Pocket Prep 3 Flashcards
Jonathan is working for a bank and is in need of advice. They have performed a quantitative and qualitative risk assessment and have uncovered that there is a concern that a bad actor could gain access to their system through a web portal with very little social engineering. They are concerned because there are laws that they must follow to protect the information that a bad actor could access in this manner. They have decided that the best option is to reprogram the web portal to reduce the chance of access.
What have they decided to do?
A. Transferring risk
B. Avoiding risk
C. Mitigate the risk
D. Accepting risk
C. Mitigate the risk
Explanation:
After risk has been identified and evaluated, either through qualitative or quantitative assessments, the decision must be made on how to respond to risk. There are four main categories for responding to risk: accepting risk, avoiding risk, transferring risk, and mitigating risk.
By reprogramming, they have fixed and hopefully prevented that path of access for the bad actor. This is a mitigation.
Transferring the risk means that someone else will be responsible or partially responsible when something happens. The most common example here is insurance.
Avoiding the risk would see them close that web portal.
Accepting the risk means they effectively do nothing. They accept that something could happen and will deal with it if it does.
Vendor management is more intense with the cloud as opposed to traditional equipment vendor management for an on-premises data center. When managing a vendor, a corporation must first negotiate a contract that will match their needs. If a company is planning on moving their data storage into a cloud provider’s Platform as a Service (PaaS), they need to assess many variables to ensure that they choose the right vendor.
What is most critical for them to evaluate before signing contracts?
A. Explore escrow options
B. Assess the vendor
C. Assess vendor lock-in risks
D. Assess vendor viability
C. Assess vendor lock-in risks
Explanation:
When moving data into the cloud, it is critical to assess the format or changes that will happen to the data. One of the most important things to plan when moving into the cloud is how to move out. If the vendor makes any changes to the data files that would make it very difficult to pull the data out and move it someplace else in the future, it is probably not a good choice for a business. When moving to the cloud, it would be good to believe that you are in the right place with the right vendor, but things do change for businesses and it may be necessary to change vendors in the future for a currently unknown reason.
This is all part of assessing the vendor. However, the question is specific to the data, and lock-in risks are specific to the data. So assessing for a lock-in risk is very important.
Assessing the vendor would include viability. If the cloud provider is new, it may not be able to survive into the future. If the vendor goes bankrupt, that would be a big problem for a corporation.
Escrow is critical to discuss regarding storage of keys and software source code. If a company is moving to Platform or Software as a Service (PaaS or SaaS), a good thing to investigate is where the source code is. If that vendor goes bankrupt, would it be possible for the customer to get the source code to load and run that software somewhere else to protect the functionality of the business?
Volume storage is a storage type where a virtual machine has storage allocated to it and configured as a hard drive or file system. When storage is carved or sliced into manageable units across storage devices, likely in a Storage Area Network (SAN), they are identified and locatable using which of the following?
A. Logical Unit Numbers (LUNs)
B. World Wide Node Name ((WWNN)
C. Internet Protocol (IP) address
D. World Wide Port Name (WWPN)
A. Logical Unit Numbers (LUNs)
Explanation:
In storage systems, the main storage is sliced into smaller segments, called Logical Unit Numbers (LUNs). These logical units are a chunk of the virtualized storage and appear as drives to virtual machines. A LUN can be part of a physical drive, or it can span several drives in arrays, probably RAID arrays.
In Fibre Channel, the servers are located using WWNN and the physical ports are identified by WWPN. (It might help to know these for the test.)
IP addresses are what we have been using for decades now, and they are used in iSCSI to identify the storage servers on the network.
High availability and single points of failure are MOST related to which of the following best practices?
A. Configuration Management and Change Management
B. Redundancy
C. Scheduled Downtime and Maintenance
D. Logging and Monitoring
B. Redundancy
Explanation:
Some best practices for designing, configuring, and securing cloud environments include:
Redundancy: A cloud environment should not include single points of failure (SPOFs) where the outage of a single component brings down a service. High availability and duplicate systems are important to redundancy and resiliency. Scheduled Downtime and Maintenance: Cloud systems should have scheduled maintenance windows to allow patching and other maintenance to be performed. This may require a rotating maintenance window to avoid downtime. Isolated Network and Robust Access Controls: Access to the management plane should be isolated using access controls and other solutions. Ideally, this will involve the use of VPNs, encryption, and least privilege access controls. Configuration Management and Change Management: Systems should have defined, hardened default configurations, ideally using infrastructure as code (IaC). Changes should only be made via a formal change management process. Logging and Monitoring: Cloud environments should have continuous logging and monitoring, and vulnerability scans should be performed regularly.
