Science Computer Science Computer Security and Reliability
WGU - D320
Save
Students also studied
Flashcard sets Study guides
D320 D320 OA Review WGU Course C838 -
75 terms 77 terms Teacher 1,037 terms
r_mm11 Preview bwiesm3 Preview Nm_Ali
A. Domain Name System Security Extensions (DNSSEC)
B. Internet Protocol Security (IPSec) VPN
C. Web Application Firewall (WAF)
D. Data Loss Prevention (DLP)
Correct Answer: B. Internet Protocol Security (IPSec) VPN
Explanation:
1: Implements Secure Solutions
• IPSec VPN is designed to secure communication over an IP
Which technology should be
network. It encrypts the entire IP packet for secure transmission
implemented to ensure secure
between on-site systems and cloud platforms, ensuring data
communication between on-site
integrity and confidentiality.
enterprise systems and a cloud
• DNSSEC ensures the integrity of DNS responses but doesn't
platform
provide secure communication between systems.
• WAF protects web applications by filtering and monitoring
HTTP traffic but is not used for secure communication between
systems.
• DLP prevents data breaches by monitoring and controlling data
flows, but it doesn't establish secure communication channels.
A. Share
B. Store
C. Use
D. Destroy
2: Implements Operations
Correct Answer: B. Store
Which phase of the cloud data
Explanation:
lifecycle is most likely to overlap
• Store often overlaps with the Create phase because as soon as
with the 'Create' phase in terms
data is created, it usually needs to be securely stored. Security
of implementing security
controls, such as encryption, should be implemented at this
controls
stage.
• Share and Use happen after data is stored.
• Destroy is the final stage in the lifecycle and typically occurs
after data is no longer needed.
, A. Mitigation
B. Avoidance
C. Transfer
D. Acceptance
3: Conducts Risk Management Correct Answer: B. Avoidance
Which risk management Explanation:
approach involves completely • Avoidance involves eliminating the risk entirely, typically when
eliminating a risk because it the potential impact is too great or when controls cannot
exceeds the organization's risk adequately reduce the risk to an acceptable level.
appetite • Mitigation involves reducing the risk to an acceptable level.
• Transfer involves shifting the risk to a third party, such as
through insurance.
• Acceptance involves acknowledging the risk and choosing to
bear it without further action.
A. Health Insurance Portability and Accountability Act (HIPAA)
B. Sarbanes-Oxley Act (SOX)
C. Gramm-Leach-Bliley Act (GLBA)
D. Safe Harbor
Correct Answer: C. Gramm-Leach-Bliley Act (GLBA)
4: Identifies Legal, Compliance,
Explanation:
and Ethical Concerns
• GLBA is designed to protect consumer financial privacy by
Which United States law focuses
setting regulations for how financial institutions handle private
specifically on the privacy of
data.
financial information
• HIPAA focuses on healthcare information.
• SOX is concerned with corporate financial practices and
reporting.
• Safe Harbor was an agreement between the US and EU for data
transfers, not specifically financial privacy.
A. Data Masking
B. Tokenization
C. Encryption
1: Implements Secure Solutions D. Obfuscation
Which technology is most Correct Answer: C. Encryption
effective in preventing Explanation: Encryption transforms readable data into an
unauthorized access to sensitive unreadable format using cryptographic algorithms, making it
data by ensuring it is unreadable inaccessible to unauthorized users. Tokenization and data
without proper decryption keys masking are also methods of protecting data, but they do not
provide the same level of security as encryption. Obfuscation is
the process of making data more difficult to understand but is
not intended to prevent access.
A. Static Analysis
B. Code Review
C. Dynamic Analysis
2: Implements Operations D. Acceptance Testing
Which of the following activities Correct Answer: C. Dynamic Analysis
is essential during the Secure Explanation: Dynamic Analysis is crucial during the secure
Operations phase of the operations phase because it involves testing the software in a
Software Development Lifecycle runtime environment, identifying security vulnerabilities that
(SDLC) might only become apparent during execution. Static Analysis
and Code Review are performed earlier in the SDLC, and
Acceptance Testing is typically done after secure operations to
verify the system meets the requirements.
, A. Risk Mitigation
B. Risk Avoidance
C. Risk Transference
3: Conducts Risk Management D. Risk Acceptance
Which risk management Correct Answer: C. Risk Transference
approach involves the transfer Explanation: Risk Transference involves shifting the impact of a
of risk to another party, such as risk to a third party, often by using insurance or outsourcing
through insurance certain activities. Risk Mitigation involves reducing the risk, Risk
Avoidance involves eliminating the risk, and Risk Acceptance
involves acknowledging and accepting the risk without further
action.
