
Flow logging
AI features in SIEM devices are used to:
- Analyze and learn network traffic patterns
- Use log correlation and threat intelligence to identify unexpected/potentially malicious behavior
default gateway
subnet mask
DNS server info
IP address
Are all provided by
DHCP
A ________ is a router that connects your host to remote network segments.
default gateway
A _________ is a number that distinguishes the network address and the host address within an IP address.
subnet mask
________ is an Internet service that translates domain names (e.g., its.umich.edu) into IP addresses.
Domain Name System (DNS)
________ is a protocol for automatically assigning IP addresses and other configurations to devices when they connect to a network.
Dynamic Host Configuration Protocol (DHCP)
An ________ is a unique numerical identifier for every device or network that connects to the internet and is used for communicating across the internet.
Internet Protocol (IP) address
________ is a security standard developed by members of the PC industry to help make sure that your PC boots using only software that is trusted by the PC manufacturer.
Secure Boot
Disabling _________ b/w VMs and the console is a standard security practice.
cut and paste
Removing ________ is a standard security practice.
unnecessary hardware
Use of the VM console is considered direct access and should only be used for ________.
critical actions - use virtualization management platform for most actions
Are honeypots used to capture traffic to stop attacks?
No - just to study
What 3 things can stop attacks by preventing malicious traffic from entering the network?
network security groups, firewalls, and IPSs
What can be associated with subnets or individual virtual machine instances within that subnet to activate a rule or access control list (ACL) to allow or deny network traffic to your virtual machine instances in a virtual network.
Network security groups
use multiple vendors
have SLAs in place
use self-hosted failover capabilities
high availability techniques
Invest in redundant systems
Additional monitoring
availability management techniques
T/F: Disk images, VM snapshots, and network packet capture require low-level access that can’t typically be accessed in SaaS.
True
What measures performance and checks it against requirements set in SLAs and service-level requirements?
Service capacity management
What involves interpreting business needs into requirements for services and architecture?
Business capacity management
What focuses on the actual components of an infrastructure?
Component capacity management
________ is dedicated file storage that enables multiple users and heterogeneous client devices to retrieve data from centralized disk capacity.
Network-attached storage (NAS)
________ is a management platform for Windows endpoints providing inventory, software distribution, operating system imaging, settings and security management.
Microsoft Endpoint Configuration Manager
What mode is used to remove running systems for a VM cluster to allow for hardware/software upgrades?
Maintenance mode
What hides details of a system to make management simpler?
Abstraction
Like honeypots, these are set up to detect network attacks and techniques.
Honeynets
What’s used to look for unexpected traffic indicating probes by potential attackers?
Darknets
What’s used to provide secure access from a lower security zone to a higher one?
Bastion hosts
What’s the next step after data/artifacts are identified in forensics?
Preservation
________ is the managing and provisioning of infrastructure through code instead of through manual processes.
Infrastructure as Code (IaC)
Benefits of ______ include:
Increase consistency by removing human error
Easily updated
Increases speed
IaC
A ________ ensures uptime and availability by helping you manage hardware, application, and site failures.
clustered environment
The benefits of ________ include flexibility and scalability, availability and performance, reduced IT costs, and a customizable infrastructure.
server clustering
- Identifying/specifying attributes for each config item type/subcomponent
- The relationship b/w each CI/subcomponent and others in the org
Are all things _____ includes.
ITIL’s config identification subprocess
What focuses on managing changes in the config management system?
Config control
What validates that configs match what’s expected?
Config verification
