Domain 5 Cloud Security Operations Wiley Flashcards
What term is used to describe agreements between IT service providers and customers that describe service level targets and responsibilities of the customer and provider?
A. OLA
B. SAC
C. SLA
D. SLR
C. SLA
Explanation:
Service level agreement defines service level targets and the responsibilities of the IT service provider and customer.
An OLA (operational level agreement) is an internal agreement between the IT service provider and another part of the same organization and supports the service providers delivery of the service.
Service Acceptance Criteria (SAC) are the criteria used to determine whether a service meets its quality and functionality goals.
Finally, a service level requirement (SLR) defines the requirements of a service from the customers perspective
Sally is building her organizations communication plans and knows that customers are an important group to include in the plan. What key function does proactive customer communication help with?
A. Notification of breaches
B. Regulatory compliance
C. Managing expectations
D. Problem management
C. Managing expectations
Explanation:
Proactive customer communications is key to managing expectations. Reactive communications are often used for data breach notification, regulatory compliance and problem management
Juanita has discovered unexpected programs running on her freshly installed Linux system that was built using her cloud providers custom Linux distribution but that did not allow connections from the internet yet. What is the most likely reason for this?
A. Juanita inadvertently installed additional tools during the installation process
B. The version of Linux automatically downloads helper agents when installed.
C. Cloud vendors often install helper utilities in their own distributions
D. Attackers have installed applications
C. Cloud vendors often install helper utilities in their own distributions
Explanation:
Juanita knows that the major cloud vendors provide their own customized versions of Linux that often include additional agents and tools to help them work better with the providers infrastructure. She should verify that this is the case, but it is the most likely scenario for a freshly built system as described
Ben wants to manage OS and application patches for thousands of machines hosted in an IaaS vendors cloud. What should he do?
A. Use the cloud vendors native patch management tools
B. Use the OS vendors patch management tools
C. Use manual update processes
D. Write custom scripts to manage updates
A. Use the cloud vendors native patch management tools
Explanation:
When managing systems at scale in the cloud, Ben knows that the best option is to use the cloud IaaS vendors tools, particularly because they are typically designed to handle both OS that may have special features to work in the vendors environment and applications
Jasons organization is required to provide information about its cloud operating environment, including yearly audit information to regulators in his industry. What is he most likely to be able to provide to the regulators when they ask for a security audit of his hosted environment?
A. A recent audit conducted by staff from Jason’s organization
B. A recent audit conducted by a third party auditor hired by Jasons organization
C. Direct audit permissions for the regulators to audit the cloud provider
D. A copy of the cloud providers third party audit results
D. A copy of the cloud providers third party audit results
Explanation:
Jason knows that cloud service providers typically do not allow direct or third party audits of their systems and services but they do provide audit results to customers
Tracy has set up a cloud hardware security module service for her organization in her cloud hosted environment. What activity is she preparing for?
A. Securely storing and managing secrets
B. Ensuring end to end encryption between cloud and on site systems
C. Managing the security of the underlying hardware in the environment
D. Detecting attacks against hosted systems
A. Securely storing and managing secrets
Explanation:
A cloud hardware security module (HSM) is used to create, store and manage secrets
Charles wants to be able to create new servers as needed for his environment using variables and configuration files to configure the systems to meet changing needs. What type of solution should he implement to help with this type of orchestration?
A. A CI/CD pipeline
B. Infrastructure as code
C. A check in/check out design
D. An application interface
B. Infrastructure as code
Explanation:
Charles knows that his situation calls for an infrastructure as code design, which uses code and configuration files or variables to allow rapid deployment using scripts and automated tools. A CI/CD pipeline will often leverage infrastructure as code and automation tools, but it doesnt directly meet this need. APIs (application programming interfaces) are used to access data from services and check in/checkout design was made up for this question
James wants to establish key performance indicators for his service continuity management practice based on ITIL. Which of the following is a useful KPI for service continuity management?
A. The number of business processes with continuity agreements
B. The number of vulnerabilities found in installed software per period of time
C. The number of patches installed per period of time
D. The number of natural disasters in the local area in a year
A. The number of business processes with continuity agreements
Explanation:
From a service continuity management perspective, the number of business processes with continuity agreements is the only relevant answer from this list. Understanding the number of business practices that have continuity planning in place and assessing which gaps in coverage are critical is a common practice to improve service continuity
Zoe wants to speed up her traditional release management process. What modern approach is best suited to an ITIL v4 based rapid release oriented organization?
