Pocket Prep 7 Flashcards
Sigrid works for a Cloud Service Provider and has been certified against ITIL. She knows that ITIL addresses the practices needed within a data center to provide the services that it needs for its customers. What is the name of the practice that ensures service will be there in the case of a horrible natural disaster that has affected the area?
A. Business continuity management
B. Incident management
C. Disaster recovery management
D. Continuity management
D. Continuity management
Explanation:
Continuity management is the term used by ITIL. They do not use the terms disaster or business continuity. Continuity management is the practice of ensuring that services are available and perform at a level sufficient in the event of a disaster.
According to NIST, disaster recovery would be the correct term. They define a disaster recovery plan as “a written plan for processing critical applications in the event of a major hardware or software failure or destruction of facilities.”
Business continuity management is more inclusive. It is defined by NIST as “the documentation of a predetermined set of instructions or procedures that describe how an organization’s mission/business processes will be sustained during and after a significant disruption.”
ITIL does use the term incident management. That is the practice of minimizing the impact of unplanned interruptions or reductions in the quality of service.
A software developer is looking for a way to avoid installing and running application software directly within the operating system. As an alternative, it is suggested they should begin storing applications and any associated library files in the cloud. Which cloud service is being discussed?
A. Virtual machines
B. Hypervisors
C. Containerization
D. Virtualization
C. Containerization
Explanation:
Containerization is the process of putting all objects into a container. Developers can accomplish this by packaging a program they have written along with all necessary components for the program’s execution. Application containers isolate application files and dependencies from the container’s host system. Containerization is a lightweight alternative to installing and running applications directly within an operating system.
Hypervisors, in particular type 1, are thin operating systems that allow for virtual machines to be built. Virtual machines include the operating system. This is the process of virtualization.
Arguably, containers are a type of virtualization, but containers directly matches the question.
A cloud information security specialist needs to find out when a document was originally created. What could this engineer look at to find this information?
A. Data tags
B. Data labels
C. Data classification
D. Metadata
D. Metadata
Explanation:
Metadata is information about data, including the type of data, when the data was created, where the data is stored, and more.
Classification tells us the sensitivity of the document/file/etc., but it does not have information about when it was created. The classification can be found on the label (data labels) but usually no date information is given.
Data tags can be used to track the billing department or a project, but it is not about when the data was created.
The lead information security specialist working with the team that is going to move their internal communications capability to a cloud provider with a Software as a Service (SaaS) solution is currently determining what their business will be responsible for managing.
Of the following, which list includes the responsibilities of the customer?
A. Data security, governance, risk management and compliance, setting up firewall security for the communications software
B. Data security, governance, risk management and compliance, software security as well as managing the security of the platform.
C. Governance, risk management and compliance, data security and defining the Service Level Agreements (SLA)
D. Governance, risk management and compliance, data security and hypervisor access control security
C. Governance, risk management and compliance, data security and defining the Service Level Agreements (SLA)
Explanation:
Correct answer: Governance, risk management and compliance, data security and defining the Service Level Agreements (SLA)
Governance, Risk management and Compliance (GRC) is the responsibility of the customer in the shared responsibility model. The cloud provider has their own GRC, but all the clues between the question and the answers point to the shared responsibility model, which is the customer’s responsibility. GRC is also in the remaining answer options.
Data security from the shared responsibility model is also the customer’s responsibility. The cloud provider has a responsibility to protect the data in their possession, but if something happens, the customer is ultimately responsible for their data. Their mistake could have been choosing the wrong cloud provider.
Defining the SLAs that are needed by the customer should be the customer’s responsibility. They may need help and guidance from a consultant or even the cloud provider, but it is the customer’s responsibility to communicate their needs.
Platform security is shared if this is Platform as a Service (PaaS), or the customer’s responsibility if it is Infrastructure as a Service (IaaS), but it is the cloud provider’s responsibility in SaaS.
Setting up firewall security for SaaS is the cloud provider’s responsibility. For PaaS and IaaS, it would be the customer’s responsibility; however, the question clearly states SaaS.
Hypervisor access control is always the responsibility of the cloud provider. The exception is if a business is building their own private cloud.
Which of the following best practices supports vulnerability and patch management practices?
A. Configuration Management and Change Management
B. Isolated Network and Robust Access Controls
C. Scheduled Downtime and Maintenance
D. Logging and Monitoring
C. Scheduled Downtime and Maintenance
Explanation:
Some best practices for designing, configuring, and securing cloud environments include:
Redundancy: A cloud environment should not include single points of failure (SPOFs) where the outage of a single component brings down a service. High availability and duplicate systems are important to redundancy and resiliency. Scheduled Downtime and Maintenance: Cloud systems should have scheduled maintenance windows to allow patching and other maintenance to be performed. This may require a rotating maintenance window to avoid downtime. Isolated Network and Robust Access Controls: Access to the management plane should be isolated using access controls and other solutions. Ideally, this will involve the use of VPNs, encryption, and least privilege access controls. Configuration Management and Change Management: Systems should have defined, hardened default configurations, ideally using infrastructure as code (IaC). Changes should only be made via a formal change management process. Logging and Monitoring: Cloud environments should have continuous logging and monitoring, and vulnerability scans should be performed regularly.
Emery has been tasked with finding a solution or tool for her company. The problem they are trying to solve is to find a way to share their training videos with their customers. The videos are related to products they sell. They need a way to control who sees the content with the ability to remove access to old videos as their product changes.
What kind of product should she be looking for?
A. Cloud Software as a Service
B. Cloud Data Loss Prevention
C. Cloud Digital Rights Management
D. Cloud Intrusion Detection System
C. Cloud Digital Rights Management
Explanation:
Cloud Digital Rights Management (DRM) implementations include auditing, expiration, policy control, protection, and support for applications and formats. This would allow her company to share the video files with their customers and have control over them so that old videos can be removed or rights can be taken away from a customer if necessary. DRM is sometimes referred to as Information Rights Management (IRM).
Cloud Data Loss Prevention (DLP) is a tool to help control where data flows but also looks for traffic that should not be sent. For example, a file classified as secret should not be sent in an email.
Cloud Software as a Service (SaaS) could be how the DRM tool is delivered to the customer. This is a more generic answer though, so DRM is a better answer because of the details in the question.
Cloud Intrusion Detection System (IDS) would be analyzing traffic looking for the transmissions from bad actors. It is not concerned with useful data flows or who should be able to see what traffic.
When selecting a cloud service provider, what is the MOST preferred attestation report to receive from vendors providing cloud services?
A. SOC 2, Type 1
B. SOC 2, Type 2
C. SOC 1, Type 2
D. SOC 3
B. SOC 2, Type 2
Explanation:
A SOC 2, Type 2 attestation report is the most desirable attestation report to receive from vendors providing cloud services. A SOC for Service Organizations: Trust Services Criteria (SOC 2) provides information about the control objectives relating to the five trust principles: security, availability, processing integrity, confidentiality, and privacy. The scope of the Type 2 report is limited to a specified time period and includes information about the controls’ presentation, system and design suitability, and operational efficacy in achieving the related control objective.
The scope of a Type 1 report is determined by a single precise date rather than an extended time period as with a Type 2 report. So a Type 1 can only attest to the system’s design but not its operational efficacy.
A SOC 1 report has to do with an audit of “the user entities’ financial statements (user auditors), in evaluating the effect of the controls at the service organization on the user entities’ financial statements,” as stated by the AICPA.
A SOC 3 is designed for public distribution. It is the likely report that a requestor would receive about a cloud service provider. However, the question is about the most preferred. The most preferred has the most information about security controls, their designs, and efficacy at the cloud provider. That is a SOC 2, Type 2.
The cloud enables operations in geographically dispersed places and increases hardware and data redundancy. What is the end result of this in terms of disaster recovery and business continuity?
A. Lower Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO)
B. Lower Recovery Point Objectives (RPO) and Recovery Service Level (RSL)
C. Higher Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
D. Lower Recovery Time Objectives (RTO) and Higher Recovery Point Objectives (RPO)
A. Lower Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO)
Explanation:
The capacity to operate in geographically remote locations and to provide increased hardware and data redundancy results in lower Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for disaster recovery and business continuity. It is easier to bring new/replacement systems up in other regions if there has been a major disaster. The RTO is the amount of time it takes to bring a system on line. With images, you just spin up a new image on a different server as long as you have a copy of that image. Backing up data can also be easier, which reduces the RPO. RPO is the amount of data that the business can tolerate losing.
The Recovery Service Level (RSL) measures the percentage of the total production service level that needs to be restored to meet BCDR objectives.
Reference:
A bank has built a disaster recovery plan for their datacenter. Their plan is to fail from their traditional datacenter into the cloud. They have now contracted a cloud provider for an Infrastructure as a Service (IaaS) environment. They have constructed all the virtual machines that construct the virtual datacenter. Now they are going to test that those systems work and can operate for the business.
Which type of disaster recovery plan testing are they conducting?
A. Simulation
B. Full interruption
C. Tabletop
D. Parallel
D. Parallel
Explanation:
In a parallel test, team members replicate the procedures necessary if a disaster occurs without disrupting the operation of the running business and data center.
A full interruption test causes a fail over to the alternate processing site, which in this case is the IaaS cloud.
A tabletop exercise is where team members talk their way through the plan. This should be done before a parallel.
A simulation should actually be before parallel and after tabletop exercises. The best example of this would be a fire drill. There are actions taken, but a real fire is not started. This does not have much use in a cloud environment though.
A real estate company is planning to move the services that they have built in an on-premises datacenter into the cloud. They have found that there are Software as a Service (SaaS) providers that have the capabilities that they need. One of their concerns is that it is possible that they will be attacked by bad actors because of the confidential information that they store regarding their customers and their loan applications. If there is an attack, they will need access to data that is vital to the Incident Response (IR) process.
Of the following, which is TRUE regarding eDiscovery?
A. Only log files can be recovered during eDiscovery in a traditional data center environment
B. Only log files can be recovered during eDiscovery in a cloud environment
C. eDiscovery in a cloud environment is typically easier and less complex than eDiscovery in a traditional data center
D. eDiscovery in a traditional data center is typically easier and less complex than eDiscovery in a cloud environment
D. eDiscovery in a traditional data center is typically easier and less complex than eDiscovery in a cloud environment
Explanation:
Within a traditional data center environment, any systems needed for an investigation can easily be physically isolated and preserved. In a cloud environment, most cloud customers do not own their own hardware but instead share physical hardware in the cloud. Due to this, eDiscovery is typically easier and less complex in a traditional data center than in a cloud environment. It is unlikely that a server can be seized in the cloud to support a company’s discovery in a SaaS deployment.
It is possible to obtain more than log files in both a cloud and a traditional data center. The on-prem data center would be owned by the cloud customer (in this question), and therefore they can obtain anything they need for eDiscovery and incident response. It is possible to get the log files and more, even in a SaaS environment, but that would need to be discussed and negotiated before the contract is signed.
Which of the following is NOT listed by the CCSP as something that requires continuous monitoring?
A. Network Security Groups
B. Artificial Intelligence
C. Endpoint Security Tools
D. Honeypots
C. Endpoint Security Tools
Explanation:
Monitoring security controls is essential to detecting and remediating attacks. Some common controls to monitor include:
Network Security Controls: Network security solutions such as firewalls, intrusion detection/prevention systems (IDPS), network security groups, web application firewalls (WAFs), and other solutions should be continually monitored to identify any issues and potential signs of an attack. Honeypots: A honeypot is a dummy system designed to attract an attacker’s attention and waste their time while allowing defenders to detect and observe the attack. Monitoring honeypots can provide advance warning of potential threats. Artificial Intelligence (AI): AI is increasingly integrated into security tools to help identify events and trends of interest. AI-enabled systems can help to fight alert overload and security fatigue.
Endpoint security is an important part of a cybersecurity program, but it is not listed by the CCSP as a core control to model. For some cloud environments, such as Platform as a Service and Software as a Service, there is no endpoint for the customer to manage and secure.
Reference:
Which of the following, published by the Cloud Security Alliance (CSA), provides a detailed framework and approach for handling controls that are pertinent and applicable in a cloud environment?
A. Consensus Assessment Initiative Questionnaire (CAIQ)
B. Cloud Controls Matrix (CCM)
C. National Institute of Standards & Technology (NIST) Special Publication 800-53
D. International Standards Organization (ISO)/International Electrotechnical Commission (IEC) 27017
B. Cloud Controls Matrix (CCM)
Explanation:
The Cloud Controls Matrix (CCM) outlines a detailed approach for handling controls in a cloud environment. The Cloud Controls Matrix was developed and published by the Cloud Security Alliance.
The CAIQ is a questionnaire that a Cloud Service Provider (CSP) can fill out and then register themselves with the Security, Trust, Assurance, and Risk (STAR) Registry.
NIST and ISO are different organizations than the CSA.
NIST SP 800-53 (the latest revision is 5, which is not something you need to worry about for the exam) is titled “Security and privacy controls for information systems and organizations.” Overly simplified, it is a list of security controls.
ISO/IEC 27017 is also overly simplified to a list of security controls. This document is specific to cloud controls. Its proper title is “Code of practice for information security controls based on ISO/IEC 27002 for cloud services.”
Neither (ISC)2 nor the CSA mention each other in their materials. It is unknown if this exam is still a joint venture between the two companies. However, that is how it started, so it would not hurt to know about the CCM and CAIQ before you take the exam. The CSA guidance document and their SecaaS documents are still good reads in preparation for the exam.
Which of the following necessary attributes of evidence disallows selectively presenting evidence to support a case?
A. Accurate
B. Complete
C. Authentic
D. Convincing
B. Complete
Explanation:
Typically, digital forensics is performed as part of an investigation or to support a court case. The five attributes that define whether evidence is useful include:
Authentic: The evidence must be real and relevant to the incident being investigated. Accurate: The evidence should be unquestionably truthful and not tampered with (integrity). Complete: The evidence should be presented in its entirety without leaving out anything that is inconvenient or would harm the case. Convincing: The evidence supports a particular fact or conclusion (e.g., that a user did something). Admissible: The evidence should be admissible in court, which places restrictions on the types of evidence that can be used and how it can be collected (e.g., no illegally collected evidence).
A public cloud provider that primarily sells Platform as a Service (PaaS) deployments, both server-based and server-less, recently had a breach. The source of the breach is related to a failure that was found too late. The hypervisor that they chose to use had a vulnerability in how it managed the Central Processing Unit (CPU) utilization among the customers.
What type of threat is this known as?
A. Malicious insiders
B. Advanced persistent threats
C. Shared technology issues
D. Insufficient logging and monitoring
C. Shared technology issues
Explanation:
Shared technology issues occur in the cloud when the cloud provider has not properly secured the CPU and memory utilization. Multitenancy and resource pooling is how the cloud works, and it is up to the cloud provider to add additional layers of security to ensure that each cloud customer has access to only their own data and not others’ who may be sharing the same environment.
Insufficient logging and monitoring is very common, and it has been since long before the prevalence of the cloud. Logging and monitoring is essential to know if any issues or threats have been exploited within a network of any kind.
Malicious insiders are coworkers who are up to no good. They could be trying to destroy the company because they are disgruntled or are selling corporate secrets to someone else, among many more issues.
Advanced Persistent Threats (APT) are particularly nasty and sophisticated attacks. They most commonly occur between countries as opposed to a bad actor attacking the average company.
Generally Accepted Privacy Principles (GAPP) is a standard consisting of many privacy principles, one of which is regarding the utilization of information that is collected by an organization. What does the use principle say?
A. The organization can utilize the information for anything except offering it for sale. They must notify the customer of its imminent deletion, so the customer can opt back in if they choose.
B. The organization can utilize information for the purpose for which it was collected and within expected use beyond that. They are allowed to store the information in archival status for up to 50 years.
C. The organization can utilize the information for the original stated purpose and for the following seven years. At the end of that time, it must be disposed of appropriately and permanently.
D. The organization can utilize information for only the purpose for which it was collected and only for a limited amount of time. At the end of that time, it must be disposed of appropriately and permanently.
D. The organization can utilize information for only the purpose for which it was collected and only for a limited amount of time. At the end of that time, it must be disposed of appropriately and permanently.
Explanation:
Correct answer: The organization can utilize information for only the purpose for which it was collected and only for a limited amount of time. At the end of that time, it must be disposed of appropriately and permanently.
The Generally Accepted Privacy Principles (GAPP) is a standard that consists of 10 key principles. The use, retention, and disposal principle states that use of personal information is limited to the purposes for which it was collected in the notice the individual consented to. The organization can then retain that information only for as long as it is needed to fulfill that purpose. At the end of that time, it must be disposed of appropriately and permanently.
Paige works for a Cloud Service Provider (CSP). She works on the deployment of new hardware to the data center. When new equipment is placed in the data center, it must be configured, and the operations team may need the ability to remotely manage the actual equipment and its operating system and configurations.
What is used to gain access?
A. Keyboard, Video, Mouse (KVM)
B. Uninterruptible Power Supply (UPS)
C. Internet Protocol Security (IPSec)
D. Transmission Control Protocol (TCP)
A. Keyboard, Video, Mouse (KVM)
Explanation:
When a piece of hardware is added to a data center, a physical keyboard and monitor is plugged in by way of a laptop for its initial configuration. Then a Keyboard, Video, Mouse (KVM) switch allows for remote administration. It allows administrators to access and control multiple servers from a single location, eliminating the need for physical proximity to each individual server.
Transmission Control Protocol (TCP) is one of the core protocols of the Internet Protocol Suite (TCP/IP) and is widely used for reliable and connection-oriented communication between network devices. It operates at the transport layer of the TCP/IP model and provides a reliable, ordered, and error-checked delivery of data packets over IP networks. TCP/IP can carry Remote Desktop Protocol (RDP), Secure Shell (SSH), and other remote administration protocols, but that is not quite what the question is asking for.
Internet Protocol Security (IPSec) is a protocol suite used to secure Internet Protocol (IP) communications by providing authentication, integrity, and confidentiality for network traffic. It is commonly used in Virtual Private Networks (VPNs) and other secure network connections. IPsec operates at the network layer of the TCP/IP protocol stack and can be used to secure communication between two endpoints or between network gateways. IPSec is not used to connect to and configure equipment in the data center.
An Uninterruptible Power Supply (UPS) is an electrical device used to provide backup power to connected devices or systems in the event of a power outage or disruption. It serves as a bridge between the main power source and the devices it powers, ensuring uninterrupted operation and protecting against power-related issues.
