SC-900

Question 1

Zero trust

Answer 1

Assume everything behind the firewall is unsafe

Question 2

Zero trust principles

Answer 2

• Verify explicitly
• Use least priviliged access
• Assume breach

Question 3

How can you validate identity and authorization

Answer 3

• User ID and password
• Multifactor authentication (code from another app)
• Limit access to certain geographic locations
• Check device they are using

Question 4

JIT

Answer 4

Just In Time
- Temporary permissions that will expire after a certain amount of time

Question 5

JEA

Answer 5

Just Enough Access
- Different people have different levels of access e.g some read only or only access to certain files

Question 6

Security inside network

Answer 6

Encryption - application to application communciation should be in an encrypted channel

Segmentation - break network into segments and authentication is properly set on different segments

Threat detection - active and intelligent threat detection for example machine learning and ai technologies to detect suspiscious behaviours

Question 7

On Premises (On-Prem) responsibilty

Answer 7

• If you have your own servers you have all the responsibility of securing it

Question 8

IasS

Answer 8

Infrastructure as a Service
- where you can rent servers for a period of time

Question 9

IasS responsibilty

Answer 9

• when using a third party provider to host servers then third party provider is responsible for the physical location
• however you are still responsible for the OS e.g security updates, migrating to new OS. Also responsible for the network, applications, identity and directory infrastructure, accounts, devices and information

Question 10

PasS

Answer 10

Platform as a service
- Microsoft has the servers and you upload the code, settings and date then Microsoft runs it

Question 11

PasS responsibility

Answer 11

-Microsoft responsible for physical location and the OS
- You are responsible for adding additional firewalls, your own application, data, devices and accounts

Question 12

SaaS

Answer 12

Software as a service

Question 13

SaaS responsibility

Answer 13

• Microsoft responsible for physical location, OS, Network controls and the application
• You cannot change any underlyin code but can grant user access and specific roles
• You are responsible for the data, devices and accounts

Question 14

common threats to security

Answer 14

Data breaches
Dictionary attack
Ransomware
Denial of service attacks

Question 15

Entry point for data breaches
Phishing attack

Answer 15

millions of emails are sent and a few people click on the link and enter details on a fake webpage therefore getting their details stolen

Question 16

Entry point for data breaches
Spear phishing

Answer 16

Target specific individuals for a specific purpose using phishing method

Question 17

Entry point for data breaches
Tech support scam

Answer 17

Someone will call, email or message you to try trick you into installing malware

Question 18

Entry point for data breaches
SQL Injection

Answer 18

programs that try to use your website or application to extract data in a way that is not authorized
- done by putting codes into text fields and hope the website is misconfigured so code will run

Question 19

Entry point for data breaches
malware, trojans, viruses

Answer 19

Any system that tries to make you download malware, trojans or viruses

Question 20

Dictionary attack

Answer 20

attempting to brute force entry into an account by guessing popular passwords

Question 21

Ransomware

Answer 21

Locking a company from its computers and data resources and demanding a payment in exchange for the key

Question 22

DoS Denial of service attack

Answer 22

a type of cyber attack in which a malicious actor aims to render a computer or other device unavailable to its intended users by interrupting the device’s normal functioning.

Question 22

Asymetric encryption

Answer 22

Anyone can use the public key to encrypt the message to you then you use your private key to decrypt the message

Question 23

Symetric encryption

Answer 23

you use the same key for encryption and decryption
so both people must have the same key

Question 24

AES

Answer 24

Advanced Encryption Standard
- most commonly used
- Symetric

Question 24

Hashing

Answer 24

A one way function that signifies the original message has not been altered

Question 24

DES

Answer 24

Data Encryption Standard
- considered to weak for use nowadays
- Symetric

Question 25

RSA

Answer 25

• encryption used by HTTPS and SSL
• asymetric

Question 26

Identity Provider

Answer 26

Username and password is sent to third party identity provider and if this is correct it will then a security token to the client which can be passed to the server and gives access to the client

Question 27

ECC

Answer 27

• encryption used by bitcoin
• asymetric

Question 28

Authorization

Answer 28

Princ

Question 28

SSO

Answer 28

Single Sign On