Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Professional Cloud Security Manager > Sec Mgmt LifeCycle > Flashcards

Sec Mgmt LifeCycle Flashcards

1
Q 
Security Mgmt (6) LifeCycle List?   Hint: Cntls
What are the (6) Lifecycle steps?
A
  1. (CAT) Categorize Info Sys – Define Critical IS to
    potential worse case impact
  2. (CNTL) Select Sec CNTL – Baseline Sec Cntl – Apply
    supplement cntl needed for baseline on risk
  3. (Implem) Implem Sec CNTL – Using sound Engineer
    practices, apply Sec Config settings
  4. (Assess) Assess Sec Cntl – PenTest – Confirm chgs
  5. (AO) Authorize IS – if acceptable … authorize
    operations
  6. (CM) Monitor Sec State – Continuous Monitoring –
    track chgs against CNTLs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is ROSI?

A

Return on Security Investment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ROSI = ___________ - ______________

A

$$RISK Mitigation - Cost of Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

For each threat we can then calculate:

A

ALE = ARO * SLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ALE

A

Annual Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ARO

A

Annual Rate of Occurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SLE

A

Single Loss Expectancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

PDCA?

A

Plan - Do - Check - Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Steps in PLAN of PDCA:

A

Design ISMS, Assess Risk, Select Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Steps of Do of PDCA:

A

Implement / Operation Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Steps of Check of PDCA:

A

Review / Evaluate Performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Steps of Act of PDCA:

A

Changes made, Bring ISMS back to peak performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISMS Info Sys Mgmt Sys = (hint: name of standard)

A

ISO /IEC 27001 (FISMA) standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Governance is how we do what we do …

Governance = (3)

A

Policy + Standard + Procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Policy is ___________
Standard is _________
Procedure is ________

A

Principle
Control
Step-by-step instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

List (5) Governance Frameworks:

A
  1. ISO / IEC 38500 CORP
  2. ISO 17799 PCI DSS
  3. ISO 27001 FISMA
  4. ISO 13335 HIPAA
  5. COBIT Govt Mgmt Enterprise IT
    * COBIT is a good-practice framework created by international professional association ISACA for information technology management and IT governance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RISK to Multi-Tenancy: (5)

A
  1. Inadequate Logical Sec Cntls
    ie: CPU, Ntwk, Stor, DB, & Stack shared btw Multi-
    tenants
  2. Other Tenants > Malicious / Ignorant
    i.e.: weaker logical cntl can affect other Tenants
  3. Shared Svc can become single pt of fail (SPF)
    if common svc not architecture well. Affect other
    Tenants
  4. Uncoordinated Chg Cntl & Misconfiguration –
    All chgs need to be well coordinated & Tested
  5. Co-mingle Tenant Data –
    to reduce cost – providers store data from multiple
    DB & BU tapes.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is not a risk for multi-tenancy design?
A. Co-mingled tenant data
B. Inadequate logical Sec Cntl
C. Overcharging for extreme use of resources
D. Uncoordinated change cntl and mis-config

A

C. Overcharging for extreme use of resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A cloud subscriber may come under certain security constraints when hosting sensitive data in the cloud due to government regulations. Which of the following is the BEST mitigating control that could be implemented by the cloud provider?

A. Offer multi-tenancy software as a service with segregated physical infrastructure.
B. Offer a single-tenancy software service with segregated virtualized infrastructure.
C. Offer multi-tenancy software as a service with logically segregated infrastructure.
D. Offer a single-tenancy software service with monitored intrusion detection systems.

A

B. Offer a single-tenancy software service with segregated virtualized infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ISO 27005 defines risk as:

And … it is measured by …. (2)

A

Potential that a given threat will exploit vulnerability of asset/group of assets and thereby cause harm to organization

Likelihood of event
And … Consequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What (Who) are the Cloud Sec Ref Architecture Members (5)

A 
Cloud Consumer
Cloud Provider
Cloud Broker
Cloud Carrier ie: VZ, ATT, COX
Cloud Auditor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is CLOUD Bursting?

A

When a Private Cloud or Data Center burst into Public Cloud as capacity spikes

23
Q

An organization has just gone to a start-up cloud provider for its entire infrastructure. Which of the following is one of the new organizational roles required at the cloud provider?

A. Supply manager
B. Commercial manager
C. Infrastructure project manager
D. Credit risk manager

A

C. Infrastructure project manager

24
Q

What are the Cloud Compliance Cntl Layers (8)

A 
SaaS
Paas
Iaas
Virtual Cntl
Data Mgmt & Storage Cntl
Access Cntl
Communications Cntl
Support Infrastructure
25
What the (6) steps of Data Security LifeCycle
``` Create Store Use Share Archive Destroy ```
26
What is Vendor Lock-in?
Vendor goes out of business, lost data, or changed versions and now unreadable ….
27
Which of the following is an important factor for maintaining strategic flexibility? A. Return on investment B. Integrity C. Elasticity D. Vendor lock-in
D. Vendor lock-in
28
What are the Cloud Risk Assessment List (9)
``` Char(ize) Threat Vuln Cntl Likelihood Det – Impact Risk Det Cntl Recommendation Results Doc ```
29
Cloud Risk Assessment List (9)
1. Sys Char – Char(ize) assets, bus process, or sys to Cloud 2. Threat ID – identify threats to org (exist/new) 3. Vuln ID – identify potential vuln/current Sec issues 4. Cntl Analysis – Analyze Sec Cntl / framewk for assessmt 5. Likelihood Det – Determine definite likelihood of event based on Criticality 6. Impact Analysis – Analyze defin of impact if risk was exploited 7. Risk Determ –Detemine risk base on likelihood of threat, impact & Mitig Cntl 8. Cntl Recommendation – ID Process, Cntl, activity to manage ID risk 9. Results Doc – ID risk treatment option such as bear risk, transfer risk, mitigate risk.
30
The Risk Assessment methodology has 9 steps. Which step is THREAT IDENTIFICATION? A. First B. Second C. Third D. Fourth
B. Second
31
The Risk Assessment method has 9 steps. Which step do you define System, Process scope, & service i.e: Technical Cntls, Mgmt Cntls, Operational Cntls, Physical Cntls, and Environmental Sec get assessed? 1. Char 2. Threat ID 3. Vuln ID 4. Cntl Analysis
1. Char
32
At what level of the Risk Assessment do you consider Pen Testing? 1. Char 2. Threat ID 3. Vuln ID 4. Cntl Analysis
3. Vuln ID
33
What stage of risk assessment step focuses on controls to use for assessment? 1. Impact Analysis 2. Control Analysis 3. Risk Determination 4. Control Remediation
2. Control Analysis
34
At what level of the Risk Assessment do you define a risk criteria that includes likelihood of a threat, magnitude of impact, and capability of mitigating controls? 1. Control Recommendation 2. Impact Analysis 3. Risk Determination 4. Results Documentation
3. Risk Determination | * RISK Determination = Likelihood
35
At what level of the Risk Assessment do you establish a framework, and document the universe of controls 1. Char 2. Threat ID 3. Vuln ID 4. Cntl Analysis
4. Cntl Analysis
36
At what level of the Risk Assessment do you create risk assessment report, identify risk management options, ie: accept, transfer, mitigate, and document risk exceptions? 1. Control Recommendation 2. Impact Analysis 3. Risk Determination 4. Results Documentation
4. Results Documentation
37
At what level of the Risk Assessment do you establish a framework, and document the universe of controls 1. Char 2. Threat ID 3. Vuln ID 4. Cntl Analysis
4. Cntl Analysis
38
At what level of the Risk Assessment do you analyze the relation to the loss of integrity, availability, or confidentiality, and the definition of impact of a particular risk. 1. Control Recommendation 2. Impact Analysis 3. Risk Determination 4. Results Documentation
2. Impact Analysis
39
At what level of the Risk Assessment do you identify threats, history of sys attacks, and identify security issues? 1. Char 2. Threat ID 3. Vuln ID 4. Cntl Analysis
2. Threat ID
40
At what level of the Risk Assessment do you identify processes, controls, and activities that can help manage risks identified. 1. Control Recommendation 2. Impact Analysis 3. Risk Determination 4. Results Documentation
1. Control Recommendation
41
Which Svc Delivery model requires resource provisioning roles to be defined in the shared responsibility matrix? A. IaaS B. PaaS C. SaaS
A. IaaS
42
``` As part of threat modeling process, owners wish to minimize the ____ and impose countermeasures. These measures may pose certain vuln in return and might lead to new ___ being identified. A. Risks, Risks B. Threat Agents, Risks C. Threat Agents, Assets D. Vuln, Vuln ```
A. Risks, Risks
43
``` What stage of risk assessment step focuses on controls to use for assessment? A. Impact Analysis B. Control Analysis C. Risk Determination D. Control Remediation ```
B. Control Analysis
44
What are the 3 Tiers to Continuous Monitoring ISCM Rqmts?
Tier 1 – Org Bus Process – Estab / define Risk Tolerance of Org Tier 2 – ISCM Strategy – Create risk Mitigation strategy Tier 3 – ISCM Cloud Computing Strategy – Implement Operationalize
45
How many tiers should an ISCM per NIST 800-137 have: A. 2 – Tier 1 (Org Bus Process), Tier 2 (Cloud Computing Strategy Implem) B. 2 – Tier 1 (Cloud Computing Strategy Implem), Tier 2 (Org Bus Process) C. 3 – Tier 1 (Org Bus Process), Tier 2 (ICSM Strategy) Tier 3 (Cloud Computing Strategy Implem) D. 3 – Tier 1 (Cloud Computing Strategy Implem), Tier 2 (Org Bus Process), Tier 3 (ICSM Strategy)
``` C. 3 – Tier 1 (Org Bus Process), Tier 2 (ICSM Strategy) Tier 3 (Cloud Computing Strategy Implem) ```
46
What is JAB?
Joint Authorization Board
47
What does JAB do?
reviews Sec pkg submit by CSP/ grants ATO?
48
What is 3PAO? | And what does 3PAO do?
Auditor – | 3rd party Assessor Organization, validates / attests to quality and compliance of CBP provided SEC PKG
49
What is PMO? | And what does PMO do?
FedRamp Project Mgr Ofc – | manages process assessment, authorize, & CM process. Continuous Monitoring
50
What is SP? What is its process in FedRAMP? SP = _________ ___________
Cloud Sec Pkg, | follows process for provisional authorization under Fed Ramp
51
What is FEDRAMP?
FedRamp is risk management program that provides a standardized approach for assessing and monitoring security of cloud products and services
52
What is SOA acronym for?
Service Oriented Architecture
53
What is SOA for?
Discrete SW provides Application function / service to other applications . . .

Professional Cloud Security Manager (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions