Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Managing Cloud Security - D320 > Flashcards

Managing Cloud Security - D320 Flashcards

1
Q

Which phase of the cloud data life cycle requires adherence to export and import restrictions, including Export Administration Regulations (EAR) and the Wassenaar Arrangement?

A

Share

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Why is the striping method of storing data used in most redundant array of independent disks (RAID) configurations?

A

It allows efficient data recovery as even if one drive fails, other drives fill in the missing data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the purpose of egress monitoring tools?

A

They are used to prevent data from going outside the control of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A company is looking at different types of cloud storage options. One of the threats to cloud storage that the company foresees is the possibility of losing forensic artifacts in the event of an incident response investigation.

Which type of cloud storage has the highest risk of losing forensic artifacts in the event of an incident response investigation?

A

Ephemeral

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A manager is made aware of a customer complaint about how an application developed by the company collects personal and environmental information from the devices it is installed on.

Which document should the manager refer to in order to determine if the company has properly disclosed information about what data it collects from this application’s users?

A

Privacy notice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An organization needs to store passwords in a database securely. The data should not be available to system administrators.

Which technique should the organization use?

A

Hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A company is looking to ensure that the names of individuals in its data in the cloud are not revealed in the event of a data breach, as the data is sensitive and classified.

Which data masking technique should the company use to prevent attackers from identifying individuals in the event of a data breach?

A

Anonymization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An organization needs to quickly identify the document owner in a shared network folder.

Which technique should the organization use to meet this goal?

A

Labeling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An organization plans to introduce a new data standard and wants to ensure that system inventory data will be efficiently discovered and processed.

Which type of data should the organization use to meet this goal?

A

Structured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An organization implemented an information rights management (IRM) solution to prevent critical data from being copied without permission and a cloud backup solution to ensure that the critical data is protected from storage failures.

Which IRM challenge will the organization need to address?

A

Replication restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A data center engineer is tasked with the destruction of data on solid-state drives (SSDs). The engineer must ensure that the data is not able to be retrieved.

Which data destruction action should the engineer take to meet this goal?

A

Crypto-shredding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

An organization wants to gather and interpret logs from its cloud environment.

Which system should the organization use for this task?

A

Security Information and Event Management (SIEM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An organization with a Security Information and Event Management (SIEM) system wants to minimize errors or missed issues due to human log analysis.

Which SIEM policy should the organization use in this case?

A

Automated analysis of data sets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which software type allows multiple operating systems to run on the same physical server in a virtualized environment?

A

Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the name of the process of automatically provisioning, configuring, and managing virtual machines and other resources in a virtualized environment?

A

Orchestration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which cloud computing characteristic allows customers to manage their utilization by only paying for the resources used?

A

Metered service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which cloud deployment model allows customers to take advantage of service and price differences from two or more cloud vendors?

A

Multi-cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which cloud consideration refers to the ability of the infrastructure to withstand disruptive events?

A

Resiliency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which technology is used to protect the confidentiality of data from on-path attacks?

A

Transport Layer Security (TLS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which technology allows cryptographic secrets to be held in a secure way so that they can be recovered by parties who have authorization?

A

Key escrow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which safety control acts as a virtual firewall in cloud environments?

A

Network security group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An organization with a single headquarters building in New York City wants to secure its cloud infrastructure so that only users at its offices can administer its cloud resources.

Which architectural concept should the organization implement?

A

Geofencing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which business continuity/disaster recovery (BC/DR) term refers to a secure container that contains all the necessary documentation and resources needed to conduct a proper BC/DR response action?

A

Toolkit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An organization is planning to store its production data in a public cloud service. While researching the service, the organization discovers that its data will be stored in a proprietary data format that cannot be read by other cloud services.

Which cloud risk does this represent?

A

Vendor lock-in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A company configures a backup solution that will automatically sync the data between the services of multiple cloud service providers to prevent data redundancy. One concern is that the different service offerings may not have the same level of data protection and may not allow direct syncing between the providers.

Which architectural concept addresses this concern?

A

Interoperability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which design pillar represents the ability of a workload to execute its intended function accurately and consistently when it is expected to?

A

Reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A cloud customer wants to store application programming interface (API) tokens for their applications so they can be accessed from anywhere.

Which cloud provider service should the customer use?

A

Secrets management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The Department of Justice (DOJ) assesses options for a new cloud-hosted collaboration solution.

What should it use to ensure that the vendors are compliant with the governmental regulations for data management in the United States?

A

Federal Risk and Authorization Management Program (FedRAMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A European Union (EU) citizen contacts a company doing business in the EU, claiming that its data processing activities are out of compliance with the General Data Protection Regulation (GDPR). The citizen demands that the company stops processing their personal data.

