C838 V2 - Exam 13 Questions with 100%
Correct Answers.
Cloud Provider:
A service provider that offers customer storage or software solutions available via a public
network, usually the Internet. The cloud provider dictates both the technology and
operational procedures involved.
Cloud Services Broker (CSB):
Typically a third-party entity or company that looks to extend or enhance value to multiple
customers of cloud-based services through relationships with multiple cloud service providers. It
acts as a liaison between cloud services customers and cloud service providers, selecting the best
provider for each customer and monitoring the services.
Cloud Storage:
The storage of data online in the cloud, wherein a company's data is stored in an accessible form
from multiple distributed and connected resources that comprise a cloud.
Cloud Testing:
Load and performance testing conducted on the applications and services provided by a
cloud provider, particularly the capability to access the services, in order to ensure optimal
performance and scalability under a wide variety of conditions.
Community Cloud:
A model where the cloud infrastructure is designed for use by a specific community.
Generally, this is a community of users or consumers with shared concerns, missions, and/or
security requirements.
Enterprise Application:
The term used to describe applications or software that a business would use to assist
the organization in solving enterprise problems.
,Eucalyptus:
An open source cloud computing and Infrastructure as a Service (IaaS) platform for
enabling private clouds.
FIPS 140-2
A NIST document that lists accredited and outmoded cryptosystems.
Hybrid Cloud:
A cloud solution that mixes elements of public, private, and community cloud models.
Infrastructure as a Service (IaaS)
Offers only hardware and administration, leaving the customer responsible for the OS and other
software.
Managed Service Provider:
An IT service where the customer dictates both the technology and operational procedures,
and an external party executes administration and operational support according to a contract.
Multi-Tenant:
Multiple customers using the same public cloud (and often the same hosts, in a virtualized cloud
environment).
NIST 800-53:
A guidance document with the primary goal of ensuring that appropriate security requirements
and controls are applied to all U.S. federal government information in information
management systems.
Platform as a Service (PaaS):
A way for customers to rent hardware, operating systems, storage, and network capacity over
the Internet from a cloud service provider.
Private Cloud:
,The phrase used to describe a cloud computing platform that is implemented within the
organization. A private cloud is designed to offer the same features and benefits of public
cloud systems but removes a number of objections to the cloud computing model, including
control over enterprise or customer data, worries about security, and issues connected to
regulatory compliance or contractual agreements.
Software as a Service (SaaS):
It is a software delivery method that provides access to software and its functionality remotely
as a web-based service. Software as a Service allows organizations to access business
functionality at a cost typically less than paying for licensed application because SaaS pricing is
based on a monthly fee.
Trusted Cloud Initiative (TCI) Reference Model:
is a guide for cloud providers, allowing them to create a holistic architecture (including the
physical facility of the datacenter, the logical layout of the network, and the processes necessary
to utilize both) that cloud customers can purchase and use with comfort and confidence. For
more information, visit Reference Architecture
Vendor Lock-in:
it occurs in a situation where a customer may be unable to leave, migrate, or transfer to
an alternate provider due to technical or nontechnical constraints.
Vendor Lock-out:
it occurs when a customer is unable to recover or access their own data due to the cloud
provider going into bankruptcy or otherwise leaving the market.
Virtualization:
Creating a virtual (a logical vs. a physical) version of something, including virtual computer
hardware platforms, operating systems, storage devices, and computer network resources.
Computer hardware virtualization is a way of improving overall efficiency. It involves CPUs
that provide support for virtualization in hardware, and other hardware components that help
improve the performance of a guest environment.
, Tangible assets:
The organization is a rental car company; cars are critical to its operations—if it has no cars to
rent to customers, it can't do business.
Intangible assets:
The organization is a music production firm; music is the intellectual property of the company—
if the ownership of the music is compromised (for instance, if the copyright is challenged and the
company loses ownership, or the encryption protecting the music files is removed and the music
can be copied without protection), the company has nothing of value and will not survive.
Processes:
The organization is a fast-food restaurant noted for its speed; the process of taking orders,
preparing and delivering food, and taking payment is critical to its operations—if the restaurant
cannot complete the process for some reason (for instance, the registers fail so that the restaurant
cannot accept payment), the restaurant cannot function.
Data paths:
The organization is an international shipping line; matching orders to cargo carriers is critical to its
operations. If the company cannot complete its logistical coordination—assigning cargo requests to
carriers with sufficient capacity—it cannot provide its services, and will not survive.
Personnel:
The organization is a surgical provider; the surgeon is critical to the existence of the
company— if the surgeon cannot operate, there is no company.
From a cloud provider perspective, a layered defense should entail (4x)
· Strong personnel controls, involving background checks and continual monitoring
· Technological controls such as encryption, event logging, and access control enforcement
· Physical controls related to both the overall campus, the various facilities, the areas within
the datacenter where data is processed and stored, individual racks and particular devices, and
portable media entering and leaving the campus
· Governance mechanisms and enforcement, such as strong policies and regular, thorough audits
Correct Answers.
Cloud Provider:
A service provider that offers customer storage or software solutions available via a public
network, usually the Internet. The cloud provider dictates both the technology and
operational procedures involved.
Cloud Services Broker (CSB):
Typically a third-party entity or company that looks to extend or enhance value to multiple
customers of cloud-based services through relationships with multiple cloud service providers. It
acts as a liaison between cloud services customers and cloud service providers, selecting the best
provider for each customer and monitoring the services.
Cloud Storage:
The storage of data online in the cloud, wherein a company's data is stored in an accessible form
from multiple distributed and connected resources that comprise a cloud.
Cloud Testing:
Load and performance testing conducted on the applications and services provided by a
cloud provider, particularly the capability to access the services, in order to ensure optimal
performance and scalability under a wide variety of conditions.
Community Cloud:
A model where the cloud infrastructure is designed for use by a specific community.
Generally, this is a community of users or consumers with shared concerns, missions, and/or
security requirements.
Enterprise Application:
The term used to describe applications or software that a business would use to assist
the organization in solving enterprise problems.
,Eucalyptus:
An open source cloud computing and Infrastructure as a Service (IaaS) platform for
enabling private clouds.
FIPS 140-2
A NIST document that lists accredited and outmoded cryptosystems.
Hybrid Cloud:
A cloud solution that mixes elements of public, private, and community cloud models.
Infrastructure as a Service (IaaS)
Offers only hardware and administration, leaving the customer responsible for the OS and other
software.
Managed Service Provider:
An IT service where the customer dictates both the technology and operational procedures,
and an external party executes administration and operational support according to a contract.
Multi-Tenant:
Multiple customers using the same public cloud (and often the same hosts, in a virtualized cloud
environment).
NIST 800-53:
A guidance document with the primary goal of ensuring that appropriate security requirements
and controls are applied to all U.S. federal government information in information
management systems.
Platform as a Service (PaaS):
A way for customers to rent hardware, operating systems, storage, and network capacity over
the Internet from a cloud service provider.
Private Cloud:
,The phrase used to describe a cloud computing platform that is implemented within the
organization. A private cloud is designed to offer the same features and benefits of public
cloud systems but removes a number of objections to the cloud computing model, including
control over enterprise or customer data, worries about security, and issues connected to
regulatory compliance or contractual agreements.
Software as a Service (SaaS):
It is a software delivery method that provides access to software and its functionality remotely
as a web-based service. Software as a Service allows organizations to access business
functionality at a cost typically less than paying for licensed application because SaaS pricing is
based on a monthly fee.
Trusted Cloud Initiative (TCI) Reference Model:
is a guide for cloud providers, allowing them to create a holistic architecture (including the
physical facility of the datacenter, the logical layout of the network, and the processes necessary
to utilize both) that cloud customers can purchase and use with comfort and confidence. For
more information, visit Reference Architecture
Vendor Lock-in:
it occurs in a situation where a customer may be unable to leave, migrate, or transfer to
an alternate provider due to technical or nontechnical constraints.
Vendor Lock-out:
it occurs when a customer is unable to recover or access their own data due to the cloud
provider going into bankruptcy or otherwise leaving the market.
Virtualization:
Creating a virtual (a logical vs. a physical) version of something, including virtual computer
hardware platforms, operating systems, storage devices, and computer network resources.
Computer hardware virtualization is a way of improving overall efficiency. It involves CPUs
that provide support for virtualization in hardware, and other hardware components that help
improve the performance of a guest environment.
, Tangible assets:
The organization is a rental car company; cars are critical to its operations—if it has no cars to
rent to customers, it can't do business.
Intangible assets:
The organization is a music production firm; music is the intellectual property of the company—
if the ownership of the music is compromised (for instance, if the copyright is challenged and the
company loses ownership, or the encryption protecting the music files is removed and the music
can be copied without protection), the company has nothing of value and will not survive.
Processes:
The organization is a fast-food restaurant noted for its speed; the process of taking orders,
preparing and delivering food, and taking payment is critical to its operations—if the restaurant
cannot complete the process for some reason (for instance, the registers fail so that the restaurant
cannot accept payment), the restaurant cannot function.
Data paths:
The organization is an international shipping line; matching orders to cargo carriers is critical to its
operations. If the company cannot complete its logistical coordination—assigning cargo requests to
carriers with sufficient capacity—it cannot provide its services, and will not survive.
Personnel:
The organization is a surgical provider; the surgeon is critical to the existence of the
company— if the surgeon cannot operate, there is no company.
From a cloud provider perspective, a layered defense should entail (4x)
· Strong personnel controls, involving background checks and continual monitoring
· Technological controls such as encryption, event logging, and access control enforcement
· Physical controls related to both the overall campus, the various facilities, the areas within
the datacenter where data is processed and stored, individual racks and particular devices, and
portable media entering and leaving the campus
· Governance mechanisms and enforcement, such as strong policies and regular, thorough audits
