Pluralsight CCSP Domain 3 Flashcards
- Reservations
- Limits
- Shares
- Reservations - minimum guarantee CSP gives resources to consumer
- Limits - maximum given to consumer
- Shares - if resources are scarce due to attack, CSP will prioritize which consumer receives resources
- Reservations
- Limits
- Shares
- Reservations - minimum guarantee CSP gives resources to consumer
- Limits - maximum given to consumer
- Shares - if resources are scarce due to attack, CSP will prioritize which consumer receives resources
Two elements of computing
- # of CPUs - HERTZ
- Amount of memory - BYTES
Define each step in zero trust
step 1 of zero trust is defining protect surface
* data
* applications
* assets
* services
step 2 of zero trust is mapping transaction flows - determine the critical path of DAAS
step 3 of zero trust is architect zero trust network
* reference architecture (recommended structures)
* granular layer 7 protect surface (application layer)
* application user and content ID management
step 4 - zero trust policy
* defining who, what when, where, why, and how (who is accessing, what is accessed, when is it, where is it access, etc)
step 5 - monitor and maintain
* analyze and evaluate logs
OSI Model
Logical design precedes…
physical design to avoid functionless lock-in of physical state
Portability vs interoperability
portability is moving from CSP to CSP and interoperability is transferring data from CSP to CSP
ISO 22237 - four classes of protection
about data center infrastructure
class 1 - general office space
class 2 - personnel entry docking bay storage
class 3 - telecom electrical mechanical testing
class 4 - control room datacenter main distribution
- ASHRAE Standards
- Two types of Cooling
- 18-27 C / 68 - 77 F
- 5-15 C DP / 40-60% (DewPoint/Humidity)
- Latent Cooling - removes moistures
- Sensible Cooling - removes heat
Hot Aisle Containment
Cold Aisle Containment
ISO 12237 - Availability Classes
Data center Site Infrastructure Tier Standard
Tier 1 - Data Center Infrastructure Tier Standard
Class 1 - single path, no resiliency
Tier 2 - Data Center Infrastructure Tier Standard
Class 2 - single path, resiliency
Tier 3 - Data Center Infrastructure Tier Standard
Class 3 - multi path, redundancy
Tier 4 - Data Center Infrastructure Tier Standard
Class 4 - multi path, fault tolerant
Define BIA and the 3 important metrics
MTD - timer
RTO - goal / stopwatch
On-premises, cloud as BCDR
- Primary site is data center
- Back up to cloud
- If primary site is down, recovery from cloud to alternate data center
Cloud consumer, Primary Provider BCDR
- Primarily consuming from CSP
- Replicated Availability Zones within one cloud so if one zone goes out, you can use the other zone to work; load balancing will elminate the user knowing there was an outage
Cloud Consumer, alternate provider BCDR
If customer loses service in primary cloud, can go to alternate cloud.
Two Primary BCDR Activities
-
Recovery - bringing alternate site systems up
* Prevention, Detection, Response, Recovery, Improvement -
Restoration - bringing primary site systems up
* Original Location, new normal, reverse order (fix least to most critical to ensure no conflict with recovery location), in concert with recovery, contain costs/risks
BCDR Steps
- Requirements Gathering and Context
* Identify Critical Business Functions
* Identify Threats - Plan Risk Assessment
- Plan Design, Creation, and Implementation
- DR Plan Tests
Types of DR Plan Tests
- Desktop Review - walkthrough
- Recovery Simulation - component failure recovery; or service recovery in non-production environment
- Operational test - FULL TEST; simulates most realistic; use ALT site
- CHAOS Engineering - the ultimate test;
CHAOS Engineering Test
- Chaos Monkey - impose VM failure; Clusters are good
- Chaos Gorilla - impose availability zone failure; shutting down data center;
- Chaos Kong - similuated region failure;
Verification vs Validation
Verification - ensure the application works
Validation - ensure this application solves business requirement
Type of Secutiy Application Tests
ISO 15408 - Common Criteria
- Tests security in system components
- tests functionalty in relation to rigor of the test
- 11 Security Functional Requirements
- 1-7 Evaluation Assurance Levels
Vuln Assessment vs pen test
vuln assess looks for weaknesses while pen test exploits that weakness
Proprietary Software
- Difficult to do in-depth testing
- can do black box DAST
- cannot check code; no white box SAST
- ensure signed patches and patchign is done
- source code in escrow
ISO 27034
- Standard for Application Security
- ONF - Organizational Normative Framework - library of security controls
- ANF - Application Normative Framework - subset of ONF - library of securtiy controls for application
*
Content Distribution Networks
connecting users to local servers rather then transmitting all data all over the world
Sandboxing
