Pocket Prep 13 Flashcards
Eila works for a large government contractor. As their lead information security professional working on the business case for their potential move to the cloud, she knows that it is critical to define and defend her reasons for moving to the cloud. Of the following statements, which is the MOST accurate?
A. Cloud platforms offer increased scalability and performance
B. There are no security risks associated with moving to a cloud environment
C. Cloud platforms are always less expensive than on-prem solutions
D. Traditional data centers and cloud environments have the exact same risks
A. Cloud platforms offer increased scalability and performance
Explanation:
Cloud environments are attractive to organizations because they offer increased scalability and performance.
While it’s possible that moving to the cloud can be less expensive than traditional data centers, that is not always the case. Sometimes cloud platforms can come with hidden costs that weren’t initially expected. Cloud platforms come with their own set of security risks and, while some are the same as the risks you’d see in a traditional data center, some are different as well.
Multivendor network connectivity is MOST related to which of the following risk considerations of cloud computing?
A. General Technology Risks
B. Data Center Location
C. Downtime
D. Compliance
C. Downtime
Explanation:
Cloud computing risks can depend on the cloud service model used. Some risks common to all cloud services include:
CSP Data Center Location: The location of a CSP’s data center may impact its exposure to natural disasters or the risk of regulatory issues. Cloud customers should verify that a CSP’s locations are resilient against applicable natural disasters and consider potential regulatory issues. Downtime: If a CSP’s network provider is down, then its services are unavailable to its customers. CSPs should use multivendor network connectivity to improve network resiliency. Compliance: Certain types of data are protected by law and may have mandatory security controls or jurisdictional limitations. These restrictions may affect the choice of a cloud service model or CSP. General Technology Risks: CSPs are a big target for attackers, who might exploit vulnerabilities or design flaws to attack CSPs and their customers.
Which of the following terms is LEAST related to the others?
A. HA
B. Resiliency
C. IaC
D. Clustering
C. IaC
Explanation:
Clustering is commonly used as part of high availability (HA) schemes for resiliency and redundancy. IaC is for configuration management.
Quinn has been hired as the new information security manager at a regional hospital. He has been reviewing the hospital’s information security policies. In reviewing the data handling policies, he has discovered that it is necessary to redefine what data would be considered sensitive and require protection under the Health Insurance Portability and Accountability Act (HIPAA).
Of the following, which is considered sensitive data that must be protected as Protected Health Information (PHI)?
A. Current street address
B. Political views
C. Passport number
D. Demographic information
D. Demographic information
Explanation:
Protected Health Information (PHI) covers items such as demographic information, medical history, physical and mental health information, lab results, physician notes, and other health related items.
Passport numbers, political views, and current street addresses would be considered Personally Identifiable Information (PII) rather than PHI.
You see a value like XXXX XXXX XXXX 1234 in the credit card column of a database table. Which of the following data security techniques was used?
A. Anonymization
B. Encryption
C. Hashing
D. Masking
D. Masking
Explanation:
Cloud customers can use various strategies to protect sensitive data against unauthorized access, including:
Encryption: Encryption performs a reversible transformation on data that renders it unreadable without knowledge of the decryption key. If data is encrypted with a secure algorithm, the primary security concerns are generating random encryption keys and protecting them against unauthorized access. FIPS 140-3 is a US government standard used to evaluate cryptographic modules. Hashing: Hashing is a one-way function used to ensure the integrity of data. Hashing the same input will always produce the same output, but it is infeasible to derive the input to the hash function from the corresponding output. Applications of hash functions include file integrity monitoring and digital signatures. FIPS 140-4 is a US government standard for hash functions. Masking: Masking involves replacing sensitive data with non-sensitive characters. A common example of this is using asterisks to mask a password on a computer or all but the last four digits of a credit card number. Anonymization: Anonymization and de-identification involve destroying or replacing all parts of a record that can be used to uniquely identify an individual. While many regulations require anonymization for data use outside of certain contexts, it is very difficult to fully anonymize data. Tokenization: Tokenization replaces sensitive data with a non-sensitive token on untrusted systems that don’t require access to the original data. A table mapping tokens to the data is stored in a secure location to enable the original data to be looked up when needed.
Any information relating to past, present, or future medical status that can be tied to a specific individual is known as which of the following?
A. Gramm Leach Bliley Act (GLBA)
B. Payment Card Industry (PCI) information
C. Protected Health Information (PHI)
D. Health Information Portability Accountability Act
C. Protected Health Information (PHI)
Explanation:
Protected Health Information (PHI) is a subset of Personally Identifiable Information (PII). PHI applies to any entity defined under the U.S. Health Information Portability and Accountability Act (HIPAA) laws. Any information that can be tied to a unique individual as it relates to their past, current, or future health status is considered PHI.
The payment card industry defines the Data Security Standard (DSS) that we fully know as PCI-DSS. It demands that payment card information be protected.
GLBA is a U.S. act that ensures that personal data belonging to the customers of financial institutions must be protected. It is tied to Sarbanes Oxley (SOX).
Which of the following regulations deals with law enforcement’s access to data that may be located in data centers in other jurisdictions?
A. GLBA
B. SCA
C. US CLOUD Act
D. SOX
C. US CLOUD Act
Explanation:
A company may be subject to various regulations that mandate certain controls be in place to protect customers’ sensitive data or ensure regulatory transparency. Some examples of regulations that can affect cloud infrastructure include:
General Data Protection Regulation (GDPR): GDPR is a regulation protecting the personal data of EU citizens. It defines required security controls for their data, export controls, and rights for data subjects. US CLOUD Act: The US CLOUD Act creates a framework for handling cross-border data requests from cloud providers. The US law enforcement and their counterparts in countries with similar laws can request data hosted in a data center in a different country. Privacy Shield: Privacy Shield is a program designed to bring the US into partial compliance with GDPR and allow US companies to transfer EU citizen data outside of the US. The main reason that the US is not GDPR compliant is that federal agencies have unrestricted access to non-citizens’ data. Gramm-Leach-Bliley Act (GLBA): GLBA requires financial services organizations to disclose to customers how they use those customers’ personal data. Stored Communications Act of 1986 (SCA): SCA provides privacy protection for the electronic communications (email, etc.) of US citizens. Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act: HIPAA and HITECH are US regulations that protect the protected health information (PHI) that patients give to medical providers. Payment Card Industry Data Security Standard (PCI DSS): PCI DSS is a standard defined by major payment card brands to secure payment data and protect against fraud. Sarbanes Oxley (SOX): SOX is a US regulation that applies to publicly-traded companies and requires annual disclosures to protect investors. North American Electric Reliability Corporation/Critical Infrastructure Protection (NERC/CIP): NERC/CIP are regulations designed to protect the power grid in the US and Canada by ensuring that power providers have certain controls in place.
Structured and unstructured storage pertain to which of the three cloud service models?
A. DataBase as a Service (DBaaS)
B. Infrastructure as a Service (IaaS)
C. Platform as a Service (PaaS)
D. Software as a Service (SaaS)
C. Platform as a Service (PaaS)
Explanation:
Each cloud service model uses a different method of storage as shown below:
Platform as a Service (PaaS) uses the terms of structured and unstructured to refer to different storage types. Infrastructure as a Service (IaaS) uses the terms of volume and object to refer to different storage types. Software as a Service (SaaS) uses content and file storage and information storage and management to refer to different storage types.
The use of these terms begins with the Cloud Security Alliance, and it would be a good idea to read the CSA guidance document. As of the time this question was written in 2022, the CSA put out version 4. Version 5 is expected soon.
DBaaS is not one of the three cloud service models.
Which of the following concepts in IAM is MOST relevant if an organization has a close partner that they share access to data, systems, and software with?
A. Multi-Factor Authentication
B. Single Sign-On
C. Federated Identity
D. Identity Providers
C. Federated Identity
Explanation:
Identity and Access Management (IAM) is critical to application security. Some important concepts in IAM include:
Federated Identity: Federated identity allows users to use the same identity across multiple organizations. The organizations set up their IAM systems to trust user credentials developed by the other organization. Single Sign-On (SSO): SSO allows users to use a single login credential for multiple applications and systems. The user authenticates to the SSO provider, and the SSO provider authenticates the user to the apps using it. Identity Providers (IdPs): IdPs manage a user’s identities for an organization. For example, Google, Facebook, and other organizations offer identity management and SSO services on the Web. Multi-Factor Authentication (MFA): MFA requires a user to provide multiple authentication factors to log into a system. For example, a user may need to provide a password and a one-time password (OTP) sent to a smartphone or generated by an authenticator app. Cloud Access Security Broker (CASB): A CASB sits between cloud applications and users and manages access and security enforcement for these applications. All requests go through the CASB, which can perform monitoring and logging and can block requests that violate corporate security policies. Secrets Management: Secrets include passwords, API keys, SSH keys, digital certificates, and anything that is used to authenticate identity and grant access to a system. Secrets management includes ensuring that secrets are randomly generated and stored securely.
HIPAA protects which of the following types of private data?
A. Payment Data
B. Protected Health Information
C. Personally Identifiable Information
D. Contractual Private Data
B. Protected Health Information
Explanation:
Private data can be classified into a few different categories, including:
Personally Identifiable Information (PII): PII is data that can be used to uniquely identify an individual. Many laws, such as the GDPR and CCPA/CPRA, provide protection for PII. Protected Health Information (PHI): PHI includes sensitive medical data collected regarding patients by healthcare providers. In the United States, HIPAA regulates the collection, use, and protection of PHI. Payment Data: Payment data includes sensitive information used to make payments, including credit and debit card numbers, bank account numbers, etc. This information is protected under the Payment Card Industry Data Security Standard (PCI DSS). Contractual Private Data: Contractual private data is sensitive data that is protected under a contract rather than a law or regulation. For example, intellectual property (IP) covered under a non-disclosure agreement (NDA) is contractual private data.
Rogelio is working with the deployment team to deploy 50 new servers as virtual machines (VMs). The servers that he will be deploying will be a combination of different Operating Systems (OS) and Databases (DB). When deploying these images, it is critical to make sure…
A. That the golden images are always used for each deployment
B. That the VMs are updated and patched as soon as they are deployed
C. That the VM images are pulled from a trusted external source
D. That the golden images are used and then patched as soon as it is deployed
A. That the golden images are always used for each deployment
Explanation:
The golden image is the current and up-to-date image that is ready for deployment into production. If an image needs patching, it should be patched offline and then the new, better version is turned into the new current golden image. Patching servers in deployment is not the best idea. Patching the image offline is the advised path to take.
The golden image should be built within a business, not pulled from an external source, although there are exceptions. It is critical to know the source of the image (IT or security) and to make` sure that it is being maintained and patched on a regular basis.
Cloud environments call for high availability and resiliency. What can be done to ensure that there is no downtime?
A. Create backups of the most important servers in the environment
B. Ensure that there are no single points of failure
C. Only perform maintenance a couple times a year
D. Only perform updates and upgrades during non-business hours
B. Ensure that there are no single points of failure
Explanation:
Many cloud customers expect their systems to be available at all times. To maintain high availability, it’s critical to ensure that there are not any single points of failure. While it’s good practice to perform updates and upgrades outside a business’ normal operating hours, many organizations today have locations across the globe and operate 24 hours a day. This means that downtime at any time is going to be unacceptable. Cloud providers must find a way to perform updates and upgrades without causing any downtime.
Backing up systems is very important, but all systems must be backed up, not just a select few.
Maintenance can’t be scheduled only a couple times a year. It must be done whenever necessary, so it’s important to be able to do the maintenance without causing any downtime to the customer. Updates and upgrades during non-business hours are a little difficult if this is a global company. There are ways in the cloud to do upgrades in a way that does not cause the customer downtime. Orchestration is a good tool to begin that discussion.
A large consulting firm has a hybrid cloud environment. They have their own private cloud that they manage on their premises, and they use a large public cloud provider for some of their Platform and Software as a Service (PaaS & SaaS) needs. Their Security Operations Center (SOC) has been processing a few high priority Indications of Compromise (IoC) that appear to point to a live incident.
For their response, what should they do?
A. Reconnaissance, Delivery, Exploitation
B. Observe, Orient, Decide, Act
C. Weaponization, Delivery, Exploitation
D. Reconnaissance, Execution, Evasion, Collection
B. Observe, Orient, Decide, Act
Explanation:
The OODA loop is Observe, Orient, Decide and Act. This is a common incident response concept. The OODA loop is iterative, meaning that after completing one cycle, individuals continuously loop back to the beginning to gather new information, reassess the situation, and make further decisions and actions. The loop emphasizes the importance of speed, adaptability, and learning from feedback to maintain a competitive advantage and effectively respond to dynamic and uncertain situations.
The other three answer options come from steps in cyber kill chains. One of those kill chains is the Lockheed-Martin Cyber Kill Chain, and the other is the MITRE ATT&CK cyber kill chain. Kill chains are the path that bad actors take in their attacks. They are good to be familiar with. In their entirety, they are as follows:
The Lockheed Martin Kill Chain is a comprehensive cybersecurity strategy that helps organizations identify and prevent advanced cyber attacks at various stages of the attack process. The concept is based on the idea of a chain, where each stage represents a link in the chain that can be broken or disrupted, effectively stopping the cyber attack from being successful. The stages are: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework, according to MITRE's website, "is a comprehensive knowledge base that describes the various Tactics, Techniques, and Procedures (TTPs) used by adversaries during cyberattacks. It provides a structured and standardized way of understanding and categorizing the different stages of an attack. One of the frameworks within MITRE ATT&CK is the "ATT&CK Kill Chain." The kill chain steps are: Reconnaissance, Resource Development, Inital Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact."
Piotr is the cloud administrator that is setting up several servers for his corporation’s software development projects. He has been selecting the servers that they need based on the number of Central Processing Units (CPU) and the amount of Random Access Memory (RAM) that they expect these servers to need.
In a cloud environment, these options can be described as which of the following?
A. Storage parameters
B. Reservations
C/ Compute parameters
D. Network parameters
C/ Compute parameters
Explanation:
There are three fundamental elements that need to be built to build a cloud environment. They are compute, storage, and network. The compute parameters and processing power of a cloud environment are made up by the number of CPUs and the amount of RAM in the system or environment.
The storage parameters would include HDD or SSD and amount of space. It would also include how often the data would be accessed to ensure bandwidth and CPU are sufficient.
Network parameters would include the number of bits per second needed to move the data back and forth from the clients to the servers as well as the uptime that the connection needs.
Reservations are the amount of CPU, RAM, network, etc. that the corporations believe is the minimum that they will need for this environment.
A covert government agency has hired highly skilled software developers to create a tool to infiltrate and control the power grid of an enemy state. The software is designed to slowly cause damage to the programmable logic computers (PLC) that control the physical systems of the power station. The software is also designed to send false information to the monitoring devices to reduce the chance that the damage will be noticed until it is too late.
What type of threat is this?
A. Denial of Service (DoS) attack
B. Command injection attack
C. Malicious insider
D. Advanced Persistent Threat (APT)
Baird is responsible for vendor management at his office. He works for a large bank that relies on several vendors for different services at different times. This includes a public cloud provider for their Infrastructure and Platform as a Service (IaaS & PaaS) deployments. He has learned that vendor management can be both difficult and fulfilling.
What international standard can he use to possibly make things easier?
A. International Standards Organization/International Electrotechnical Committee (ISO/IEC) 17788
B. International Standards Organization/International Electrotechnical Committee (ISO/IEC) 27002
C. International Standards Organization/International Electrotechnical Committee (ISO/IEC) 27036
D. International Standards Organization/International Electrotechnical Committee (ISO/IEC) 27050
C. International Standards Organization/International Electrotechnical Committee (ISO/IEC) 27036
Explanation:
ISO/IEC 27036 is a set of international standards that provides guidance on information security for supplier relationships. It focuses on establishing and maintaining secure relationships between organizations and their suppliers, ensuring the protection of information assets throughout the supply chain. It may not make things easier, but then again it might.
ISO/IEC 27002, also known as ISO 27002:2013 or simply ISO 27K2, is an international standard that provides guidelines and best practices for information security management. It is a part of the ISO/IEC 27000 series, which collectively defines the framework for implementing an Information Security Management System (ISMS).
ISO/IEC 17788, also known as ISO 17788:2014, is an international standard that provides guidelines and definitions for cloud computing. It aims to establish a common understanding of cloud computing concepts, terminology, and models, facilitating communication and interoperability among different stakeholders involved in cloud-related activities.
ISO/IEC 27050 is an international standard that provides guidelines and best practices for electronic Discovery (e-Discovery).
Which of the following is NOT one of the main risks that needs to be assessed during the Business Impact Assessment (BIA) phase of developing a Disaster Recovery (DR) plan?
A. Migration of services to the alternate site
B. Legal and contractual issues from failures
C. Load capacity at the disaster recovery site
D. Budgetary constraints applied by management
D. Budgetary constraints applied by management
Explanation:
As with any new system or plan being implemented, it’s important to assess the risks of the changes. Budgetary constraints are not a main risk when developing a DR plan.
The main risks associated with developing a BCDR plan include the load capacity at the BCDR site, migration of services, and legal or contractual issues.
Jada is currently vetting the tokenization process of her organization’s cloud provider. They are using this tokenization process to protect payment card data that will be tied to their own internally created application. What is one risk that Jada should ensure is limited during the tokenization process?
A. Vendor lock-in
B. Service Level Agreement (SLA) modifications
C. Price changes
D. File type changes
A. Vendor lock-in
Explanation:
Vendor lock-in is a scenario in which a cloud customer is tied and dependent on one cloud provider without the ability to move to another provider. Cloud customers should ensure that anything done with the cloud provider will not cause this type of vendor lock-in. If there is anything in how the tokenization is performed that locks them into that format after they adapt their internal application, it could prevent them moving easily to a different vendor in the future if needed.
Price changes are annoying but not a security risk. It is a financial risk. The focus here is information security.
SLA modifications can be annoying or helpful. It depends on what is being modified, why, and how. So, it’s not as critical a risk as vendor lock-in.
File type changes could be a problem somewhere, but it is not a potential problem here. The lock-in potential problem is not the change of the data file type. The problem is how the data is converted to a token and then back again.
Traditional encryption methods may become obsolete as the cloud’s computing power and innovative technology improve optimization issues. What kind of advanced technology is potentially capable of defeating today’s encryption methods?
A. Quantum computing
B. Blockchain
C. Artificial intelligence
D. Machine learning
A. Quantum computing
Explanation:
Quantum computing is capable of solving problems that traditional computers are incapable of solving. When quantum computing becomes widely accessible to the general public, it will almost certainly be via the cloud due to the substantial processing resources necessary to do quantum calculations.
A side note: The encryption we have today will likely be broken, especially algorithms such as RSA and Diffie-Hellman. NIST began a competition in 2016 to get ahead of this and design encryption algorithms that can be used in the age of quantum computers safely. For information about this, refer to NIST’s website (csrc) and look for post quantum cryptoography and post quantum cryptography standardization.
Machine learning is the ability we now have for computers to be able to process a lot of data and provide us with information. It could be that they aid us in verifying a hypothesis, or they determine the idea that we need to address, or can address.
Machine learning is arguably a subset of Artificial Intelligence (AI). We keep making advances in technology that are getting us closer to true AI. We have robots that can navigate terrain all on their own, and we have chatGPT that can answer questions as if it is thinking on its own rather than just citing or quoting a source.
Blockchains give us the ability to track something, such as cryptocurrency, with an immutable or unchangeable record.
Dezso and his team are planning on moving to the cloud in a Platform as a Service (PaaS) implementation. As they are evaluating the cloud vendors that they have to choose from, they are concerned about vendor lock-in. What would cause vendor lock in?
A. Overly expensive hardware
B. Proprietary requirements
C. Poorly written Service Level Agreements (SLA)
D. Undocumented software
B. Proprietary requirements
Explanation:
Vendor lock-in occurs when an organization is unable to leave the vendor. The most common reason for vendor lock-in would be proprietary formats for how data is stored. It is possible that some consider contracts that prevent a customer from leaving to be vendor lock-in as well. The proprietary requirements make it very expensive, difficult, and burdensome to move to a new provider.
Undocumented software occurs all the time. The biggest problem with that is that it is hard to understand how it works.
Poorly written SLAs would not cause lock-in. They are a problem. The SLAs specify the level of service that the customer can and should expect to receive from the cloud provider. If they are not well defined, the customer may not get the service they need, such as enough bandwidth.
Overly expensive hardware does not cause lock-in. It might lock money into the wrong products, but that is not vendor lock-in. That’s poor financial management.
An information security manager is weighing their options for protecting the organization’s external-facing applications from SQL injection, cross-site scripting, and cross-site forgery attacks. What type of solution has the IT manager selected to protect the external-facing applications?
A. eXtensible Markup Language (XML) gateway
B. Web Application Firewall (WAF)
C. Intrusion Prevention System (IPS)
D. Application Programming Interface (API) gateway
B. Web Application Firewall (WAF)
Explanation:
A Web Application Firewall (WAF) specifically addresses attacks on applications and external services. A WAF can assist in defending against SQL injection, cross-site scripting (XSS), and Cross-Site Request Forgery (CSRF) attacks.
API gateways analyze and monitor SOAP and ReST traffic. This includes XML and JavaScript Object Notation (JSON).
XML gateways focus on XML traffic.
IPS traffic watches for intrusions. It would not see XSS or CSRF attacks within the web traffic.
A cloud information security manager is building the policies and associated documents for handling cloud assets. She is currently detailing how assets will be understood or listed so that access can be controlled, alerts can be created, and billing can be tracked. What tool allows for this?
A. Identifier
B. Key
C. Tags
D. Value
C. Tags
Explanation:
Tags are pervasive in cloud deployments. It is crucial that a plan is built for the corporation on how to tag assets. If it is not done consistently, it is not helpful. A tag is made up of two pieces, a key or name and a value. Key here is not the cryptographic key for encryption and decryption, but it is a word in English that was chosen by some to use here. It is really a name.
You can think of the tag as a type of identifier, but the tool needed to manage assets is called a tag.
Cloud providers that are at tier 3 must have multiple and independent power feeds to ensure redundancy. What else is needed in case of a power failure on one of the power feeds?
A. Third power feed and a generator
B. Generator and second power feed
C. Second power feed and Uninterruptible Power Supply (UPS)
D. Generator and Uninterruptible Power Supply (UPS)
D. Generator and Uninterruptible Power Supply (UPS)
Explanation:
Cloud providers will need to have multiple independent power feeds in case a power feed goes down. In addition, they will also typically have a generator or battery backup (UPS) to serve in the meantime when a power feed goes out.
The answers that contain “second power feed” are not correct because that already exists in the question with the word “multiple.” It is not necessary to have a third power feed. It may not be a bad idea, but it is not required
Simulations and tabletop exercises are part of which stage of developing a BCP?
A. Auditing
B. Implementation
C. Testing
D. Creation
C. Testing
Explanation:
Managing a business continuity/disaster recovery plan (BCP/DRP) has three main stages:
Creation: The creation stage starts with a business impact assessment (BIA) that identifies critical systems and processes and defines what needs to be covered by the plan and how quickly certain actions must be taken. Based on this BIA, the organization can identify critical, important, and support processes and prioritize them effectively. For example, if critical applications can only be accessed via a single sign-on (SSO), then SSO should be restored before them. BCPs are typically created first and then used as a template for prioritizing operations within a DRP. Implementation: Implementation involves identifying the personnel and resources needed to put the BCP/DRP into place. For example, an organization may take advantage of cloud-based high availability features for critical processes or use redundant systems in an active/active or active/passive configuration (dependent on criticality). Often, decisions on the solution to use depend on a cost-benefit analysis. Testing: Testing should be performed regularly and should consider a wide range of potential scenarios, including cyberattacks, natural disasters, and outages. Testing can be performed in various ways, including tabletop exercises, simulations, or full tests.
Auditing is not one of the three stages of developing a BCP/DRP.
Which of the following relates to an organization’s efforts to operate its cloud infrastructure in a way that complies with applicable laws and regulations?
A. Security
B. Auditability
C. Governance
D. Privacy
C. Governance
Explanation:
When deploying cloud infrastructure, organizations must keep various security-related considerations in mind, including:
Security: Data and applications hosted in the cloud must be secured just like in on-prem environments. Three key considerations are the CIA triad of confidentiality, integrity, and availability. Privacy: Data hosted in the cloud should be properly protected to ensure that unauthorized users can’t access the data of customers, employees, and other third parties. Governance: An organization’s cloud infrastructure is subject to various laws, regulations, corporate policies, and other requirements. Governance manages cloud operations in a way that ensures compliance with these various constraints. Auditability: Cloud computing outsources the management of a portion of an organization’s IT infrastructure to a third party. A key contractual clause is ensuring that the cloud customer can audit (directly or indirectly) the cloud provider to ensure compliance with contractual, legal, and regulatory obligations. Regulatory Oversight: An organization’s responsibility for complying with various regulations (PCI DSS, GDPR, etc.) also extends to its use of third-party services. Cloud customers need to be able to ensure that cloud providers are compliant with applicable laws and regulations.
Which of the following organizations publishes security standards applicable to any systems used by the federal government and its contractors?
A. Service Organization Controls (SOC)
B. National Institute of Standards and Technology (NIST)
C. International Standards Organization (ISO)
D. Information Systems Audit and Control Association (ISACA)
B. National Institute of Standards and Technology (NIST)
Explanation:
The National Institute of Standards and Technology (NIST) is a part of the United States government, which is responsible for publishing security standards applicable to any systems used by the federal government and its contractors although they are available to anyone to use.
SOC is the type of audit report that is the result of SSAE 16/18 or ISAE 3402 audits. ISACA is the company behind the CISM and CISA certifications. They are fundamentally a company of IT auditors although they have expanded greatly over the years. ISO is the international body that creates standards for the world to use.
Which of the Trust Services principles must be included in a Service Organization Controls (SOC) 2 audit?
A. Privacy
B. Security
C. Availability
D. Confidentiality
B. Security
Explanation:
The Trust Service Criteria from the American Institute of Certified Public Accountants (AICPA) for the Security Organization Controls (SOC) 2 audit report is made up of five key principles: Availability, Confidentiality, Process integrity, Privacy, and Security. Security is always required as part of a SOC 2 audit. The other four principles are optional.
Which of the following is a strategy for maintaining operations during a business-disrupting event?
A. Disaster recovery plan
B. Operational continuity plan
C. Business continuity plan
D. Ongoing operations plan
C. Business continuity plan
Explanation:
A business continuity plan is a strategy for maintaining operations during a business-disrupting event. A disaster recovery plan is a strategy for restoring normal operations after such an event.
Ongoing operations and operational continuity plans are fabricated terms.
Rashid has been working with his customer to understand the Indication of Compromise (IoC) that they have seen within their Security Information and Event Manager (SIEM). The logs show that a bad actor infiltrated their organization through a phishing email. Once the bad actor was in, they traversed the network till they gained access to a firewall. Once they were in the firewall, the bad actor assumed the role the firewall had to access the database. The database was then copied by the bad actor.
This is an example of which type of threat?
A. Data breach
B. Account hijacking
C. Command injection
D. Advanced persistent threat (APT)
A. Data breach
Explanation:
A data breach occurs when data is leaked or stolen, either intentionally or unintentionally. This is not an Advanced Persistent Threat (APT). An APT requires an advanced level of skill from bad actors who usually will be attacking for one nation state against another.
Account hijacking is a step along the way when the bad actor assumed the role that the firewall had to access the database. The whole attack was for the purpose of stealing the data, which is a data breach.
Command injection occurs when a bad actor types a command into a field that is interpreted by the server. This is similar to an SQL injection.
A cloud data center is being built by a new Cloud Service Provider (CSP). The CSP wants to build a data center that has a level of resilience that will classify it as a Tier III. At which tier is it expected to add generators to backup the power supply?
A. Tier I
B. Tier III
C. Tier IV
D. Tier II
A. Tier I
Explanation:
Generators are added to the requirements from the lowest level, Tier I.
Tier II and above also require those generators to be there. Tier I and II also require Uninterruptible Power Supply (UPS) units.
Tier III requires a redundant distribution path for the data.
Tier IV requires several independent and physically isolated power supplies.
An organization is looking to balance concerns about data security with the desire to leverage the scalability and cost savings of the cloud. Which of the following cloud models is the BEST choice for this?
A. Private Cloud
B. Hybrid Cloud
C. Public Cloud
D. Community Cloud
B. Hybrid Cloud
Explanation:
Cloud services are available under a few different deployment models, including:
Private Cloud: In private clouds, the cloud customer builds their own cloud in-house or has a provider do so for them. Private clouds have dedicated servers, making them more secure but also more expensive. Public Cloud: Public clouds are multi-tenant environments where multiple cloud customers share the same infrastructure managed by a third-party provider. Hybrid Cloud: Hybrid cloud deployments mix both public and private cloud infrastructure. This allows data and applications to be hosted on the cloud that makes the most sense for them. For example, sensitive data can be stored on the private cloud, while less-sensitive applications can take advantage of the benefits of the public cloud. Multi-Cloud: Multi-cloud environments use cloud services from multiple different cloud providers. This enables customers to take advantage of price differences or optimizations offered by different providers. Community Cloud: A community cloud is essentially a private cloud used by a group of related organizations rather than a single organization. It could be operated by that group or a third party, such as FedRAMP-compliant cloud environments operated by cloud service providers.
A cloud provider needs to ensure that the data of each tenant in their multitenant environment is only visible to authorized parties and not to the other tenants in the environment. Which of the following can the cloud provider implement to ensure this?
A. Network security groups (NSG)
B. Geofencing
C. Physical network segregation
D. Hypervisor tenant isolation
D. Hypervisor tenant isolation
Explanation:
In a cloud environment, physical network segregation is not possible unless it is a private cloud built that way. However, it’s important for cloud providers to ensure separation and isolation between tenants in a multitenant cloud. To achieve this, the hypervisor has the job of tenant isolation within machines.
An NSG is a virtual Local Area Network (LAN) behind a firewall, which is beneficial to use. It is used to control traffic within a tenant or from the internet to that tenant, not between tenants.
Geofencing is used to control where a user can connect from. It does not isolate tenants from each other. Rather, it restricts access from countries that you do not expect access to come from.
Leodis has been working on the setup of a new application. They have been trying to decide how to determine who the users are and what permissions they should be given, if any. There are several protocols available to make this happen in a cloud environment. Which protocol allows the communication of the users’ permissions?
A. OAuth (Open Authorization)
B. Web Services Federation (WS-Federation)
C. Kerberos
D. Open Identification (OpenID)
A. OAuth (Open Authorization)
Explanation:
Open Authorization (OAuth) is an open standard protocol that allows secure authorization and delegation of user permissions between different applications or services. It provides a framework for users to grant limited access to their resources on one website or application to another website or application without sharing their login credentials.
OpenID is an open standard and decentralized authentication protocol that allows users to authenticate themselves on multiple websites or applications using a single set of credentials. It provides a convenient and secure way for users to log in to various websites without the need to create and remember separate usernames and passwords for each site.
Kerberos is a network authentication protocol that provides secure authentication for client-server communication over an insecure network. It was developed by MIT and has become an industry-standard protocol for authentication in many systems and applications. This is used, or has been used, for LAN environments, not the cloud.
Web Services Federation (WS-Federation) is an industry-standard protocol that provides a framework for identity federation and Single Sign-On (SSO) across different web services and security domains. It is based on XML and relies on other web service standards, such as Simple Object Access Protocol (SOAP), to enable secure communication and identity exchange between participating entities.
Defining clear, measurable, and usable metrics is a core component of which of the following operational controls and standards?
A. Continuity Management
B. Continual Service Improvement Management
C. Information Security Management
D. Change Management
B. Continual Service Improvement Management
Explanation:
Standards such as the Information Technology Infrastructure Library (ITIL) and International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1 define operational controls and standards, including:
Change Management: Change management defines a process for changes to software, processes, etc., reducing the risk that systems will break due to poorly managed changes. A formal change request should be submitted and approved or denied by a change control board after a cost-benefit analysis. If approved, the change will be implemented and tested. The team should also have a plan for how to roll back the change if something goes wrong. Continuity Management: Continuity management involves managing events that disrupt availability. After a business impact assessment (BIA) is performed, the organization should develop and document processes for prioritizing the recovery of affected systems and maintaining operations throughout the incident. Information Security Management: Information security management systems (ISMSs) define a consistent, company-wide method for managing cybersecurity risks and ensuring the confidentiality, integrity, and availability of corporate data and systems. Relevant frameworks include the ISO 27000 series, the NIST Risk Management Framework (RMF), and AICPA SOC 2. Continual Service Improvement Management: Continual service improvement management involves monitoring and measuring an organization’s security and IT services. This practice should be focused on continuous improvement, and an important aspect is ensuring that metrics accurately reflect the current state and potential process. Incident Management: Incident management refers to addressing unexpected events that have a harmful impact on the organization. Most incidents are managed by a corporate security team, which should have a defined and documented process in place for identifying and prioritizing incidents, notifying stakeholders, and remediating the incident. Problem Management: Problems are the root causes of incidents, and problem management involves identifying and addressing these issues to prevent or reduce the impact of future incidents. The organization should track known incidents and have steps documented to fix them or workarounds to provide a temporary fix. Release Management: Agile methodologies speed up the development cycle and leverage automated CI/CD pipelines to enable frequent releases. Release management processes ensure that software has passed required tests and manages the logistics of the release (scheduling, post-release testing, etc.). Deployment Management: Deployment management involves managing the process from code being committed to a repository to it being deployed to users. In automated CI/CD pipelines, the focus is on automating testing, integration, and deployment processes. Otherwise, an organization may have processes in place to perform periodic, manual deployments. Configuration Management: Configuration errors can render software insecure and place the organization at risk. Configuration management processes formalize the process of defining and updating the approved configuration to ensure that systems are configured to a secure state. Infrastructure as Code (IaC) provides a way to automate and standardize configuration management by building and configuring systems based on provided definition files. Service Level Management: Service level management deals with IT’s ability to provide services and meet service level agreements (SLAs). For example, IT may have SLAs for availability, performance, number of concurrent users, customer support response times, etc. Availability Management: Availability management ensures that services will be up and usable. Redundancy and resiliency are crucial to availability. Additionally, cloud customers will be partially responsible for the availability of their services (depending on the service model). Capacity Management: Capacity management refers to ensuring that a service provider has the necessary resources available to meet demand. With resource pooling, a cloud provider will have fewer resources than all of its users will use but relies on them not using all of the resources at once. Often, capacity guarantees are mandated in SLAs.
If an application accepts XML directly or XML uploads, especially from untrusted sources, or inserts untrusted data into XML documents, which is then parsed by an XML processor, it is susceptible to which attack?
A. Security misconfiguration
B. Cross-site scripting
C. Injection
D. Server-side request forgery
A. Security misconfiguration
Explanation:
Security misconfiguration includes the older XML external entities. An application is susceptible if it accepts XML directly, among other conditions.
Cross-Site Scripting (XSS) involves invalidated user-controlled input. There are three types of XSS: reflected, stored, and DOM.
Server-Side Request Forgery (SSRF) occurs when a server accepts content in the user-supplied URL. This forces the server to send a crafted request to another site.
Injection includes SQL and command injection. It happens when user input is not validated. A user should not enter any SQL commands in the application.
Leelo works for a corporation that assists both cloud service providers (CSP) and cloud service customers (CSC). They assist in the negotiation of services as well as the management of those services. They also have some of their own software to help with this management.
What term is used to describe an individual or organization that serves as an intermediary between cloud customers and a cloud service provider?
A. Cloud service partner
B. Cloud service broker
C. Cloud service user
D. Cloud service auditor
B. Cloud service broker
Explanation:
A cloud service broker is an individual or organization which serves as the go-between or intermediary between cloud customers and cloud service providers. Brokers can negotiate and manage the services between the customer and the provider. They do have some of their own software to help with this management.
Cloud service auditors are the auditors who go into the cloud service provider’s datacenter as the third party to verify their controls.
Cloud service users are the customers of the cloud provider. This would include the end user as well as the corporations that they work for.
A cloud service partner is a company that helps either the customer or the partner. It is the more generic term that can include the brokers and the auditors.
JoAnn has been configuring a server that will handle all network forwarding decisions, which allows the network device to simply perform frame forwarding. This allows for dynamic changes to traffic flows based on customer needs and demands. What is the name of the network approach described here?
A. Virtual Private Cloud (VPC)
B. Dynamic Host Configuration Protocol (DHCP)
C. Dynamic Name System Security (DNSSec)
D. Software-defined networking (SDN)
D. Software-defined networking (SDN)
Explanation:
In software defined networking, decisions regarding where traffic is filtered and sent are separate from the actual forwarding of the traffic. This separation allows network administrators to quickly and dynamically adjust network flows based on the needs of customers. Software defined networking is often referred to as Software Defined - Wide Area Network (SD-WAN) when it is used as the backbone network.
DNSSec is an extension to DNS. DNS converts domain names, such as pocketprep.com to IP addresses. DNS is a hierarchically organized set of servers within the internet and corporate networks. DNSSec adds authentication to allow verification of the source of DNS information.
DHCP is used to dynamically allocate IP addresses to devices when they join a network.
VPC is a simulation of a private cloud within a public cloud environment.
Which of the following considerations MOST closely relates to ensuring that customers’ personal data is not accessed by unauthorized users?
A. Regulatory Oversight
B. Privacy
C. Security
D. Governance
B. Privacy
Explanation:
When deploying cloud infrastructure, organizations must keep various security-related considerations in mind, including:
Security: Data and applications hosted in the cloud must be secured just like in on-prem environments. Three key considerations are the CIA triad of confidentiality, integrity, and availability. Privacy: Data hosted in the cloud should be properly protected to ensure that unauthorized users can’t access the data of customers, employees, and other third parties. Governance: An organization’s cloud infrastructure is subject to various laws, regulations, corporate policies, and other requirements. Governance manages cloud operations in a way that ensures compliance with these various constraints. Auditability: Cloud computing outsources the management of a portion of an organization’s IT infrastructure to a third party. A key contractual clause is ensuring that the cloud customer can audit (directly or indirectly) the cloud provider to ensure compliance with contractual, legal, and regulatory obligations. Regulatory Oversight: An organization’s responsibility for complying with various regulations (PCI DSS, GDPR, etc.) also extends to its use of third-party services. Cloud customers need to be able to ensure that cloud providers are compliant with applicable laws and regulations.
Imani is working with their cloud data architect to design a Storage Area Network (SAN) that will provide the cloud storage needed by the users. They want users to be able to have access to mountable volumes within the Fibre Channel (FC) SAN.
Of the following, which term describes the allocated storage space that is presented to the user as a mountable drive?
A. World Wide Port Name (WWPN)
B. Logical Unit Number (LUN)
C. World Wide Names (WWN)
D. World Wide Node Name (WWNN)
B. Logical Unit Number (LUN)
Explanation:
To access their cloud environment remotely, a cloud administrator sets up a web server in a demilitarized zone (DMZ) that is publicly accessible from the internet. She made it so that the server has been hardened to prevent attacks. Which of the following did the cloud administrator create?
A. Firewall
B. Virtual Private Cloud (VPC)
C. Micro-segmentation
D. Bastion host
D. Bastion host
Explanation:
A bastion host is a hardened and fortified device. To harden, you change the default password, close unnecessary ports, disable unnecessary services, etc.
A VPC is a virtualized environment that is isolated to make it harder for bad actors to interfere with business processes.
Micro-segmentation is when a virtual network is created that has one or just a few virtual machines behind its own firewall.
A firewall is a security device that blocks or allows traffic. It should be a hardened device as well, hopefully by design.