Damien is working for a real estate company that is working on their plans to move to an online document service that would allow their customers to sign contracts no matter what computer platform they have in their possession. So, interoperability is a critical aspect that they are concerned with. What best describes interoperability?
A. The ability for two or more systems to exchange information and mutually use that information
B. The ease with which resources can be rapidly expanded as needed by a cloud customer
C. The ability for two customers to share the same pool of resources while being isolated from each other
D. The ability of customers to make changes to their cloud infrastructure with minimal input from the cloud provider
A. The ability for two or more systems to exchange information and mutually use that information
Explanation:
Correct answer: The ability for two or more systems to exchange information and mutually use that information
Interoperability is defined in ISO/IEC 17788 as the ability for two or more systems to exchange information and mutually use that information. As a simple example, a Windows machine and a Mac that can exchange a Word document, where both can use it.
The ability for two customers to share the same pool of resources while being isolated from each other is known as multitenancy.
The ability of customers to make changes to their cloud infrastructure with minimal input from the cloud provider is known as on-demand self-service.
The ease with which resources can be rapidly expanded as needed by a cloud customer is called rapid elasticity.
FISMA is a piece of legislation that pertains specifically to which of the following?
A. The collection and storing of protected health information
B. Any organization which deals with credit card information
C. The storing of personally identifiable data (PII)
D. Any systems that will interact with federal agencies
D. Any systems that will interact with federal agencies
Explanation:
Any systems that will interact with federal agencies in any manner must adhere to the requirements set forth in the Federal Information Security Management Act (FISMA). The requirements are used to ensure compliance with security controls required by the federal government.
Health information would be protected under the Health Insurance Portability and Accountability Act (HIPAA).
Credit cards are managed according to the Payment Card Industry Data Security Standard (PCI DSS)
PII is managed according to the European GDPR, Canadian PIPEDA, Australian Privacy Act of 1988, and so on.
During which phase of the SDLC should unit tests be developed and executed regularly?
A. Deployment
B. Testing
C. Development
D. Design
C. Development
Explanation:
The Software Development Lifecycle (SDLC) describes the main phases of software development from initial planning to end-of-life. While definitions of the phases differ, one commonly-used description includes these phases:
Requirements: During the requirements phase, the team identifies the software's role and the applicable requirements. This includes business, functional, and security requirements. Design: During this phase, the team creates a plan for the software that fulfills the previously identified requirements. Often, this is an iterative process as the design moves from high-level plans to specific ones. Also, the team may develop test cases during this phase to verify the software against requirements. Development: This phase is when the software is written. It includes everything up to the actual build of the software, and unit testing should be performed regularly through the development phase to verify that individual components meet requirements. Testing: After the software has been built, it undergoes more extensive testing. This should verify the software against all test cases and ensure that they map back to and fulfill all of the software’s requirements. Deployment: During the deployment phase, the software moves from development to release. During this phase, the default configurations of the software are defined and reviewed to ensure that they are secure and hardened against potential attacks. Operations and Maintenance (O&M): The O&M phase covers the software from release to end-of-life. During O&M, the software should undergo regular monitoring, testing, etc., to ensure that it remains secure and fit for purpose.
A DLP solution sends a message to security personnel. This is likely part of which of the following stages of the DLP process?
A. Mapping
B. Enforcement
C. Discovery
D. Monitoring
B. Enforcement
Explanation:
Data loss prevention (DLP) solutions are designed to prevent sensitive data from being leaked or accessed by unauthorized users. In general, DLP solutions consist of three components:
Discovery: During the Discovery phase, the DLP solution identifies data that needs to be protected. Often, this is accomplished by looking for data stored in formats associated with sensitive data. For example, credit card numbers are usually 16 digits long, and US Social Security Numbers (SSNs) have the format XXX-XX-XXXX. The DLP will identify storage locations containing these types of data that require monitoring and protection. Monitoring: After completing discovery, the DLP solution will perform ongoing monitoring of these identified locations. This includes inspecting access requests and data flows to identify potential violations. For example, a DLP solution may be integrated into email software to look for data leaks or monitor for sensitive data stored outside of approved locations. Enforcement: If a DLP solution identifies a violation, it can take action. This may include generating an alert for security personnel to investigate and/or block the unapproved action.
Mapping is not a stage of the DLP process.
Jose works for a small regional bank that is building their Business Continuity Plan (BCP) for the first time. As he builds the business case that he will present to the Board of Directors and C-suite, he is identifying risks that will be addressed by this plan.
If he is working to ensure that the customers will have enough access to the online portal for their needs, even through disruptions within the data center, what parameter must he ensure that the alternate plan meets?
A. Maximum Tolerable Downtime
B. Recovery Service Level
C. Maximum Tolerable Outage
D. Recovery Time Objective
B. Recovery Service Level
Explanation:
The Recovery Service Level (RSL) is the level of service (percentage of normal) that the alternate site must be able to support. For example, if the server normally handles 400 calls an hour from customers but needs to be able to at least handle 300 calls an hour so that the customers’ basic needs are met, then that is the RSL. RSL would be 75% of normal functionality.
The Maximum Tolerable Outage (MTO) is the amount of time that a corporation can survive being in this alternate state. Using the above example, since they are only at 75% functionality, they may only be able to handle that state for three days.
The Recovery Time Objective (RTO) is the amount of time that it takes to do the recovery work. This would take the server from not functioning to functioning at some level. The level needed is the RSL.
The Maximum Tolerable Downtime (MTD) is the amount of time that the system can be offline, not working, or non-functional.
An engineer has recently started working for an organization and is concerned about which regulations might affect how long they need to retain or store financial and accounting data. Which of the following regulations does this engineer need to be aware of to address the organization’s concerns?
A. Health Insurance Portability and Accountability Act (HIPAA)
B. Gramm-Leach-Bliley Act (GLBA)
C. Sarbanes-Oxley Act (SOX)
D. Asia Pacific Economic Cooperation (APEC)
C. Sarbanes-Oxley Act (SOX)
Explanation:
The Sarbanes-Oxley Act (SOX) regulates accounting and financial practices within an organization. IT engineers need to be aware of SOX, as it can affect which type of data needs to be stored/retained and for how long.
HIPAA is concerned with the storage of Protected Health Information (PHI), not financial data.
GLBA is related to SOX, but it regulates the storage of personal data, not financial data.
APEC is an international agreement among 21 countries around the Pacific Rim that promotes free trade and discusses the handling of personal data.
A large information security vendor that sells handware and software tools has its own DevOps team. Management recently decided that they must follow the guidance from OWASP regarding application logging. There are many things that they are concerned with regarding their customers’ personal data protection. They have been analyzing what they are creating through the lens of threat modeling. What they have determined is that the clocks need to be pulled from the atomic clock sources on the planet.
Which of the following recommendations applies to this scenario?
A. Integrity of log files
B. Time synchronization
C. Identity attribution
D. Differing classification schemes
B. Time synchronization
Explanation:
Correct answer: Time synchronization
The OWASP data event logging cheat sheet does not recommend network traffic logs. However, other logging recommendations by OWASP include:
Synchronize time across all servers and devices Differing classification schemes Identity attribution Application-specific logs Integrity of log files
The full logging cheat sheet is available on OWASP’s website.
Which of the following ways is how a business addresses regulatory compliance challenges in the cloud?
A. Security policies, annual audits, Cloud Service Customer (CSC) defined service level agreements, contracts
B. Security policies, golden images, Cloud Service Customer (CSC) defined service level agreements, contracts
C. Security policies, annual audits, Cloud Service Customer (CSC) defined service level agreements, containers
D. Security policies, annual audits, Cloud Service Provider (CSP) defined service level agreements, contracts
A. Security policies, annual audits, Cloud Service Customer (CSC) defined service level agreements, contracts
Explanation:
Correct answer: Security policies, annual audits, Cloud Service Customer (CSC) defined service level agreements, contracts
There are many things that a business should do to address regulatory compliance challenges in the cloud or simply secure the corporation’s information and information systems. It begins with having security policies. The process is first governance and board of directors oversight. Then risk management must be done to understand the threat environment more completely. Then we can create security policies.
One of the things the policies should specify is that audits should be performed. The customer might need to be audited by a third party if there is a legal compliance requirement. Otherwise, knowing that the CSP has been audited by a third party and what the results of that audit are would be beneficial to know (SOC reports and such). Depending on the customer and the provider, it is possible that the customer could be involved in the actual audit of the cloud service provider.
Side note: A third party audit is an audit done by an external company such as Deloitte or pwc. It is now third because first, there is the CSC. Second, there is the CSP. So, adding an external auditor brings the count to three. It is possible to go to a fourth party if the audit company hires contractors to do some of the work.
The CSC should define the Service Level Agreements (SLA) that they require. The CSP may need to help them work this out, but the customer should specify what they need.
The SLAs are part of the contracts that need to be established with the CSP.
What is not part of this is golden images or containers. The golden image is our stable virtual machine image that should be used to deploy a specific virtual machine. Containers are a contained environment that is portable to run specific code. Having golden images certainly can help with compliance, but it would not be in the same category as the rest of these options.
An attacker deleting log files maps to which letter of the STRIDE acronym for cybersecurity threat modeling?
A. I
B. D
C. R
D. E
C. R
Explanation:
Microsoft’s STRIDE threat model defines threats based on their effects, including:
Spoofing: The attacker pretends to be someone else Tampering: The attacker damages data integrity Repudiation: The attacker can deny that they took some action that they did take Information Disclosure: The attacker gains unauthorized access to sensitive data Denial of Service: The attacker can harm the availability of a service Elevation of Privilege: The attacker can access resources that they shouldn’t be able to access
Deleting log files is likely an effort to cover the attacker’s tracks and is related to repudiation (R).
Dakota is the information security manager for a social media corporation. They have been concerned about a particular Denial of Service attack coming in from a particular part of the world. She needs to configure a device that has the ability to block specific Internet Protocol (IP) addresses.
Which network device can she have configured to block this type of traffic?
A. Switch
B. Router
C. Intrusion Detection System (IDS)
D. Firewall
D. Firewall
Explanation:
The firewall is the main device that is used to manage the flow of traffic in and out of the network based on rules configured on the firewall. Firewalls can be virtual devices or physical devices, and they can be configured to block specific IP addresses or ranges.
Routers route traffic based on IP addresses. It is possible that they can be configured with Access Control Lists (ACL), but firewalls are designed to block traffic specifically. So “firewall” is a better answer.
Switches are designed to forward traffic. The typical switch forwards based on Media Access Control (MAC) addresses. It could be a layer 3 switch that uses IP addresses, but they are not designed to block traffic.
IDS devices can detect intruders. However, they do not block traffic. They are passive in nature.
Which of the following is PRIMARILY a concern in multi-cloud environments?
A. Availability
B. Performance
C. Interoperability
D. Resiliency
C. Interoperability
Explanation:
Some important cloud considerations have to do with its effects on operations. These include:
Availability: The data and applications that an organization hosts in the cloud must be available to provide value to the company. Contracts with cloud providers commonly include service level agreements (SLAs) mandating that the service is available a certain percentage of the time. Resiliency: Resiliency refers to the ability of a system to weather disruptions. Resiliency in the cloud may include the use of redundancy and load balancing to avoid single points of failure. Performance: Cloud contracts also often include SLAs regarding performance. This ensures that the cloud-based services can maintain an acceptable level of operations even under heavy load. Maintenance and Versioning: Maintenance and versioning help to manage the process of changing software and other systems. Updates should only be made via clear, well-defined processes. Reversibility: Reversibility refers to the ability to recover from a change that went wrong. For example, how difficult it is to restore on-site operations after a transition to an outsourced service (like a cloud provider). Portability: Different cloud providers have different infrastructures and may do things in different ways. If an organization’s cloud environment relies too much on a provider’s unique implementation or the provider doesn’t offer easy export, the company may be stuck with that provider due to vendor lock-in. Interoperability: With multi-cloud environments, an organization may have data and services hosted in different providers’ environments. In this case, it is important to ensure that these platforms and the applications hosted on them are capable of interoperating. Outsourcing: Using cloud environments requires handing over control of a portion of an organization’s infrastructure to a third party, which introduces operational and security concerns.
