MANAGING CLOUD SECURITY COMPREHENSIVE EXAM
QUESTIONS AND ANSWERS GRADED A+
✔✔Entails a procedure that involves multiple people, each with access to only a portion
of the key. - ✔✔Key recovery
✔✔Describes those items that will be the first things that let you know something is
inappropriate. - ✔✔Key risk indicator
✔✔The practice of having multiple overlapping means of securing the environment with
a variety of methods. - ✔✔Layered defenses
✔✔Causes a wide variety of problems, including data loss, loss of control of devices,
interruption of operations, and so forth. - ✔✔Malware
✔✔The plane that controls the entire infrastructure. Because parts of it are exposed to
customers independent of the network location, it is a prime resource to protect. -
✔✔Management Plane
✔✔A weak form of confidentiality assurance that replaces the original information with
asterisks or Xs.
A technique that hides the data with useless characters, e.g., showing only the last four
digits of a social security number. - ✔✔Masking
✔✔The measure of the average time between failures of a specific component or part of
a system. - ✔✔Mean time between failure (MTBF)
✔✔The measure of the average time it should take to repair a failed component or part
of a system. - ✔✔Mean time to repair (MTTR)
✔✔A process of taking steps to decrease the likelihood or the impact of the risk--this
can take the form of controls/countermeasures and is usually where security
practitioners are involved. - ✔✔Mitigation
✔✔A form of cloud storage that applies to storing an individual's mobile device data in
the cloud and providing the individual with access to the data from anywhere. -
✔✔Mobile Cloud Storage
✔✔A method of computer access control that a user can pass by successfully
presenting authentication factors from two or more independent credentials: what the
user knows (password), what the user has (security token), and what the user is
(biometric verification). - ✔✔Multifactor Authentication
,✔✔The concept of sharing resources with other cloud customers simultaneously. -
✔✔Multitenancy
✔✔Multiple customers using the same public cloud. - ✔✔Multitenant
✔✔A NIST publication written to ensure that appropriate security requirements and
security controls are applied to all U.S. federal government information and information
management systems. - ✔✔National Institute of Standards and Technology (NIST) SP
800-53
✔✔Helps to check not only the hardware and the software but the distribution facets
such as SDN control planes. - ✔✔Network monitoring
✔✔A guide for implementing the risk management framework, which is a methodology
for handling all organizational risks in a comprehensive manner. - ✔✔NIST SP 800-37
✔✔The assurance that a specific author actually did create and send a specific item to
a specific recipient and that it was successfully received. With assurance of
nonrepudiation, the sender of the message cannot later credibly deny having sent the
message, nor can the recipient credibly claim not to have received it. -
✔✔Nonrepudiation
✔✔Informs an individual that personal information about them is being gathered or
created. - ✔✔Notice
✔✔The convoluting of code to such a degree that even if the source code is obtained, it
is not easily decipherable. - ✔✔Obfuscation
✔✔Additional metadata, such as content type, redundancy required, and creation date,
that is stored for a file. These objects are accessible through application programming
interfaces (APIs) and potentially through a web user interface (UI).
Stores all data in a filesystem and also gives access to the customers to the parts of the
hierarchy to which they are assigned. - ✔✔Object Storage
✔✔Allows a significant level of description, including the marking, labels, classification
and categorization; it also enhances the opportunity for indexing capabilities. -
✔✔Object-based storage
✔✔Leverages the Internet and cloud computing to create an attractive offsite storage
solution with little hardware requirements for any business of any size. - ✔✔Online
Backup
,✔✔A framework of so-called containers for all components of application security best
practices catalogued and leveraged by the organization. - ✔✔Organizational Normative
Framework (ONF)
✔✔Used to alert administrators when usage approaches a level of capacity utilization
that may affect SLA parameters. - ✔✔OS logging
✔✔The cloud provider is responsible for installing, maintaining, and administering the
OS(s). - ✔✔PaaS boundaries
✔✔What is the intellectual property protection for a useful manufacturing innovation?
A Trademark
B Trade secret
C Copyright
D Patent - ✔✔D
✔✔A form of cloud storage that applies to storing an individual's data in the cloud and
providing the individual with access to the data from anywhere. - ✔✔Personal Cloud
Storage
✔✔Any information relating to an identified or identifiable data subject; an identifiable
person is one who can be identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his physical, physiological,
mental, economic, cultural, or social identity. - ✔✔Personal Data
✔✔Information that can be traced back to an individual user, such as name, postal
address, or email address. Personal user preferences tracked by a website via a cookie
are also considered personally identifiable when linked to other PII you provide online. -
✔✔Personally Identifiable Information (PII)
✔✔Provides increased level of robustness among personnel resources who administer
and support the IT components. - ✔✔Personnel redundancy
✔✔A malicious or negligent insider who can cause significant negative impact, as they
have physical access to the resources. - ✔✔Personnel threat
✔✔____________________ abstracts and provides development or application
platforms, such as databases, application platforms (e.g. a place to run Python, PHP, or
other code), file storage and collaboration, or even proprietary application processing
(such as machine learning, big data processing, or direct API access to features of a full
, SaaS application). The key differentiator is that, with PaaS, you don't manage the
underlying servers, networks, or other infrastructure.
It contains everything included in IaaS, with the addition of OSs. This model is
especially useful for software development operations (DevOps). - ✔✔Platform as a
Service (PaaS)
✔✔Provide a voice and expression to the strategic goals and objectives of
management. - ✔✔Policies
✔✔Serves as the enforcement arm of authentication and authorization and is
established based on business needs and senior management decisions. - ✔✔Policy
management
✔✔Behooves the cloud provider to ensure that all communication lines are replicated
on opposite sides of each building. - ✔✔Power line redundancy
✔✔A private cloud configuration is a legacy configuration of a datacenter, often with
distributed computing and BYOD capabilities. - ✔✔Private cloud
✔✔Used by organizations to enable their information technology (IT) infrastructures to
become more capable of quickly adapting to continually evolving business needs and
requirements. - ✔✔Private Cloud Project
✔✔A form of cloud storage in which the enterprise data and cloud storage resources
reside within the enterprise's data center and behind the firewall. - ✔✔Private Cloud
Storage
✔✔A form of cloud storage in which the enterprise and storage service provider are
separate and the data is stored outside the enterprise's data center. - ✔✔Public Cloud
Storage
✔✔Includes whether the information will be shared with any other entity. - ✔✔Purpose
✔✔The capability of a network to provide better service to selected network traffic over
various technologies, including Frame Relay, Asynchronous Transfer Mode (ATM),
Ethernet and 802.1 networks, synchronous optical networking (SONET), and Internet
protocol (IP)-routed networks that may use any or all of these underlying technologies. -
✔✔Quality of Service (QoS)
✔✔A technique which allows the replacement of the data with random characters,
leaving the other traits intact such as length of the string and character set. -
✔✔Randomization
QUESTIONS AND ANSWERS GRADED A+
✔✔Entails a procedure that involves multiple people, each with access to only a portion
of the key. - ✔✔Key recovery
✔✔Describes those items that will be the first things that let you know something is
inappropriate. - ✔✔Key risk indicator
✔✔The practice of having multiple overlapping means of securing the environment with
a variety of methods. - ✔✔Layered defenses
✔✔Causes a wide variety of problems, including data loss, loss of control of devices,
interruption of operations, and so forth. - ✔✔Malware
✔✔The plane that controls the entire infrastructure. Because parts of it are exposed to
customers independent of the network location, it is a prime resource to protect. -
✔✔Management Plane
✔✔A weak form of confidentiality assurance that replaces the original information with
asterisks or Xs.
A technique that hides the data with useless characters, e.g., showing only the last four
digits of a social security number. - ✔✔Masking
✔✔The measure of the average time between failures of a specific component or part of
a system. - ✔✔Mean time between failure (MTBF)
✔✔The measure of the average time it should take to repair a failed component or part
of a system. - ✔✔Mean time to repair (MTTR)
✔✔A process of taking steps to decrease the likelihood or the impact of the risk--this
can take the form of controls/countermeasures and is usually where security
practitioners are involved. - ✔✔Mitigation
✔✔A form of cloud storage that applies to storing an individual's mobile device data in
the cloud and providing the individual with access to the data from anywhere. -
✔✔Mobile Cloud Storage
✔✔A method of computer access control that a user can pass by successfully
presenting authentication factors from two or more independent credentials: what the
user knows (password), what the user has (security token), and what the user is
(biometric verification). - ✔✔Multifactor Authentication
,✔✔The concept of sharing resources with other cloud customers simultaneously. -
✔✔Multitenancy
✔✔Multiple customers using the same public cloud. - ✔✔Multitenant
✔✔A NIST publication written to ensure that appropriate security requirements and
security controls are applied to all U.S. federal government information and information
management systems. - ✔✔National Institute of Standards and Technology (NIST) SP
800-53
✔✔Helps to check not only the hardware and the software but the distribution facets
such as SDN control planes. - ✔✔Network monitoring
✔✔A guide for implementing the risk management framework, which is a methodology
for handling all organizational risks in a comprehensive manner. - ✔✔NIST SP 800-37
✔✔The assurance that a specific author actually did create and send a specific item to
a specific recipient and that it was successfully received. With assurance of
nonrepudiation, the sender of the message cannot later credibly deny having sent the
message, nor can the recipient credibly claim not to have received it. -
✔✔Nonrepudiation
✔✔Informs an individual that personal information about them is being gathered or
created. - ✔✔Notice
✔✔The convoluting of code to such a degree that even if the source code is obtained, it
is not easily decipherable. - ✔✔Obfuscation
✔✔Additional metadata, such as content type, redundancy required, and creation date,
that is stored for a file. These objects are accessible through application programming
interfaces (APIs) and potentially through a web user interface (UI).
Stores all data in a filesystem and also gives access to the customers to the parts of the
hierarchy to which they are assigned. - ✔✔Object Storage
✔✔Allows a significant level of description, including the marking, labels, classification
and categorization; it also enhances the opportunity for indexing capabilities. -
✔✔Object-based storage
✔✔Leverages the Internet and cloud computing to create an attractive offsite storage
solution with little hardware requirements for any business of any size. - ✔✔Online
Backup
,✔✔A framework of so-called containers for all components of application security best
practices catalogued and leveraged by the organization. - ✔✔Organizational Normative
Framework (ONF)
✔✔Used to alert administrators when usage approaches a level of capacity utilization
that may affect SLA parameters. - ✔✔OS logging
✔✔The cloud provider is responsible for installing, maintaining, and administering the
OS(s). - ✔✔PaaS boundaries
✔✔What is the intellectual property protection for a useful manufacturing innovation?
A Trademark
B Trade secret
C Copyright
D Patent - ✔✔D
✔✔A form of cloud storage that applies to storing an individual's data in the cloud and
providing the individual with access to the data from anywhere. - ✔✔Personal Cloud
Storage
✔✔Any information relating to an identified or identifiable data subject; an identifiable
person is one who can be identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his physical, physiological,
mental, economic, cultural, or social identity. - ✔✔Personal Data
✔✔Information that can be traced back to an individual user, such as name, postal
address, or email address. Personal user preferences tracked by a website via a cookie
are also considered personally identifiable when linked to other PII you provide online. -
✔✔Personally Identifiable Information (PII)
✔✔Provides increased level of robustness among personnel resources who administer
and support the IT components. - ✔✔Personnel redundancy
✔✔A malicious or negligent insider who can cause significant negative impact, as they
have physical access to the resources. - ✔✔Personnel threat
✔✔____________________ abstracts and provides development or application
platforms, such as databases, application platforms (e.g. a place to run Python, PHP, or
other code), file storage and collaboration, or even proprietary application processing
(such as machine learning, big data processing, or direct API access to features of a full
, SaaS application). The key differentiator is that, with PaaS, you don't manage the
underlying servers, networks, or other infrastructure.
It contains everything included in IaaS, with the addition of OSs. This model is
especially useful for software development operations (DevOps). - ✔✔Platform as a
Service (PaaS)
✔✔Provide a voice and expression to the strategic goals and objectives of
management. - ✔✔Policies
✔✔Serves as the enforcement arm of authentication and authorization and is
established based on business needs and senior management decisions. - ✔✔Policy
management
✔✔Behooves the cloud provider to ensure that all communication lines are replicated
on opposite sides of each building. - ✔✔Power line redundancy
✔✔A private cloud configuration is a legacy configuration of a datacenter, often with
distributed computing and BYOD capabilities. - ✔✔Private cloud
✔✔Used by organizations to enable their information technology (IT) infrastructures to
become more capable of quickly adapting to continually evolving business needs and
requirements. - ✔✔Private Cloud Project
✔✔A form of cloud storage in which the enterprise data and cloud storage resources
reside within the enterprise's data center and behind the firewall. - ✔✔Private Cloud
Storage
✔✔A form of cloud storage in which the enterprise and storage service provider are
separate and the data is stored outside the enterprise's data center. - ✔✔Public Cloud
Storage
✔✔Includes whether the information will be shared with any other entity. - ✔✔Purpose
✔✔The capability of a network to provide better service to selected network traffic over
various technologies, including Frame Relay, Asynchronous Transfer Mode (ATM),
Ethernet and 802.1 networks, synchronous optical networking (SONET), and Internet
protocol (IP)-routed networks that may use any or all of these underlying technologies. -
✔✔Quality of Service (QoS)
✔✔A technique which allows the replacement of the data with random characters,
leaving the other traits intact such as length of the string and character set. -
✔✔Randomization