A. Waterfall
B. Agile/DevOps
C. Spiral
D. RAID
B. Agile/DevOps
Explanation:
Agile and DevOps are well suited to rapid release cycles, with continuous integration and continuous delivery processes. Waterfall and spiral both tend to take longer periods of time for each release, and RAD is not as widely adopted and not as release focused.
ITIL v4 includes a seven step continual improvement model. What item occurs at the end of the process before it starts again?
A. Determining the vision
B. Assessing results
C. Taking action
D. Determining the goal
B. Assessing results
Explanation:
Assessing results occurs at the end of the seven step process, helping provide feedback into the next cycles vision determination phase
Tim puts a server in his virtualization environment into maintenance mode. Which of the following events will occur?
A. Migrates the running virtual machines to other hardware
B. Pauses all running VMs immediate
C. Sends a notification to users, then pauses running VMs
D. Mark the machine as unavailable for new VMs
A. Migrates the running virtual machines to other hardware
Explanation:
Maintenance mode migrates virtual machines to other hosts or waits until they are powered down to allow for hardware or other maintenance. Tim knows that he will need to ensure all VMs are migrated or shut down and that he can then perform maintenance
Kathleens wants to centralize her log capture and analysis capabilities and use automated tools to help her identify likely security issues. What type of tool should she look for?
A. SIEM
B. IPS
C. CASB
D. MITRE
A. SIEM
Explanation:
Kathleen should look for a security information and event management (SIEM) tool. They are used to centralized log collection, analysis, and detection capabilities and often have automated methods of ding issues and alerting on them. An IPS is used to detect and stop attacks, a CASB is used to control and manage access to cloud services and MITRE is a US government funded research organization with a heavy focus on security work
Elaine wants to ensure that traffic is encrypted in transit. What technology is commonly used to secure data in transit?
A. VLANs
B. TLS
C. DNSSEC
D. DHCP
B. TLS
Explanation:
TLS is an encryption protocol used to secure data in transit. VLANs are used to logically separate network segments, DNSSEC is intended to provide security to domain name system requests, and DHCP provides IP addresses and other network configuration information to systems automatically
Ujama wants to protect systems in his environment from being accessed via SSH. What should he do if he needs to leave the service available for local connections?
A. Block inbound connections to TCP port 3389 on his firewall
B. Block outbound connections to TCP port 3389 on his firewall
C. Block inbound connections to TCP port 22 on his firewall
D. Block outbound connections to TCP port 22 on his firewall
C. Block inbound connections to TCP port 22 on his firewall
Explanation:
Blocking inbound connections to port 22, the default SSH port will stop attackers and third parties from outside of the network from accessing SSH as long as it hasnt been changed to another port. TCP 3389 is associated with RDP
Ron wants to use a central system to store information about system and software configurations and their relationships. What tool is often used for this support standards based configuration management practices like those found in ITIL v4?
A. CRM
B. CMDB
C. Configuration item
D. Change catalog
B. CMDB
Explanation:
A configuration management database (CMDB) is frequently used in mature standards based configuration management environments where it stores both configuration management and information about relationships between configuration items (CIs). CRMs are customer relationship management tools and arent part of the CCSP exam. A change catalog was made up for this question
Maria’s manager is concerned about patching for the underlying cloud environment that her PaaS vendor provides. What should Maria tell her manager?
A. Maria’s organization is responsible for patching and needs to set up a regular patch cycle
B. The vendor is responsible for patching and there is no patching that needs to be done by customers in a PaaS environment
C. Negotiations need to be done with the vendor to determine which organization is responsible for patch management
D. The contract will determine which organization is responsible for patch management
B. The vendor is responsible for patching and there is no patching that needs to be done by customers in a PaaS environment
Explanation:
Maria knows that PaaS environments are patched by the vendor and that she does not need to perform patching of the software or cloud service. She may, however, have to decide when to adopt patches or versions - although she wont be able to delay adopting new versions forever
ITIL v4 describes three sub-processes related to availability management. What are these three sub-processes?
