DOMAIN 6 - MANAGEMENT PLANE SECURITY

Question 1

APIs and _______ are the way the management plane is delivered.

Answer 1

web consoles

Question 2

_______ allow for programmatic management of the cloud. They are the glue that holds the cloud’s components together and enables their orchestration.

Answer 2

Application Programming Interfaces

Question 3

Cloud providers and platforms will also often offer _______ and Command
Line Interfaces (CLIs) to make integrating with their APIs easier.

Answer 3

Software Development Kits (SDKs)

Question 4

_______are managed by the provider. They can be organization-specific [typically using Domain Name Server (DNS) redirection tied to federated identity].

Answer 4

Web consoles

Question 5

APIs are typically _______ for cloud services, since REST is easy to implement across the Internet. ________ APIs have become the standard for web-based services since they run over HTTP/S and thus work well across diverse environments.

Answer 5

REST

Question 6

there is no single standard for authentication in REST. HTTP request signing and _______ are the most common; both of these leverage cryptographic techniques to validate authentication requests.

Answer 6

OAuth

Question 7

No matter the platform or provider there is always an account owner with _______ privileges to manage the entire configuration.

Answer 7

super-admin

Question 8

Separate from the ______ you can usually create super-admin accounts for individual admin
use.

Answer 8

account-owner

Question 9

Your platform or provider may support lower-level administrative accounts that can only manage parts of the service. We sometimes call these ________ or “day to day administrators”.

Answer 9

“service administrators”

Question 10

All privileged user accounts should use _______.

Answer 10

multi-factor authentication (MFA)

Question 11

Protecting from attacks against the management plane’s components itself, such as the web and API servers. It includes both lower-level network defenses as well as higher-level defenses against application attacks.

Answer 11

Perimeter security

Question 12

Providing secure mechanisms for customers to authenticate to the management plane. This should use existing standards (like OAuth or HTTP request signing) that are cryptographically valid and well documented

Answer 12

Customer authentication

Question 13

The mechanisms your own employees use to
connect with the non-customer-facing portions of the management plane. It also includes any translation between the customer’s authentication and any internal API requests.

Answer 13

Internal authentication and credential passing

Question 14

Granular _______ better enable customers to securely manage their own users and administrators

Answer 14

entitlements

Question 15

Robust _________ of administrative is essential for effective security and compliance. This applies both to what the customer does in their
account, and to what employees do in their day-to-day management of the service. Alerting of unusual events is an important security control to ensure that monitoring is actionable, and not merely something you look at after the fact. Cloud

Answer 15

logging and monitoring

Question 16

Since cloud configurations are controlled by software, these configurations should be backed up in a restorable format

Answer 16

Metastructure

Question 17

_________allows you to create an infrastructure template to configure all or some aspects of a cloud deployment.

Answer 17

Software-Defined Infrastructure

Question 18

As mentioned, any provider will offer features to support higher availability than can comparably be achieved in a traditional data center for the same cost. But these only work if you adjust your architecture

Answer 18

Infrastructure

Question 19

Data synchronization is often one of the more difficult issues to manage across locations, even if the actual storage costs are manageable.

Answer 19

Infostructure

Question 20

_____includes all of the above, but also the application assets like code, message queues, etc.

Answer 20

Applistructure

Question 21

_________ include a range of functions we used to manually implement in applications, everything from authentication systems to message queues and notifications

Answer 21

Platform services

Question 22

_______is often used to help build resilient cloud deployments

Answer 22

“Chaos Engineering”

Question 23

_______ may often be the biggest provider outage concern, due to total reliance on the provider.

Answer 23

SaaS

Question 24

This is completely on the provider’s shoulders, and _____ includes everything down to the physical facilities. RTOs and RPOs will be stringent, since if the cloud goes down, everything goes down.

Answer 24

BC/DR

Question 25

For super-high-availability applications, start with ______ BC before attempting cross-provider BC.

Answer 25

cross-location