Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCSP > Learnzapp > Flashcards

Learnzapp Flashcards

1
Q

Maintenance mode

A

Generation of new instances is prevented.

Alerting mechanisms are suspended.

Events are logged.

Admin access continues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Remember EU member states

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Maintenance mode :

Live migration
snapshots

A

Live migration is the term used to describe the movement of functioning virtual instances from one physical host to another and how VMs are moved prior to maintenance on a physical device.

VMs are moved as image snapshots when they are transitioned from production to storage;

During live migration, the VM moves in unencrypted form.

Live migration goes over the network; portable media is not necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Tunneling

A

Generic routing encapsulation (GRE) is a tunneling mechanism, specifically designed for the purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SSH tunnelling includes the services

A

Remote login
Port forwarding
Command Execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

TLS

A

TLS is a session encryption tool that uses asymmetric encryption to create a symmetric session key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

which risk can make - cloud env unviable

A

VM Sprawl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NAS ( Network attached Storage)

SAN (Storage Area Network)

A

NAS: file server that provides data access to multiple, heterogeneous machines and users on the network

NAS is designed basically for file sharing across the network.

SAN :A SAN typically presents storage devices to users as attached/mounted drives.

SAN is designed to meet high-performance needs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Dynamic Host Configuration Protocol (DHCP) servers

A

provide the clients:
-A temp IP Address
- A default gateway
- Time server synchronization

Doesn’t provide - encryption protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data in transit ( Secure)

TLS
DNSSEC
IPSec

A
  • TLS

-DNSSEC:
Domain Name System Security Extensions (DNSSEC) protects data in transit by reducing the risk of DNS poisoning

-IPSEC - Transport Layer Security (TLS) and Internet Protocol Security (IPSec) reduce the risk of eavesdropping and interception of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

OS Hardening

A

Remove default accounts
remove unnecessary services
Disallow local save of credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

cloud storage cluster

A

A tightly coupled cloud storage cluster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SSD

A

Solid-state disks (SSDs) are used in cloud computing today because they operate at high speeds as compared to traditional spinning drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IETF

IANA

ISO/IEC

A

The IETF is an international organization of network designers and architects who work together in establishing standards and protocols for the Internet.

IANA oversees global IP address allocation among other Internet tasks.

the ISO/IEC develops, maintains and promotes standards in information technology and information communication technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ONF : An Organization Normative Framework (ONF)

ANF - application normative frameworks (ANFs)

A

An Organization Normative Framework (ONF) is a framework of so-called containers of application security best practices catalogued and leveraged by the organization and contains at least one or more subcomponents known as application normative frameworks (ANFs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Brewer-Nash (Chinese Wall)

A

Brewer-Nash was specifically created for managed services arrangements, where an administrator for a given customer might also have access to a competitor’s data/environment; the model requires that administrators not be assigned to competing customers. In the modern cloud provider model, a cloud data center administrator will almost definitely have access to many customers from the same industry (i.e., competitors) but probably won’t even know it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Ports : DNS

A

DNS:53
google dns server 8.8.8.8.

DNSSEC : Adds digital signatures to DNS , Verify clients to check authenticity of DNS records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Network Ports

0 - 1023 - Wellknown ports
1024 - 49151 : registered ports
49152-65535 - dynamic ports

A

16bit binary numbers
2 power 16 values : 0 - 65,535

0 - 1023 - Wellknown ports
webservers - 80,
secure webserver - 443, mailservers

1024 - 49151 : registered ports
Microsoft reservers 1433 for sql server DB connection

Oracle server - 1521 for its own dbs

49152-65535 - dynamic ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Administrative Services - Ports

21: FTP
22: SSH
3389 - RDP
137,138,139 - Windows -NetBIOS
53: DNS

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Mail services:

25 : SMTP
110: POP (Post office protocol_
143 : IMAP

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Webservices:

80: HTTP
443: HTTPS

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ICMP - Internet Control Message Protocol

  • PIng
    -traceroute

eg: traceroute -I linkedin.com

A

PIng - identifies live system
-traceroute - identifies network path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ICANN

A

IP Addresses scarce

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Private IP Address ranges

A

10.0.0.1 - 10.255.255.255
172.16.0.1 - 172.31.255.255
192.168.0.1-192.168.255.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

NAT ( Network address translation)

NAT & Security

PAT - Port address translation

A

PAT Allows mulitple systems to share the same public IP Address

assigning unique ports to each communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Subnetting : network, host

A

subdivides larget networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Subnet mask

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

VLAN - Configuring VLANs

A

Enable VLAN Trunking
Assign Switch ports to VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Routers, switches, firewalls

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

DMZ, Bastion hosts

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

stateless firewalls ,
Stateful inspection

firewall rule content

NGFW ( Incorporate contextual information into their decision making)

A

firewall rule contents
source, destination IP, Ports, action (allow , deny)

implicit deny (default deny)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Firewall Role:
NAT Gateway
Content / URL Filtering
Webapplication firewall

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Network deployment options:
-

A
  1. Network hardware vs Host based software firewalls
  2. Open source or proprietary
    3.Hardware appliance vs Virtual Appliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Network security groups

A

Serve as IaaS firewalls
Maintaining network SG is customer’s responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

VPN - Site to site , remote access VPN

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

VPN Endpoints

A

Firewalls
Routers
Servers
VPN Concentrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

IPSec - Works at n/wk layer (layer3)

A

Works at n/wk layer (layer3)
supports the layer 2 tunneling protocol
provides secure transport
difficult to configure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Full tunnel VPN, Split tunnel VPN

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Always ON VPN (default)

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

IPS , IDS

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

IDS : False positives, false negative error

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Signature detection systems / rule based detection systems

A

problem: fail to brand new attacks
advantage: low false positive rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Anomaly detection/ behaviour based detection/ heuristic detection systems (Same)

A

high false postiitve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

IPS Deployment models

In-band (inline) : device sits in the path of network commns

out-of-band (passive)
device connects to SPAN port on a switch

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Zero trust networking

IAM Platforms are the foundation of zero trust approaches

A

zero trust shifts the focus away from perimeter protection onto strong identity and access mgmt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

SIEM
SOAR

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

CASB

A

Enforce security policies in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

EDR (Endpoint detection response) platforms

A

remediate endpoint security issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Security baseline

A

baselines are generic
they cover uncertain future

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Accreditation Process

A

Initiation, security Certification, security Accreditation, continuous monitoring phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

SSH Tunneling

A

doesnt provide content filtering

it provides
remote log-on
port forwarding
command execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Storage Clusters:
Tightly coupled
Loosely Coupled

A

storage devices are clustered in groups, providing increased performance, flexibility, and reliability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Tightly coupled cluster

A

tightly coupled architecture also enhances performance a

the tightly coupled cluster has a maximum capacity, whereas the loosely coupled cluster does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

loosely coupled cluster,

A

A loosely coupled cluster, on the other hand, allows for greater flexibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

DHCP - Dynamic host configuration protocol servers

A

provide the clinets - temp iP Address, default gateway, time server sync

doesn’t provide Encryption protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Domain 1:

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Magnetic swipe cards

A

Data on Magnetic swipe cards is not usually encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

SOC reports

A

SOC reports are the audit reporting mechanisms dictated by SSAE 18. SOX is a federal law targeting publicly traded corporations in the United States. SSL is a way to conduct secure online transactions. SABSA is an architecture framework.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

SSAE Report :
SOC1 - Financial reporting
SOC2- deals with CIA
SOC3: attestation by the auditor

A

SOC1 - Financial reporting
SOC2- deals with CIA
SOC3: attestation by the auditor

SOC 2 reports were not designed for dissemination outside the target organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Statutory compliance

A

Statutory compliance refers to state and federal laws. They cannot force a customer to stay with a cloud provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

CASB

A

provides services - Key escrow, single sign-on, IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

*****Federal Express - Private company

A

Federal Express is a private company; only federal entities are required to comply with FedRAMP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Elliptical curve cryptography (ECC)

A

Elliptical curve cryptography (ECC) uses algebraic elliptical curves that result in much smaller keys that can provide the same level of safety as much larger ones used in traditional key cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

****Virtual machine introspection (VMI)

A

Virtual machine introspection (VMI) is an agentless means of ensuring a VM’s security baseline does not change over time by examining things such as physical address, network settings, and installed OS. These ensure that the baseline has not been inadvertently or maliciously tampered with.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Virtualization technologies - cloud computing

A

Virtualization technologies have been the driving force behind enabling cloud computing to become a real and scalable service due to the savings, sharing, and allocation of resources across multiple tenants and environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

A demilitarized zone (DMZ)

A

A demilitarized zone (DMZ) isolates network elements that are public facing and would otherwise be vulnerable to attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Type 1 , Type 2 hypervisor

A

A Type 1 hypervisor uses a minimal piece of software to manage the underlying resources. A Type 2 hypervisor is a piece of software installed on top of or as part of a device’s operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

A hybrid cloud

A

A hybrid cloud is a combination of two or more distinct cloud infrastructures that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

**Cloud migration

A

Cloud migration is the process of transitioning all or part of a company’s data, applications, and services from onsite premises behind the firewall to the cloud. This enables information to be provided over the Internet on an on-demand basis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Corporate governance

A

Corporate governance is defined as the relationship between shareholders and other stakeholders in the organization versus the senior management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Auditability

A

Something is said to be auditable when it is in a state of readiness for auditing. Cloud providers are often required to maintain a state of auditability as a way of maintaining compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Cloud server hosting

A

Cloud server hosting is a type of hosting in which hosting services are available to customers on demand via the Internet as opposed to being provided by a single server or virtual server. In a cloud services model, multiple connected servers that a cloud server comprises provide the hosting environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Public key infrastructure (PKI)

A

Public key infrastructure (PKI) is a framework of programs, procedures, communication protocols, and public key cryptography that enables a diverse group of individuals to communicate securely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Turnstiles

egress monitoring
encryption
digital watermarking

A

Turnstiles are a physical security barrier to prevent piggybacking/tailgating (an unauthorized person coming through an entrance behind someone who is authorized), but they don’t really present much protection for intellectual property in this case.

Egress monitoring (often referred to as “DLP” solutions) is a great way to reduce the likelihood of intellectual property leaving the owner’s control in an unexpected/unapproved manner. Likewise, strong encryption is useful in the cloud to reduce the impact of theft either from leakage to other cloud tenants or from insider threats (such as malicious admins in the employ of the cloud provider). Finally, digital watermarks aid protection of intellectual property by proving original ownership, which is essential for enforcing intellectual property rights (in the case of software design, mainly copyright protections).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

PCI DSS CVV

A

PCI DSS requires that the CCV (or, sometimes, “CVV” for “card verification value”) only be used in the transaction, not stored. The data described in all the other options may be stored after the transaction is complete.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

SSAE , AICPA

A

SSAE 18 is the current AICPA audit standard, as of 2018.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

SABSA

A

SABSA is an IT architecture framework

SABSA is a means of looking at security capabilities from a business perspective;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

COBIT

A

COBIT is designed for all types of business, regardless of their purpose;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

TOGAF

A

TOGAF is a means to incorporate security architecture with the overall business architecture;

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

ITIL

A

ITIL was specifically designed to address service delivery entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

NIST SP 800-53 - RMF

A

NIST SP 800-53 contains guidance for selecting security controls in accordance with the Risk Management Framework.

NIST 800-53 is a standard, not a law,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

SOX

A

SOX affects publicly traded corporations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

SOC1

A

The SOC 1 report provides information about financial reporting mechanisms of the target only and is of little interest to the IT security professional,

The SOC 1 audit report is not for security controls; it is for financial reporting controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

The SOC 2, Type 2

A

The SOC 2, Type 2 report will provide details on IT security controls used by the target and how well those controls function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

The SOC 3 reporT

A

The SOC 3 report is only an attestation that the target was audited and that it passed the audit, without detail

The SOC 3 report is an attestation that the target was audited and that it passed the audit, without detail; you could use the SOC 3 reports to quickly narrow down the list of possible providers by eliminating the ones without SOC 3s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

PCI DSS

A

Because PCI DSS is strictly voluntary, and the PCI Council is not a government body but a consortium of private interests, they cannot detain or imprison anyone.
They can, however, assess fees, suspend processing privileges, and require more auditing, s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

PCI Merchant levels

A

The PCI merchant levels are based on how many transactions a compliant entity engages in over the course of a year.

Level 1: Merchants that process more than 6 million card transactions per year
Level 2: Merchants that process between 1 million and 6 million card transactions per year
Level 3: Merchants that process between 20,000 and 1 million card transactions per year
Level 4: Merchants that process fewer than 20,000 card transactions per year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Merchant level 1

A

Merchant level 1 is for the merchants that engage in the most transactions per year (six million or more). It carries with it the requirement for the most comprehensive, detailed, and repeated security validation actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Federal Information Processing Standard (FIPS) 140-2 security levels for cryptographic module

A

The Federal Information Processing Standard (FIPS) Publication 140-2 defines four levels of security for cryptographic modules, with each level offering increasing physical protection:
Level 1
The lowest level of security, requiring production-grade equipment and externally tested algorithms
Level 2
Improves physical security with pick-resistant locks and role-based authentication
Level 3
Provides a high probability of detecting and responding to physical access attempts, with physical tamper-resistance and identity-based authentication
Level 4
The highest level of security, with tamper-active hardware that erases its contents if it detects changes in normal operating conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Evaluation Assurance Level (EAL)

A

The EAL is a measure of how thoroughly the security features the product vendor claims the product offers have been tested and reviewed, and by whom.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Common criteria certification of an IT Product - who pays - vendor

A

The vendor/manufacturer of a given product will pay to have it certified, with the premise that certification costs are offset by premium prices that certified products command and that customers won’t purchase uncertified products.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

**NIST Publishes

A

NIST publishes the list of validated crypto modules. The other choices are government or non-government organizations that are not involved with publishing the list of cryptographic modules that meet FIPS 140-2 requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

HSM Certification

A

Vendors seeking HSM certification under FIPS 140-2 send their products to independent laboratories that have been validated as Cryptographic Module Testing Laboratories under the National Voluntary Laboratory Accreditation Program (the Accreditation Program is run by NIST, which approves the laboratories). As of this writing, 21 labs in the United States and Canada are accredited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

FIPS 140-2

A

FIPS 140-2 is only for SBU Sensitive but unclassified (SBU) data

FIPS 140-2 is the federal standard for the accreditation and distinguishing of secure and well-architected cryptographic modules produced by private sector vendors who see to or are in the process of having their solutions and services certified by the US government departments and regulated industries that collect, store, transfer, or share data that is deemed to be sensitive but not classified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

broken authentication and session management - risk reduce

A

method for reducing the risk of broken authentication and session management

Do not use custom authentication schemes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

OWASP Top 10: insecure direct object references

A

Check access each time a direct object reference is called by an untrusted source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

OWASP Top 10: Injection

A

attacker trying to do with an injection attack:
Trick the application into running commands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

OWASP Top 10:broken authentication and session management

A

reduce risk by:
Do not use custom authentication schemes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

OWASP Top 10 : cross-site scripting (XSS) attacks

A

HTML escape all HTML attributes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

OWASP Top 10 : cross-site request forgery” (CSRF)

A

Remediation: Ensure that all HTTP resource requests include a unique, unpredictable token.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

OWASP Top 10 : Security misconfiguration

A

Example: Having unpatched software in the production environment

technique to reduce:
Perform periodic scans and audits of the environment.

Follow a published, known industry standard for baseline configurations.

A repeatable patching process that includes updating libraries as well as software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

OWASP Top 10 : missing function level access control

A

reduce by:
Set the default to deny all access to functions, and require authentication/authorization for each access request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

OWASP Top 10 : using components with known vulnerabilities.

A

Remediation: Update to current versions of component libraries as soon as possible.

Review all updates/lists/notifications for components your organization uses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

OWASP Top 10 : sensitive data exposure.

A

techniques to reduce :
Destroying sensitive data as soon as possible

Using proper key management when encrypting sensitive data

Disabling autocomplete on forms that collect sensitive data

Extensive user training on proper data handling techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Why org uses : using components with known vulnerabilities.

A

The particular vulnerabilities exist only in a context not being used by developers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

OWASP Top 10 : unvalidated redirects and forwards

A

Train users to recognize invalidated links.

Don’t use redirects/forwards in your applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Redirects and Forwards

A

A forward is a situation when instead of an external URL, your website or web application causes the browser to go to different parts of the site. Redirects and forwards are technically identical, the only difference is the type of destination: external URLs vs. internal pages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Lightweight Directory Access Protocol (LDAP)

A

LDAP is used in constructing and maintaining centralized directory services, which are vital in all aspects of IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Privileged user account access

A

Privileged users should have privileged access to specific systems/data only for the duration necessary to perform their administrative function; any longer incurs more risk than value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

The Cloud Security Alliance (CSA) - Data Breach

A

The CSA points out that data breaches come from a variety of sources, including both internal personnel and external actors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Service traffic hijacking

A

Service traffic hijacking can affect all portions of the CIA triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Distributed denial of service (DDoS)

A

Denial-of-service attacks staged from multiple machines against a specific target is the definition of a DDoS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Incidents versus Events

A

Events are anything that can occur in the IT environment, whereas incidents are unscheduled events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

PIPEDA - Canada

A

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian law governing protection of personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

FIPS 140-2

A

The Federal Information Processing Standard (FIPS) 140-2 standard certifies cryptologic components for use by American federal government entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

HIPAA

A

The Health Information Portability and Accountability Act (HIPAA) is an American law regulating patient information for medical providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

The cross-certification model

A

The cross-certification model of federated identity requires all participants to review and confirm all the others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Community Cloud

A

The community cloud is defined by its joint ownership of assets among a member group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

A private cloud - Very sensitive assets.

A

A private cloud is the best option for work in highly regulated industries or industries that involve very sensitive assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

A private cloud - European personal data privacy laws

A

European appliance rental company

Because of European personal data privacy laws, it is extremely important for your company to be sure that the data does not leave the borders of a country approved to handle such data. A private cloud model is the best means for your company to be sure that the data is processed in a data center residing in a particular geophysical location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Big data

A

Big data refers to extremely large data sets used to determine patterns and trends such as purchasing or travel trends of large groups of people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

Portability

A

Portability is the term used to describe the ease with which a customer can move from one cloud provider to another; the higher the portability, the less chance for vendor lock-in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

A cloud reseller

A

A cloud reseller is a firm that contracts with both cloud providers and customers in order to arrange custom services.

The cloud computing reseller purchases hosting services and then resells them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Cloud carrier

A

Cloud carrier is a term describing the intermediary between cloud customer and provider that delivers connectivity; this is typically an ISP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Cash flow at Risk (CFaR)

A

when the amount of cash you receive from your operations is less than all expenditures and bills from the sales

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

X.509

A

X.509 is the certificate standard for communicating public key information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Encryption in cloud computing

A

Storage, Remote access, Secure sessions

The data on magnetic swipe cards isn’t usually encrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Erasure Coding

A

Erasure coding is the practice of having sufficient data to replace a lost chunk in data dispersion, protecting against the possibility of a device failing while it holds a given chunk; parity bits serve the same purpose in a traditional RAID configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Egress Monitoring Solutions

A

EMS resides on client machines

Discovers data assets according to classification/categorization

Egress monitoring solutions (often referred to as DLP tools, where DLP stands for data loss protection or data leak prevention, or some combination of these terms) will often include an agent that resides on client devices in order to inspect data being shared/sent by end users.

E-discovery/forensics
Data exfiltration
Data categorization/classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

DRM Solutions

A

DRM is mainly designed to protect intellectual property. It can also sometimes be used for securing PII, but intellectual property is a better answer here.

DRM is often deployed to ensure that copyrighted material (frequently software) is only delivered to and used by licensed recipients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Homomorphic encryption

A

experimental technology that might lead to the possibility of processing encrypted data without having to decrypt it first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

International traffic in arms regulations (ITAR)

A

International traffic in arms regulations (ITAR) is a Department of State program

The International Traffic in Arms Regulations (ITAR) are a set of U.S. government regulations that control the export of defense articles and services. The ITAR are administered by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Export administration regulations (EAR)

A

The Export Administration Regulations (EAR) govern the export and re-export of some commodities, software and technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

ITAR versus EAR

A

EAR focuses on dual-use items, while ITAR targets defense-related items.

Export administration regulations (EAR) is a Commerce Department program

International traffic in arms regulations (ITAR) is a Department of State program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

A content delivery network (CDN)

A

A content delivery network (CDN) is a service that distributes data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Data dispersion versus RAID

Scalable cloud hosting

A

Data dispersion uses parity bits, data chunks, and encryption.
Data dispersion uses chunks of data, erasure coding, and encryption.

Parity bits and disk striping are characteristic of RAID implementations

Cloud-bursting is a feature of scalable cloud hosting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

Copyright

A

Copyrights are designed to protect tangible expressions of creative works, like books, articles, music, and so on

Copyrights are protected tangible expressions of creative works.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

Trademark

A

Logos and symbols and phrases and color schemes that describe brands are trademarks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

Tradesecrets

A

Confidential recipes unique to the organization are trade secrets.

Confidential sales and marketing materials unique to the organization are trade secrets.

141
Q

Patents

A

Patents protect processes (as well as inventions, new plantlife, and decorative patterns).

142
Q

Personal cloud storage

A

Personal cloud storage is the storage of a single user’s data in the cloud, allowing them access from anywhere on the Internet.

143
Q

Volume Storage

A

Volume storage consists of volumes that are attached to virtual storage and act or behave just like a physical drive or array.

144
Q

Secret sharing made short (SSMS)

–

Bit splitting

A

SSMS is a method of bit splitting that uses the three phases: encryption, using an information dispersal algorithm, and splitting the encryption key using the secret sharing algorithm. The fragments are signed and distributed to different cloud storage services, making it difficult to decrypt without both arbitrarily chosen data and encryption key fragments.

145
Q

Information rights management (IRM)

A

Information rights management (IRM) is a means to prevent unauthorized copying and limitation of distribution to only those who pay for content.

146
Q

crypto-shredding

A

In crypto-shredding, the purpose is to make the data unrecoverable; saving a backup of the keys would attenuate that outcome because the keys would still exist for the purpose of recovering data. All other steps outline the crypto-shredding process.

147
Q

Data dispersion - chunking/sharding
RAID - Striping

A

Data dispersion is basically RAID in the cloud, with data elements parsed and stored over several areas/devices instead of stored as a unit in a single place. RAID (and data dispersion) does aid in BC/DR activities by increasing the robustness and resiliency of stored data, but BC/DR is a much more general discipline, so it is not the optimum answer for the question. SDN is used for abstracting network control commands away from production data, and CDN is usually used for ensuring quality of streaming media.

Where RAID used data striping across multiple drives, with data dispersion this technique is referred to as “chunking,” or sometimes “sharding” when encryption is also used.

148
Q

DRM Solution characteristics

A

Mapping to existing access control lists (ACLs) is the trait that allows DRM tools to provide additional access control protections for the organization’s assets. The other options are not characteristics associated with DRM solutions.

Continuous audit trail is the trait that allows DRM tools to log and exhibit all access to a given object. The other options are not characteristics associated with DRM solutions.

Automatic expiration is the trait that allows DRM tools to prevent access to objects when a license expires or to remove protections when intellectual property moves into the public domain. The other options are not characteristics associated with DRM solutions.

Persistence is the trait that allows DRM protection to follow protected files wherever they might be stored/copied. The other options are not characteristics associated with DRM solutions.

149
Q

Transparent encryption

A

Encrypting specific tables within the database is one of the options of transparent encryption;

150
Q

Application-level encryption -
database encryption techniques makes it difficult to perform database functions (searches, indexing, etc.

A

Application-level encryption involves encrypting the data before it enters the fields of the database; it is much more difficult to search and review data that has been encrypted, so this reduces the functionality of the database.

151
Q

Event monitoring tools - SIEM
SIM, SEM

detect external hacking
predict system outages

Optimizing performance
Detecting ambient heating, ventilation, and air-conditioning (HVAC) problems

A

Event monitoring tools can help detect external hacking efforts by tracking and reporting on common hack-related activity, such as repeated failed login attempts and scanning.

Event monitoring tools can be used to predict system outages by noting decreases in performance; repeated performance issues can be an indicator a device is failing.

Event monitoring tools can detect repeated performance issues, which can be used by administrators and architects to enhance performance/productivity.

Event monitoring tools can detect repeated performance issues, which can be indicative of improper temperature settings in the data center; also, some system monitoring metrics, such as CPU temperature, can directly indicate inadequate HVAC performance

Detecting ambient heating, ventilation, and air-conditioning (HVAC) problems

Incident evidence

152
Q

Digital Millennium Copyright Act (DMCA)

A

The DMCA deals with intellectual property and not specifically with personal privacy. It is not included in the CSA CCM.

153
Q

DRM requires that every data resource be provisioned with ….An access policy

A

For DRM to work properly, each resource needs to be outfitted with an access policy so that only authorized entities may make use of that resource

154
Q

Crypto-shredding

A

The proper procedure for crypto-shredding requires two cryptosystems: one to encrypt the target data, the other to encrypt the resulting data encryption keys. All the other answers are incorrect.

155
Q

Code Signing

A

Digitally signing software code is an excellent method for determining original ownership and has proven effective in major intellectual property rights disputes.

156
Q

Copyright
Civil Court

A

Enforcement of copyright is usually a tortious civil action, as a conflict between private parties.

157
Q

Homomorphic encryption

A

heoretical technique would allow encrypted data to be manipulated without decrypting it first

158
Q

Quantum computing

A

theoretical technology would allow superposition of physical states to increase both computing capacity and encryption keyspace?

159
Q

DLP / DRM

A

Every additional security measure might reduce a potential threat but definitely will reduce productivity and quality of service. There is always an overhead cost of security

DLP tools can function better if appropriate and accurate classification and labeling is applied throughout the environment and done on a consistent basis.

160
Q
A
161
Q

Risk

A

A vulnerability combined with a specific threat is defined as a risk.

162
Q

Business impact analysis (BIA)

A

Business impact analysis (BIA) is designed to identify and ascertain the value of assets in addition to the critical paths and processes.

163
Q

Mean time to repair (MTTR)

A

Mean time to repair (MTTR) is the time required to repair a device that has failed or is in need of repair. The term mean indicates the average time as opposed to the actual or past experiences.

164
Q

annual loss expectancy (ALE)

A

The term that best describes the amount an organization should expect to lose on an annual basis due to one type of incident is annual loss expectancy (ALE) and is calculated by multiplying the annual rate of occurrence (ARO) by the single loss expectancy (SLE).

165
Q

Heating, ventilation, and air-conditioning (HVAC)

A

Heating, ventilation, and air-conditioning (HVAC) systems separate the cool air from the heat caused by servers. They provide air management including racks with built-in ventilation or alternate cold/hot aisles.

166
Q

Hot aisle containment

A

The backs of the devices face each other and the ambient temperature in the work area is cool, it is called

167
Q

Cold aisle containment

A

Cold aisle containment is a configuration where the fronts of devices face each other.

168
Q

Recovery point objective (RPO)

A

Recovery point objective (RPO) is a term used in BC and DR describing the tolerable amount of data that might be lost due to an outage before severe consequences are experienced.

169
Q

The maximum tolerable downtime/maximum allowable downtime (MTD/MAD)

A

The maximum tolerable downtime/maximum allowable downtime (MTD/MAD) is a point in time after an outage has occurred and beyond which recovery becomes extremely difficult or impossible.

170
Q

SDN

A

SDN is the idea of separating the network control plane from the actual network forwarding plane. This allows for greater control over networking capabilities and for integration of such things as APIs.

a means to centralize logical control of all networked nodes in the environment, abstracted from the physical connections to each

171
Q

In software-defined networking (SDN), the northbound interface (NBI)

A

The NBI usually handles traffic between the SDN controllers and SDN applications.

172
Q

Single sign-on (SSO)
federation

A

Single sign-on (SSO) is similar to federation, but it is limited to a single organization; federation is basically SSO across multiple organizations.

173
Q

Cross-certification

A

The cross-certification federation model is also known as a web of trust.

174
Q

liquid propane

A

Liquid propane does not spoil, which obviates necessity for continually refreshing and restocking it and might make it more cost-effective

175
Q

UPS

A

The UPS is intended to last only long enough to save production data currently being processed. The exact quantity of time will depend on many variables and will differ from one datacenter to the next.

176
Q

Line conditioning

A

A UPS can provide line conditioning, adjusting power so that it is optimized for the devices it serves and smoothing any power fluctuations; it does not offer any of the other listed functions.

177
Q

Mobile cloud storage

A

Mobile cloud storage is defined as a form of cloud storage that applies to storing an individual’s mobile device data in the cloud and providing the individual with access to the data from anywhere

178
Q

The purpose of the transfer switch

A

The purpose of the transfer switch is to redirect power consumption from utility power to generator power; this should be done fast enough to ensure power is available when the batteries fail.

179
Q

controls

A

Controls are mechanisms designed to restrict a list of possible actions down to allowed or permitted actions.

180
Q

Security Assertion Markup Language (SAML)

A

Security Assertion Markup Language (SAML) is based on XML. HTTP is used for port 80 web traffic; HTML is used to present web pages

181
Q

Ping, Power, Pipe

A

Remote access for customer to racked devices in the data center; electrical utilities; connectivity to an Internet service provider (ISP)/the Internet

182
Q

Cloud Carrier

A

The ISP between the cloud customer and provider

183
Q

Challenge of operating in the cloud is that additional controls must be placed on file storage systems

A

VMs are snapshotted and simply stored as files when they are not being used; an attacker who gains access to those file stores could ostensibly steal entire machines in highly portable, easily copied formats. Therefore, these cloud storage spaces must include a significant amount of controls.

184
Q

Object storage

A

Snapshotted VM images are usually kept in object storage, as files.

185
Q

Host escape

A

the situation when a malicious user or attacker can exit the restrictions of a single host and access other nodes on the network

186
Q

Guest Escape

A

the situation when a malicious user or attacker can exit the restrictions of a virtual machine (VM) and access another VM residing on the same host

187
Q

automation of configuration helps

A

A secure baseline configuration, applied and maintained automatically, ensures the optimum security footprint with the least attack surface.

188
Q

cross-certification federation model
web of trust - federation model

A

The cross-certification federation model is also known as a web of trust.

In a web of trust federation model, all of the participating organizations are identity providers; each organization will assign identity credentials to its own authorized users, and all the other organizations in the federation will accept those credentials.

service providers : each organisation
identity provider : each organisation

189
Q

Proxy federation model

A

In the proxy federation model, the third party acts on behalf of the member organizations, reviewing each to ensure that they are all acceptable to the others

190
Q

cloud data center audit - Challenges

A

Cloud providers may be reluctant to grant physical access, even to their customers, on the assumption that allowing access would disclose information about security controls. In some cases, cloud customers won’t even know the location(s) of the data center(s) where their data is stored

a cloud audit will depend on which information a cloud provider discloses, which makes auditing difficult and less trustworthy

They frequently rely on third parties: Because cloud audits are often the result of third-party assertions, recipients of cloud audit reports may be more skeptical of the results than they would have been of traditional audits, in which the recipients may have performed firsthand.