A. Designing services for availability, disaster recovery testing, determining availability targets
B. Availability management, availability metrics, and availability improvement
C. Designing services for availability, availability testing, and availability monitoring and reporting
D. Availability planning, availability improvement, availability validation
C. Designing services for availability, availability testing, and availability monitoring and reporting
Explanation:
The ITIL sub-processes for availability management are designing services for availability, availability testing and availability monitoring and reporting. Even if you’re not familiar with ITIL, thinking about a standards based approach to availability might help you - design, testing and monitoring are all logical steps in a process like this
Naomis organization has recently experienced a data breach. Which of the following parties is least likely to require notification based on existing contracts or regulations?
A. Customers
B. Vendors
C. Regulators
D. Partners
B. Vendors
Explanation:
Vendors are the least likely to have contractual or regulatory requirements that mean they must be notified. Vendors often have to tell their customers about breaches, but customers typically do not need to tell their vendors
Megan is starting her organization’s change management practices. She has conduced an asset inventory. What step is typically next in a change management process?
A. Create a baseline
B. Deploy new assets
C. Establishing a CMB
D> Documenting deviations from the baseline
A. Create a baseline
Explanation:
Megan’s next step once she has an inventory is to create a baseline. With that in hand she can establish a CMB, deploy new assets configured to meet the baseline and document deviations that the CMB approves if needed
Dan wants to use clipboard based drag and drop between his virtualized desktops in a Type 2 hypervisor environment. Which of the following steps is most likely to allow him to access additional features that require virtualization environment integration to work?
A. Building the virtual machines as containers
B. Installing guest operating system virtualization tools
C. Installing virtualization environment orchestration tools
D. Building the containers as virtual machines
B. Installing guest operating system virtualization tools
Explanation:
Guest operating system virtualization tools add additional functionality like use of GPUs, shared clipboards, and drag and drop between guest OS, shared folders and similar features that require additional integration between the guest OS and the underlying hypervisor and hardware
Geoff knows that ITIL v4 focuses on four information security management policies. Which of these processes could involve an SOC 2 Type 2 audit?
A. Design of security controls
B. Security testing
C. Management of security incidents
D. Security Review
D. Security Review
Explanation:
The security review objective focuses on whether security practices and procedures align to risk tolerance for the organization and includes verification and testing like an SOC 2 Type 2 audit does. Design, testing and management of incidents involve the topics they describe
Theresa is building an automated CI/CD pipeline. She wants to ensure that code that passes through the pipeline is secure before it moves from staging to production. What is her best option if she wants to test the running application?
A. Manual static code review
B. Automated code review
C. Using a web application firewall
D. Using an IPS
B. Automated code review
Explanation:
Ensuring that the code itself is secure in an automated process requires a tool that can be run as part of the process. That means that the only option from the list that is viable is an automated review of code. Manual static code review isnt a good fit for a CI/CD pipeline in most cases due to speed requirements. WAFs and IPS scan help protection the application but again they do not test the code or make the application itself more secure
The Cloud Security Alliance’s Cloud Incident Response (CIR) framework documents typical breakdowns for customers versus cloud provider responsibilities in incident response, including point to cloud provider as being responsible for almost all risks in an SaaS environment, who is responsible for network risks?
A. The customer
B. Both the customer and the service provider
C. The service provider
D. Third party incident responders
B. Both the customer and the service provider
Explanation:
Since IaaS provides the customer with access to and control over some of the network, they must take responsibility for network based risks. The IaaS provider provides services and infrastructure, and thus must take responsibility for some of the network based risks as well. Third party incident responders do not play a role in risk responsibility in this model
Eleanor wants to build her organizations change management processes. What is the typical first step for change management efforts?
A. Policy creation
B. Baselining
C. Documentation creation
D. Vulnerability scanning
B. Baselining
Explanation:
Configuration management typically starts with baselining. While policies and documentation are important, creating a baseline allows organizations to understand what they have and what state it is in, a critical part of the change management practice
Juanita is responsible for a web application that is split between an on site application environment and a cloud hosted database. Juanita knows the application performs thousands of small database queries for some transactions. What performance monitoring option is most important to her applications performance?
