Flashcards in “CCSK: Certificate of Cloud Security Knowledge 4 of 6 Practice
Which of the following can the cloud provider implement to mitigate the credential compromise or theft?
A,Separation of roles and responsibilities
B.Automated inventory of all assets
C.Anomaly detection
D.Federated method of authentication
E.Hardening of virtual machines using industry standards
C.Anomaly detection
Explanation
Explanation CREDENTIAL COMPROMISE OR THEFT · Do you provide anomaly detection (the ability to spot unusual and potentially malicious IP traffic and user or support team behaviour)? For example, analysis of failed and successful logins, unusual time of day, and multiple logins, etc. · What provisions exist in the event of the theft of a customer’s credentials (detection, revocation, evidence for actions)?
Which of the following is the most commonly used application programming interface?
A.JSON
B.HTTP
C.REST
D.SOAP
C.REST
Explanation
Most cloud APIs these days use REST (Representational State Transfer), which runs over the HTTP protocol, making it extremely well suited for Internet services. APIs are typically the underlying communications method for components within a cloud, some of which (or an entirely different set) are exposed to the cloud user to manage their resources and configurations. Most cloud APIs these days use REST (Representational State Transfer), which runs over the HTTP protocol, making it extremely well
Which of the following WAN virtualization technology is used to create networks which span multiple base networks?
A.Virtual Private Networks
B.Network Peering
C.Virtual Private Cloud
D.Cloud Overlay Networks
D.Cloud Overlay Networks
Explanation
Cloud overlay networks are a special kind of WAN virtualization technology for created networks that span multiple “base” networks. For example, an overlay network could span physical and cloud locations or multiple cloud networks, perhaps even on different providers. Source: Security Guidance for Critical Areas of Focus in Cloud Computing V4.0 Topic: Cloud Overlay Networks Domain 8// VIRTUALIZATION AND CONTAINERS
Cloud user does not require special permission to perform vulnerability assessment on its environment in cloud
A.CORRECT
B.INCORRECT
B.INCORRECT
Explanation
Certain types of customer technical assessments and audits (such as a vulnerability assessment) may be limited in the provider’s terms of service, and may require permission. This is often to help the provider distinguish between a legitimate assessment and an attack. Source: Security Guidance for Critical Areas of Focus in Cloud Computing V4.0 Topic: How Cloud Changes Audit Management Domain 4 // COMPLIANCE AND AUDIT MANAGEMENT
Which of the following is not one of the five key legal issues common across all scenarios?
A.Global Proliferation B.Intellectual Property C.Professional Negligence D.Confidentiality E.Data Protection
A.Global Proliferation
Explanation
Explanation CLOUD COMPUTING – KEY LEGAL ISSUES Five key legal issues have been identified which are common across all the scenarios: 1. Data protection a. Availability and integrity b. Minimum standard or guarantee 2. Confidentiality 3. Intellectual property 4. Professional negligence 5. Outsourcing services and changes in control Source: enisa Topic: ANNEX I – CLOUD COMPUTING – KEY LEGAL ISSUES
Which of the following is not an example of vendor lock-in?
A.Contracts with termination penalties
B.Provider exports data only in a proprietary format
C.Custom SaaS Applications
D.PaaS platforms that restrict available functions
C.Custom SaaS Applications
Explanation
All SaaS products are customized applications. This fact is not the source of vendor lock-in. What creates a lock-in situation with SaaS is the lack of ability to move data easily from one SaaS provider to another. If tools exist (generally they are limited) to move from one SaaS provider to another, vendor lock-in can be fairly easily dealt with. All the other answers are lock-in scenarios.
VM hopping is an attack that is possible in the event of what failure?
A.Virtual Storage Control Failure
B.Hypervisor Segregation Failure
C.Hypervisor Isolation Failure
D.Inadequate Security Controls by the Customer
C.Hypervisor Isolation Failure
Explanation
Performing VM hopping is a result of hypervisor isolation failure. None of the other answers is correct. Remember that segregation is not the same as isolation.
Which of the following could be considered a malicious insider as per ENISA “Top Security Risks”?
A.Customer Administrator
B.Provider’s Auditor
C.Customer’s Auditor
D.All of These
C.Customer’s Auditor
Explanation
The ENISA document lists provider employees and contractors as potential malicious insiders. As such, the only possible correct answer is the provider’s auditor.
A company administrator determines that the best approach to dealing with any sudden increases in network traffic is to create an auto-scaling group that will create an unlimited number of web servers to meet increased demand. What has the administrator created?
A.The administrator has implemented an auto-scaling practice that is commonly performed to take advantage of the elastic nature of the cloud
B.The administrator has implemented an application load-balancing system
C.The administrator has implemented a network load-balancing system
D.The administrator has created an economic denial of service scenario if there is ever a denial of service attack against the company
D.The administrator has created an economic denial of service scenario if there is ever a denial of service attack against the company
Explanation
The administrator has created an economic denial of service scenario if there is ever a denial of service attack against the company. This is because of the measured service characteristic of cloud computing, where companies pay for the resources they use. Load balancing will distribute traffic across only an established amount of servers, so B and C do not address what the administrator has established. Finally, although auto-scaling groups are common, there needs to be a set limit to the amount of servers that will be created.
Which of the following is not considered a vulnerability associated with the risk of loss of business reputation due to co-tenant activities?
A.Lack of resource isolation
B.Lack of reputational isolation
C.Hypervisor vulnerabilities
D.Object Storage
D.Object Storage
Explanation
Object storage is the only answer that is not listed as an associated vulnerability to the risk of loss of business reputation due to co-tenant activities.
Which of the following is not listed in the ENISA documentation as a potential area that needs to be considered and protected from being exploited with regard to user provisioning?
A.Credentials that may be vulnerable to interception and replay
B.If the customer cannot control the providers provisioning process
C.If the identity of the customer may not be adequately verified upon registration
D.The customers ability to restrict access to the IAM system supplied by the provider to a specific range of IP addresses
D.The customers ability to restrict access to the IAM system supplied by the provider to a specific range of IP addresses
Explanation
The only possible answer not listed is that the customer can restrict access to the IAM system supplied by the provider to a specific range of IP addresses. This is because the IAM system is part of the management plane that can be accessed from anyone as part of the broad network access characteristic of the cloud. All other entries are listed as areas for consideration and protection.
What should always be done to protect against possible management interface compromise where an attacker gains access to your cloud environment (select the best answer)?
A.Connect to the management interface via IPSec VPN
B.Protect connections through the use of TLS
C.Implement MFA on all privileged accounts
D.Create separate accounts for administrators with access to the management plane
C.Implement MFA on all privileged accounts
Explanation
Privileged accounts should always access the management plane with MFA. The management plane faces increased risk of compromise because it is globally accessible; therefore, implementing a VPN of any sort is not listed as a potential safeguard. All users accessing the management plane should always have separate accounts, but D addresses repudiation, not security of the accounts accessing the management plane. Although all connections should be protected in transit (such as with TLS), B is not the best answer.
Which of the following is a key area of control for the cloud provider network architecture?
A.Host based intrusion prevention service (IPS) B.Hardened virtualised image C.DDOS D.SANS Checklist E.Anti Virus
C.DDOS
Explanation
distributed denial of service. Explanation NETWORK ARCHITECTURE CONTROLS · Define the controls used to mitigate DDoS (distributed denial–of-service) attacks. o Defence in depth (deep packet analysis, traffic throttling, packet black-holing, etc) o Do you have defences against ‘internal’ (originating from the cloud providers networks) attacks as well as external (originating from the Internet or customer networks) attacks? · What levels of isolation are used? For virtual machines, physical machin
In which of the five main phases of secure application design and development, you perform Threat Modelling?
A.Design B.Define C.Test D.Develop E.Training
A.Design
Explanation
It is during the design phase that you perform threat modelling, which must also be cloud and provider/platform specific. Design: During the application design process, especially when PaaS is involved, the focus for security in cloud is on architecture, the cloud provider’s baseline capabilities, cloud provider features, and automating and managing security for deployment and operations. We find that there are often significant security benefits to integrating security into the application arch
Which of the following is true about the pass-through audit which is a form of compliance inheritance?
A.Provider’s infrastructure is within the scope of customers audit/assessment
B.Providers infrastructure is not within the scope of customers audit/assessment
C.Everything the customer builds on top of Provider Infrastructure is out of scope
D.Customer is not responsible for maintaining the compliance as the Provider is already compliant
B.Providers infrastructure is not within the scope of customers audit/assessment
Explanation
A pass-through audit is a form of compliance inheritance. In this model all or some of the cloud provider’s infrastructure and services undergo an audit to a compliance standard. The provider takes responsibility for the costs and maintenance of these certifications. Provider audits, including pass-through audits, need to be understood within their limitations: • They certify that the provider is compliant. • It is still the responsibility of the customer to build compliant applications and serv
The main difference between traditional virtualization and cloud computing and is abstraction.
A.CORRECT
B.INCORRECT
B.INCORRECT
Explanation
Virtualization abstracts resources, but it typically lacks the orchestration to pool them together and deliver them to customers on demand, instead relying on manual processes. The key techniques to create a cloud are abstraction and orchestration. We abstract the resources from the underlying physical infrastructure to create our pools, and use orchestration (and automation) to coordinate carving out and delivering a set of resources from the pools to the consumers. As you will see, these two t
Logs, documentation, and other materials that are needed for audits and compliance and are used as evidence to support compliance activities are called as-
A.Audit Trail B.Log Trail C.Audit Evidence D.Audit Proof E.Artifacts
E.Artifacts
Explanation
Artifacts are the logs, documentation, and other materials needed for audits and compliance; they are the evidence to support compliance activities. Both providers and customers have responsibilities for producing and managing their respective artifacts. Source: Security Guidance for Critical Areas of Focus in Cloud Computing V4.0 Topic: How Cloud Changes Audit Management Domain 4 // COMPLIANCE AND AUDIT MANAGEMENT
Which of the following tools lists cloud security controls and maps them to multiple security and compliance standards. ?
A.Cloud Provider Contracts B.Cloud Security Alliances STAR Registry C.Supplier (cloud provider) Assessments D.Cloud Control Matrix E.Consensus Assessments Initiative Questionnaire
D.Cloud Control Matrix
Explanation
The Cloud Controls Matrix (CCM) lists cloud security controls and maps them to multiple security and compliance standards. The CCM can also be used to document security responsibilities. • The Cloud Controls Matrix (CCM), which lists cloud security controls and maps them to multiple security and compliance standards. The CCM can also be used to document security responsibilities. • The Consensus Assessments Initiative Questionnaire (CAIQ). A standard template for cloud providers to document thei
What is the role of the Scope Applicability column in the CCM?
A.Applicability of controls in the domain
B.Overall applicability of the domain
C.Maps the existing industry standards to the controls in the domains
D.Shows architecture elements that are related to given control
C.Maps the existing industry standards to the controls in the domains
Explanation
Scope applicability column in CCM maps the existing industry standards like PCI DSS , NIST SP800-53 R3, ISO/IEC 27001-2005, HIPAA / HITECH Act, GAPP, ENISA IAF, COBIT etc to the controls in the domains Source: Cloud Controls Matrix Version 3.0.1
Dedicated or private tenancy model is not possible in a cloud environment.
A.CORRECT
B.INCORRECT
B.INCORRECT
Explanation
In some environments dedicated/private tenancy is possible, but typically at a higher cost. With this model only designated workloads run on a designated physical server. Costs increase in public cloud as a consumer since you are taking hardware out of the general resource pool, but also in private cloud, due to less efficient use of internal resources. Source: Security Guidance for Critical Areas of Focus in Cloud Computing V4.0 Topic: How Cloud Changes Workload Security Domain 7// INFRASTRUCTU
What can be used to determine what actors are allowed to do and what they’re not allowed to do?
A.Entitlements
B.Information Classification
C.Information Governance
D.Contractual Controls
A.Entitlements
Explanation
Entitlements determine what actors are allowed to do and what they’re not allowed to do. Contractual controls are a legal tool, and information governance is much larger than determining what actors can and cannot do, so B and C are not the best answers. Classification of data may assist control selection, but, again, it is not the best answer.
Moving to the cloud creates a greenfield opportunity to reexamine what?
A.How you manage information and find ways to improve things
B.Existing Security Policies
C.Existing Security Controls
D.Existing Information Classification Capabilities
A.How you manage information and find ways to improve things
Explanation
Moving to the cloud gives you the opportunity to look at how you manage information and find ways to improve things. This can include all the other answers as well, but since the first answer covers all the other options, it is the best answer.
Extending information governance to include cloud services requires:
A.Security Controls
B.Contractual Controls
C.Both contractual and security controls
D.Provider supplying a written business associate agreement
C.Both contractual and security controls
Explanation
The best answer is that both security and contractual controls are required to extend information governance to the cloud. The business associate agreement is applicable only for HIPAA-regulated data, and it would be covered as a contractual control.
What does an authorization determine?
A.The legally accountable party for security of end-user data
B.Whether data can be stored in a cloud environment
C.Permitted cloud service providers based on classification of data
D.Who is allowed to access certain information and/or data
D.Who is allowed to access certain information and/or data
Explanation
Authorizations determine who is allowed to access certain information and/or data and are part of information governance. The customer always retains legal accountability in the event of end-user data being compromised. Although we want to have information management assist in the selection of appropriate cloud providers and determine data classifications, these are not authorizations.