191
Q

controls would be useful to build into a virtual machine baseline image for a cloud environment

A

Automated vulnerability scan on system startup

Automatic registration with the configuration management system

192
Q

Having your BC/DR backup stored with the same cloud provider as your production environment can help in

A

Having the backup within the same environment can allow easy rollback to a last known good state or to reinstantiate clean VM images after minor incidents (e.g., a malware infection in certain VMs).

193
Q

The BC/DR plan/policy ( need not include)

A

you don’t need to include full copies of these governance documents

include:
Tasking for the office responsible for maintaining/enforcing the plan

Contact information for essential entities, including BC/DR personnel and emergency services agencies

Checklists for BC/DR personnel to follow

194
Q

Opportunity …Risk

A

Risk should always be considered from a business perspective. Risk is often balanced by corresponding oppurtunity

195
Q

new risk in the cloud, not affecting the traditional, on-premise environment

A

Legal seizure of another firm’s assets

Resource exhaustion

Multitenancy

196
Q

Inference Attacks

A

While it is possible that one guest VM seeing the resource calls of another VM could possibly allow one guest to see the other’s data, it’s much more likely that a user seeing another user’s use of resources, rather than raw data, would allow the viewer to infer something about the victim’s behavior/usage/assets.

197
Q

ENISA –IAM

A

According to ENISA, custom IAM builds can become weak if not properly implemented.

198
Q

Credential revocation

A

Revoking credentials that might be lost when a device goes missing is a way to mitigate the possibility of those credentials being used by an unauthorized person.

199
Q

RTO , MAD

A

The RTO must always be less than the MAD.

The RTO is the measure of time after an interruption at which the company needs to resume critical functions; any service migration must take place within that time.
RTOs vary for every organization; there is no set answer for all organizations. Options A and B might be correct for a given organization but incorrect in the general case because it’s impossible to know an organization’s RTO without knowing more about the organization.

The RTO is the measure of time after an interruption at which the company needs to resume critical functions; any service migration must take place within that time.

200
Q

Social engineering - Pen testing

A

Cloud providers will probably not allow ____________social engineering_______ as part of a customer’s penetration test.

201
Q

pen test, prosecution

A

A cloud customer performing a penetration test without the provider’s permission is risking … Prosecution

A penetration test requires the tester to analyze the security of an environment from the perspective of an attacker; this also includes actually taking action that would result in breaching that environment.

202
Q

security controls, VM

A

Security controls operating on a guest VM OS are only active while the VM is active; when the VM is stored, it is snapshotted and saved as a file, so those controls won’t be active either.

203
Q

Which of the following is a risk in the cloud environment that does not exist or is not as prevalent in the traditional environment

A

Legal liability in multiple jurisdictions
Loss of availability due to DDoS

204
Q

A virtual network interface card (NIC)

A

The virtualized NIC is part of the Data-Link layer.

205
Q

CDN, SaaS

A

CDNs are often used in conjunction with SaaS services to deliver high-quality data of large sizes (often multimedia).

206
Q

FM-200

A

FM-200 is used as a replacement for older Halon systems specifically because it (unlike Halon) does not deplete the ozone layer.

207
Q

Converged networking model

A

Optimized for cloud deployments, the converged networking model combines the underlying storage and IP networks to maximize the benefits of a cloud workload.

208
Q

DR Sites - Hot, cold, warm

A

Hot site: A fully functional data center that’s usually kept ready around the clock. It’s a near duplicate of an organization’s primary site, with complete backups of user data and full computer systems. Hot sites are the most expensive option and are best for businesses with zero tolerance for downtime and data loss

Warm site: A data center that’s equipped with some or all of the hardware, software, and network services found in a working data center, but doesn’t have live data. Warm sites are a good option for businesses with a lower budget and a need for flexible and fast recovery

Cold site: An empty operational space with basic facilities like air conditioning, power, and communication lines. Cold sites have no or little equipment or hardware, and no network connectivity or data synchronization. Before a cold site can be used, backup data and additional hardware must be sent to the site and installed.

209
Q

CDN - handles DDoS attacks

A

A content delivery network (CDN) run by a major provider can handle large-scale DDoS attacks more easily than any of the other solutions. Using DDoS mitigation techniques via an ISP is the next most useful capability, followed by both increases in bandwidth and increases in the number of servers in the web application cluster.

210
Q

packet capture , most accurate reconstruction of user activity

A

full packet capture provides the most accurate reconstruction of user activity, but it is costly to implement due to data storage requirements.

211
Q

2 different cloud providers - most significant risk

one cloud provider for your operational environment and another for BC/DR backup/archive?

A

When using two different cloud providers, a cloud customer runs the risk that data/software formats used in the operational environment can’t be readily adapted to the other provider’s service, thus causing delays during an actual failover.

212
Q

Organizational Normative Framework (ONF)

A

A framework of containers for all components of application security, best practices, catalogued and leveraged by the organization

213
Q

APIs

A

A set of routines, standards, protocols, and tools for building software applications to access a web based software application or tool

214
Q

ONF - ANF

A

there is a one-to-many ratio of Organizational Normative Framework (ONF) to Application normative framework (ANF); each organization has one Organizational Normative Framework (ONF) and many ANFs (one for each application in the organization). Therefore, the Application normative framework (ANF) is a subset of the Organizational Normative Framework (ONF).

215
Q

SAML

A

A standard for exchanging authentication and authorization data between security domains

216
Q

the purpose and scope of International Organization for Standardization (ISO)/International electrotechnical commission (IEC) 27034 1

A

Provides an overview of application security that introduces definitive concepts, principles, and processes involved in application security

217
Q

Database activity monitoring (DAM) can be

A

Host based or network based

A DAM can recognize and block malicious SQL traffic.

218
Q

WAF - Layer 7

A

WAFs operate at Layer 7 of the OSI model.

219
Q

DAST

Fuzz testing

A

Test performed on an application or software product while it is being executed in memory in an operating system.

Also called fuzz testing, dynamic testing methods should include known bad inputs in order to determine how the program will handle the “wrong” data (will it fail into a state that is less secure than normal operations, etc.).

220
Q

Sandbox

A

A test environment that isolates untrusted code changes for testing in a nonproduction environment

Sandboxing is often used for testing applications in development or carving out resources that cannot then touch other parts of the same system.

A sandbox can be used to run malware for analysis purposes as it won’t affect (or infect) the production environment; it’s worth noting, though, that some malware is sandbox-aware, so additional antimalware measures are advisable.

221
Q

three types of training

A

Initial, Recurring, Refresher

222
Q

Federation

A

Federation is an arrangement that can be made among multiple enterprises allowing them to use the same identification data to obtain access to all enterprises’ resources within the group.

223
Q

REST

A

Representational State Transfer (REST) relies on stateless, client-server, cacheable communications. It is a software architecture consisting of guidelines and best practices for creating scalable web services.

224
Q

OpenID

A

OpenID is one form of authentication used to enable SSO and enables the user to log into more than one application or website using the same credentials.

225
Q

Return on investment (ROI)

A

Return on investment (ROI) is a term used to describe a profitability ratio. It is generally calculated by dividing net profit by net assets.

226
Q

A cross-site scripting (XSS)

A

A cross-site scripting (XSS) attack occurs when an application receives untrusted data and then sends it to a web browser without proper validation, allowing an attacker to execute scripts in the user’s browser, hijack sessions, or engage in other malicious behavior.

reduce techniques:
Put untrusted data in only allowed slots of HTML documents.

HTML escape when including untrusted data in any HTML elements.

Use the attribute escape when including untrusted data in attribute elements.

Use an auto-escaping template system.

HTML escape JSON values in an HTML context and read the data with JSON.parse.

Sanitize HTML markup with a library designed for the purpose.

227
Q

Layer 7

A

API Gateway
Database
WAF

228
Q

Process isolation

A

Process isolation can reduce the possibility of side-channel attacks in an environment with shared resources.

229
Q

ISO 27034 mandates a framework for application security within an organization

A

Organizational Normative Framework (ONF), Application Normative Framework (ANF)

230
Q

RESTful responses can come from the server

A

Extensible Markup Language (XML), JavaScript Open Notation (JSON)

231
Q

Data owners

A

The data owner is responsible for the disposition of the data under their control; this includes access decisions.

232
Q

Forklifting

A

an informal industry term for moving applications from a traditional environment into the cloud

233
Q

Cloud migration

A

Cloud migration is the process of transitioning all or part of a company’s data, applications, and services from onsite premises behind the firewall to the cloud. This enables information to be provided over the Internet on an on-demand basis.

234
Q

OpenID Connect

A

OpenID Connect is a federation protocol that uses representational state transfer (REST) and JavaScript Object Notation (JSON); it was specifically designed with mobile apps in mind, instead of only web-based federation.

WS-Federation is a federation protocol that is part of the WS-Security family of standards and reliant on Simple Object Access Protocol (SOAP)

235
Q

federated protocols :

OAuth2
OpenID
SAML

A

open federated protocols like SAML, OAuth 2.0, and OpenID Connect.

236
Q

multifactor authentication

A

For high-risk operations and data that is particularly sensitive

237
Q

The XML gateway

A

Which security tool can perform content inspection of Secure File Transfer Protocol (SFTP) communications?

The XML gateway can provide this functionality”; it acts as a reverse proxy and can perform content inspection on many traffic protocols.

238
Q

Application virtualization can typically be used for

A

Running an application on an endpoint without installing it
Running an application in a non-native environment

239
Q

TLS

A

TLS maintains the confidentiality and integrity of communications, often between a web browser and a server.

TLS uses symmetric key crypto for each communications session in order to secure the connection; the session key is uniquely generated each time a new connection is made

240
Q

Vulnerability scans
vulnerability signatures

A

Vulnerability scans use signatures of known vulnerabilities to detect and report those vulnerabilities.

241
Q

DAST :
SAST:

A

DAST:Path coverage
SAST: Code coverage

242
Q

Tokenization

A

Compliance with the Payment Card Industry Data Security Standard (PCI DSS)

By offloading privacy data to a tokenizing third party, merchants can free themselves of the contractual burdens for protecting cardholder data at rest.

243
Q

A cloud-based sandbox should not be used for _ƒISO

A

Installing malware on systems owned by someone else may be illegal in many jurisdictions. While on-premises sandboxes are fine for this purpose, it may be a felony if performed in the cloud.

244
Q

ISO 27034

A

ISO 27034 addresses the sets of controls used in software throughout the environment.

245
Q

Open source

open source review

A

Open source software includes programs where customers (or even the public) can view the software’s source code.

Open source review can detect flaws /programming defects that a structured testing method might not.

246
Q
A
247
Q

REST

A

REST calls web resources by using uniform resource identifiers (URIs).

248
Q

The Agile method

A

The Agile method reduces the dependence and importance of documentation in favor of functioning software versions.

249
Q

Threat modelling

STRIDE
DREAD
ATASM
PASTA

A

Threat modeling (e.g., Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE), Disaster, Reproducibility, Exploitability, Affected Users, and Discoverability (DREAD), Architecture, Threats, Attack Surfaces, and Mitigations (ATASM), Process for Attack Simulation and Threat Analysis (PASTA))

250
Q

Overview of the CSA STAR framework

A

The STAR program’s open certification framework contains three levels: self-assessment (Level 1), third-party audit (Level 2), and continuous auditing (Level 3).

251
Q
A
252
Q

Which of the following SOC report subtypes represents a point in time - Type 1

Which of the following SOC report subtypes spans a period of time?

A

An SOC Type I report is designed around a specific point in time as opposed to a report of effectiveness over a period of time.

An SOC Type II report is designed around a period of time as opposed to a specific point in time.

253
Q

The doctrine of the proper law

A

The doctrine of the proper law refers to how jurisdictional disputes are settled.

254
Q

The silver platter doctrine

A

The silver platter doctrine allows law enforcement entities to use material presented voluntarily by the owner as evidence in the prosecution of crimes, without a warrant or a court order.

255
Q

The doctrine of plain view

A

The doctrine of plain view allows law enforcement to act on probable cause when evidence of a crime is within their presence

256
Q

The Restatement (Second) Conflict of Law

A

The Restatement (Second) Conflict of Law is the basis used for determining which laws are most appropriate in a situation where conflicting laws exist.

257
Q

The Stored Communication Act (SCA)

A

The Stored Communication Act, passed in 1995, is old, in bad need of updating, and unclear with regard to newer technologies.

258
Q

KRI stands for key risk indicator.

A

KRI stands for key risk indicator. KRIs are the red flags if you will in the world of risk management. When these change, they indicate something is amiss and should be looked at quickly to determine if the change is minor or indicative of something important.

259
Q

International Organization for Standardization (ISO) 31000:2009

design implementation and management

A

International Organization for Standardization (ISO) 31000:2009 specifically focuses on design implementation and management

260
Q

International Organization for Standardization (ISO) 27017

cloud specific security controls

A

International Organization for Standardization (ISO) 27017 is about cloud specific security controls

261
Q

ISO 27050 - eDiscovery

A

is an industry standard that provides guidance for eDiscovery programs.

262
Q
A
263
Q

National Institute of Standards and Technology (NIST) 800-92

Log management

A

National Institute of Standards and Technology (NIST) 800-92 is about log management,

264
Q

ENISA - the top 8 security risks based on likelihood and impact.

A

European Union Agency for Network and Information Security (ENISA)

specifically identifies the top 8 security risks based on likelihood and impact.

European Union Agency for Network and Information Security (ENISA) identifies 35 types of risks organizations should consider but goes further by identifying the top eight security risks based on likelihood and impact.

265
Q

International Organization for Standardization (ISO)/International electrotechnical commission (IEC) 28000:2007

A

to addressing security risks in a supply chain

266
Q

International Organization for Standardization (ISO) 31000:2009

A

International Organization for Standardization (ISO) 31000:2009 is an international standard that focuses on designing, implementing, and reviewing risk management processes and practices

267
Q

National Institute of Standards and Technology (NIST) SP 800-37

A

National Institute of Standards and Technology (NIST) SP 800-37 is the Guide for Implementing the Risk Management Framework (RMF), a methodology for handling all organizational risk in a holistic, comprehensive, and continual manner.

268
Q

KPIs, KRIs

A

Key risk indicators (KRIs) try to predict future risk, while key performance indicators (KPIs) examine events that have already happened. The other answers are just distractors.

269
Q

Cloud Security Alliance Cloud Controls Matrix (CCM)

A

An inventory of cloud service security controls that are arranged into separate security domains

270
Q

The acceptable use policy (AUP)

A

The acceptable use policy (AUP) is designed to make clear to employees what is acceptable as well as unacceptable use of company-owned computing equipment and data such as email.

271
Q

ISO 20000-1

A

ISO 20000-1 describes service management.

ISO 27001 describes an information security management system.

ITIL is not an ISO standard, nor is COBIT—in fact, they’re their own standards.

272
Q

ISO 27001

A

ISO 27001 describes an information security management system (ISMS) as a set of interrelated elements that organizations use to manage and control information security risks to protect and preserve the confidentiality, integrity, and availability of information.

273
Q

ISO/IEC 27037:2012

A

ISO standard for collecting, preserving, and identifying electronic evidence.

274
Q

The Cloud Security Alliance (CSA)

A

The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.

275
Q

ISO - Common criteria

A

ISO publishes and maintains the Common Criteria program.

276
Q

The Diffie-Hellman

RADIUS

TACACS

A

The Diffie-Hellman key exchange process is designed to allow two parties to create a shared secret (symmetric key) over an untrusted medium

RADIUS is an outmoded access control service for remote users. RSA is an encryption scheme.