A. The network routes between datacenters
B. Network throughput between the two datacenters
C. The bandwdith between the two datacenters
D. Network response time (latency) between the datacenters
D. Network response time (latency) between the datacenters
Explanation:
Network latency is the critical factor when transaction volume is key. Bandwidth is less critical for small transactions, even when there are thousands of them. Routes may influence all of these options but arent as critical as the impact they have on the traffic.
Kolin needs to collect forensic data from an Azure hosted VM. What should he do to validate his forensic data after capturing disk snapshots for the VMs OS and data disks?
A. Compare hashes of the VMs OS and data disks and the snapshots of each
B. Make two copies of the snapshots and compare hashes between the snapshot hashes
C. Export the VM as a hash, then validate the hash
D. Export the VM as a disk image and compare the disk image’s digital signature to the original
A. Compare hashes of the VMs OS and data disks and the snapshots of each
Explanation:
Azure’s best practices suggest creating disk snapshots for both the VMs OS and data disks, safely storing the snapshots, then comparing hashes between the images and the originals. Comparing the hashes of a snapshot to a copy wont validate it against the original, VMs cant be exported as hashes, and disk images arent signed in a way that makes sense for this type of forensic use.
Ilya wants to use an ITIL v4-based practice for capacity and performance management. Which of the following is not a typical subprocess for capacity and performance management under ITIL?
A. Customer KPI oversight
B. Service capacity management
C. Component capacity management
D. Capacity management reporting
A. Customer KPI oversight
Explanation:
Businesses typically dont manage customer capacity. Instead, they would assess their own capacity, know as business capacity management
Nick’s organization has experienced a data breach of their cloud hosted environment. Which of the following is most likely to need to be communicated with based on regulations?
A. Vendors
B. Customers
C. Partners
D. Law enforcement
B. Customers
Explanation:
Data breach regulations typically focus on customer notification. Nick should work with legal counsel to ensure that his organization is compliant with any notification requirements for his industry and location
Valerie has created disk images of virtual machines running in her cloud environment. What key digital forensic requirement should she ensure is handled properly if she believes that the information be used for a legal case in the future?
A. Legal hold
B. Chain of custody
C. Seizure requirements
D. Disposal requirements
B. Chain of custody
Explanation:
Valerie should carefully document the chain of custody for the disk images so that they can be considered valid for potential legal action. Legal hold is the process for preserving data for legal action, not for documenting actions taken with disk images and other forensic artifacts. Seizure is a type of acquisition but isnt mentioned here, and disposal would occur after the potential legal case
Asha wants to take advantage of her cloud providers ability to schedule instances to match her business practices. What practice will help her handle a large number of instances with different scheduling requirements?
A. Using a third party scheduler
B. Enabling auto scheduling
C. Tagging
D. Disabling unused instances
C. Tagging
Explanation:
Tagging is a critical part of instance scheduling, but even more so for large numbers of instances. It allows schedules to be easily applied to all instances with the proper tags. Since Asha wants to use her cloud providers scheduling, a third party does not meet her requirements. Autoscheduling was made up for this question, and disabling unused instances help with spend but doesnt help more than tagging would for scheduling
Which of the following is not an aspect of host hardening?
A. Removing all unnecessary software and services
B. Patching and updating as needed
C. Adding a new hardware to provide increased performance
D. Installing a host based firewall and an intrusion detection system
C. Adding a new hardware to provide increased performance
Explanation:
Adding new hardware to increase performance is not an element of hardening. Hardening is the process of provisioning a specific element (in this case, a host) against attack. Audits don’t protect against attacks; they only detect and direct responses to attacks
Isabell has been asked to review her organizations patch management scheme. The current process focuses on manual patch installation on a weekly window. Isabella is interested in moving to an automated patch deployment process on a more frequent basis. What risk is commonly associated with automated patching systems?
