Pocket Prep 10 Flashcards
An information security manager, Cat, has uncovered a problem within the Information Technology (IT) department. The staff have been moving new firewall equipment directly into production without proper testing in a lab or controlled environment. When the staff has not properly tested the firewalls, there has been an immediate issue or two that has been seen by the users. He is looking for a process to implement that would control this better in the future.
What would you recommend?
A. Capacity management
B. Continuity management
C. Deployment management
D. Change management
C. Deployment management
Explanation:
Deployment management is the process of moving new or changed hardware or software to a live environment.
Change management is the process of managing the addition, modification, or removal of anything that could have a direct or indirect impact on IT services. Change management could have been the answer, but since deployment management is an option, that is a more specific fit to the issue of adding hardware to a live environment.
Continuity management is the process of making sure that the services that IT provides will still be available in the event of a disaster. ITIL does not use the term Disaster Recovery (DR).
Capacity management is the process of ensuring that resources are managed in a way to meet the corporation’s demand for IT services.
An auditor performing a manual audit pulls a registry file from a sample of windows servers and compares it to a baseline. Where would they be pulling the baseline from?
A. Code repository
B. Configuration Management DataBase (CMDB)
C. Security Information & Event Manager (SIEM)
D. Information Security Management System (ISMS)
B. Configuration Management DataBase (CMDB)
Explanation:
The organization’s Configuration Management DataBase (CMDB) should capture all Configuration Items (CIs) that have been placed under configuration management. The CIs are the required configuration. This database can be used for manual audits as well as automated scanning to identify systems that have drifted out of their secure state.
An ISMS is effectively the security program. The term ISMS comes from ISO/IEC 27001/2.
A SIEM is a device that collects the logs from all devices within the network and then correlates the events to determine when there is an Indication of Compromise (IoC) within the environment.
A code repository is a storage location for source code created within the business.
Which of the following cloud environments has cloud servers used only by a single organization?
A. Hybrid Cloud
B. Community Cloud
C. Private Cloud
D. Public Cloud
C. Private Cloud
Explanation:
Cloud services are available under a few different deployment models, including:
Private Cloud: In private clouds, the cloud customer builds their own cloud in-house or has a provider do so for them. Private clouds have dedicated servers, making them more secure but also more expensive. Public Cloud: Public clouds are multi-tenant environments where multiple cloud customers share the same infrastructure managed by a third-party provider. Hybrid Cloud: Hybrid cloud deployments mix both public and private cloud infrastructure. This allows data and applications to be hosted on the cloud that makes the most sense for them. Multi-Cloud: Multi-cloud environments use cloud services from multiple different cloud providers. This enables customers to take advantage of price differences or optimizations offered by different providers. Community Cloud: A community cloud is essentially a private cloud used by a group of related organizations rather than a single organization. It could be operated by that group or a third party, such as FedRAMP-compliant cloud environments operated by cloud service providers.
A Hardware Security Module (HSM) vendor has had their product tested to ensure the physical security of the device. It has proven that it will overwrite the data and keys within if the box is ever opened. What certification would this be?
A. Federal Information Processing Standard (FIPS) 140-3 Level two
B. Common Criteria (CC/ISO/IEC 15408) Evaluation Assurance Level (EAL) three
C. Federal Information Processing Standard (FIPS) 140-3 Level three
D. Common Criteria (CC/ISO/IEC 15408) Evaluation Assurance Level (EAL) four
C. Federal Information Processing Standard (FIPS) 140-3 Level three
Explanation:
The Federal Information Processing Standard (FIPS) 140-3 is a test of the physical security of cryptographic products. Level three includes the zeroization of the key and data if the box is tampered with. Level 2 is only tamper evidence through a sticker or seal being cut.
ISO/IEC 15408 (Common Criteria) level three is methodically designed and tested. Level four is methodically designed, tested, and reviewed. What is being tested is specified in the Protection Profile (PP) and the Security Target (ST). This testing is for any security products, including HSMs.
Which of the following is the MAIN consideration when determining retention periods for certain types of data such as personal data or company financial data?
A. Data Classification
B. Regulatory Requirements
C. Retention Requirements
D. BC/DR req
B. Regulatory Requirements
Explanation:
Data retention policies define how long an organization stores particular types of data. Some of the key considerations for data retention policies include:
Retention Periods: Defines how long data should be stored. This usually refers to archived data rather than data in active use. Regulatory Requirements: Various regulations have rules regarding data retention. These may mandate that data only be retained for a certain period of time or the minimum time that data should be saved. Typically, the first refers to personal data, while the second is business and financial data or security records. Data Classification: The classification level of data may impact its retention period or the means by which the data should be stored and secured. Retention Requirements: In some cases, specific requirements may exist for how data should be stored. For example, sensitive data should be encrypted at rest. Data retention may also be impacted by legal holds. Archiving and Retrieval Procedures and Mechanisms: Different types of data may have different requirements for storage and retrieval. For example, data used as backups as part of a BC/DR policy may need to be more readily accessible than long-term records. Monitoring, Maintenance, and Enforcement: Data retention policies should have rules regarding when and how the policies will be reviewed, updated, audited, and enforced.
In which cloud service model is the cloud service provider (CSP) responsible for securing physical infrastructure for compute resources?
A. IaaS
B. PaaS
C. SaaS
D. All service models
D. All service models
Explanaion:
Compute resources include the components that offer memory, CPU, disk, networking, and other services to the customer. In all cases, the cloud service provider (CSP) is responsible for the physical infrastructure providing these services.
However, at the software level, responsibility depends on the cloud service model in use, including:
Infrastructure as a Service (IaaS): In an IaaS environment, the CSP provides and manages the physical components, virtualization software, and networking infrastructure. The customer is responsible for configuring and securing their VMs and the software installed in them. Platform as a Service (PaaS): In a PaaS environment, the CSP’s responsibility extends to offering and securing the operating systems, database management systems (DBMSs), and other services made available to a customer’s applications. The customer is responsible for properly configuring and using these services and the security of any software that they install or use. Software as a Service (SaaS): In a SaaS environment, the CSP is responsible for everything except the custom settings made available to the cloud customer. For example, if a cloud storage drive can be set to be publicly accessible, that is the customer’s responsibility, not the CSP’s.
Charlie is working with the developers as they build a new piece of software that will be able to store and retrieve data in the cloud. How does a piece of software access object, file, block, and database storage?
A. Application Programming Interface (API)
B. Internet Protocol Security (IPSec)
C. Transport Layer Security (TLS)
D. Security Assertion Markup Language (SAML)
A. Application Programming Interface (API)
Explanation:
Multiple types of cloud storage technologies use APIs to access data. Some common examples include:
Object Storage: Object storage systems like Amazon S3, Microsoft Azure Blob Storage, and Google Cloud Storage File Storage: Cloud file storage services, such as Amazon Elastic File System (EFS), Azure Files, and Google Cloud Filestore Block Storage: Cloud block storage services like Amazon Elastic Block Store (EBS), Azure Disk Storage, and Google Cloud Persistent Disk Database Storage: Cloud database services, such as Amazon Relational Database Service (RDS), Azure SQL Database, and Google Cloud SQL
TLS is used to encrypt the transmission. TLS can be used to encrypt a RestFUL API and should be used. It is not the access method to actually find and retrieve a piece of data.
SAML can be used to authenticate the user before they are allowed to access the storage, but it too does not actually find and retrieve a piece of data.
Internet Protocol Security (IPSec) could be used to secure a Virtual Private Network (VPN) connection by encrypting the traffic. Or it could be used to connect the router at the office to the edge router in the cloud. Either way, it is like TLS. It is encrypting the data, not finding and retrieving the data.
Which of the following cloud audit mechanisms may only be possible in an IaaS environment OR with the help of the cloud provider?
A. Access Controls
B. Correlation
C. Log Collection
D. Packet Capture
D. Packet Capture
Explanation:
Three essential audit mechanisms in cloud environments include:
Log Collection: Log files contain useful information about events that can be used for auditing and threat detection. In cloud environments, it is important to identify useful log files and collect this information for analysis. However, data overload is a common issue with log management, so it is important to collect only what is necessary and useful. Correlation: Individual log files provide a partial picture of what is going on in a system. Correlation looks at relationships between multiple log files and events to identify potential trends or anomalies that could point to a security incident. Packet Capture: Packet capture tools collect the traffic flowing over a network. This is often only possible in the cloud in an IaaS environment or using a vendor-provided network mirroring capability.
Access controls are important but not one of the three core audit mechanisms in cloud environments.
Frederick works for a medium-sized company as the Chief Information Security Officer (CISO). They use a public Cloud Service Provider (CSP) for their Information Technology (IT) environment. They have built a large Infrastructure as a Service (IaaS) environment as a virtual Data Center (vDC). They did their due diligence and carefully constructed a contract with the CSP. They were able to determine who is responsible for Security Governance, Risk, and Compliance.
Who would that be?
A. Both the customer and the provider
B. Cloud service provider
C. Cloud service broker
D. Cloud service customer
D. Cloud service customer
Explanation:
In all cloud service types (IaaS, PaaS, SaaS), the roles and responsibility of Security Governance, Risk, and Compliance fall solely to the cloud service customer and not the CSP. Check the references listed at the bottom. (If you do not have either book, see the (ISC)2 website regarding responsibility and accountability in the cloud.) The CSP does have to do their own Governance, Risk, and Compliance work, but that is not the question. The exam will look from a customer’s perspective when looking at their public cloud provider unless stated differently in the question (some questions will be from the provider’s perspective).
A Cloud Service Broker (CSB) is a third-party intermediary that facilitates the interaction between CSPs and cloud service consumers (organizations or individuals). The role of a cloud service broker is to add value to the cloud computing ecosystem by providing various services that help organizations effectively use and manage cloud services. They are not responsible for the Governance of the cloud service customer. They may assist at some point, but they are not accountable nor responsible.
Which of the following types of data is regulated under PCI DSS?
A. Protected Health Information
B. Contractual Private Data
C. Personally Identifiable Information
D. Payment Data
D. Payment Data
Explanation:
Private data can be classified into a few different categories, including:
Personally Identifiable Information (PII): PII is data that can be used to uniquely identify an individual. Many laws, such as the GDPR and CCPA/CPRA, provide protection for PII. Protected Health Information (PHI): PHI includes sensitive medical data collected regarding patients by healthcare providers. In the United States, HIPAA regulates the collection, use, and protection of PHI. Payment Data: Payment data includes sensitive information used to make payments, including credit and debit card numbers, bank account numbers, etc. This information is protected under the Payment Card Industry Data Security Standard (PCI DSS). Contractual Private Data: Contractual private data is sensitive data that is protected under a contract rather than a law or regulation. For example, intellectual property (IP) covered under a non-disclosure agreement (NDA) is contractual private data.
Which of the following is a type of durable storage that may include immutable storage and integrity protections?
A. Raw
B. Ephemeral
C. Object
D. Long-term
D. Long-term
Explanation:
Cloud-based infrastructure can use a few different forms of data storage, including:
Ephemeral: Ephemeral storage mimics RAM on a computer. It is intended for short-term storage that will be deleted when an instance is deleted. Long-Term: Long-term storage solutions like Amazon Glacier, Azure Archive Storage, and Google Coldline and Archive are designed for long-term data storage. Often, these provide durable, resilient storage with integrity protections. Raw: Raw storage provides direct access to the underlying storage of the server rather than a storage service. Volume: Volume storage behaves like a physical hard drive connected to the cloud customer’s virtual machine. It can either be file storage, which formats the space like a traditional file system, or block storage, which simply provides space for the user to store anything. Object: Object storage stores data as objects with unique identifiers associated with metadata, which can be used for data labeling
Which of the following is NOT checked when using the DREAD threat model?
A. Measure of how easy it is to reproduce an exploit
B. Measure of damage to the system should a successful exploit occur
C. Measure of the restoration time needed after a successful exploit
D. Measure of the skill level or resources needed to successfully exploit a threat
C. Measure of the restoration time needed after a successful exploit
Explanation:
DREAD is about measuring how severe an exploit could be. This does not involve how much time will be needed to restore afterward. It does need to be managed, but that is the Disaster Recovery (DR) topic.
The DREAD threat model focuses on the quantification of risk and threat evaluation. DREAD is based on the equation below, which calculates the value based on risk quantification in specific categories, with a value ranging from 0 to 10:
Risk DREAD = (Damage + Reproducibility + Exploitability + Affected users + Discoverability) / 5
A cloud architect has been working with operations to determine a few of the features that they should build into their Infrastructure as a Service (IaaS) deployment. One of their concerns is having a user directed to a malicious website due to a Domain Name System poisoning.
Which of the primary information security principles does DNS Security (DNSSec) primarily ensure?
A. Privacy
B. Confidentiality
C. Integrity
D. Availability
C. Integrity
Explanation:
DNSSec addresses DNS integrity. When a DNS server passes information on to another DNS server regarding the Internet Protocol (IP) addresses that a domain name can be found at, it is necessary these days to confirm that information is coming from a trusted source. If the hacker can pretend to be a DNS server for just a moment and pass along incorrect information without authentication, the DNS server will simply pass this information on to other DNS servers. DNSSec includes a digital signature on updated DNS information so that a DNS server can first authenticate the source before adding or changing the information it already has.
Digital signatures provide information that confirms the identity of the sender. This is considered part of integrity.
Confidentiality is to keep information out of view, but DNS information needs to be made available to the users so there is no confidentiality built into the protocol. Privacy falls under the topic of confidentiality. Most of the time, when the word privacy is used, it refers to the need to keep personal information protected.
Availability of the DNS servers is necessary for functionality, but that does not address the problem in the question.
Which of the following threat models was developed by Microsoft but has since fallen out of widespread use?
A. PASTA
B. STRIDE
C. ATASM
D. DREAD
D. DREAD
Explanation:
Several different threat models can be used in the cloud. Common examples include:
STRIDE: STRIDE was developed by Microsoft and identifies threats based on their effects/attributes. Its acronym stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. DREAD: DREAD was also created by Microsoft but is no longer in common use. It classifies risk based on Damage, Reproducibility, Exploitability, Affected Users, and Discoverability. ATASM: ATASM stands for Architecture, Threats, Attack Surfaces, and Mitigations and was developed by Brook Schoenfield. It focuses on understanding an organization’s attack surfaces and potential threats and how these two would intersect. PASTA: PASTA is the Process for Attack Simulation and Threat Analysis. It is a seven-stage framework that tries to look at infrastructure and applications from the viewpoint of an attacker.
Which of the following types of SOC reports could include an extended assessment of the effectiveness of an organization’s security controls?
A. SOC 1
B. SOC 2 Type I
C. SOC 2 Type II
D. SOC 3
C. SOC 2 Type II
Explanation:
Service Organization Control (SOC) reports are generated by the American Institute of CPAs (AICPA). The three types of SOC reports are:
SOC 1: SOC 1 reports focus on financial controls and are used to assess an organization’s financial stability. SOC 2: SOC 2 reports assess an organization's controls in different areas, including Security, Availability, Processing Integrity, Confidentiality, or Privacy. Only the Security area is mandatory in a SOC 2 report. SOC 3: SOC 3 reports provide a high-level summary of the controls that are tested in a SOC 2 report but lack the same detail. SOC 3 reports are intended for general dissemination.
SOC 2 reports can also be classified as Type I or Type II. A Type I report is based on an analysis of an organization’s control designs but does not test the controls themselves. A Type II report is more comprehensive, as it tests the effectiveness and sustainability of the controls through a more extended audit.
A hospital has uncovered that they have a nurse that has been breaking a policy that they have. When the nurse has a few minutes of free time, they have a bad habit of browsing through patient records. As it turns out, the nurse has been using this information to blackmail some of these patients. What term is used to describe this nurse?
A. Malicious insider
B. Man-in-the-Middle (MitM)
C. Escalation of privilege
D. Advanced persistent threat
A. Malicious insider
Explanation:
A malicious insider is any user with legitimate network or system access who uses their access for purposes other than those authorized. Malicious insiders are regularly listed as one of the top sources of breaches and compromises. The best way to mitigate the risk of the malicious insider is to implement active monitoring and auditing.
An Advanced Persistent Threat (APT) is a serious threat that usually originates from a nation state that is attacking another. The advanced part refers to the level of sophistication in the coding of the malicious software and its deployment. Persistent refers to the time that the malware is in place and functioning. It would be over a long period of time. A commonly used example to describe APTs is Stuxnet.
A MitM would exist between the sender and receiver. The nurse is not between two points or two parties in a transmission. The nurse is browsing data.
Escalation of privilege is when the bad actor is able to use the login of a user and then issue a command such as SU to access super user or administrator level access. The nurse is using their normal level of access. They will need access to the patient records at some point, which is why they have access. The policy would state that they are not allowed to browse for the sake of gaining information for the purpose of blackmailing people.
Justine has been working on the contract between her company, the Cloud Service Customer (CSC), and the Cloud Service Provider (CSP) that they are purchasing a Software as a Service (SaaS) product from. In the shared responsibility model, who is responsible for protecting the application?
A. Only the CSP
B. Only the CSC
C. Cloud Service Partner
D. Both the CSC and the CSP
D. Both the CSC and the CSP
Explanation:
In a shared responsibility model, both the CSC and the CSP have a responsibility to protect the application itself. Exactly where the line of division occurs depends on the provider and the contract that Justine is working on.
The CSP is responsible for everything below the application, from the platform to the physical environment.
The CSC is responsible for their Governance, Risk management and Compliance (GRC). Independently, the CSP has their own GRC that they are responsible for, but that does not show in the share model.
Reference:
Multitenancy is BEST described as:
A. Multiple tenants on a single server. These tenants are different cloud customers of a single cloud provider.
B. The ability for two separate organizations to share an identity system while keeping autonomy
C. Multiple organizations that would be able to access the resources of a single cloud provider
D. Multiple tenants on a single server. This includes tenants within a single cloud customer or between multiple cloud customers
D. Multiple tenants on a single server. This includes tenants within a single cloud customer or between multiple cloud customers
Explanation:
Correct answer: Multiple tenants on a single server. This includes tenants within a single cloud customer or between multiple cloud customers
Multitenancy refers to when multiple cloud customers share the same server within a cloud provider. The hypervisor is responsible for isolating cloud tenants from each other. The tenants can be from different cloud customers or from a single customer. ISO/IEC 17788 states that cloud tenants can come from a single company, but they could be different departments or different projects that need to be isolated from each other. For example, the sales department and the research and development department. They should not have access to each other’s data or servers.
Multiple organizations that would be able to access the resources of a single cloud provider is the nature of the public cloud.
It is possible in federated identification for two separate organizations to share an identity system.
Multiple tenants on a single server that are different cloud customers would be an example of multitenancy. However, they could come from the same company as well, so the correct answer is more accurate.
A corporation has been expanding their current Business Continuity (BC) and Disaster Recovery (DR) capability. The DR team has recently been analyzing the plans that they have in place for a critical database. They have been looking at the time that system could be offline and the consequences that would cause for the business. They have been able to determine the expected percentage of loss in a single event.
What is the CORRECT equation to use when determining annual loss expectancy (ALE)?
A. Take the Annual Rate of Occurrence (ARO) and divide it by the Single Loss Expectancy (SLE)
B. Take the Single Loss Expectancy (SLE) and add the Annual Rate of Occurrence (ARO)
C. Take the Single Loss Expectancy (SLE) and multiply it by the Annual Rate of Occurrence (ARO)
D. Take the Single Loss Expectancy (SLE) and subtract the Annual Rate of Occurrence (ARO)
C. Take the Single Loss Expectancy (SLE) and multiply it by the Annual Rate of Occurrence (ARO)
Explanation:
Correct answer: Take the Single Loss Expectancy (SLE) and multiply it by the Annual Rate of Occurrence (ARO)
To find the annual loss expectancy, you must first know the single loss expectancy and the annual rate of occurrence. To determine the annual loss of expectancy, multiply the single loss expectancy value by the annual rate of occurrence.
At which stage of the incident should the IRT ensure that documentation is complete and perform a root cause analysis to prevent future incidents from occurring?
A. Detect
B. Post-Incident
C. Respond
D. Recover
B. Post-Incident
Explanation:
An incident response plan (IRP) should lay out the steps that the incident response team (IRT) should carry out during each step of the incident management process. This process is commonly broken up into several steps, including:
Prepare: During the preparation stage, the organization develops and tests the IRP and forms the IRT. Detect: Often, detection is performed by the security operations center (SOC), which performs ongoing security monitoring and alerts the IRT if an issue is discovered. Issues may also be raised by users, security researchers, or other third parties. Respond: At this point, the IRT investigates the incident and develops a remediation strategy. This phase will also involve containing the incident and notifying relevant stakeholders. Recover: During the recovery phase, the IRT takes steps to restore the organization to a secure state. This could include changing compromised passwords and similar steps. Additionally, the IRT works to address and remediate the underlying cause of the incident to ensure that it is completely fixed. Post-Incident: After the incident, the IRT should document everything and perform a retrospective to identify potential room for improvement and try to identify and remediate the root cause to stop future incidents from happening.
Which organization produced the “Data Center Design and Implementation Best Practices” standard, which includes specifications for items such as hot/cold aisle setups?
A. National Institute of Standards & Technology (NIST)
B. International Data Center Authority (IDCA)
C. National Fire Protection Association (NFPA)
D. Building Industry Consulting Service International (BICSI)
D. Building Industry Consulting Service International (BICSI)
Explanation:
Building Industry Consulting Service International (BICSI) has been around since 1977. Of all the standards that BICSI has developed, the ANSI/BICSI 002-2014 is the most prominent. This standard is “Data Center Design and Implementation Best Practices.” In this standard, items such as hot/cold aisle setups, power specifications, and energy efficiency are all covered.
The IDCA has issued the Infinity Paradigm® standards framework. The application, as the ultimate end-user of data, requires an ecosystem to perform and deliver its promise. IDCA Application Ecosystem® standards are inclusive of data center standards, cloud standards, application standards, and information technology standards.
The NFPA is a U.S. group that is a center for fire safety knowledge. Virtually every building, process, service, design, and installation is affected by NFPA’s 300+ codes and standards. Their codes and standards are all available for free online and reflect changing industry needs and evolving technologies, supported by research and development and practical experience.
The National Institute of Standards and Technology (NIST) was founded in 1901 and is now part of the U.S. Department of Commerce. NIST is one of the nation’s oldest physical science laboratories. Congress established the agency to remove a major challenge to U.S. industrial competitiveness at the time — a second-rate measurement infrastructure that lagged behind the capabilities of the United Kingdom, Germany, and other economic rivals.
From the smart electric power grid and electronic health records to atomic clocks, advanced nanomaterials, and computer chips, innumerable products and services rely in some way on technology, measurement, and standards provided by the National Institute of Standards and Technology.
Reference:
During which phase of the SDLC are the necessary security controls for risk mitigation/minimization integrated with the programming designs?
A. Design
B. Requirement gathering and feasibility
C. Maintenance
D. Development
A. Design
Explanation:
Once the risks are analyzed, prioritized, and mitigation strategies are defined, they are integrated into the system design. The design phase involves creating architectural designs and detailed system designs and specifying technical requirements. During this phase, the design should incorporate the necessary security controls, error handling mechanisms, fault tolerance measures, and other design elements to mitigate identified risks.
In the early stages of the SDLC, business analysts, stakeholders, and development teams collaborate to gather requirements. These requirements include functional and non-functional aspects of the software system. While capturing the functional requirements, the identification and analysis of potential risks should also take place.
The development phase is a crucial stage where the actual software solution is built based on the requirements and design specifications defined in the earlier phases. During this phase, the development team converts the design into a functional and operational software product.
The maintenance phase is the stage where the software system is actively used, monitored, and updated to ensure its smooth operation and address any issues or enhancements that may arise. This phase typically follows the completion of the development and deployment phases.
Nacala is a cloud architect that is designing an Infrastructure as a Service (IaaS) environment for the corporation. The servers that she is designing around have a serious need for uptime. They cannot afford to have a particular server offline at any time. What configuration would be useful for her to use?
A. Server cluster
B. Content Distribution Network (CDN)
C. Redundant servers
D. Software Define Network (SDN)
A. Server cluster
Explanation:
A server cluster is a group of hosts that are combined together to achieve the same purpose, such as redundancy, configuration synchronization, failover, or to minimize downtime. Clusters can be groups of hosts that are physically or logically grouped together. Clusters are handled as one unit, meaning that resources are pooled and shared between the hosts within the group. Server clusters are usually considered active-active.
Redundant servers are usually considered active-passive. The second server is not actively processing calls, data, or requests until the first fails.
SDN is a technology to improve how switches operate. It adds a controller that makes forwarding path decisions that can be configured with policy information to tailor it further to business’ needs.
CDN networks utilize edge servers to cache used content closer to the users. Netflix is an example company that uses CDN to push content out from the storage locations to edge servers for easy streaming to the users.
Karen is working to ensure that the cloud solution chosen for her banking company as they move to a vendor supplied Software as a Service (SaaS) solution will protect them properly. They have several regulations that they must be in compliance with. Of the following, what is the highest security concern that they likely have?
A. Ensuring the integrity of their data
B. Ensuring that cost is managed effectively
C. Preventing vendor lock-in
D. Ensuring 99.9999% uptime
A. Ensuring the integrity of their data
Explanation:
Security involves confidentiality, integrity, and availability according to most definitions. For banks, the greatest concern is integrity. They must ensure that the databases are accurate. That does not mean that they are not worried about confidentiality or availability. Regulations, such as Basel III, demand accuracy of financial data. SOX is another example that is similar in nature, even though it is not for banking. As further examples, service providers are more concerned about availability, and the government is more worried about confidentiality.
Cost is always a concern for a business, but it is not a security concern.
With reference to regulations, an answer that is not likely to be the highest concern is vendor lock-in. It is a concern, but not the greatest given the facts of the question.
Uptime is a concern for all businesses, but given the banking scenario, integrity is a greater concern. Accessing a bank account but not having the right values in the account is the opposite of normal concerns. Bank regulations such as Basel III demand integrity be protected. If you are unfamiliar with that one, consider SOX and its concerns as a similar type of regulation