TACACS is a network access protocol set used through a centralized server.

277
Q

The Organisation for Economic Cooperation and Development (OECD)

Characteristics of OECD :
The collection limitation principle
The data quality principle
Purpose specification principle
The use limitation principle
The security safeguards principle
The openness principle

A

The collection limitation principle requires any entity that gathers personally identifiable information (PII) about a person to restrict data collection to only information that is necessary for the transaction, and only with the knowledge and permission of the individual.

The data quality principle requires any entity that gathers personally identifiable information (PII) about a person to ensure that the data remains valid and accurate and allows for corrections by the data subject

The purpose specification principle requires any entity that gathers personally identifiable information (PII) about a person to clearly state the explicit purpose for which the PII will be used.

The use limitation principle requires any entity that gathers personally identifiable information (PII) about a person to restrict the use of that PII to that which was permitted by the data subject and the reason given when it was collected.

The security safeguards principle requires any entity that gathers personally identifiable information (PII) about a person to protect that data against unauthorized access and modification

The openness principle requires any entity that gathers personally identifiable information (PII) about a person to allow that person to access the information.

278
Q

The Privacy Shield program is

A

Voluntary for non–European Union (EU) entities

279
Q

Department of Commerce

A

The Department of Commerce manages the Privacy Shield program in the United States; the Departments of State and Interior do not. There is no Department of Trade.

280
Q

ISO 27001 , 27002
NIST SP 800-53 - NIST SP 800- 37

A

The 27002 standard contains sets of controls to be used in order to allow the organization to match the security program created for the organization with 27001

NIST SP 800-53 allows the organization to craft a set of controls to meet the requirements created for and by the organization when using NIST SP 800-37

281
Q

The EuroCloud Star Audit (ECSA) program

A
282
Q

The silver platter doctrine

A

The silver platter doctrine allows law enforcement entities to use material presented voluntarily by the owner as evidence in the prosecution of crimes, without a warrant or a court order.

283
Q

File hashes

A

File hashes can serve as integrity checks for both configuration management (to determine which systems are not configured to the baseline) and audit purposes (as artifacts/common builds of systems for audit review).

284
Q

The Reporting phase of forensic investigation – The court

A

The Reporting phase of forensic investigation usually involves presenting findings to

285
Q

Federal Trade Commission (FTC)

A

The FTC is in charge of the Privacy Shield program.

286
Q

The Capability Maturity Model (CMM)

A

The CMM is a way of determining a target’s maturity in terms of process documentation and repeatability

287
Q

How many controls are listed in the PCI DSS - over 200

A

The PCI DSS is extremely thorough and wide reaching.

Merchants at different tiers are required to have more or fewer audits in the same time frame as merchants in other tiers, depending on the tier.
All PCI DSS–compliant merchants must meet all the control and audit requirements of the standard;

288
Q

Patent , copyright

trade mark validity
trade secret

A

patent : 20 years

copy right : life of the author + 70 years then
Copyrights expire after a certain duration and then fall into the public domain, where they can be used by anyone for any purpose. This material certainly exceeds the time of any copyright protection.

trademark:
10 years from the date of registration, with a potentially unlimited number of 10-year renewal terms. renew it with the U.S. Patent and Trademark Office (USPTO)

trade secrets:
Unlike patents, which typically have a shelf life of twenty years, trade secrets last indefinitely. Trade secrets last as long as the secret can be kept

289
Q

ISO 31000, NIST 800-37 - RMF (Risk management frameworks)

A

Both ISO 31000 and National Institute of Standards and Technology (NIST) 800-37 are risk management frameworks.

290
Q

The Cloud Security Alliance - CSA

A

The Cloud Security Alliance is a volunteer organization that includes members from various industries and sectors and is focused on cloud computing. It relies largely on member participation for developing standards

291
Q

Cloud Security Alliance Cloud Controls Matrix (CSA CCM) - TOOL

A

The Cloud Controls Matrix is an excellent tool for determining completeness and possible replication of security controls.

292
Q

Civil Suit

A

Intellectual property disputes are usually settled in civil court, as a conflict among private parties.

293
Q

Trademark protection

A

Trademark protection is provided to those who apply for it, to either a state or federal trademark registration body. In the case of conflicting usage (or infringement), courts will take many criteria into account, including which party has first claim on the trademark (that is, who used it the longest), the location(s) where the trademark is used, the possibility for confusion among customers, and so forth. But for a specific location and specific business purpose, the deciding element will probably be which party first registered the trademark in question.

294
Q

which elements are appropriate to include in a service-level agreement (SLA)

A

SLA elements should be objective, numeric values, for repeated activity.

Eg: The specific amount of data that can be uploaded to the cloud environment in any given month

295
Q

Criminal law

A

Criminal law is set out in rules and statutes created by a government, prohibiting certain activities as a means of protecting the safety and well-being of its citizens. Violations generally consist of both monetary and/or loss of liberty punishments.

296
Q

Tort law

A

Tort law refers the body of laws that provide remedies to individuals who have been caused harm by unreasonable acts of others. Negligence is the most common type of tort lawsuit.

297
Q

Spoliation

A

Spoliation is the term used to describe the destruction of potential evidence (intentionally or otherwise); in various jurisdictions, it can be a crime, or the grounds for another lawsuit.

298
Q

The Digital Millennium Copyright Act (DMCA)

A

The DMCA criminalizes the production or dissemination of technology, devices, or services intended to circumvent copyright techniques used to protect digital media such as video and audio recordings; this includes some decryption tools.

299
Q

Discovery tool

A

Typically, a discovery tool is a primary component of a DLP solution. This might be employed for purposes of identifying and collecting pertinent data

300
Q

Contracts

A

Contracts are agreements between parties to exchange goods and services

301
Q

Extradition

A

legal practice of removing a suspect from one jurisdiction to another in order for the suspect to face prosecution for violating laws in the latter

302
Q

International Organization for Standardization (ISO) 31000:2009

A

focuses on design implementation and management.

303
Q

The Privacy Shield program is

A

Voluntary for non–European Union (EU) entities

304
Q

The AICPA, the OECD, and the EU GDPR have all outlined certain basic expectations

A

The AICPA, the OECD, and the EU have all outlined certain basic expectations for entities that are privacy data controllers; these expectations are extremely similar in the documentation produced by all three

305
Q

One of the characteristics the OECD suggests that privacy laws include is the

A

Purpose specification principle
Use limitation principle

306
Q

Cryptography for the two main types of APIs

A

Cryptography for the two main types of APIs is required; this is TLS for representational state transfer (REST) and message-level encryption for Simple Object Access Protocol (SOAP).

307
Q

SLA Elements

A

SLA elements should be objective, numeric values, for repeated activity.

308
Q

Private cloud

A

Your company operates under a high degree of regulatory scrutiny

309
Q

Acquiring and managing software licenses

SaaS, PaaS

A

The customer is still responsible for some software licensing and maintenance activities (and therefore costs) in infrastructure as a service (IaaS) and platform as a service (PaaS) models;

In a software as a service (SaaS) model, the cloud provider is tasked with acquiring and managing the software licenses; the scale of a cloud provider’s operations can allow them to reduce the per-seat cost of software considerably.

310
Q

DC Tier 1

A

for contingency backup and archiving purposes.
Tier 1 data center should suffice; it is the cheapest, and you need it only for occasional backup purposes (as opposed to constant access). The details of location and market are irrelevant.

Tier 1: to support an organization that wants to conduct IT operations

Tier 1 data centers are expected to help protect Lime Highlight created at 1:29 PM on 9/6/24against human error, not outages or disasters. They’re also expected to have redundancy for chillers, pumps, UPS devices, and generators but are likely to have to shut down for maintenance activities.

311
Q

DC Tier 2:

A

Tier 2 facilities provide more redundancy than Tier 1 facilities.

Tier 2 facilities are intended to ensure that critical operations are not interrupted due to planned maintenance.

312
Q

DC Tier 3:

A

The Tier 3 design is known as a “concurrently maintainable site infrastructure.” As the name indicates, the facility features both the redundant capacity components of aTier 2 build and the added benefit of multiple distribution paths where only a sole path is needed to serve critical operations at any given time.

313
Q

DC Tier 4:

A

Tier 4 data centers are the highest level described by the Uptime Institute.

They have independent and physically isolated systems providing redundancy and resiliency at both the component and distribution path levels, ensuring that events that compromised one system would not take out the redundant system.

314
Q

Data Center Tier

A

Uptime Percentage:

Tier 1: 99.671
Tier 2: 99.741
Tier 3: 99.982
Tier 4: 99.995

315
Q

Your company will not be allowed to use a cloud data center in which of the following countries? (if EU data is thr)

A

south korea
The United States

316
Q

Community cloud

A

company’s collaboration needs.

317
Q

Private cloud

A

highly sensitive industries, including aerospace and pharmaceuticals.

318
Q

TCI

A

The TCI does not, specifically, require cost-effectiveness of cloud services.

319
Q

Risk in managed cloud env

A

Management plane breach allows an attacker to gain full control of the environment and can affect all aspects of the CIA triad.

320
Q

Private cloud storage

A

One type of cloud storage wherein cloud and enterprise storage both reside inside the enterprise behind the firewall.

321
Q

Public cloud storage

A

This form of cloud storage involves the enterprise and storage service being separate, with data stored outside the confines of the enterprise environment.

322
Q

Mobile cloud storage

A

This form of cloud storage applies to storing mobile device data in the cloud while providing access to the stored data from anywhere.

323
Q

Enterprise risk management

A

A set of processes and structures used to effectively manage all risks to an enterprise.

324
Q

Which of the following circumstances would not commonly result from humidity issues

A

Situations where humidity is too high may result in the buildup of moisture and corrosion of equipment. If humidity falls too low, it may result in static electricity issues. Humidity issues generally do not contribute to fires or physical access control failures

325
Q

Inert gas systems

A

Inert gas systems use no water and are unlikely to damage sensitive electronic equipment, even if discharged. Wet pipe, dry pipe, and preaction systems all use water and may damage or destroy electronic equipment if activated or damaged.

326
Q

Which one of the following hash algorithms would not trigger this vulnerability?

MD4
MD5
SHA-1
SHA-256

A

To be used in a secure manner, certificates must take advantage of a hash function that is not prone to collisions. The MD2, MD4, MD5, and SHA-1 algorithms all have demonstrated weaknesses and would trigger a vulnerability. The SHA-256 algorithm is still considered secure.

327
Q

Asymmetric encryption–public , private key

receiver’ uses his private key to decrypt

A

The recipient of a message encrypted using an asymmetric encryption algorithm decrypts that message using their own private key. Therefore, Alice should use her own private key to decrypt the message that Bob encrypted using Alice’s public key.

328
Q

minimum amount of time to expect UPS
to provide power to the systems in the datacenter

10mins

A

The purpose of an uninterruptible power supply (UPS) is to provide power to systems for a short period of time. They provide immediate backup power from a battery that should be quickly replaced by long-term backup power from a generator or similar source. For this reason, you should only expect the UPS to last for about 10 minutes

329
Q

For IRM:
Digital certificate revocation : 2 ways
OCSP Online Certificate Status Protocol (OCSP) – FASTER
adding the certificate to a Certificate Revocation List (CRL)

A

There are two possible techniques for revoking a digital certificate: updating the certificate’s status using the Online Certificate Status Protocol (OCSP) and adding the certificate to a Certificate Revocation List (CRL). Of these, OCSP provides faster updates and is the preferred method. It is not possible to change the public or private keys associated with an existing digital certificate.

330
Q

Ephemeral storage:

Terminating a server completely deletes it and the ephemeral storage.

A

Ephemeral storage is temporary storage associated with a server instance. It will be deleted if the server is terminated, but it will not be deleted if the server is simply stopped or rebooted. Stopping a server allows it to be restarted at a later time, which requires access to the ephemeral storage. Terminating a server completely deletes it and the ephemeral storage.

331
Q

Tokenization

A

Tokenization is an approved alternative to encryption for complying with Payment Card Industry (PCI) requirements.

332
Q

RAID : Business Continuity Action

Disaster recovery actions:

restoring from backup tapes,
relocating to a cold site,
and restarting business operations

A

RAID technology provides fault tolerance for hard drive failures and is an example of a business continuity action.

Restoring from backup tapes, relocating to a cold site, and restarting business operations are all disaster recovery actions.

333
Q

SOAP - Interoperability

A

SOAP uses an XML-based approach to interoperability, allowing systems to interact more easily

334
Q

VLAN Characteristics

A

Broadcast packets sent by a machine inside the VLAN will reach all other machines in that VLAN.

Broadcast packets sent from a machine outside the VLAN will not reach machines inside the VLAN.

Broadcast packets sent by a machine inside the VLAN will not reach machines outside the VLAN.

335
Q

goal of site survey

A

Threat definition

Target identification

Facility characteristics

336
Q

Access control to virtualization management tools should be

A

Role-based

337
Q

Synthetic performance monitoring may be preferable to real-user monitoring (RUM) because

A

Synthetic agents can simulate user activity in a much faster, broader manner and perform these actions 24/7 without rest.

338
Q

Inference

A

Inference is an attack strategy, not a reason for implementing tokenization. All the other answers are good reasons to implement tokenization, and they are therefore not correct

339
Q

negative aspect of bit-splitting

A

It may require trust in additional third parties beyond the primary cloud service provider.

Significantly greater processing overhead

Some risk to availability, depending on the implementation

340
Q

Agile analytics/business intelligence

A

a data discovery approach that offers insight to trends of trends, using both historical and predictive approaches

341
Q

Real-time analytics

A

a data discovery approach used by e-commerce retailers to discern and predict shoppers’ needs?

342
Q

tools might be useful in data discovery efforts that are based on content analysis

A

Egress monitoring solutions

343
Q

Hashing

A

a cryptographic one-way function applied to data in a database to allow it to be referenced without using the actual data

344
Q

Service Provider Engineers

A

management plane of a cloud datacenter

345
Q

XML Firewall

A

SAML is an XML-based protocol, and Kristen knows that an XML firewall that is SAML-aware with appropriate rules for identity-based protection would be her best option. IDS systems cannot rate-limit even if they are SAML-aware. WAFs are designed for web applications rather than specifically for XML and SAML-based filtering, and a DAM is a database-specific tool.

346
Q

ASVS application security verification standard

A

A. ASVS uses a three-level code validation assurance level model, with level 3 requiring critical applications to meet in-depth validation and testing requirements.

347
Q

Virtual TPM

boot security

A

A virtual trusted platform module (vTPM) is the only solution that will meet Jack’s needs. HSMs (hardware security modules) are used to create, store, and manage secrets, including cryptographic keys and certificates, but aren’t used for boot security.

348
Q

ISO
ISAE
SSAE

A

ISO 20000-1 describes service management.
ISO 27001: information security management system (ISMS), the organisation’s entire security program, cyber security control objectives
ISO 27002: covers cybersecurity control implementation
ISO 27017: designed for cloud service providers
ISO 27018 describes privacy requirements for cloud providers
ISO 27034 mandates a framework for application security within an organization (ONF, ANF)
ISO 27037 : collecting, preserving, and identifying electronic evidence.
ISO 27050 : guidance for eDiscovery programs
ISO 27701 : industry standard guidance for information privacy programs.

ISO 28000 : specifies security management systems
ISO31000 - focuses on design implementation and management.

ISAE 3402 : International Standard on Assurance Engagements
ISAE 3410 - Assurance Engagements on Greenhouse Gas Statements
SSAE 16
SSAE 18 : Statement on Standards for Attestation Engagements 18, is a set of auditing standards that help businesses evaluate the controls of their service providers

CCSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions