LearnZapp Practice 1

Question 1

Which of the following is a feature of SAST?

A. Testing applications while running in RAM
B. Pentesting
C. Team building efforts
D. Source code review

Answer 1

D. Source code review

Explanation:
Static Application security testing examines source code while the application is not running

Question 2

Which of the following takes advantage of the information developed in the business impact analysis?

A. Calculating ROI
B. Risk analysis
C. Calculating TCO
D. Securing asset acquisition

Answer 2

B. Risk analysis

Explanation:
Among other things, the BIA gathers asset valuation information that is crucial to risk management analysis and further selection of security controls

Question 3

Which term best describes when a cloud provider goes out of business and leaves the customer unable to retrieve data?

A. Vendor lock in
B. Vendor lock out
C. Bankruptcy
D. Vendor closure

Answer 3

B. Vendor lockout

Explanation:
This is the definition of vendor lockout; when the cloud provider goes out of business and you can no longer access your data. This must be considered when you are determining whether to cloud migration

Question 4

When monitoring for performance reasons, which of the following should not be included?

A. Free disk space
B. Disk IO
C. CPU Usage
D. Printer queue information

Answer 4

D. Printer queue information

Explanation:
Print spooling is not an accepted performance measure. All the others are critical to keeping the environment running at peak efficiency

Question 5

Which of the following cloud service models requires the least amount of maintenance, administration and support by the cloud customer?

A. SaaS
B. PaaS
C. IaaS
D. DaaS

Answer 5

A. SaaS

Explanation:
The SaaS model requires the least intervention because the provider is responsible for maintaining the operating system, hardware and software

Question 6

Of the following SOC reports, which is the most commonly advertised?

A. SOC 1
B. SOC 2 Type 2
C. SOC 2 Type 1
D. SOC 3

Answer 6

D. SOC 3

Explanation:
The SOC 3 report is merely an attestation by an auditor. It does not contain any confidential information and is therefore readily available upon request and often even advertised on websites

Question 7

After a cloud migration, risks must be reviewed. However, a complete analysis is not necessary because much of the material has already been compiled in which of the following?

A. The cost benefit analysis completed prior to migration
B. The recent BIA
C. The last risk assessment
D. NIST 800-54r4

Answer 7

A. The cost benefit analysis completed prior to migration

Explanation:
Most of the risks associated with the cloud migration are examined in the cost benefit phase of evaluation and therefore do not need to be revisited

Question 8

Compliance with ASHRAE data center standards for humidity can help reduce the risk of which of the following?

A. Static discharge
B. Malicious users
C. Increased power usage
D. Increased heating cooling expenses

Answer 8

A. Static discharge

Explanation:
The ASHRAE standards provide for humidity standards that reduce the chances of static discharge, which could be catastrophic in a data center environment

Question 9

Egress monitoring solutions can aid in reducing the potential for loss due to

A. Data seizure
B. Crypto shredding
C. Malicous disclosure
D. Encryption

Answer 9

C. Malicious disclosure

Explanation:
Egress monitoring tools identify outbound traffic that violates an organizations policies, such as when a malicious user attempts data exfiltration

Question 10

Of the following data center redundancy characteristics, which will be in place regardless of tier?

A. All hardware
B. Power
C. Emergency Egress
D. Cooling

Answer 10

C. Emergency Egress

Explanation:
Human life is always the first priority so all data centers must have an emergency egress. The other characteristics will only be in place and associated with specific tiers

Question 11

Gathering business requirements aid in determining information about organizational assets. WHich of the following is not determined by this process?

A. Criticality
B. Robustness
C. Value
D. ROI

Answer 11

C. Robustness

Explanation:Robustness is not a trait measured by the process of reviewing business requirements

Question 12

Of the following, which is a valid readon for a baseline to change?

A. New hardware
B. Numerous change requests
C. New hypervisor
D. New database

Answer 12

B. Numerous change requests

Explanation:
The best reason for changing a baseline is numerous change requests. If too many changes are being requested, it is a sign that the baseline needs to be reviewed and changed in order to meet these new demands

Question 13

In which of the following does the customer have the most control of their data and systems while the cloud provider will have the least amount of responsibility?

A. PaaS
B. SaaS
C. IaaS
D. DaaS

Answer 13

B. IaaS

Explanation:
In the infrastructure as a service model, the provider offers and manages the physical plant and connectivity to underlying hardware. All systems and data are the responsibility of the customer

Question 14

What term best describes a set of technologies that analyze application source code, byte code and binaries for coding and design problems that would indicate a security problem or vulnerability?

A. DAST
B. SAST
C. MFA
D. STRIDE

Answer 14

B. SAST

Explanation:
DAST stands for dynamic application security testing and cannot analyze source code as it analyzes code while it is running. MFA stands for multifactor authentication and STRIDE is a threat model concept

Question 15

How long should an uninterruptable power supply be able to run during a sustained power outage?

A. Long enough for administrative intervention
B. Long enough to complete a graceful system shutdown
C. Until the power resumes
D. 4 hours

Answer 15

B. Long enough to complete a graceful system shutdown

Explanation:
A UPS is configured to safely shut down systems in order to save data in the event of a power failure

Question 16

Poorly negotiated contacts can cause many problems. Of the following, which is not an example of what can happen when contracts are not properly negotiated?

A. Unfavorable terms
B. Malware
C.Vendor lock in
D. Paying for services not used

Answer 16

B. Malware

Explanation:
MAlware is not the result of a poorly negotiated cloud contract.

Question 17

Which of the following is the most important mechanism to ensure trust in the cloud providers performance and duties?

A. The contract
B. Statutory Law
C. CSA Security Alliance Cloud Controls Matrix
D. SLA provisions

Answer 17

A. The contract

Explanation:
The contract between the provider and the customer provides trust between the two parties by holding the provider legally responsible for its contractual obligations

Question 18

Of the following, whose advice should be given the most weight on the decision to patch a live production system?

A. Customer
B. Vendor
C. Internal Compliance
D. Supervisor

Answer 18

B. Vendor

Explanation:
The vendor should be the one advising when and how to patch a system as they will have the most up to date information and it will be their patches you are applying

Question 19

What is the term used to describe the ease and efficiency of moving data from one provider to another?

A. Portability
B. Mobility
C. Forklifting
D. Vendor Lock Out

Answer 19

A. Portability

Explanation:
This is the term used to describe the ease and efficiency of moving data from one cloud provider to another

Question 20

WHich of the following is not a countermeasure designed to protect against internal threats?

A. Separation of duties
B. Data masking
C. DLP Solutions
D. Scalability

Answer 20

D. Scalability

Explanation:
All except option D are designed to protect against unreliable personnel actions, including by cloud admins

Question 21

Which of the following does not represnt an attack on a network?

A. Syn flood
B. Denial of Service
C. Nmap Scan
D. Brute force

Answer 21

C. Nmap scan

Explanation:
All of the rest of these options represent specific network attacks. Nmap is a relatively harmless scanning utility designed for network mapping. Although it can be used for info gathering

Question 22

WHich of the following is not an acceptable practice for user access control administration?

A. Customer directly administers access
B. Provider provides administration on behalf of the customer
C. Customer provides access administration on behalf of provider
D. Third party provides administration on behalf of the customer

Answer 22

C. Customer provides access administration on behalf of the provider

Question 23

How quickly should data center transfer switches bring backup power online in the event of a main failure?

A. 3 seconds
B. 1 minute
C. 5 minutes
D. Before the battery backup fails

Answer 23

D. Before the battery backup fails

Question 24

Of the following, which would be used to protect a companys sales lead information?

A. Trademark
B. Copyright
C. Patent
D. Trade secret

Answer 24

D. Trade secret

Explanation:
Information specific to a company and that is unique to them would be covered under the term trade secret

Question 25

What is the lowest tier of data center redundancy according to the Uptime Institute? A. 1 B. 3 C. 5 D. 7

Answer 25

A. 1 Explanation: There are four tiers of data center redundancy, with 1 being the lowest and 4 being the highest

Question 26

Of the following, which would be most useful in a disaster that is primarily local, such as an interruption of communications service? A. Joint operating agreements B. Diesel Generators C. Assistance from regulatory agencies D. Assistance from local law enforcement

Answer 26

A. Joint operating agreements Explanation: Having a joint operating agreement with a sister facility can assist greatly when dealing with a local disaster that does not affect a large area

Question 27

Which of the following is a technology solution for securing databases? A. NIST B. SAST C. SAML D. DAM

Answer 27

D. DAM Explanation: Database activity monitoring is a security technology used for monitoring and analyzing database activity that operates independently of the database management system. NIST is the National Institute of Technology, SAST is a type of application testing, and SAML is a technology used with identity access management

Question 28

Of the following, which would be used to protect the intellectual property of a logo for a business? A. Trademark B. Copyright C. Trade Secret D. Patent

Answer 28

A. Trademark Explanation: Trademarks are designed to protect symbols such as company logo or trade name

Question 29

Who is ultimately legally responsible for data loss or disclosure in the cloud? A. Cloud service provider B. Cloud broker C. Cloud customer D. Cloud admin

Answer 29

C. Cloud customer Explanation: The cloud customer, also the data owner, is always ultimately legally responsible for unauthorized disclosures

Question 30

Regardless of cloud deployment or service model, the customer will always be allowed to access to which of the following? A. Access controls B. User permissions C. Data D. Hypervisor

Answer 30

C. Data Explanation: Regardless of model, the customer owns the data and will therefore always be allowed to access it

Question 31

WHich of the following is the best example of a technical control? A. Access control lists B. Door locks C. Overriding security policy D. Configuration guidelines

Answer 31

A. Access control lists Explanation: Only access control lists are a technical control. All others are physical and administrative

Question 32

In order for tokenization to properly work, which of the following must be in place? A. MFA B. Two databases C. Asymmetric encryption keys D. MFA Key Fobs

Answer 32

B. Two databases Explanation: Tokenization requires two databases one containing the raw, original data and a second that contains the tokens that map to the original data

Question 33

Inability to remotely access a cloud provider impacts which of the three elements of the VIA triad? A. Integrity B. Availability C. Confidentiality D. Access Controls

Answer 33

B. Availability Explanation: The element of availability is impacted if a remote user cannot access the cloud provider

Question 34

Which of the following is the best example of a SIEM function? A. Performance enhancements B. REST C. SOAP D. Centralization of log streams

Answer 34

D. Centralization of log streams Explanation: In addition to centralization of log streams, SIEMs provide the ability to do trend analysis and view dashboards of activity

Question 35

Which of the following is not an example of encryption used in cloud computing? A. Storage encryption B. Session encryption C. Data masking D. TLS remote access

Answer 35

C. Data masking Explanation: Data masking is a technique whereby similar text strings are used in place of real data.

Question 36

How long should the fuel that is stored for data center generators be able to keep the data center up? A. 12 hours B. 24 hours C. 8 hours D. 48 hours

Answer 36

A. 12 hours Explanation: Based on Uptime Institute guidelines, enough fuel should be on hand to keep the generator running for at least 12 hours regardless of the data center tier

Question 37

When migrating to the cloud, which of the following dependencies are not important as part of the BIA review process? A. Cloud providers suppliers B. Cloud providers vendors C. Cloud providers utilities D. Cloud providers resellers and brokers

Answer 37

D. Cloud providers resellers and brokers Explanation: All options except D are important dependencies when reviewing the BIA

Question 38

Of which of the following is not a feature of DAST? A. Runtime testing B. Executable testing by teams C. Black box testing D. Code review

Answer 38

D. Code review Explanation: All of the other items listed are features of dynamic application security testing

Question 39

Which of the following is the term used for the intellectual property protection for the tangible expression of creative ideas? A. Trademark B. Registration C. Copyright D. Trade secret

Answer 39

C. Copyright Explanation: Copyrights are designed to protect the tangible expressions of creative works, like books, articles, music and so on

Question 40

Of the following which is an example of a technical control? A. Fire suppression equipment B. Audit trails C. Security policies D. Configuration procedures

Answer 40

B.Audit trails Explanation: Audit trails are an example of a technical control. Fire suppression equipment, security policies and configuration procedures are all examples of administrative controls

Question 41

In order to provide a secure environment for application testing, which service model would be the best fit? A. PaaS B. IaaS C. SaaS D. DaaS

Answer 41

A. PaaS Explanation: PaaS allows the customer to install and run any applications they want on any OS environment they may need

Question 42

Which of the following is a technique used in hardening a device? A. Use of SSL for communications B. Patching and updating C. PKI D. OS Encryption

Answer 42

B. Patching and updating Explanation: Updating and keeping systems patched is one of he most effective ways to keep them secure. If you were to encrypt the OS, you would not be able to use the system, and SSL and PKI refer to ways of protecting communications

Question 43

What is a good way to secure devices in a BYOD environments? A. Encrypt device drives B. Remove Java from all platforms C. WAFs D. Discontinue the use of Flash

Answer 43

A. Encrypt device drives

Question 44

Which of the following is a term used to describe the practice of obscuring original raw data so that only a portion is displayed for operational purposes? A. Data discovery B. Hashing C. Masking D. Public key infrastructure

Answer 44

C. Masking Explanation: Masking is a form of confidentiality assurance that often replaces the original information with asterisks or Xs

Question 45

Of the following bodies, which does not have a comprehensive federal privacy law that protects its citizens personal data? A. United States B. Europe C. Singapore D, Argentina

Answer 45

A. United States Explanation: The US is the only entity in this list that does not have a comprehensive policy directed at protecting its citizens privacy

Question 46

Which of the following is a service that provides a replication of data across various locations? A. Software defined networking (SDN) B. Virtual network C. Content delivery network (CDN) D. Local Area Network

Answer 46

C. Content delivery network

Question 47

Which of the following is something you cannot do when dealing with risk? A. Mitigation B. Transfer C. Reverse D. Accept

Answer 47

C. Reverse Explanation: Risk cannot be reversed. It can only be mitigated, transferred or accepted

Question 48

Which of the following is a characteristic of liquid propane gas that makes it attractive as a fuel for backup generators? A. Does not spoil B. Burn rate C. Price D. Ubiquitous

Answer 48

A. Does not spoil Explanation: One primary advantage of LP gas is that it does not spoil the way gasoline and diesel fuel can

Question 49

Of the following, which tpe of SSAE audit report is the cloud provider most likely to be willing to share without any additional participation from the cloud customer? A. SOC 1 Type 1 B. SOC 3 C. SOC 2 Type 1 D. SOC 3 Type 2

Answer 49

B. SOC 3 Explanation: SOC 3 is the least detailed report, designed for public dissemination. There is no SOC 3 Type 2 report

Question 50

Of the following, which is not a consideration when planning for physical security concerns? A. Local language variations B. CCTV coverage C. Traffic patterns D. Chance of natural disasters

Answer 50

A. Local language variations Explanation: Local languages having nothing to do with physical security. All the others are valid concerns

Question 51

Which of the following would be used to learn the critical paths, processes and assets of an organization? A. Business impact analysis B. Business requirements C. Risk assessment D. Pentest

Answer 51

A. Business impact requirements Explanation: BIA is designed to identify and ascertain the value of assets in addition to the critical paths and processes

Question 52

Of the following, which does not rpepresent a level of the CSA STAR ceritfication program? A. Self assessment B. SOC 2 Type 3 C. Third party assessment based certs D. Continuous monitoring based cert

Answer 52

B. SOC 2 Type 3 Explanation: SOC 2 Type 3 is not an actual report format. All of the other options are part of the levels of the CSA STAR cert program

Question 53

Which of the following is a characteristic of modern data center design? A. Weak physical security B. Located in metro areas C. Located in desert climates D. Power redundancy

Answer 53

D. Power redundancy Explanation: One of the foundational design characteristics in modern data center design involves ensuring redundant power systems. Data centers can be located anywhere, and typically have strong physical security

Question 54

When you are designing redundancy and contingency planning in a data center, which of the following is the most important consideration? A. Power availability B. Health and human safety C. HVAC Capabilities D. Redundant telco providers

Answer 54

B. Health and human safety Explanation: While the other options are important, they are all subordinate to human health and safety, which is the first priority of any security programs

Question 55

Which of the following best represent the three distinct levels of the CSA STAR program? A. Third party assessment, attestation and ongoing monitoring B. Self assessment, SOC 2, and ongoing monitoring C. Self assessment, attestation and ongoing monitoring cert D. Self assessment, attestation and cert

Answer 55

C. Self assessment, attestation and ongoing monitoring cert Explanation: Self assessment, attestation and ongoing monitoring cert are the three levels of STAR cert

Question 56

Which of the following has increased the viability of cloud services? A. Smart bus hubs B. Virtualization C. Agile development D. High speed switching

Answer 56

B; Virtualization Explanation: Virtualization allows scalable resource allocation, which has in turn dramatically increased the viability of cloud services

Question 57

With regard to PII stored in the cloud, who is ultimately responsible for the security of that PII? A. Cloud provider B. Cloud broker C. Cloud customer D. System admin

Answer 57

C. Cloud customer Explanation: The cloud customer is always the data owner and therefore ultimately responsible for the security of PII

Question 58

Of the following, which cloud data storage process uses encrypted chunks of data? A. Data dispersion B. RAID 5 C. RAID 0 D. RAID 3

Answer 58

A. Data dispersion Explanation: Data dispersion uses chunks of data, erasure coding and encryption

Question 59

IN which cloud service model is the customer required to maintain and update only the applications? A. SaaS B. IaaS C. PaaS D. DaaS

Answer 59

C. PaaS Explanation: In PaaS, the customer is paying for access to a virtual machine with an OS on which to install applications. Since the customer owns the applications, it is their responsibility to keep the applications up to date

Question 60

What is a technology that may lead to the ability to process encrypted data without having to decrypt it first? A. AES encryption B. MD5 hashing C. Message authentication D. Homomorphic encryption

Answer 60

D. Homomorphic encryption Explanation: Homomorphic encryption is an experimental technology that would allow ciphertext to be manipulated in processes and still produce the same results as when the unencrypted plaintext of the same data is processed.

Question 61

How should cryptographic keys be protected? A. AES 256 B. To a level at least high as the data they are protecting C. SHA 2 D. As high as is possible

Answer 61

B. To a level at least as high as the data they are protecting Explanation: Cryptographic keys should always be protected with safeguards at least as stringent, if not more, than the level of the data they are protecting

Question 62

Which of the following is most important in a BC DR incident? A. Checklists B. Redundant power C. Backups D. Spare hardware

Answer 62

A. Checklists Explanation: A BCDR event is no time to be scrambling around trying to figure out what to do. Having a plan in place and executing it is dependent on everyone understanding the plan and checklists are the way we work through steps of the plan in order

Question 63

Of the following elements, which is the primary driver of security decisions? A. Location B. Access C. Resiliency D. Business requirements

Answer 63

D. Business requirements Explanation: BUsiness requirements will and should always be what drives security decisions

Question 64

Which of the following is the best example of a countermeasure used to protect cloud operations against external attackers? A. Continual monitoring for anomalous activity B. Detailed and extensive background checks C. Use of generic hardware in the building infrastructure components D. Cameras inside the data center

Answer 64

A. Continual monitoring for anomalous activity Explanation: Continual monitoring for anomalous activity is a great way to detect potential external attacks. The other answers having nothing to do with protecting cloud operations from external threats

Question 65

Which of the following has never caused a data center outage? A. Squirrels B. Changes in regulations C. Construction D. Hackers

Answer 65

B. Changes in regulations Explanation: A change in regulations has never resulted in a data center outage, but each of the other options has caused many outages

Question 66

Object and volume storage are used with _______ A. IaaS B. PaaS C. SaaS D. DaaS

Answer 66

A. IaaS Explanation: Object and volume storage are both related to infrastructurew

Question 67

Of the following, which is not associated with vendor lock in? A. Statutory Compliance B. Poorly Written Contracts C. Nonportable Data Formats D. Market Forces

Answer 67

A. Statutory Compliance Explanation: Statutory compliance refers to state and federal laws. They cannot force a customer to stay with a cloud provider. HOwever, all the rest are problems that can lead to vendor lock in

Question 68

What is a function common to many agress monitoring solutions? A. Elasticity B. Data Discovery C. Metered Service D. Satellite Links

Answer 68

B. Data Discovery Explanation: Egress monitoring has nothing to do with elasticity, metered service or satellite links. However, egress monitoring tools often feature data discovery functions

Question 69

Of the following, which would be used to protect the intellectual property of manufacturing process? A. Copyright B. Trademark C. Patent D. Trade secret

Answer 69

C. Patent Explanation: Patent are designed to protect the intellectual property of processes

Question 70

Security controls for all types of cloud services and models are driven primarily by which of the following? A. Regulations B. Business requirements C. State laws D. Best practices

Answer 70

B. Business requirements Explanation: Security controls should always be based on the needs of the business. Regulations, state laws, and best practices may all shape the business requirements but are not direct drivers themselves

Question 71

Which of the following performed on an application or software product while it is being executed in memory? A. Tests performed on an application or software product while it is being executed in memory B. Tests performed on an application or software product that involves a code review C. TEsts performed on an application or software product without the users knowledge D. Tests performed on a network while it being executed in memory

Answer 71

A. Tests performed on application or software product while it being executed in memory Explanation: Dynamic application security testing is testing conducted while the application is resident in memory and being executed

Question 72

Which of the following is one example of a way to protect a data center frm the impact of external threats? A. Masking and obfuscation B. Redundant policies C. Redundant ISPs D. HVAC

Answer 72

C. Redundant ISPs Explanation: Having redundant ISPs or carriers provides the data center with protection against such external threats as DDoS international fiber cuts, and similar effects

Question 73

What is a situation in which more users are connected to a system that can be fully supported? A. Over-subscription B. Bad luck C. Temporal shift D. Peak usage

Answer 73

A. Over-subscription Explanation: The question is the definition of over subscription. This can happen in a multi tenant environment like cloud computing if not properly managed

Question 74

Which of the following is not a process used in device hardening? A. Strict administrator access B. Unused port closures C. Dual power supplies D. Deletion of unused/unnecessary services

Answer 74

C. Dual power supplies Explanation: While having secondary redundant power supplies helps with device redundancy, it has nothing to do with device hardening. Each of the other options helps in the hardening process.

Question 75

Which is the highlest level of data center redundancy, according to the Uptime Institute? A. 4 B. 5 C. 3 D. 10

Answer 75

A. 4 Explanation: The Uptime Institute has four tiers of data center redundancy rating, with the highest being 4 and the lowest being 1

Question 76

Of the following, which is most closely associated with financial controls? A. SOC 1 B. SOC 2 C. SOC 3 D. SOC 4

Answer 76

A. SOC 1 Explanation: The SOC 1 report is primarily for reporting on financial controls

Question 77

Which type of intellectual property protection would apply to a secret recipe? A. Trade secret B. Copyright C. Trademark D. Patent

Answer 77

A. Trade secret Explanation: A recipe that is not secret could be protected by a patent

Question 78

Which of the following is a DRM solution for protecting intellectual property rights? A. Media present checks B. Law enforcement notifications C. eDiscovery D. Digital forensics

Answer 78

A. Media present checks Explanation: Media present checks look to see if protected media is present before allowing content to be played or distributed

Question 79

Of the following, which term is most closely associated with egress monitoring tools? A. Data classification B. Data scrubbing C. Data sharing D. Data management

Answer 79

A. Data classification Explanation: Data classification is vital in egress monitoring solutions. This typically occurs at the same time of data creation

Question 80

What is the phase of an investigation where evidence is collected? A. eDiscovery B. eTriage C. Forensic Analysis D. Data collection

Answer 80

A. eDiscovery

Question 81

Of the following, which is responsible for determining an organizations risk appetite? A. Risk appetite assessment B. Senior management C. Legislative mandates D. SLAs

Answer 81

B. Senior management Explanation: Senior management determines the risk appetite of an organization

Question 82

Which of the following is not a feature of a secure KVM component? A. Sealed exterior case B. A TPM Chip C. Push button selectors D. Welded chipsets

Answer 82

B. A TPM Chip Explanation: A TPM is a security device found on an individual machine and is designed to store encryption keys securely. Options A, C and D are all features of secure KVMs

Question 83

Battery backups or UPSs serve many purposes. Along with providing power, which of the following do they provide? A. Line conditioning B; User discipline C. Elevated Access D. Cost Savings

Answer 83

A. Line conditioning Explanation: Battery backups also provide a critical function in that they condition the line. What this means is that they add and suppress power curves that are a part of normal minute by minute fluctuations in volytage and amperage delivered. THis smoothing out, or conditioning, helps equipment to last much longer since it is no longer subjected to varying voltages or amps

Question 84

Which of the following is an example of best practices for storing encryption keys? A. Storing them separately from data B. Using AES C. At least 256 bits D. Putting on a thumb drive and removed

Answer 84

A. Storing them separately from data Explanation: You never want to store encryption keys with the data they are protecting, They should always be stored on a seprate system3

Question 85

Which of the following is not a common cloud service model? A. Software as a Service B. Programming as a Service C. Infrastructure as a Service D. Platform as a Service

Answer 85

B. Programming as a Service Explanation: Programming as a Service is not a common offering; the others are ubiquitous throughout the industry

Question 86

The US government program that mandates a standardized approach to security assessments, authorization and continuous monitoring of cloud products and services is called: A. FISMA B. HIPAA C. FedRAMP D. GLBA

Answer 86

C. FedRAMP Explanation: FedRAMP is a US federal program that mandates a standardized approach to security assessments, authorization and continuous monitoring of cloud products and services

Question 87

Who performs the review process for hardware security modules in accordance with the Federal Information Processing Standard (FIPS) 140-2? A. The National Institute of Standards and Technology (NIST) B. The National Security Agency (NSA) C. Independent (private) Labs D. The European Union Agency for Network and Information Security (ENISA)

Answer 87

C. Independent (private) Labs Explanation: Vendors seeking HSM certs under FIPS 140-2 send their products to independent labs that have been validated as Cryptographic Module Testing Labs under the National Voluntary Lab Accreditation Program

Question 88

Which of the following are not examples of personnel controls? A. Background checks B. Reference checks C. Strict access control mechanisms D. Continuous security training

Answer 88

C. Strict access control mechanisms Explanation: While physical controls that inhibit movement affect personnel, they are not regarded as personnel controls. All the other options are examples of personnel controls

Question 89

Who pays for the Common Criteria certification of an IT product? A. NIST B. The vendor/manufacturer C. The cloud customer D. The end user

Answer 89

B. The vendor/manufacturer Explanation: The vendor/manufacturer of a given product will pay to have it certified, with the premise that cert costs are offset by premium prices

Question 90

Software that includes security elements from the outset of the software development life cycle process will: A. Be less expensive to operate securely in the production environment B. Be more expensive to operate securely in the production environment C. Be more expensive to operate securely in the production environment D. Have a greater likelihood of interoperability with other software and systems in the production environment

Answer 90

A. Be less expensive to operate securely in the production environment Explanation: When security is created as an aspect of the software itself, there is less need to acquire and apply additional security controls to mitigate the risks after deployment

Question 91

Which of the following is not a common identity federation standard? A. WS Federation B. OpenID C. OLSame D. SAML

Answer 91

C. OLSame Explanation: This is a nonsense term with no meaning

Question 92

The Restatement (Second) Conflict of Law refers to which of the following? A. The basis for deciding which laws are most appropriate in a situation where conflicting laws exist B. When judges restate the law in an opinion C. How jurisdictional disputes are settled D. Whether local or federal laws apply in a situation

Answer 92

A. The basis for deciding which laws are most appropriate in a situation where conflicting laws exist Explanation: The Restatement (Second) Conflict of Law is the basis used for determining which laws are most appropriate in a situation where conflicting laws exists

Question 93

Which of the following SOC report subtypes represents a point in time? A. SOC 2 B. Type I C. Type II D. SOC 3

Answer 93

B. Type I Explanation: A SOC Type 1 report is designed around a specific point in time as opposed to a report of effectiveness over a period of time

Question 94

Which of the following best describes SLE? A. The amount of expected loss due to any specific single incident B. The amount of expected damage or loss due to any and all incidents in a year C. The amount of expected loss or damage due to security incidents D. The amount of expected damage due to any single storage failure incident

Answer 94

A. The amount of expected loss due to any specific single incident Explanation: The single loss expectancy is the amount of expected damage or loss from any single specific security incident

Question 95

In which phase of the cloud secure data life cycle should classifications and labels be assigned to the data? A. Create B. Store C. Use D. Share

Answer 95

A. Create Explanation: Data should be labeled and classified as soon as it is created/collected. All the other options are incorrect

Question 96

When should cloud providers allow PaaS customers shell access to the servers running their instances? A. Never B. Weekly C. Only when the contract stipulates that requirements D. Always

Answer 96

A. Never Explanation: PaaS customers should never be given shell access to underlying infrastructure because any changes by one customer may negatively impact other customers in a multitenant environment

Question 97

Which of the the following best describes a way for customers to rent hardware, OS, storage and network capacity over the Internet from a cloud service provider? A. IaaS B. AaaS C. SaaS D. PaaS

Answer 97

D. PaaS Explanation: PaaS is what cloud customer use when they need to rent hardware, OS, storage and network capacity over the Internet

Question 98

Generator fuel storage for a cloud datacenter should last for how long, at a minimum? A. 10 minutes B. Three days C. Indefinitely D. 12 hours

Answer 98

D. 12 hours Explanation: The Uptime Institute dictates 12 hours of generator fuel for all cloud datacenter tiers

Question 99

Domain Name System Security Extensions (DNSSEC) provides all of the following except: A. Payload encryption B. Origin authority C. Data integrity D. Authenticated denial of existence

Answer 99

A. Payload encryption Explanation: DNSSEC is basically DNS with the added benefit of certificate validation and the usual functions that certificates offer. This does not include payload encryption - confidentiality is not an aspect of DNSSEC

Question 100

Which of the following is an international organization of network designers and architects who work together in establishing standards and protocols for the Internet? A. Internet Assigned Numbers Authority (IANA) B. International Organization Standardization (ISO)/ International Electrotechnical Commission (IEC) C. National Institute of Standards and Technology D. Internet Engineering Task Force

Answer 100

D. Internet Engineering Task Force Explanation: The IETF is an international organization of network designers and architects who work together in establishing standards and protocols for the internet

Question 101

Which of the following is a device specially purposed to handle the issuance, distribution and storage of cryptographic keys? A. Key management box (KMB) B. Hardware security module (HSM) C. Ticket granting ticket (TGT) D. Trusted computing base (TCB)

Answer 101

B. Hardware security module (HSM) Explanation:

Question 102

Digital rights management (DRM) tools should enforce ______. Which is the practice of capturing all relevant system events A. Continuous audit trail B. Limiting printing output C. Persistence D. Automatic Expiration

Answer 102

A. Continuous audit trail Explanation: Capturing all relevant system events is the definition of a continuous audit trail, one of the required traits for a DRM solution of any quality.

Question 103

You are the security officer for a cloud deployment. In order to secure data in transit, you can choose to implement all of the following techniques and technologies except: A. DNSSEC B. TLS C. IDS/IPS D. IPSec

Answer 103

C. IDS/IPS Explanation: IDSs/IPSs do not secure data, they detect attack activity

Question 104

Which of the following is a true statement about the virtualization management toolset? A. It can be regarded as something public facing B. It must be on a distinct, isolated, management network C. It connects physically to the specific storage area allocated to a given customer D. The responsibility for securely installing and updating it falls on the customer

Answer 104

C. It connects physically to the specific storage area allocated to a given customer Explanation: All management functions should take palce on a highly secure, isoalted network

Question 105

Which of the following controls would be useful to build into a virtual machine baseline image for a cloud environment? A. Automatic registration with the configuration management system B. Enhanced user training and awareness media C. Mechanisms that prevent the file from being copied D. Keystroke loggers

Answer 105

A. Automatic registration with the configuration management system Explanation: Version control can be difficult in a virtual environment because saved VMs dont receive updates. Ensuring that each VM is the correct version is a function of configuration management, and CM controls can be built into the baseline

Question 106

What does a cloud provider offer customers? A. An application hosting environment B. Reduced BCDR pricing C. Managed services on premise D. Access to an IT environment usually via the Internet

Answer 106

D. Access to an IT environment usually via the Internet Explanation: Cloud providers offer customers access to an IT environment, usually via the Internet

Question 107

Which form of cloud storage applies to storing an individuals data in the cloud while providing access from anywhere? A. Object storage B. Cloud file storage C. Personal cloud storage D. Enterprise cloud storage

Answer 107

C. Personal cloud storage Explanation: Personal cloud storage is the storage of a single users data in the cloud, allowing them access from anywhere on the Internet

Question 108

Which of the following contract terms most incentivizes the cloud customer to meet the requirements listed in the contract? A. Financial penalties B. Regulatory oversight C. Suspension of service D. Media attention

Answer 108

C. Suspension of service Explanation: The cloud provider is usually allowed to suspend service to the customer if the customer fails to meet the contract requirements. This can be fatal to a customers operations and is a great motivation to make timely payments

Question 109

All of the following are techniques to enhance the portability of cloud data, in order to minimize the potential vendor lock in except: A. Avoid proprietary data formats B. Use Digital rights management and data loss prevention solutions widely throughout the cloud operation C. Ensure there are no physical limitations to moving D. Ensure favorable contract terms to support portability

Answer 109

B. Use Digital rights management and data loss prevention solutions widely throughout the cloud operation Explanation: DRM and DLP are used for increased authentication/access control and egress monitoring, respectively and would actually decrease portability instead of enhancing it

Question 110

Which of the following dictates the requirements for US federal agencies operating in a cloud environment? A. ISO 27002 B. NIST SP 800-37 C. ENISA D. FEDRAMP

Answer 110

D. FEDRAMP Explanation: Federal Risk and Authorization Management Program is the US program for federal entities operating in the cloud

Question 111

Dynamic Host Configuration Protocol servers in a network will provide the clients with all of the following except: A. A temporary IP address B. Encryption protocols C. A default gateway D. Time sync

Answer 111

B. Encryption protocols Explanation: DHCP servers do not normally orchestrate encryption All the other options are common functions of DHCP servers

Question 112

Which technology is most associated with tunneling? A. IPSec B. GRE C. IaaS D. XML

Answer 112

B. GRE Explanation: Generic route encapsulation is a tunneling mechanism, specifically designed for the purpose of tunneling

Question 113

Risk assessment is the responsibility of: A. Companies offering managed cloud services B. Regulatory bodies C. Every organization D. Legislative entities

Answer 113

C. Every organization Explanation: Every organization is responsible for performing its own risk assessment for its own particular business needs. Cloud providers will not perform risk assessments on behalf of their customers

Question 114

Which of the following best describes a cloud carrier? A. A person or entity responsible for making a cloud service available to consumers B. The intermediary who provides connectivity and transport of cloud services between cloud providers and cloud consumers C. The person or entity responsible for keeping cloud services running for customers D. The person or entity responsible for transporting data across the internet

Answer 114

B. The intermediary who provides connectivity and transport of cloud services between cloud providers and cloud consumers Explanation: A cloud carrier is the intermediary who provides connectivity and transport of cloud services between cloud providers and cloud customers

Question 115

Data masking can be used to provide all of the following functionality, except: A. Secure remote access B. Enforcing least privilege C. Test data in sandboxed environments D. Authentication of privileged users

Answer 115

D. Authentication of privileged users Explanation: Data masking does not support authentication in any way. All the others are excellent use cases for data masking

Question 116

All of the following methods can be ued to attenuate the harm caused by escalation of privilege except: A. Extensive access control and authentication tools and techniques B. Analysis and review of all log data by trained, skilled personnel on a frequent basis C. Periodic and effective use of cryptographic sanitization tools D. The use of automated analysis tools such as SIM, SIEM and SEM solutions

Answer 116

C. Periodic and effective use of cryptographic sanitization tools Explanation: Cryptographic sanitization is a means of reducing the risks from data remnance, not a way to minimize escalation of privilege

Question 117

Which of the following might make cryptoshredding difficult or useless? A. The cloud provider also managing the organizations keys B. Lack of physical access to the environment C. External attackers D. Lack of user training and awareness

Answer 117

A. The cloud provider also managing the organizations keys Explanation: Cryptoshredding relies on the eventual destruction of the final keys; if keys are not under the management of the customer, they may be replicated or difficult to dispose of.

Question 118

DRM tools should enforce ______. which is the characteristic of access rights following the object, in whatever form or location it might be or move to. A. Continous Audit Trail B. Limiting Printing Output C. Persistence D. Automatic Expiration

Answer 118

C. Persistence Explanation: Access rights following the object in whatever form or location it might be or move to is the definition of persistence, one of the required traits for a DRM solution of any quality

Question 119

Which of the following is not checked when using the STRIDE threat model? A. The ability of users to gain administrative access rights without proper permission B. The ability of internal personnel to trigger business continuity/ disaster recovery activities C. The ability of a participant in a transaction to refute that they have taken part in the transaction D. The ability of an unauthorized user to pretend to be an authorized user

Answer 119

B. The ability of internal personnel to trigger business continuity/ disaster recovery activities Explanation: The STRIDE threat model does not deal with business continuity and disaster recovery actions. All the other options are elements of STRIDE and therefore not correct

Question 120

Which of the following will DLP solutions most likely not inspect? A. Email content B. FTP Traffic C. Material saved to portable media D. Voice Over Internet Protocol (VoIP) conversations

Answer 120

D. Voice Over Internet Protocol (VoIP) conversations Explanation: Commercial DLP products that monitor speech in real time and censor conversations are not yet widely available.

Question 121

Which of the following is not an aspect of physical security that ought to be considered in the planning and design of a cloud data center facility? A. Perimeter B. Vehicular approach C. Fire suppression D. Elevation of dropped ceilings

Answer 121

D. Elevation of dropped ceilings Explanation: The height of dropped ceilings is not a security concern, except in action moves. The rest of the answers are all aspects of physical security that should be taken into account when planning and designing a data center

Question 122

Why will cloud providers be unlikely to allow physical access to their data centers? A. They want to enhance security by keeping information about physical layout and controls confidential B. They want to enhance exclusivity for their customers, so only an elite tier of high paying clientele will be allowed physical access C. They want to minimize traffic in those areas, to maximize efficiency of operational personnel D. Most data centers are inhospitable to human life, so minimizing physical access also minimizes safety concerns.

Answer 122

A. They want to enhance security by keeping information about physical layout and controls confidential Explanation: '

Question 123

All of the following are usually nonfunctional requirements except: A. Color B. Sound C. Security D. Function

Answer 123

D. Function Explanation: Function is usually the functional requirement, describing what action the tool/process satisfies. All the others are nonfunctional requirements typically.

Question 124

Critical components should be protected with ____________ A. Strong Passwords B. Chain Link Fences C. Homomorphic Encryption D. MFA

Answer 124

D. MFA Explanation: MFA offers additional protections for assets that are critical to the organization. All logins should utilize strong passwords, whether or not they are ciritcal.

Question 125

Which International organization for standardization standard refers to addressing security risks in a supply chain? A. International Organization Standardization (ISO) 27001 B. International Organization Standardization (ISO) 28000:2007 C. International Organization Standardization (ISO) 18799 D. International Organization Standardization (ISO) 31000:20096

Answer 125

B. International Organization Standardization (ISO) 28000:2007 Explanation: ISO 28000-2007 applies to security controls in supply chains. The others are cloud computing standards but have little to do with supply chanin management

Question 126

All of the following are statutory regulations except the _____ A. Gramm Leach Billey Act (GLBA) B. Health Information Portability and Accountability Act (HIPAA) C. Federal Information Systems Management Act (FISMA) D. Payment Card Industry Data Security Standard (PCI DSS)

Answer 126

D. Payment Card Industry Data Security Standard (PCI DSS) Explanation: The PCI DSS is a voluntary standard, having only contractual obligation. All the other options are statues, created by law making bodies.

Question 127

Which of the following is a data discovery approach used by ecommerce retailers to discern and predict shoppers needs? A. Big data B. Real time analytics C. Agile analytics D. Agile business intelligence

Answer 127

B. Real time analytics Explanation: Real time analytics allow for reactive and pmredictive operations (such as recommending other, related products_) based on customers current and past shopping behaviors

Question 128

The Payment Card Industry Standard (PCI DSS) distinguishes merchants by different tiers, based on _____ A. Number of transactions per year B. Dollar value of transactions per year C. Geographic location D. Jurisdiction

Answer 128

A. Number of transactions per year Explanation: The four merchant levels in PCI are distinguished by the number of transactions that merchant conduct in a year.

Question 129

Which piece of the security triad is about ensuring that data is accurate and complete? A. Integrity B. Confidentiality C. Access Controls D. Encryption

Answer 129

A. Integrity Explanation: Integrity ensures that data has not been altered by unauthorized activity. That includes being complete and accurate

Question 130

Which of the following is not usually suitable for inclusion in a service level agreement for managed cloud services? A. Service availability B. Number of users and virtual machines C. Background checks for provider personnel D. Amount of cloud storage

Answer 130

C. Background checks for provider personnel Explanation: The SLA wont typically include direct mention of the sorts of personnel security measures undertaken by the cloud provider.

Question 131

This type of control might affect the functionality of egress monitoring solutions. A. Firewall B. Bollards C. Personnel Training D. Encryption

Answer 131

D. Encryption Explanation: Encrypted data may be impossible for egress monitoring solution to read, thereby making the tool useless

Question 132

All of the following are database encryption options that could be used in a PaaS implementation except ____ A. File level encryption B. Secure Sockets Layer C. Transparent Encryption D. Application Level Encryption

Answer 132

B. Secure Sockets Layer Explanation: SSL Is encryption used in a communication session, not a storage volume. All the other options are examples of database encryption options

Question 133

Your organization has migrated into a PaaS configuration. A network admin within the cloud provider has accessed your data and sold a list of your users to competitors. Who is required to make data breach notifications in accordance with all applicable laws? A. The network admin responsible B. The cloud provider C. The regulators overseeing your deployment D. Your organization

Answer 133

D. Your organization Explanation: The cloud customer is ultimately responsible for all legal repercussions involving data security and privacy; the cloud provider might be liable for financial costs related to these responsibilities, but those damages can only be recovered long after the notifications have been made by the cloud customer

Question 134

Which of the following describes the act of permanently and completely removing personal identifiers from data, such as converting personally identifiable information into aggregated data? A. Anonymization B. Disk scrubbning C. Deguassing D. Cryptoshredding

Answer 134

A. Anonymization Explanation: Anonymization is the act of permanently and completely removing personal identifiers from data

Question 135

What can hamper the ability of a cloud customer to protect their assets in a managed services agreement? A. Prohibitions on port scanning and pentesting B. Geographical dispersion C. Rules against training users D. Laws that prevent them from doing so

Answer 135

A. Prohibitions on port scanning and pentesting Explanation: Many cloud providers prohibit activities that are common for admin and security purposes but can also be construed/used for hacking; this includes port scanning and pentesting lllllll

Question 136

A bare metal hypervisor is Type: A. 1 B. 2 C. 3 D. 4

Answer 136

A. 1 Explanation: Option B describes another type of hypervisor; the other options are incorrect because there is no such thing as a 3 or 4 hypervisor

Question 137

If data masking is being performed for software testing purposes, which of the following is not a good masking technique to use? A. Random substitution B. Shuffling C. Deletion D. Algorithmic substitution

Answer 137

C. Deletion Explanation: While deletion is a very good way to avoid possibility of inadvertently disclosing production data in a test environment, it also eliminates the usefulness of the data set as a plausible

Question 138

Which of the following is characterized by a set maximum capacity? A. A secret sharing made short bit splitting implementation B. A tightly coupled cloud storage cluster C. A loosely coupled cloud storage cluster D. A public key infrastructure

Answer 138

B. A tightly coupled cloud storage cluster Explanation: By definition, the tightly coupled cluster has a maximum capacity, whereas the loosely coupled cluster does not, The other options do not have a set maximum capacity and are therefore incorrect

Question 139

The OWASP Top Ten is a list of web application security threats that is created by a member driven OWASP committee of application development experts and published approximately every 24 months. The Top Ten list often includes using components with known vulnerabilities. Which of the following is a good way to protect against this problem? A. Use only standard libraries B. Review all updates/lists/notifications for components your organization uses C. Be sure to HTML escape all attribute elements D. Increase the user training budget

Answer 139

B. Review all updates/lists/notifications for components your organization uses Explanation: Staying current with published vulnerability for your component is crucial. This might not be simple as there are many versions of design components and nomenclature is not always uniform

Question 140

Which of the following is not a common federation technology? A. WS Federation B. OWASP C. OpenID D. OAuth

Answer 140

B. OWASP Explanation: The OWASP is a volunteer organization that devises standards and solutions for web application development. All the other options are common federation technologies

Question 141

Security Assertion Markup Language is: A. HTML and closed source based B. XML and open standards based C. SQL and open source based D. Fake

Answer 141

B. XML and open standards based Explanation: SAML is an XML based, open standard data format designed for the exchange of authentication and authorization data between parties

Question 142

Which type of law consists of a body of rules and statutes that define prohibited conduct and is set out to protect the safety and well being out of the public? A. Tort B. Criminal C. Civil D. Contract

Answer 142

B. Criminal Explanation: Criminal law is set out in rules and statutes created by a government, prohibiting certain activities as a means of protecting the safety and well being of its citizens. Violations generally consists of both monetary and/or loss of liberty punishments

Question 143

Which of the following is a technique used to attenuate risks to the cloud environment, resulting in the loss or theft of a device used for remote access? A. Remote kill switch B. Dual control C. Muddling D. Safe harbor

Answer 143

A. Remote kill switch Explanation: Dual control is not useful for remote access devices, because we would have to assign two people for every device, which would decrease efficiency and productivity.

Question 144

In addition to battery backup, a UPS can offer which capability? A. Communication redundancy B. Breach alert C. Line conditioning D. Confidentiality

Answer 144

C. Line conditioning Explanation: A UPS can provide line conditioning, adjusting power so that it is optimized for the device it serves and smoothing any power fluctuations; it does not offer any of the other listed functions

Question 145

Which of the following items, included in the contract between a cloud customer and cloud provider, can best aid in reducing vendor lock in? A. Data format type and structure B. Availability C. Storage Space D. List of available OSs

Answer 145

A. Data format type and structure Explanation: When the cloud customer can ensure that their data will not be ported to a proprietary data format or system, the customer has a better assurance of not being constrained to a given provider; a platform agnostic data set is more portable and less subject to vendor lock in

Question 146

The cloud deployment model that features organizational ownership of the hardware and infrastructure, and usage only by members of that organization is known as: A. Private B; Public C. Hybrid D. Motive

Answer 146

A. Private Explanation:

Question 147

You run an IT security incident response team. When seizing and analyzing data for forensic purposes, your investigative personnel modify the data from its original content. For courtroom evidentiary purposes, this makes the data: A. Inadmissible B. Less believable, if the changes are not documented C. Harder to control D. Easily refutable

Answer 147

B. Less believable, if the changes are not documented Explanation: All forensic processes and activity should be documented with extreme scutinity. It is very important for your actions to be documented and repeatable in order for them to remain credible.

Question 148

Which of the follwing tools might be useful in data discovery efforts that are based on content analysis? A. Egress monitoring solutions B. Digital rights management (DRM) C. iSCSI D. Fibre Channel over Ethernet

Answer 148

A. Egress monitoring solutions Explanation: Egress monitoring tools are specifically designed to seek out and identify data sets based on content; this is part of how they operate. They can be used for or in conjunction with content base data discovery efforts. DRM is an additional access control solution for objects, so option B is incorrect

Question 149

In what cloud computing service model is the customer responsible for isntalling and maintaing the OS? A. IaaS B. PaaS C. SaaS D. QaaS

Answer 149

A. IaaS

Question 150

Which of the following terms describes a cloud storager area that uses a filesystem/hierarchy? A. Volume Storage B. Object Storage C. LUN D. Block storage

Answer 150

B. Object Storage Explanation: Object storage is a means of storing objects in a hierarchy such as a file tree. All the other options are terms used to describe cloud storage areas without file structures

Question 151

In order for an organization to determine if its backup solution is adequate for meeting the recovery point objective, what must be done? A. Conduct full backups at least daily B. Use a data mirroring solution C. Put all backups in the cloud D. Practice a restore from backup

Answer 151

D. Practice a restore from backup Explanation: There is no way to know if the backup actually serves the purpose until the organization tests a restoration. The other options are all backup options but do not actually demonstrate whether the backup is suitable for the business continuity and disaster recovery requirements

Question 152

In a data retention policy, what is perhaps the most crucial element? A. Location of the data archive B. Frequency of backups C. Security controls in long term storage D. Data recovery procedures

Answer 152

D. Data recovery procedures Explanation: All of the elements listed are important aspects of the data retention policy. However, using proper data retrieval procedures is the one without which all the others may become superfluous.

Question 153

Which organizational entity usually performs the verification part of the provisioning element of the identification process? A. Information technology (IT) B. Security C. Human Resource D. Sales

Answer 153

C. Human Resource Explaniation: Identification of personnel is usually verified during the hiring process, when HR checks identification documents such as passports or birth certs to confirm the applicants identity, often as part of a tax registration

Question 154

When an organization considers cloud migrations, the organizations software developers will need to know which _______ and which ______ the organization will be using, in order to properly and securely create suitable applications A. Geographic Location, native language B. Legal restrictions, specific ISP C. Service model, deployment model D. Available bandwidth, telecommunications country code

Answer 154

C. Service model, deployment model Explanation: in order for developers to properly create and secure applications, they will need to understand the extent of resource sharing and level of control

Question 155

Which of the following is probably most important to include in a data archiving policy? A. Data format and type B. Data classification C. Encryption procedures and standards D. Data audit and review processes

Answer 155

A. Data format and type Explanation: In order to use the archive for recovery, the data needs to be of a format and type that can be utilized by the organizations system and environment. Saving data in the wrong format can be equivalent to losing the data

Question 156

A group of clinics decides to create an identification federation for their users. If they opt to use the web of trust model for federation, who is/are the identity providers? A. Each organization B. A trusted third party C. The regulatory overseeing their industry D. All of their patients

Answer 156

A. Each organization Explanation: In a web of trust federation model, all of the participating organizations are identity providers; each group will assign identity credentials to its own authorized users, and all the other organizations in the federation will accept those credentials

Question 157

DevOps is a form of software development that typically joins the software development team with: A. The production team B. The marketing team C. The security office D. Management

Answer 157

A. The production team Explanation: In DevOps, the programmers continually work in close conjunction with the production team to ensure that the project will meet their needs

Question 158

It is important to include _______ in the design of underfloor plenums if they are also used for wiring. A. Mantraps B. Sequestered channels C. Heat sinks D. Tight gaskets

Answer 158

D. Tight gaskets Explanation: When cables come up through a raised floor used as a cold air feed, we do not want cold air bleeding around the cables in an unplanned manner; this can cause inefficiencies in airflow control.

Question 159

The CSA publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. The CSA recommends the prohibition of _______________ in order to diminish the likelihood of account/service traffic hijacking A. All user activity B. Sharing account credentials between users and services C. MFA D. Interstate commerce

Answer 159

B. Sharing account credentials between users and services Explanation: Users sharing account credentials is fairly common practice and one that can lead to significant misuse of the organizations resources and greatly increase risk to the organization.

Question 160

Which of the following is a possible negative aspect of bit splitting? A. Greater chance of physical theft of assets B. Loss of public image C. Some risk to availability, depending on the implementation D. A small fire hazard

Answer 160

C. Some risk to availability, depending on the implementation Explanation: Ironically, data dispersion can lead to some additional risk of loss of availabilty, depending on the method/breadth of the dispersion. If the data is spread across multiple cloud providers, there is a possibility that an outage at one provider will make the data set unavailable to users, regardless of location

Question 161

Which of these is most likely to have the greatest negative impact on data discovery effort? A. Bandwidth latency issues B. Poor physical security of the data center C. Severe statutory regulation D. Inaccurate or incomplete

Answer 161

D. Inaccurate or incomplete Explanation: A data discovery effort can only be as effective as the veracity and quality of the data it addresses. Bad data will result in ineffective data discovery. All the other answers do not impact data discovery efforts and are only distractors.

Question 162

The current American Institute of Certified Public Accountants (AICPA) standard codifies certain audit reporting mechanisms. What are these called? A. Sarbanes Oxley Act reports B. Secure Sockets Layers C. Sherwood Applied BUsiness Structure Architecture (SABSA) D. System and Organization Controls (SOC) reports

Answer 162

D. System and Organization Controls (SOC) reports Explanation: SOC reports are the audit reporting mechanisms dictated by SSAE 18. SOX is a federal law targeting publicly traded corporations in the US.

Question 163

You are the security manager for a software company that uses PaaS in a public cloud service. Your companys general counsel informs you that they have received a letter from a former employee who is filing a lawsuit against your company. What is one of the common practices used in your industry that will have to be halted until the resolution of the case? A. Versioning B. Patching C. Threat Modeling D. Secure Destruction

Answer 163

D. Secure Destruction

Question 164

The cloud deployment model that features joint ownership of assets among an affinity group is known as: A. Private B. Public C. Hybrid D. Community

Answer 164

D. Community Explanation

Question 165

According to NIST Cloud Computing Reference Architecture, which of the following is most likely a cloud carrier? A. AWS B. Netflix C. Verizon D. Nessus

Answer 165

A. AWS Explanation:

Question 166

You are the security manager for a software development firm. Your company is interested in using a managed cloud service provider for hosting its testing environment. Which of the following toosl, technologies, or techniques may be very useful for your purposes? A. Data loss prevention or data leak protection B. Digital rights management C. Sandboxing D. Web Application Firewall

Answer 166

C. Sandboxing Explanation: Sandboxing allows software to be run in an isolated environment, which can aid in error detection

Question 167

AT which phase of the software development lifecycle should security personnel first be involved? A. Define B. Design C. Develop D. Test

Answer 167

A. Define Explanation: The earlier security inputs are included in the project, the more efficient and less costly security controls are overall. The Define phase is the earliest part of the SDLC.

Question 168

According to the ISC2 Cloud Secure Data Lifecycle, which phase comes soon after (or at the same time as) the Create phase? A. Store B. Use C. Deploy D. Archive

Answer 168

A. Store Explanation: The Cloud Secure Data Life cycle phases are in order Create, Store, Use, Share, Archive, Destroy

Question 169

Static application testing examines ________ A. Software outcomes B. User performance C. System durability D. Source code

Answer 169

D. Source Code Explanation: In SAST, testers review the source code of an application in order to determine security flaws and operational errors

Question 170

In SDLC implementations that include a Secure Operations phase, which of the following security techniques or tools are implemented during that phase? A. Vulnerability assessments and pentesting B. Performance testing and security control validation C. Requirements fulfillment testing D. Threat modeling and secure design review

Answer 170

A. Vulnerability assessments and pentesting Explanation: Once the system is deployed operationally, continuous security monitoring including periodic vulnerability assessments and pentesting, is recommended. All the other options are security functions that should take place in phases prior to the systems deployment

Question 171

The CSA publishes the Notorious Nine, a list of common threats to organizations participating in cloud computing. According to the CSA, what is one reason the threat of insecure interfaces and APIs is so prevalent in cloud computing? A> Most of the cloud customers interaction with resources will be performed through APIs B. APIs are inherently insecure C. Attackers have already published vulnerabilities for all known APIs D. APIs are known carcinogens

Answer 171

A> Most of the cloud customers interaction with resources will be performed through APIs Explanation: Because a significant percentage of cloud customer interactions with the cloud environment will utilize APIs, the threat of insecure APIs is of great concern in cloud computing.

Question 172

Training programs should be tracked and monitored in order to fulfill both _______ and ________ requirements. Choose the best response;. A. Business, security B. Regulatory, legal C. User, managerial D. Vendor, supplier

Answer 172

A. Business, security Explanation: Tracking and monitoring personnel training is absolutely vital in order to demonstrate regulatory requirements

Question 173

Which of the following is not a report used to assess the design and selection of security controls within an organization? A. Consensus Assessments Initiative Questionnaire (CAIQ) B. Cloud Security Alliance Cloud Controls Matrix C. SOC 1 D. SOC 2 Type 1

Answer 173

C. SOC 1 Explanation: The SOC 1 audit report is not for security controls; it is for financial reporting controls.

Question 174

You are the security manager for a software development firm. Your company is interested in using a managed cloud service provider for hosting a customer facing production environment. Many of your end users are located in the EU and will provide personal data as they use your software. Your company will not be allowed to use a cloud data center in which of the following countries? A. Japan B. Australia C. Belgium D. Chile

Answer 174

D. Chile Explanation: Chile does not currently have a federal privacy law that conforms to EU legislation. All the other options are countries that do

Question 175

Which of the following is an example of true MFA? A. Having a login that requires both a password and a PIN B. Using a thumbprint and voice recognition software for access control C. Presenting a credit card along with a Social Security card D. Signing a personal check

Answer 175

D. Signing a personal check Explanation: The check involves

Question 176

A firewall can use all of the following techniques for controll traffic except: A. Rule sets B. Behavior analysis C. Content filtering D. Randomization

Answer 176

D. Randomization Explanation: Firewalls do use rules, behavior and/or content filtering in order to determine which traffic is allowable.

Question 177

Which of the following aspects of a cloud environment is most likely to add risk to the patch management process? A. Variations in user training and familiarity with the cloud B. A cloud services contract that specifies which parties are responsible for which aspects of patching C. VMs located physically in one location but operating in different time zones D. The prevalence of attacker activity at the time the patch is applied

Answer 177

C. VMs located physically in one location but operating in different time zones Explanation: If patches are rolled out across an environment where users are operating virtual machine at different times, there is a possibility that VMs will not be patched in uniform, which could lead to data disruption

Question 178

Which of the following best describes authorization? A. The act of identifying or verifying the eligibility of a user to access a program or process B. The act of identifying a person by password C. The act idetnfiying a person by biometrics D. The grating of right of access to a user, program or process

Answer 178

D. The grating of right of access to a user, program or process Explanation: Authorization is the granting of right of access to a user, program or process. All the other options are related to authentication

Question 179

Confidentiality refers to which of the following? A. The concept of keeping all information secret B. The concept of keeping info secret from anyone other than someone with equal or greater access C. The concept of keeping information secret from anyone other than someone with authorized access D. The concept of keeping infomration secrety from anyone other than the system admin

Answer 179

C. The concept of keeping information secret from anyone other than someone with authorized access Explanation: Confidentiality refers to the concept of keeping info secret from anyone other than someone with authorized access

Question 180

You are in charge of building a cloud data center. Which of the following is a useful rack configuring for regulating airflow? Exhaust fans on racking facing the inlet vents of other racks B. Inlet fans on racks facing exhaust fans on other racks C. All rack perpendicular to each other D. Exhaust fans on racks facing exhaust fans on other racks

Answer 180

D. Exhaust fans on racks facing exhaust fans on other racks Explanation: The preferred methid is cold aisle containment (hot aisle containment, where the inlets on racks face each other is all right too.

Question 181

Which characteristic of liquid propoane increases its desirability as a fuel for backup generators? A. Burn rate B. Price C. Does not spoil D. Flavor

Answer 181

C. Does not spoil Explanation: Liquid propane does not spoil, which obviates necessity for continually refreshing and restocking it and might make it more cost effective

Question 182

Which of the following best describes SSO? A. SSO allows a user to access an application with a single set of creds for authentication and authorization B. SSO allows a user to access multiple websites with a single set of credentials for authentication and authorization C. SSO allows a user to access multiple applications with a single set of creds for authentication and authorization D. SSO allows a user to access multiple applications with multiple sets of credentials for authentication

Answer 182

C. SSO allows a user to access multiple applications with a single set of creds for authentication and authorization Explanation: SSO allows a user to access multiple applications with a single set of credentials for authentication and authorization

Question 183

Who will determine data classifications for the cloud customer? A. The cloud provider B. NIST C. Regulators D. The cloud customer

Answer 183

D. The cloud customer Explanation: While the determination of what sorts of data need to be protected may come from external sources, the classification of data for each data owner/cloud customer will be specific to that entity

Question 184

If the organization operates in a cloud environment, security operations procedures should include guidance for all of the following audit or logging processes except ______- A. Definition of security events and incidents B. The brand or vendor of the cloud providers audit or logging tool C. Process for adding new audit or logging rules D. Process for filtering out false postives by amending the rule set

Answer 184

B. The brand or vendor of the cloud providers audit or logging tool Explanation: All the answers are processes or elements that should be included in the security operations procedures except for option B; the cloud customer will not get to select, or probably even know, what tools and devices the cloud provider has put into place, so this will not be included in the customers procedures

Question 185

All of the following are reasons to perform review and maintenance actions on user accounts except: A. To determine whether the user still needs the same access B. To determine whether the user is still with the organization C. To determine whether the data is still applicable to the users role D. To determine whether the user is still performing well

Answer 185

D. To determine whether the user is still performing well Explanation: Job performance is not a germance aspect of account review and maintenance; that is a management concern, not an access control issue.

Question 186

What is the intellectual property protection for the logo of a new video game? A. Copyright B. Patent C. Trademark D. Trade secret

Answer 186

C. Trademark Explanation: Logos and symbols and phrases and color schemes that describe brands are trademarks

Question 187

Typically, when raised flooring is used as an air plenum ______ air is directed through it A. Warm B. Bleed C. Cold D. Exhaust

Answer 187

C. Cold Explanation: Cold air is usually put through raised flooring because warm air naturally raises and using the riases flooring to conduct warm air would require an unnecessary and inefficient expenditure of energy

Question 188

Vulnerability scans are dependent on ________ in order to function A. Privileged Access B. Vulnerability Signatures C. Malware libraries D. Forensic Analysis

Answer 188

B. Vulnerability Signatures Explanation: Vulnerability scans use signatures of known vulnerabilities to detect and report those vulnerabilities. Scans do not typically require admin access to function; option A is incorrect

Question 189

Which of the following best describes federation? A. Allows a single user to authenticate using a process that then allows access across multiple IT systems or even orgs B. Allow access across multiple jurisdictions C. Allow a single user to authenticate in a cloud environment D. Requires MFA

Answer 189

A. Allows a single user to authenticate using a process that then allows access across multiple IT systems or even orgs Explanation: Federated SSO allows users to authenticate once but then be granted access to resources of other federated organizations within the federation

Question 190

MTTR is best describes as which of the following? A. The average cost to repair a device that has failed or is in need of repair B. The average time it takes to replace a device that has failed or is in need of repair C. The average time it takes to repair a device that has failed or is in need of repair D. The maximum time it takes to repair a device that has failed or is in need of repair

Answer 190

C. The average time it takes to repair a device that has failed or is in need of repair Explanation: Mean time to repair (MTTR) is the time required to repair a device that has failed or is in need of repair. The term mean indicates the average time as opposed to the actual or past exerpiences

Question 191

Which of the following is not a component of contractual Personally Identifiable Information (PII)? A. Scope of processing B. Use of subcontractors C. Location of data D. Value of data

Answer 191

D. Value of data Explanation: The value of data itself has nothing to do with it being considered part of contractual Personally Identifiable Information (PII) even though it may have value associated with it

Question 192

The Business Continuity/Disaster Recovery kit should include all of the following except: A. Flashlight B. Documentation equipment C. Hard drives D. Annotated asset inventory

Answer 192

C. Hard drives Explanation: While hard drives may be useful in the kit, they are not necesarrily required. All the other items should be included.

Question 193

_________________ are required to use only cryptographic modules that are compliant with Federal Information Processing Standard (FIPS) 140-2 A. Americans B. Cloud providers C. IaaS providers D. US Federal Agencies

Answer 193

D. US Federal Agencies Explanation US federal entities are prohibited from using cryptosystems that are not compliant with FIPS 140-2

Question 194

Mass storage in the cloud will most likely currently involve ______ A. Spinning platters B. Tape drivers C. Magnetic disks D. SSDs

Answer 194

D. SSDs Explanation: SSDs are currently the most efficient and durable storage technology, so cloud providers will favor them.

Question 195

What is the process of granting access to resources? A. Identification B. Authentication C. Authorization D. Federation

Answer 195

C. Authorization Explanation:

Question 196

Which of the following is not a part of the European Union Agency for Network and Information Security (ENISA) Top 8 Security Risks of cloud computing? A. Vendor lock in B. Isolation failure C. Insecure or incomplete data deletion D. Availability

Answer 196

D. Availability Explantion: The ENISA Top 8 Security Risks of Cloud Computing does not include availability, even though it is certainly a risk that could be realized

Question 197

Which of the following best describes the term ROI? A. Used to describe part of the SDLC B. Used to describe a particular SaaS C. Used to describe a profitability ratio D. Used to describe a software rollout phase

Answer 197

C. Used to describe a profitability ratio Explanation: Return on investment is a term used to describe a profitiability ratio. It is generally calculated by dividing net profit by net assets

Question 199

Which of the following is not typically included in the list of critical assets specified for continuity for BC/DR contingency operations? A. Systems B. Data C. Cash D. Personnel

Answer 199

C. Cash Explanation: Although cash is important for a business to function in general, it is not one of the critical BCDR assets, which include personnel, systems and data

Question 200

A SAML identity assertion token uses the ____________ protocol A. Extensible Markup Language (XML) B. Hypertext Transfer Protocol (HTTP) C. Hypertext Markup Language (HTML) D. American Standard Code for Information Interchange (ASCII)

Answer 200

A. Extensible Markup Language (XML) Explanation: Security Assertion Markup Language is based on XML. HTTP us used for port 80 web traffic; HTML is used to present web pages. ASCII is the universal alphanumeric characterc set

Question 201

Which of the following are risks associated with virtualization? A. Loss of governance, snapshot and image security and sprawl B. Public awareness, snapshot and image availability, and sprawl C. Increased cost, snapshot and image security and sprawl D. Loss of data

Answer 201

A. Loss of governance, snapshot and image security and sprawl Explanation: The primary risks associated with virtualization are loss of governance, snapshot and image security and sprawl. Options B and C are incorrect. Public awareness and increased costs are not risks associated with virtualization.

Question 202

Which of the following is a theoretical technology that is intended to allow encrypted material to be processed and manipulated without decrypting it first? A. Inverse postulation B. Homomorphic encryption C. Didactic alignment D. Obverse re instantiation

Answer 202

B. Homomorphic encryption Explanation:

Question 203

An audit against the ________ reporting mechniams will demonstrate that an organization has an adequate security control design A. Service Organization Control (SOC) 1 B. SOC 2, Type 1 C. SOC 2 Type 2 D. SOC 3

Answer 203

B. SOC 2, Type 1 Explanation: This is what a SOC 2, Type 1 report is for. The SOC 1 is for financial reporting; the SOC 2, Type 2 is to review the implementation (not design) of controls; and the SOC 3 is just an attestation that an audit was performed. All these options are incorrect

Question 204

Benefits for addressing Business Continuity and Disaster Recovery offered by cloud operations include all of the following except: A. Metered service B. Distribute, remote processing, and storage of data C. Fast replication D. Regular backups offered

Answer 204

A. Metered service Explanation: Metered service allows cloud customers to minimize expenses and only pay for what they need and use this has nothing to do with BCDR

Question 205

Data classification can be ______ or ______ A. Inverse or obverse B. Automatic or manual C. Correct or incorrect D. Diurnal or nocturnal

Answer 205

B. Automatic or manual Explanation: An organization could implement an automated tool that assigns labels based on certain criteria (location of the source of the data, time, creator, content etc) much like metadata, or the organization could require that data creators/collectors assign labels when the data is first created/collected, according to a policy that includes discrete, objective classification guidance

Question 206

The OWASP Top Ten is a list of web application security threats that is created by a member driven OWASP committee of application development experts and published approximately every 24 months. The OWASP Top Ten includes broken authentication and session management. Which of the following is a good method for reducing the risk of broken authentication and session management? A. Do not use customer authentication schemes B. Implement widespread training programs C. Ensure that strong input validation is in place D. Use X.400 protocol standards

Answer 206

A. Do not use customer authentication schemes Explanation: Authentication schema should be transparent to users, who will have little or no control over that element of communication.

Question 207

What is the most secure form of code testing and review? A. Open source B. Proprietary/internal C. Neither open source and proprietary D. Combination of open source and proprietary

Answer 207

D. Combination of open source and proprietary Explanation: Using multiple forms of code review will produce more secure results than any one form of review

Question 208

How often should the accounts of privileged users be reviewed? A. Annually B.Twice a year C. Monthly D. More often than regular user account reviews

Answer 208

D. More often than regular user account reviews Explanation: There is no specific rule for the timeliness of privileged user account reviews. However, as a matter of course, privileged user accounts should be reviewed more often than the accounts of regular users because privileged users can cause more damage and therefore entail more risk

Question 209

Adhering to ASHRAE standards for humidity can reduce the possibility of _________ A. Breach B. Static discharge C. Theft D. Inversion

Answer 209

B. Static discharge Explanation: A datacenter with less than optimum humidity can have a higher static electricity discharge rate. Humidity has no bearing on breaches or theft and inversion is a nonsense term used as a distraction

Question 210

A ____________ is generally a type of network device designed to allow only authorized traffic through its interfaces A. SIEM B> Firewall C. Honeypot D. HIDS

Answer 210

B> Firewall Explanation: A firewall is a type of network device that allows only authorized traffic to flow across its interfaces

Question 211

For performance purposes, OS monitoring should include all of the following except: A. Disk space B. Disk IO usage C. CPU Usage D. Print spooling

Answer 211

D. Print spooling Explanation: Print spooling is not a metric for system performance; all the rest area

Question 212

CASBs might offer all of the following services except: A. Single sign on B. BCP/DR/COOP C. IAM D. Key escrow

Answer 212

B. BCP/DR/COOP Explanation: CABs dont usually offer BCP/DR/COOP services; thats something typically offered by cloud providers

Question 213

Your organization is developing software fdor wide use by the public. You have decided to test it in a cloud environment, in a PaaS model. Which of the following should be of particular concern to yor organization for this situation? A. Vendor lock in B. Backdoors C. Regulatory compliance D. High speed network connectivity

Answer 213

B. Backdoors Explanation: Backdoors are a particularly prevalent risk in software development because programmers legitimately use backdoors for ease of use and speed of delivery but may mistakenly or even purposefully leave the backdoors in

Question 214

A hosted cloud environment is great for an organization to use as _________ A. Storage of physical assets B. A testbed/sandbox C. A platform for managing unsecured production data D. A cost free service for meeting all user needs

Answer 214

B. A testbed/sandbox Explanation: Cloud customers can test different hardware/software implementations in the cloud without affecting production environment and use this information to make decisions before investing in particular solutions

Question 215

You are the subject matter expert for an organization considering a transition from a traditional IT enterprise environment into a hosted cloud providers data center. One of the challenges youre facing is whether the cloud provider will be able to allow your organization to substantiate and determine with some assurance that all of the contract terms are being met. This is an _______ issue. A. Regulatory B. Privacy C. Resiliency D. Auditability

Answer 215

D. Auditability Explanation:

Question 216

When you're using a storage protocol that involves a storage controller, it is very important the controller be configured in accordance with _____________ A. Internal guidance B. Industry C. Vendor guidance D.Regulatory dictates

Answer 216

C. Vendor guidance Explanation: While it is important to follow internal policy, industry standards and regulations when they are applicable, vendor guidance will most often offer the most detailed, specific settings for the particular

Question 217

The Organization for Economic Cooperation and Development (OECD) is a multinational entity that creates nonbinding policy suggestions for its member countries. The OECD has published recommendations for privacy laws. One of the characteristics the OECD suggests that privacy laws include is the _____ A. Use limitation principle B. Erstwhile substitution principle C. Flatline cohesion principle D. Airstream fluidity principle

Answer 217

A. Use limitation principle Explanation: The use limitation principle requires any entity that gathers personally identifiable information (PII) about a person to restrict the use of that PII to that which was permitted by the data subject and the reason given when it was collected

Question 218

Which of the following techniques is not recommended for privileged user management? A. Increased password/phrase complexity B. More frequent password/phrase changes C. More detailed background checks D. Less detailed audit trail

Answer 218

D. Less detailed audit trail Explanation: If anything, the audit trail for privileged users should be more detailed than that for regular users. All the other options are recommended techniques for privileged user management

Question 219

Federation allows __________ across organization A. Role replication B. Encryption C. Policy D. Access

Answer 219

D. Access Explanation: Federation allows users from multiple member organizations to access resources owned by various members. All the other answers are simply not correct

Question 220

Data loss prevention solutions can aid in deterring loss due to which of the following? A. Randomization B. Inadvertent disclosure C. Natural disaster D. Device failure

Answer 220

B. Inadvertent disclosure Explanation: DLP Solutions may protect against inadvertent disclosure. Randomization is a technique for obscuring data, not a risk to data. DLP tools will not protect against risks from natural disasters, or against impacts due to device failure

Question 221

Which IT product review framework is intended to determine the accuracy of vendor claims regarding security functions of the product? A. Underwriters Laboratories (UL) B. Federal Information Processing Standard (FIPS) 140-2 C. PCI DSS D. Common Criteria

Answer 221

D. Common Criteria Explanation: This is a framework for reviewing product security functions, as stated by the vendor

Question 222

What is usually considered the difference between business continuity and disaster recovery efforts? A. BC involvds a recovery time objective and DR involves a recovery point objective B. BC is for events caused by humans (like arson or theft) whereas DR is for natural disasters C. BC is about maintaining critical functions during a disruption of normal operations, and DR is about recovering to normal operations after a disruption D. BC involves protecting human assets (personnel, staff, users) whereas DR is about protecting property

Answer 222

C. BC is about maintaining critical functions during a disruption of normal operations, and DR is about recovering to normal operations after a disruption Explanation: Technically, BC efforts are meant to ensure that critical business functions can continue during a disruptive event and DR efforts are supported to support the return to normal operations. However, in practice, efforts often coincide, use the same plans/personnel and have many of the same procedures

Question 223

Bob is designing a data center to support his organization, a financial services firm. How long should the uninterruptable power supply provide power to the systems in the data center? A. 12 hours B. An hour C. 10 minutes D. Long enough to perform a graceful shutdown of the data center systems

Answer 223

D. Long enough to perform a graceful shutdown of the data center systems Explanation: Traditionally, it would be optimum if the UPS latest as long as necessary until the generator is able to resume providing the electrical load that was previously handled by utility power.

Question 224

You are in charge of creating the business continuity and disaster recovery plan and procedures for your organization. You are going to conduct a full tests of the BC/DR plan. WHich of the following strategies is an optimum technique to avoid major issues? A. Have another full backup of the production environment stored prior to the test B. Assign all personnel tasks to perform during the test C. Have the cloud provider implement a simulated disaster at a random moment in order to maximize realistic testing D. Have your regulators present at the test so they can monitor performance

Answer 224

A. Have another full backup of the production environment stored prior to the test Explanation: A full test will involve both the production environment and the backup data it is possible to create an actual disaster during a full test by ruining the availability of both. Therefore, it is crucial to have a full backup, distinct from the BCDR backup, in order to roll back from the test in case something goes horribly wrong

Question 225

Typically, MFA should be used ______ A. In every IT transaction B. For high risk operations and data that is particularly sensitive C. When remote users are logging into the cloud environment D. Only in the traditional environment

Answer 225

B. For high risk operations and data that is particularly sensitive Explanation: MFA should be considered for operations that have a significant risk or that deal with highly sensitive data

Question 226

Encryption can be used in various aspects of cloud computing, including all of the following except: A. Storage B. Remote Access C. Secure Sessions D. Magnetic swipe cards

Answer 226

D. Magnetic swipe cards Explanation; The data on magnetic swipe cards isnt usually encrypted

Question 227

User access to the cloud environment can be administered in all of the following ways except ______ A. Customer directly administers access B. Customer provides administration on behalf of the provider C. Provider provides administration on behalf of the customer D. Third party provides administration on behalf of the customer

Answer 227

B. Customer provides administration on behalf of the provider Explanation: The customer does not administer on behalf of the provider

Question 228

Which of the following best describes the formal, legal agreement between two or more organizations that may or may not contain incentives and/or penalties? A. SLA B. SDLC C. PLA D. SOC

Answer 228

A. SLA Explanation: The SLA is a formal agreement between two or more organizations that may or may not contain incentives or penalties. The primary use of the SLA is to determine if the provider is in fact providing services being purchased

Question 229

Which of the following is a risk in the cloud environment that does not exist or is not as prevalent in the traditional environment? A. DDoS B. Isolation failure C. External attack D. Internal attack

Answer 229

B. Isolation failure Explanation: In the traditional environment, when all resources are owned, controlled and used by the organizations personnel, loss of isolation will only expose data to other members of the organization; isolation failure in the cloud enivronment may expose data to people outside the organization; a more significant impact

Question 230

According the the CSA, why are DoS attacks such a significant threat to cloud operations? A. DoS attackers operate internationally B. There are now laws against DoS attacks, so they are impossible to prosecute C. Availability issues prevent productivity in the cloud D. DoS attacks that can affect cloud providers are easy to launch

Answer 230

C. Availability issues prevent productivity in the cloud Explanation: If users cant access the cloud provider, then the operational environment is, for all intents and purposes, useless. DoS attacks that affect avaialbility of cloud services are therefore a great concern

Question 231

WHat is the importance of adhering to vendor guidance in configuration settings? A. Conforming with federal law B. Demonstrating due dilligence C. Staying one step ahead of aggresors D. Maintaining customer satisfaction

Answer 231

B. Demonstrating due dilligence Explanation: Applying vendor configurations is an excellent method for demonstrating due dilligence in IT security efforts. Always remember that proper documentation of the action is also necessary.Cry

Question 232

Cryptoshredding requires at least ______ cryptosystems A. One B. Two C. Three D. Four

Answer 232

B. Two Explanation: The proper procedure for cryptoshredding requires two cryptosystems; one to encrypt the target data; the other to encrypt result data encryption keys

Question 233

You are the security directory for a chain of automatoive repair centers across several states. Your company uses a cloud SaaS provider for business functions that cross several of the locations of your facilities such as ordering of parts, logistics and inventory, billing and marketing. The manager at one of your newest locations reports that there is a competing car repair company that has a olog that looks almost exactly like the one your company uses. THis conflict will most likely have to be resolved with what legal method? A. Breach of contract lawsuite B. Criminal prosecution C. Civil suit D. Military tribunal

Answer 233

C. Civil suit Explanation: Intellectual property disputes are usually settled in civil court, as a conflict among private parties. Because there was no agreement between your company and the competitor in question, there is no contract, so no breach of contract dispute is perinent.

Question 234

_____________ is a symmetric block type of cipher used to encrypt information and is currently the stabdard for the US government in protecting sensitive and secret documents A. MD5 B. Secure Socket Layer C. Blowfish D. AES

Answer 234

D. AES Explanation: AES is currently used to encrypt and protect US government sensitive and secret data.

Question 235

What is perhaps the main way in which software defined networking solutions facilitate security in the cloud environment? A. Monitoring outbound traffic B. Monitoring inbound traffic C. Segmenting networks D. Preventing DDoS attacks

Answer 235

C. Segmenting networks Explanation: Network segmentation allows providers to create zones of trust within the cloud environment, tailoring the available services to meet the needs of a variety of clients and markets

Question 236

Which of the following management risks can make an organization cloud environment unviable? A. Insider trading B. VM Sprawl C. Hostile takeover D. Improper personnel selection

Answer 236

B. VM Sprawl Explanation: Because the cost of creating new instances in the cloud environment is transparent to many users/offices, there is a significant likelihood that users/officers will create many new virtual machine instances without the knowledge/oversight of management

Question 237

Proper implementation of DLP solutions for successful function requires which of the following? A. Accurate data categorization B. Physical access limitiations C. USB connectivity D. Physical presence

Answer 237

A. Accurate data categorization Explanation: DLP tools need to be aware of which information to monitor and which requires categorization DLPs can be implemented with or without physical access or presence.

Question 238

The CSA Security Trust and Assurance Registry (STAR) program includes a level of certification for cloud providers that acquire third party assessments of their environment and controls. WHich STAR level is this? A. 1 B. 2 C. 3 D. 4

Answer 238

B. 2 Explanation: Level 2 of the CSA STAR program requires third party assessments of the provider

Question 239

When the customer requests modifications to the current contract or SLA for business continuity and DR purposes, who should abosrb the cost of modification? A. The customer absorsbs the cost B. The provider absorbs the cost C. The cost should be split equally D. Modifications dont cost anything

Answer 239

A. The customer absorsbs the cost Explanation: The customer will have to pay for the costs of modification requested by the customer, regardless of the purpose. The provider does not absorb the cost whgen the customers requests a modification of the SLA.

Question 240

Which of the following is not a core princinople included in the Organization for Economic Cooperation and Development (OECD) privacy guidelines? A. The individual must have the ability to refrain from sharing their data B. The individual must have the ability to correct errors in their data C. The individual must be able to request a purge of their data D. The entitiy holding the data must secure it

Answer 240

C. The individual must be able to request a purge of their data Explanation: This is an aspect of the EU legislation, known colloquially as the right to be forgottenn

Question 241

In application level encryption, where does the encryption engine reside? A. In the application accessing the database B. In the OS on which the application is running C. Within the database accessed by the application D. In the volume where the database resides

Answer 241

A. In the application accessing the database Explanation: The application contains the encryption engine used in application level encryption. The OS is responsible for providing the resources an application needs and for running the applications

Question 242

The CSA has developed a model for cloud privacy frameworks called the Privacy Level Agreement (PLA). Why might a cloud service provider be reluctant to issue or adhere to a PLA? A. A PLA might limit the providers liability B. A PLA would force the provider to accept more liability C. A PLA is nonbinding D. A PLA is not enforceable

Answer 242

B. A PLA would force the provider to accept more liability Explanation: Under current laws and regulations, ultimate liability for the security of privacy data rests on the data controller, aka the cloud customer

Question 243

All of the following are methods of data masking suggested by ISC^ except A. Random substitution B. Algorithimic substitution C. Deletion D. Conflation

Answer 243

D. Conflation Explanation

Question 244

What should the cloud customer do to ensure that disaster recovery activities dont exceed the maximum allowable downtime (MAD)? A. Make sure any alternate provider can support the application needs of the organization B. Ensure that contact information for all first responder agencies are correct and up to date at all times C. Select an appropriate recovery time objective D. Regularly review all regulatory directives for DR

Answer 244

C. Select an appropriate recovery time objective Explanation: The RTO must always be less than the MAD

Question 245

Typically, a cloud customer seeking stand alone hosting will except all of the following except: A. More control over governance of the environment B. Greater administrative control of the environment C. Higher overall security of the environment D. Lower costs for the environment

Answer 245

D. Lower costs for the environment Explanation: Stand alone hosting will cost more than pooled resources and multitenancy

Question 246

Which of the following is used to describe a frasmework of application security best practices that have been catalogued and leveraged by the organization and contain at least one or more subcomponents? A. ANF B. ONF C. NIST D. Hi Trust

Answer 246

B. ONF Explanation: An Organization Normative Framework (ONF) is a framework of so called containers of application security best practices catalogued and leveraged by the organization and contains at least one or more subcomponents known as application normative frameworks

Question 247

Who operates the management plane? A. Regulators B. End consumers C. Privileged Users D. Privacy Data Subjects

Answer 247

C. Privileged Users Explanation: The only the most trusted administrators and managers will have access to the cloud data centers management plane. These will usually be cloud provider employees, but some cloud customer personnel may be granted limited access to arrange their organizations cloud resources

Question 248

You are in charge of creating the business continuity and disaster recovery plan and procedures for your organization. Your organization has its production environment hosted in a cloud environment. You are considering using cloud backup services for your BCDR purposes as well. What would probably be the best strategy for this approach, in terms of redundancy and resiliency? A. Have your cloud provider also provide BCDR Backup B. Keep a BCDR backup on the premises of your corporate headquaters C. Use another cloud provider for the BCDR backup D. Move your production environment back into your corporate premises, and use your cloud provider to host your BCDR backup

Answer 248

C. Use another cloud provider for the BCDR backup Explanation: It is best to have your backup at another cloud provider in case whatever causes an interruption in service occurs throughout your primary providers environment; this will be more complicated and expensive, but it provides the best redundancy and resiliency

Question 249

You are the privacy data officer to a large hospital and trauma center. You are called on to give your opinion of the hospitals plans to mirgate all IT functions to a cloud service. WHich of the following Uptime INstitute Tier level rating would ou insist be included for any data center offered by potential providers? A. 1 B. 2 C. 3 D. 4

Answer 249

D. 4 Explanation: Because the nature of a life support effort requires absolute availability, nothing less than a Tier 4 data center will serve your purposes. All the other options are incorrect

Question 250

FM 200 has all the following properties except ________ A. Its nontocix at levels used for fire suppression B. Its gaseous at room temperature C. It may deplete the earths ozone layer D. It does not leave a film or coagulant after use

Answer 250

C. It may deplete the earths ozone layer Explanation: FM 200 is used as a replaement for older Halon systems specifically because it does not deplete the ozone layer

Question 251

In PaaS environment, user access management often requires that data about user activitybe collected, analyzed, audited and reported against rule based criteria. These criteria are usually based on _________ A. International standards B. Federal regulations C. Organizational policies D. Federation directives

Answer 251

C. Organizational policies Explanation: Organizational policies dictates rules for access entitlement.

Question 252

The physical layout of a cloud data center campus should include redundancies of all the following except _______ A. Physical perimeter security controls (fences, lights, walls, etc) B. The administration/support staff building C. Electrical utility lines D. Communications connectivity lines

Answer 252

B. The administration/support staff building Explanation: Administrative and suport staff are usually not part of the critical path of a data center; they are nonfunctional requirement elements, not functional requirements

Question 253

What is often a major challenge to getting both redundant power and communications utility connections? A. Expense B. Carrying medium C. Personnel deployment D. Location of many datacenters

Answer 253

D. Location of many datacenters Explanation: The location of many datacenters - rurally situated, distant from metro areas - may create challenges for finding multiple power utility providers and ISPs

Question 254

You are the IT security manager for a video game software development company. In order to test your products for security defects and performance issues, your firm decides to use a small team of game testers recruited from a public pool of interested gamers who apply for a chance to take part. It absolutely crucial to include ______ as part of this process A. Managerial oversight B. Signed nondisclosure agreements C. Health benefits D. THe programming team

Answer 254

B. Signed nondisclosure agreements Explanation: Having the test participants provide signed NDAs is an absolutely essential part of this process

Question 255

Which of the following poses a new risk in the cloud, not affecting the traditional, on premise IT environment? A. User carelessness B. Inadvertent breach C. Device failure D. Resource exhaustion

Answer 255

D. Resource exhaustion Explanation: It is possible that a cloud provider will be unable to handle an increased load during contingency situations where all its customers are demanding additional resources far beyond their usual contracted rate

Question 256

The cloud data center campus physical access point should include all the following except _______ A. Reception area B. Video surveillance C. Badging procedure D. Mantrap structures

Answer 256

D. Mantrap structures Explanation: Usually, mantrap areas control access to sensitive locations within a facility, not an entrace to the facility.

Question 257

Which of the following best describes the use of several smaller disks rather than a single large disk for storage purposes as well as redundancy and speed? A. RADE B. SAN C. NAS D. RAID

Answer 257

D. RAID Explanation: Redundant array of indepedent disks is a way of using a group of smaller and usually less expensive disks as opposed to a single large disk.

Question 258

In an IaaS arrangement, who accepts responsibility for securing cloud based applications? A. The cloud provider B. The cloud customer C. The regulator D. The end user/client

Answer 258

B. The cloud customer Explanation: In IaaS model, the provider is only responsible for provisioning the devices and computing/storage capacity; the customer is responsible for everything else, including the security of the applications

Question 259

DRM solutions often protect unauthorized distribution of what type of intellectual property? A. Patents B. Trademarks C. PII D. Copyright

Answer 259

D. Copyright Explanation: DRM is often deployed to ensure that copyrighted material is only delivered to and used by licensed recipients

Question 260

_______ drive security decisions A. Customer service responses B. Surveys C. BUsiness requirements D. Public opinion

Answer 260

C. BUsiness requirements Explanation: Seciroty is usually not a profit center; and is therefore beholden to business drivers; the purpose of security is to support the business

Question 261

Cryptographic keys for encrypted data stored in the cloud should be: A. At least 128 bits long B. Not stored with the cloud provider C. Split into groups D. Generated with redundancy

Answer 261

B. Not stored with the cloud provider Explanation: Cryptographic keys should not be stored along with the data they secure, regardless of the length.

Question 262

What is the entity that created the Statement on Standards for Attestation Engagements (SSAE) auditing standard and certifies auditors for that standard? A, NIST B. ENISA C. GDPR D. AICPA

Answer 262

D. AICPA Explanation: The American Institute of Certified Public Accountants publishes the SSAE 18 standard. NIST is a US government entity that publishes many standards for federal agencies

Question 263

____________ is the idea of identifying specific points of vulnerability and them implemeting countermeasures to protect or thwar those points from successful exploitation A. TCI reference model B. Pentesting C, Transcending D. Threat modeling

Answer 263

D. Threat modeling Explanation: Threat modeling is used specifically to identify points of vulnerability in order to implement countermeasures as part of the overall system protection activity

Question 264

Which of the following terms best describes the amount an organization should expect to lose on an annual basis due to specific type of incident? A. ARO B. BIA C. BLE D. ALE

Answer 264

D. ALE Explanation: The term that best describes the amount an organization should expect to lose on an annual basis due to one type of incident is ALE and is calculated by multiplying the ARO by SLE

Question 265

Which tool can reduce confusion and misunderstanding during a BC/DR response? A. Flashlight B. Controls matrix C. Checklist D. Call tree

Answer 265

C. Checklist Explanation: Checklists serve as a reliable guide for BC/DR activity and should be straightforward enough to use that someone not already an expert or trained in BC/DR response could ostensibly accomplish the necessary tasks.

Question 266

A honeypoit can be used for all the following purposes except ______ A. Gathering threat intelligence B. Luring attackers C. Distracting attackers D. Delaying attackers

Answer 266

B. Luring attackers Explanation: It is important to distinguish the purpose of the honeypot. It is not for luring in attackers; a lure is an invitation, and inviting an attack decreases the organizations ability to have the attacker prosecured or conduct successful litigation against the attacker

Question 267

You are the security policy lead for your organization, which is considering migrating from your on premises, traiditional IT environment into the cloud. You are reviewing the CSA CCM as a tool for your organization. Which of the following benefits will the CSA CCM offer your organization? A. Simplifying regulatory compliance B. Collecting multiple data streams from your log files C. ENsuring that the baseline configuration is applied to all systems D. Enforcing contract terms between your organization and the cloud provider

Answer 267

A. Simplifying regulatory compliance Explanation: The CSA CCM will aid you in selecting and implementing appropriate controls for various regulatory frameworks. The CCM does not aid in collecting log files; that is the function of a SIEM

Question 268

Bob is designing a data center to support his organization, a financial services firm. What Uptime Institute tier rating should Bob try to attain in order to meet his companys needs without adding extraneous costs? A. 1 B. 2 C. 3 D. 4

Answer 268

C. 3 Explanation: Tier 3 should probably suffice for Bobs purposes; providing sufficient redundancy and resiliency

Question 269

Which of the following is most useful in determing the SLE of an asset? A. The frequnecy with which you expect that type of loss to occur B. The dollar value of the asset C. The sensitivity of the asset D. The size and scope of the asset

Answer 269

B. The dollar value of the asset Explanation: The monetary value of the asset is the most objective, discrete metric possible and the most accurate for the purposes of SLE determination