A. The potential to disrupt systems due a t patching issue or bad patch
B. The inability to report on patches that fail installation
C. The inability to report on patches that are not installed
D. The potential to increase patching speed and accuracy
A. The potential to disrupt systems due a t patching issue or bad patch
Explanation:
Automated patching systems can cause disruptions if a bad patch is released or if there is an installation problem that is not detected. That means that a human is often in the loop for patching, or that patches are installed in nonproduction environments first where they can be validated prior to further installation and on systems that do not have patches in place, and it is a desirable feature to speed patching and patch accuracy via automation
In order to enhance virtual environment isolation and security, a best practice is to:
A. Ensure that all virtual switches are not connected to the physical network
B. Ensure that management systems are connected to a different physical network than the production systems
C. Never connect a virtual switch to a physical host
D. Connect physical devices only with virtual switches
B. Ensure that management systems are connected to a different physical network than the production systems
Explanation:
The management systems control the entirety of the virtual environment and are therefore extremely valuable and need to be protected accordingly. When possible, isolating those management systems, both physically and virtually, is optimum
Deployment management is a component of which service management practice in ITIL v4?
A. Problem management
B. Release management
C. Change Management
D. IT Asset Management
B. Release management
Explanation:
ITIL v4 categorizes deployment management as part of release management
Carlos wants to monitor CPU load, temperature and voltages for his virtual machine. What should Carlos do to achieve this?
A. Carlos cannot track temperature and voltages for his virtual system, but he can track load using the underlying hardware
B. Carlos cannot track load, but he can track temperature and voltages for his virtual system and should use the underlying hardware for the VM
C. Carlos cannot track temperature and voltages for a virtual CPU, but he can track load via the OS
D. Carlos cannot track load and voltages, but he can install a thermal sensor to track his virtual machine’s temperature
C. Carlos cannot track temperature and voltages for a virtual CPU, but he can track load via the OS
Explanation:
Carlos knows the virtual machines use virtualized processors and that temperature and voltages cant be tracked for virtual CPUs. He can track load and most operating systems have a built in method for doing so. If voltages and temperature are an ongoing concern, he will need to monitor them at the underlying operating system, hardware or hypervisor level
Megan is responsible for ensuring that her organizations continual service improvement efforts are meeting their goals. What formal role does Megan hold under ITIL?
A. CSI Manager
B. Process architect
C. Process owner
D. Customer
C. Process owner
Explanation:
Megan is a process owner and is responsible for the fit to purpose for the continual service improvement effort. Continual service improvement managers (CSI Managers) improve ITSM processes and services. Process architects ensure that processes work together and support each other effectively, and customers consume or purchase services
Felicia wants to apply rules to her Amazon AWS VPC to limit the IPs that can contact her servers. What feature should she use to do this?
A. Honeypots
B. IDS
C. IPS
D. Network Security Groups
D. Network Security Groups
Explanation:
Felicia wants to perform firewall like rules based filtering, which is a function of network security groups
Designing system redundancy into a cloud data center allows all the following capabilities except:
A. Incorporating additional hardware into the production environment to support increased redundancy
B. Preventing any chance of service interruption
C. Load sharing/balancing
D. Planned, controlled failover during contingency operations
B. Preventing any chance of service interruption
Explanation:
Risk cant be entirely prevented, but it can be drastically reduced. Hardware redundancy, local sharing and balancing and failure mode design are all common practices when designing redundancy into cloud datacenters
Raj is required to provide proof of PCI compliance to his acquiring bank. What should he ask for from his cloud service provider?
A. An attestation of compliance
B. An SOC 1 Type 1 Audit
C. An SOC 2 Type 2 Audit
D. To allow him to conduct a PCI audit of the vendor
A. An attestation of compliance
Explanation:
Cloud providers who are PCI-compliant will typically provide an attestation of compliance upon request. This type of documentation is important for regulators as part of compliance validation. SOC audits dont specifically test PCI compliance, and most vendors will not allow customers to conduct PCI assessments of their underlying infrastructure
Naomi wants to conduct a vulnerability scan of her cloud environment. What requirement is she likely to need to meet with her cloud service vendor for an IaaS environment?
A. She can only scan her own internal systems
B. She will have to use the service provider’s scanning tools
C. She can only scan her own external systems
D. She will need to schedule a time and date for the scans
A. She can only scan her own internal systems
Explanation:
IaaS vendors typically allow customers to scan their own internal systems but may recommend that certain types of instances with lower resources are not scanned to avoid disruption. While vendors may provide scanning tools, they typically dont require customers to use them in an IaaS environment. Since external scans can inadvertently impact other customers, external scanning is typically prohibited or limited, and scheduling a time and date may be required for more advanced or specialized testing