A. Sarbanes-Oxley Act (SOX)
B. Health Insurance Portability and Accountability Act (HIPAA)
C. Gramm-Leach-Bliley Act (GLBA)
4: Identifies Legal, Compliance,
D. Federal Information Security Management Act (FISMA)
and Ethical Concerns
Correct Answer: B. Health Insurance Portability and
Which U.S. law focuses
Accountability Act (HIPAA)
specifically on the protection of
Explanation: HIPAA sets standards for the protection of personal
personal health information
health information. SOX is related to corporate financial
practices, GLBA focuses on financial privacy, and FISMA applies
to federal information security management.
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
5: Implements Secure Solutions
D. Containers as a Service (CaaS)
Which cloud service model
Correct Answer: C. Infrastructure as a Service (IaaS)
requires the customer to
Explanation: In IaaS, the provider manages the underlying
manage the security of the
infrastructure, while the customer is responsible for managing
operating system, applications,
the security of the operating system, applications, and data. In
and data
SaaS, the provider manages everything, including security. PaaS
offers more management of security, but the customer still
handles application security.
A. Ensure high availability of cloud services
B. Recover operations after a catastrophic event
C. Perform routine backups of data
6: Implements Operations D. Prevent unauthorized access to cloud resources
What is the primary goal of Correct Answer: B. Recover operations after a catastrophic event
implementing a Disaster Explanation: The main goal of a Disaster Recovery Plan is to
Recovery Plan (DRP) in cloud recover business operations as quickly as possible after a
operations catastrophic event. High availability is a separate concern,
focusing on maintaining operations, while backups are part of
DRP but not the primary goal. Preventing unauthorized access is
a security concern, not specifically related to DRP.
A. Risk Assessment
B. Business Impact Analysis (BIA)
C. Threat Modeling
7: Conducts Risk Management
D. Risk Avoidance
Which risk management process
Correct Answer: B. Business Impact Analysis (BIA)
involves determining the impact
Explanation: BIA identifies the effects of potential threats on
of potential threats on business
business operations and helps prioritize recovery efforts. Risk
operations
Assessment identifies risks, Threat Modeling focuses on
identifying and mitigating threats, and Risk Avoidance involves
eliminating risks.
WGU - D320
Save
Students also studied
Flashcard sets Study guides
D320 D320 OA Review WGU Course C838 -
75 terms 77 terms Teacher 1,037 terms
r_mm11 Preview bwiesm3 Preview Nm_Ali
A. Domain Name System Security Extensions (DNSSEC)
B. Internet Protocol Security (IPSec) VPN
C. Web Application Firewall (WAF)
D. Data Loss Prevention (DLP)
Correct Answer: B. Internet Protocol Security (IPSec) VPN
Explanation:
1: Implements Secure Solutions
• IPSec VPN is designed to secure communication over an IP
Which technology should be
network. It encrypts the entire IP packet for secure transmission
implemented to ensure secure
between on-site systems and cloud platforms, ensuring data
communication between on-site
integrity and confidentiality.
enterprise systems and a cloud
• DNSSEC ensures the integrity of DNS responses but doesn't
platform
provide secure communication between systems.
• WAF protects web applications by filtering and monitoring
HTTP traffic but is not used for secure communication between
systems.
• DLP prevents data breaches by monitoring and controlling data
flows, but it doesn't establish secure communication channels.
A. Share
B. Store
C. Use
D. Destroy
2: Implements Operations
Correct Answer: B. Store
Which phase of the cloud data
Explanation:
lifecycle is most likely to overlap
• Store often overlaps with the Create phase because as soon as
with the 'Create' phase in terms
data is created, it usually needs to be securely stored. Security
of implementing security
controls, such as encryption, should be implemented at this
controls
stage.
• Share and Use happen after data is stored.
• Destroy is the final stage in the lifecycle and typically occurs
after data is no longer needed.
, A. Mitigation
B. Avoidance
C. Transfer
D. Acceptance
3: Conducts Risk Management Correct Answer: B. Avoidance
Which risk management Explanation:
approach involves completely • Avoidance involves eliminating the risk entirely, typically when
eliminating a risk because it the potential impact is too great or when controls cannot
exceeds the organization's risk adequately reduce the risk to an acceptable level.
appetite • Mitigation involves reducing the risk to an acceptable level.
• Transfer involves shifting the risk to a third party, such as
through insurance.
• Acceptance involves acknowledging the risk and choosing to
bear it without further action.
A. Health Insurance Portability and Accountability Act (HIPAA)
B. Sarbanes-Oxley Act (SOX)
C. Gramm-Leach-Bliley Act (GLBA)
D. Safe Harbor
Correct Answer: C. Gramm-Leach-Bliley Act (GLBA)
4: Identifies Legal, Compliance,
Explanation:
and Ethical Concerns
• GLBA is designed to protect consumer financial privacy by
Which United States law focuses
setting regulations for how financial institutions handle private
specifically on the privacy of
data.
financial information
• HIPAA focuses on healthcare information.
• SOX is concerned with corporate financial practices and
reporting.
• Safe Harbor was an agreement between the US and EU for data
transfers, not specifically financial privacy.
A. Data Masking
B. Tokenization
C. Encryption
1: Implements Secure Solutions D. Obfuscation
Which technology is most Correct Answer: C. Encryption
effective in preventing Explanation: Encryption transforms readable data into an
unauthorized access to sensitive unreadable format using cryptographic algorithms, making it
data by ensuring it is unreadable inaccessible to unauthorized users. Tokenization and data
without proper decryption keys masking are also methods of protecting data, but they do not
provide the same level of security as encryption. Obfuscation is
the process of making data more difficult to understand but is
not intended to prevent access.
A. Static Analysis
B. Code Review
C. Dynamic Analysis
2: Implements Operations D. Acceptance Testing
Which of the following activities Correct Answer: C. Dynamic Analysis
is essential during the Secure Explanation: Dynamic Analysis is crucial during the secure
Operations phase of the operations phase because it involves testing the software in a
Software Development Lifecycle runtime environment, identifying security vulnerabilities that
(SDLC) might only become apparent during execution. Static Analysis
and Code Review are performed earlier in the SDLC, and
Acceptance Testing is typically done after secure operations to
verify the system meets the requirements.
, A. Risk Mitigation
B. Risk Avoidance
C. Risk Transference
3: Conducts Risk Management D. Risk Acceptance
Which risk management Correct Answer: C. Risk Transference
approach involves the transfer Explanation: Risk Transference involves shifting the impact of a
of risk to another party, such as risk to a third party, often by using insurance or outsourcing
through insurance certain activities. Risk Mitigation involves reducing the risk, Risk
Avoidance involves eliminating the risk, and Risk Acceptance
involves acknowledging and accepting the risk without further
action.
A. Sarbanes-Oxley Act (SOX)
B. Health Insurance Portability and Accountability Act (HIPAA)
C. Gramm-Leach-Bliley Act (GLBA)
4: Identifies Legal, Compliance,
D. Federal Information Security Management Act (FISMA)
and Ethical Concerns
Correct Answer: B. Health Insurance Portability and
Which U.S. law focuses
Accountability Act (HIPAA)
specifically on the protection of
Explanation: HIPAA sets standards for the protection of personal
personal health information
health information. SOX is related to corporate financial
practices, GLBA focuses on financial privacy, and FISMA applies
to federal information security management.
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
5: Implements Secure Solutions
D. Containers as a Service (CaaS)
Which cloud service model
Correct Answer: C. Infrastructure as a Service (IaaS)
requires the customer to
Explanation: In IaaS, the provider manages the underlying
manage the security of the
infrastructure, while the customer is responsible for managing
operating system, applications,
the security of the operating system, applications, and data. In
and data
SaaS, the provider manages everything, including security. PaaS
offers more management of security, but the customer still
handles application security.
A. Ensure high availability of cloud services
B. Recover operations after a catastrophic event
C. Perform routine backups of data
6: Implements Operations D. Prevent unauthorized access to cloud resources
What is the primary goal of Correct Answer: B. Recover operations after a catastrophic event
implementing a Disaster Explanation: The main goal of a Disaster Recovery Plan is to
Recovery Plan (DRP) in cloud recover business operations as quickly as possible after a
operations catastrophic event. High availability is a separate concern,
focusing on maintaining operations, while backups are part of
DRP but not the primary goal. Preventing unauthorized access is
a security concern, not specifically related to DRP.
A. Risk Assessment
B. Business Impact Analysis (BIA)
C. Threat Modeling
7: Conducts Risk Management
D. Risk Avoidance
Which risk management process
Correct Answer: B. Business Impact Analysis (BIA)
involves determining the impact
Explanation: BIA identifies the effects of potential threats on
of potential threats on business
business operations and helps prioritize recovery efforts. Risk
operations
Assessment identifies risks, Threat Modeling focuses on
identifying and mitigating threats, and Risk Avoidance involves
eliminating risks.