What must the company do if it wishes to continue processing this personal data?

A

Demonstrate that this data processing is authorized under approved standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is used to allow additional functionality such as improved networking or video output for a guest operating system by connecting to an underlying host’s hardware?

A

Virtualization toolsets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which concept denotes an advantage of virtualized environments that enable them to achieve high availability?

A

Hardware abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which storage architecture contains nodes that are logically connected rather than physically connected?

A

Loosely coupled clusters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which purpose does an intrusion prevention system (IPS) serve when compared to an intrusion detection system (IDS)?

A

An IPS detects and stops malicious traffic, while an IDS detects and alerts about malicious traffic.

34
Q

Which part of a network should a security information and event management (SIEM) suite use to ensure network devices in a software-defined network are properly forwarding traffic?

A

Control plane

35
Q

An analyst needs to scan hosts for misconfigurations and known security threats that could lead to a security incident.

Which type of scanner will allow the analyst to check for these types of issues?

A

Vulnerability

36
Q

An organization identified the need to improve the resiliency of a critical IT service to ensure access for its customers.

Which information technology service management (ITSM) process should be implemented to ensure the organization meets this goal?

A

Availability management

37
Q

An organization lost connectivity to one of its data centers because of a power outage.

What is used to measure the return to operational capability after the loss of connectivity?

A

Recovery time objective (RTO)

38
Q

Which type of management focuses on arranging all the elements needed to deploy new software, including QA testing and staging, before the software enters active maintenance?

A

Release management (RM)

39
Q

A security analyst is tasked with collecting evidence related to a data breach involving monetary theft.

Which action should the security analyst take when accessing the breached system?

A

Document and record all activities taken

40
Q

During an investigation, government agents asked a security professional to collect the records stored in a database and present them to the court.

Which process should the security professional use to identify and obtain that information?

A

Electronic discovery

41
Q

The service at a cloud provider has been interrupted.

Which group should this cloud provider contact with information about the expected window for which the services will be down as per a contractual agreement?

A

Customers

42
Q

An online store has declared a disaster situation because of a large storm in the area of its primary cloud data center location. The emergency plan has allowed the store to remain online and accept payments, but it has fallen out of compliance with its Payment Card Industry Data Security Standard (PCI DSS) practices.

Which party should the store keep apprised of ongoing developments and the potential solutions being considered?

A

Regulators

43
Q

Which type of communication channel should be established between parties in a supply chain to be used in a disaster situation?

A

Secondary

44
Q

An organization’s engineers recently attended a training session designed to raise awareness of the dangers of using insecure direct object identifiers to view another user’s account information.

Which Open Web Application Security Project (OWASP) Top 10 vulnerability category did their training cover?

A

Broken access control

45
Q

An organization’s engineers recently attended a training session that raised their awareness of the dangers of using weak algorithms or protocols for data security.

Which Open Web Application Security Project (OWASP) Top 10 vulnerability category did their training cover?

A

Cryptographic failures

46
Q

A company plans to deploy a new application. Before the deployment, the company hires an IT security consultant to perform a zero-knowledge test to access the application as an external hacker would.

Which testing technique applies to the work the consultant is performing?

A

Black box

47
Q

Which concept refers to multiple teams and roles within an organization that perform testing on code from end to end to ensure that the code meets all standards and requirements?

A

Quality assurance

48
Q

What is the purpose of implementing rate limiting in application programming interface (API) security?

A

To prevent API overuse

49
Q

An organization wants to ensure that untested software updates provided by a third-party vendor are not run in its mission-critical environment.

What should the organization use in this scenario?

A

Manual updates

50
Q

Which software development methodology is sequential, with each phase followed by the next phase and with no overlap between the phases?

A

Waterfall

51
Q

Which phase of software design includes gathering customer input to determine a system’s desired functionality?

A

Requirements definition

52
Q

Which technology is used to prevent cross-site request forgery (CSRF) attacks?

A

Tokens

53
Q

A project manager is working on a new software project for a customer. The project manager works closely with the customer to get input on the desired features and ranks them based on how critical they are for the project.

Which phase of the software development life cycle (SDLC) is the project manager working on?

A

Requirements definition

54
Q

Which web application firewall (WAF) feature protects the application servers behind it from systems sending requests?

A

Reverse proxy

55
Q

Which scheme would provide protection if an entire physical solid-state drive was lost or stolen?

A

Full-disk encryption

56
Q

A small organization adopts a strategy to ensure that the cryptographic keys it uses in its cloud environment are securely stored and handled.

Which third-party service should the organization leverage for key administration in the given scenario?

A

Cloud access security broker (CASB)

57
Q

An organization started the transition to using a public cloud service for a customer-facing application. The organization’s security team has concerns about the application programming interface (API) tokens being lost or exposed to malicious actors.

Which service do cloud providers offer that the organization should leverage to administer its API tokens?

A

Secrets management

58
Q

What is the benefit of virtualization management tools with respect to the management plane?

A

They allow more effective handling of resource demands.

59
Q

Which component provides improved availability and path redundancy?

A

Network interface card (NIC) teaming

60
Q

After an internal audit, an organization determined that its cloud deployment may be vulnerable to threats from external attackers.

What should the organization implement to mitigate this risk?

A

Hardened virtual machines with strong access controls

61
Q

A group of colleges decided to pool their resources to create a community cloud.

Which risk is associated with this type of cloud deployment?

A

Shared access and control mechanisms between members

62
Q

An organization believes that a man-in-the-middle attack is possible but unlikely to occur. However, if a successful attack occurs, the consequences will be serious. The cost estimate for reducing the risk of such an attack is much more than the organization wishes to pay.

Which factor will determine whether the organization decides to pay the amount to mitigate the risk of an attack?

A

Risk appetite

63
Q

Which tier of service is provided by a data center that is designed to have independent and physically isolated systems, multiple distribution paths, and fault tolerance for components?

A

Tier 4

64
Q

Which concept focuses on balancing virtual machines across clusters to ensure reliable and consistent performance?

A

Distributed resource scheduling

65
Q

An organization exclusively uses Microsoft software and prefers to use tools that run natively on Windows whenever possible.

Which tool should this organization use to provide remote access to machines over an encrypted channel?

A

Remote Desktop Protocol (RDP)

66
Q

An organization opens an office with a reception area. Visitors are required to sign in at the reception and collect a visitor’s badge, which turns from white to red after eight hours.

Which security concept is the organization employing?

A

Controlled entry point

67
Q

An organization wants to include a second factor of authentication in its authentication, authorization, and accounting scheme for its cloud environment. It wants to ensure that the additional authentication mechanism will not be compromised if an employee’s laptop or smartphone is compromised.

Which type of authentication token will meet the organization’s requirements?

A

Hardware such as key fob devices

68
Q

An organization deploying a greenfield cloud-based system wants to validate users’ identities and access before they are allowed to interact with data.

Which scheme should the organization leverage to ensure that users are properly validated?

A

Zero trust

69
Q

An organization is taking part in a disaster recovery (DR) exercise that simulates a natural disaster. The key players are performing minimal actions that test the call tree to ensure that all the contact information is up to date.

Which type of testing is the organization performing?

A

Dry run

70
Q

After a severe storm, the local power grid used by an organization’s primary European data center was damaged and could no longer provide the necessary power to keep the services running. Management has established that this event does not meet the definition of a disaster but is a business continuity impacting event since a failover site can temporarily bear the load.

What should the organization leverage to return operations to the data center?

A

Generators

71
Q

Which legal requirement mandates companies in the United States to provide federal officials with data even if the data is not stored in the United States and disclosure of the data is illegal under the laws where it is stored?

A

The Clarifying Lawful Overseas Use of Data (CLOUD) Act

72
Q

Which process describes the tracking and monitoring of evidence, including who had access and what controls were used, from the time it is classified and gathered for evidential purposes until the time it is delivered to a court or law enforcement officials?

A

Chain of custody

73
Q

The General Data Protection Regulation (GDPR) provides data subjects with various rights related to privacy.

What do organizations need to do in order to acquire and use personal information under GDPR?

A

Have the data subject opt in for the data use

74
Q

An organization has devised a new use for the personal data that it stores about its customers.

What should the organization do in this situation according to the Generally Accepted Privacy Principles (GAPP)?

A

Obtain additional consent before using personal data in a different way

75
Q

Which type of analysis compares a control analysis against a baseline standard?

A

Gap analysis

76
Q

Which type of statement issued by an auditor indicates that an organization did not disclose enough information to perform a fair audit?

A

Scope limitation

77
Q

Which risk management strategy involves changing business practices to eliminate the potential of an enterprise risk?

A

Avoidance

78
Q

Which risk management strategy involves continuing business operations as normal after being made aware of an enterprise risk?

A

Acceptance

79
Q

Which document specifies the service guarantees a vendor will provide and the remedies available if the vendor fails to adhere to them?

A

Service level agreement (SLA)

80
Q

Which document provides a contract for a vendor’s work for an organization over an extended period and usually includes security requirements?

A

Master service agreement (MSA)

CISSP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions