Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Cloud Security Professional > General Knowledge > Flashcards

General Knowledge Flashcards

1
Q

What is BIOS?

A

Basic Input Output System

  • It is firmware, comes on a chip - normally a Electrically Erasable Programmable Read-Only Memory (EEPROM).
  • Multiple BIOS (Motherboard, Hard Drive Controllers, Video Cards, Network cards etc.).
  • First program that gets executed
  • Performs a set of functions (self-test, measurements to ensure correct configurations, authenticate hardware), load the OS, before handling control over to the hypervisor or OS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are BIOS Security Features? Per NIS SP 800-147b.

A
  1. Authenticated updates - digital signatures prevent the execution of non-authentic BIOS images
  2. Secure local update - requires an admin to be physically present to install BIOS image without signature verification
  3. Firmware integrity protection - prevents unintended or malicious updates outside of authenticated BIOS update process
  4. Non-bypassability - no mechanism to allow main processor to bypass BIOS protections.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a TPM?

A

Trusted Platform Module or cryptographic co-processor
- Supports cryptographic functions
- Enables trust in computing systems
- Has a processor, persistent memory and volatile memory
- Used as roots of trust.
- Provides tamper resistance
- TPMs are HW-based.
SW-based TPMs are also available, though not as secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are storage controllers and what do they do?

A

Storage controllers are hardware used to control storage devices.

They provide:

  • Access Control
  • assembly of data
  • provide users/apps an interface to the storage device

Examples include iSCSI and FCoE (Fiber Channel over Ethernet).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is KVM switch?

A

Keyboard Video Mouse Switch
Allows a single set of human interface peripherals to connect to multiple computers
Saves space.
Users can switch between multiple computers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is VXLAN?

A
  • Virtual Extensible LAN
  • Used in cloud environments
  • VLAN is a Layer 2 concept that uses tags.
  • VXLAN - extends this to Layer 3 allows VLANs to exist across data centers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the steps in DHCP exchange between server and client?

A

The mnemonic is DORA
Discover - client to server on UDP Port 67
Offer - DHCP responds with IP address on Port 68
Request - Client confirms it will use the IP address
Acknowledge - Server acks its.

DHCP v6 uses IPSec.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are write-blockers?

A
  • Write-blockers are used in digital forensics to preserve evidence - essentially, they block writes
  • They are used to read from a disk for evidence analysis without writing to it thereby preserving the evidence.
  • They can be SW-based -e.g. installed on a forensics computer
  • Or HW-based - e.g. blockers on a chip/portable device through which the disk is connected to a computer. It traps and prevents writes.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Per CSA - what are the two key techniques that underpin cloud computing?

A
  • Abstraction and Orchestration
  • Abstraction - resources are abstracted from the underlying physical hardware/what virtualization does.
  • Orchestration - coordinate carving out and delivering a set of resources from a pool to the consumer.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Per CSA - what’s the difference between traditional virtualization and cloud computing?

A

Traditional virtualization abstracts the resources, but does not orchestrate to pool resources together. This often requires manual processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is utility computing?

A

Utility computing is the idea that computing resources can be consumed like water or electricity and paying only for what you use (metering).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What capabilities to PaaS offer?

A
  • Databases, Messaging, Queuing, application development frameworks are some of the capabilities that PaaS have.
  • In a PaaS, users only sees the platform - e.g. DBs may expand/contract automatically without the user having to manage the underlying servers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Noteworthy

A
  1. Organizations can outsource cloud, but not the responsibility for governance.
  2. Moving to the cloud doesn’t change your risk tolerance. It just changes how risk is managed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What information does PCI-DSS prevent you from storing?

A

CVV - Card Verification Value

CVV can be used in a transaction but cannot be stored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are merchant levels in PCI-DSS?

A

Merchants are classified into levels 1 through 4 based on the number of transactions annually.
Level 1 is the highest (unlike FIPS and CC/EAL) . These levels determine risk and ascertain the appropriate level of security for their businesses

Level 1 - over 6 million transactions annually
Level 4 - Less than 20,000 annually.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How must cardholder data be protected in PCI-DSS?

A

Using either Tokenization or Encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is XSS and how do you protect against it?

A

XSS = Cross Site Scripting

  • Attacker inserts code into a Web App through HTML using the Java Code tag.
  • Code eventually gets downloaded when a victim accesses the Web App and his/her browser executes the code in the background without victim’s awareness.
  • WAF is one method of protecting web app against an XSS attack.
  • Use of modern browsers which isolate un-trusted HTML code segments and won’t run them.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

OWASP 2021 - Top 10 List

A

A01 - Broken Access Control
A02- Cryptographic Failures (weak crypto keys, unprotected passwords/secrets)
A03 - Injection (SQL, XSS)
A04-Insecure design

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an insecure direct object reference?

A
  • IDOR is when an application exposes a reference to an internal implementation object - e.g. HR application revealing format of Employee ID (EMP-0001).
  • Allows an attacker to launch an enumeration attack to identify other resources (e.g. EMP-0001 to EMP-9999)
  • Can be combined with broken access control resulting in sensitive data leaks.
20
Q

What does data/information governance mean?

A

Use of Data/information complies with the organizational policies, standards and strategy including regulatory, contractual and business requirements and objectives.

21
Q

How does cloud use affect data/information governance?

A
  1. Multi-tenancy
  2. Jurisdictional issues
  3. Data Privacy
  4. Inclusion of a third party (CSP) in the governance framework
  5. Destruction/removal of data
  6. Shared responsibility: Ownership vs. Custodianship (data controller, processor).
22
Q

NIST Cybersecurity Framework vs Incident Response Comparison

A

NIST CSF: Identify -> Protect -> Detect -> Respond -> Recover

Incident Response: Prepare -> Detect&Analysis -> Containment/Eradicate/Recover -> Post-Mortem.

23
Q

In Cloud, what is the equivalent of “Striping” used in traditional RAID storage?

A

The equivalent of RAID in the cloud is data dispersion.

The terms chunking and sharding is used in the cloud.

Chunking is at a file level - e.g. 100KB file broken into 5 20 KB chunks

Sharding is at a DB level - e.g. phone directory in a DB stored across 5 computers. A-to-E in computer 1 etc..

24
Q

What is Transparent Database Encryption?

A

TDE encrypts the entire database file.
This is encryption of data at rest that protects against theft of storage devices.
Does NOT protect data in transit or data in use.

TDE does page level encryption - i.e. before a page is written to disk it is encrypted. It is decrypted before loading into memory.

25
Q

What is static and dynamic masking?

A

Static masking involves modifying an entire data set all at once. Good for testing an application.

Dynamic masking is masking a particular record in a dataset when accessed - for e.g. when a customer service rep accesses a particular account.

26
Q

What is algorithmic masking?

A

Using an algorithm to mask data in a dataset.

Risk: If algorithm is reverse engineered, an attacker could infer the original data from the masked data.

27
Q

What is Inference in cybersecurity?

A

Inference is a type of attack - e.g. reverse engineering real data from masked data by cracking the masking algorithm.

28
Q

What’s the difference between Data Dispersion and bit splitting?

A

Data dispersion - data is broken up into smaller chunks and stored across multiple storage - e.g. multiple clouds. Risk: If one cloud provider is unavailable, then whole data set is unavailable.

Bit splitting - The data is first encrypted, then separated into pieces, and the pieces are distributed across several storage areas. Processing is intensive. Not great if data is constantly changing as the erasure codes have to be constantly recreated.

29
Q

In IAM, what’s the difference between Authorization, Access Control and Entitlement?

A
  • Authorization is permission to do something (e.g. access a file). Cloud provider enforces this.
  • Access control is allowing denying the expression of that authorization - for example, only allowing a user to perform the task allowed if he/she is authenticated. Cloud provider enforces this.
  • Entitlement - maps identities to authorizations (e.g. user x can access resource y). Cloud user is responsible for defining this.
30
Q

In SW Development what is Utility and Warranty?

A

Utility = functionality of a product and service to meet a specific need; what the service does

Warranty = assurance that the product/service will meet the agreed-upon requirements (SLA)

Utility + Warranty = Value in the mind of the customer

31
Q

In virtualization, what is limit vs reservation vs share?

A

Concepts used in allocating CPU to tenants.

Limit = the max ceiling for resource allocation
Reservation = guaranteed minimum for each tenant
Shares = after reservations are met, how the rest of the resources are prioritized between guests.
32
Q

What is Brewer-Nash or Chinese Wall Model?

A

Information Security Access Controls - designed to prevent conflicts of interest in a managed service environment where a company provides services to other companies which may compete with each other.

E.g. law firm advising companies A and B who may be competitors.

33
Q

What is ISO 27034?

A

The standard for Application Security. Key concepts are:

a) Application Security Control (ASC) - a control to prevent a security weakness within an application. e.g. an ASC to mask credit card numbers on screen
b) Application level of trust - not all applications need the same level of security controls Level 0 (low) to Level 2 (high)
c) Organization Normative Framework (ONF) - company-wide repository of ASCs. Stored in a central repository
d) Application Normative Framework (ANF) - ASCs that apply to specific applications.

34
Q

How does TLS preserve integrity?

A

Use a HMAC (Hashed Message Authentication Code)

35
Q

What is the difference between SAML and SOAP?

A
  • SAML is an XML based language - it describes formats; SOAP is a protocol.
  • SAML is carried over SOAP
  • SOAP itself is carried over HTTP/S.
36
Q

What is OAuth?

A
  • Authorization protocol defined by IETF
  • Uses HTTP
  • Delegates authorizations between services
37
Q

What is OIDC?

A

OIDC = Open ID Connect - Standard for federated authentication
Uses REST and JSON (not XML like SAML).
Extends OAuth2.0
Uses Java Web Tokens (JWT).

38
Q

What’s the difference between SAML and OIDC?

https://www.onelogin.com/blog/real-difference-saml-oidc

A

Both are identity protocols. SAML is older. OIDC is easier and becoming more popular.
SAML - used in enterprise settings v/s OIDC - used in mobile gaming, social media integration
SAML based on XML vs. OIDC on REST/JSON

39
Q

What is due care vs due diligence?

A

Due care - minimal level of effort necessary to perform your duty to others; lack of due care is negligence. Developing security policies/standards/controls .

Due diligence - understanding current threats and implementing counter measures. Activities undertaken in support or furtherance of due care.

40
Q

What is the difference between liability and risk?

A

Liability is a measure of responsibility for providing due care.
While an organization can share risk, it cannot share liability.

41
Q

What is risk?

A

The probability of a threat materializing.

Risk = Asset * Threat * Vulnerability.

If there is no threat, there is no vulnerability
If there is no vulnerability, there is no risk
If the asset value is zero, there is no risk.

42
Q

In Data Center Management what is Hot and Cold Aisle?

A

Hot/Cold Aisle have to do with air flow management.
Objective is to lower energy costs
Cold air intake is on one side, while hot air exhaust is on the other side.

43
Q

What do HVACs do?

A

Heat exchange with the outside world.
Thus the ambient temperature determines how much energy is actually used.
If outside is hot, more energy is needed to cool the air.

44
Q

What is a underfloor plenum?

A

Data center floors are raised by 2 feet (18-24”).
Underneath the floor is a plenum or duct
Used for cold air circulation and optionally cabling.
If cabling is used, then gaskets are important to prevent cold air leakage.

45
Q

What are the four components of risk management?

A
  1. Risk Framing - characterizing the risk environment.
  2. Risk Assessment - identify, estimate, prioritize information security risk. Likelyhood and impact are key factors. Assets, Threats and Vulnerabilities are considered. Qualitative and quantitative risk assessments
  3. Responding to Risk -
  4. Monitoring for Risk.
46
Q

Why would you use SOAP?

A
  • SOAP can be carried over multiple transport - e.g. HTTP, HTTPS, FTP etc.
  • In SOAP, data is put inside an envelop which can be encrypted. This is why bank applications use them.
  • This gives an additional layer of protection without having to rely on transport layer protection.
47
Q

What is SLE, ALE, AV, ARO and EF?

A
  • AV = Asset Value - the value of your asset in $$$
  • EF = Exposure Factor = what portion of your asset is actually at risk for a particular threat
  • SLE = Single Loss Expectancy - how much you can expect to loss by a single attack (AV * EF).
  • ARO = Annual rate of occurrence - number of times a year you can expect an attack to occur
  • ALE=Annual Loss Expectancy = your loss each year = (SLE * ARO).

Certified Cloud Security Professional (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions