C838 - Pre Assessment
44. Which design principle of secure cloud computing ensures that users can utilize data and applications from around the globe? Scalability Portability Broad network access On-demand self-service
Broad network access
39. Which technology allows an organization to control access to sensitive documents stored in the cloud? Digital rights management (DRM) Database activity monitoring (DAM) Identity and access management (IAM) Distributed resource scheduling (DRS)
Digital rights management (DRM)
83. Which open web application security project (OWASP) Top 9 Coding Flaws leads to security issues? Denial-of-service Client-side injection Cross-site scripting Direct object reference
Direct object reference
43. Which design principle of secure cloud computing ensures that the business can resume essential operations in the event of an availability-affecting incident? Access control Resource pooling Disaster recovery Session management
Disaster recovery
74. Which approach is considered a black-box security testing method? Source code review Binary code inspection Static application security testing Dynamic application security testing
Dynamic application security testing
16. Which jurisdictional data protection controls the ways that financial institutions deal with the private information of individuals? Sarbanes-Oxley act (SOX) Gramm-Leach-Bliley act (GLBA) Stored communications act (SCA) Health insurance portability and accountability act (HIPAA)
Gramm-Leach-Bliley act (GLBA)
61. Which element is a cloud virtualization risk? Licensing Jurisdiction Guest isolation Electronic discovery
Guest isolation
113. Which international standard guide provides procedures for incident investigation principles and processes? ISO/IEC 27034-1:2011 ISO/IEC 27037:2012 ISO/IEC 27001:2013 ISO/IEC 27043:2015
ISO/IEC 27043:2015
47. Which standard addresses practices related to acquisition of forensic artifacts and can be directly applied to a cloud environment? ISO/IEC 27001 ISO/IEC 27050-1 NIST SP 500-291 NIST SP 800-145
ISO/IEC 27050-1
24. A security analyst is investigating an incident of access to a resource from an unauthorized location. Which data source should the security analyst use to investigate the incident? Vulnerability assessment report Packet capture file Windows health report Linux dmesg logs
Packet capture file
54. What is a component of device hardening? Patching Unit testing Versioning Configuring VPN access
Patching
124. Which item is required in a cloud contract? Strategy for the SDLC Specifications for unit testing Penalties for failure to meet SLA Diagrams for data flow structures
Penalties for failure to meet SLA
116. Which penalty is imposed for privacy violations under the general data protection regulation (GDPR)? Penalty up to 10 million Euros Penalty up to 20 million Euros Penalty up to 2% of gross income Penalty up to 5% of gross income
Penalty up to 20 million Euros
81. Which security threat occurs when a developer leaves an unauthorized access interface within an application after release? Easter egg Deprecated API Persistent backdoor Development operations
Persistent backdoor
91. Which risk is associated with malicious and accidental dangers to a cloud infrastructure? External attacks Personnel threats Natural disasters Regulatory noncompliance
Personnel threats
93. Which risk is controlled by implementing a private cloud? Eavesdropping Physical security Unauthorized access Denial-of-service (DoS)
Physical security
15. Which jurisdictional data protection includes dealing with the international transfer of data? Privacy regulation Financial modernization Sarbanes-Oxley act (SOX) Secure choice authorization (SCA)
Privacy regulation
36. Which cloud deployment model is operated for a single organization? Private Public Hybrid Consortium
Private
37. Which cloud model provides data location assurance? Hybrid Public Private Community
Private
38. Which cloud model allows the consumer to have sole responsibility for management and governance? Hybrid Public Private Community
Private
88. Which type of cloud deployment model is considered equivalent to a traditional IT architecture? Public Hybrid Private Community
Private
70. Which description characterizes<b> </b>the application programming interface (API) format known as representational state transfer (REST)? Tolerates errors at a high level Supports only extensible markup language (XML) Delivers a slower performance with complex scalability Provides a framework for developing scalable web applications
Provides a framework for developing scalable web applications
10. Which encryption technique connects the instance to the encryption instance that handles all crypto operations? Proxy Database Server-side Externally managed
Proxy
82. Which process prevents the environment from being over-controlled by security measures to the point where application performance is impacted? Private cloud Community cloud Quality of service (QoS) Trusted cloud initiative (TCI)
Quality of service (QoS)
123. Which requirement is included when exceptions, restrictions, and potential risks are highlighted in a cloud services contract? Load balancer algorithm Stockholder expectations Regulatory and compliance Virtual machine and operating system
Regulatory and compliance
115. Which action is required for breaches of data under the general data protection regulation (GDPR) within 72 hours of becoming aware of the event? Notifying the affected persons Reporting to the supervisory authority Suspending the processing operations Informing consumer credit reporting services
Reporting to the supervisory authority
45. Which design principle of secure cloud computing involves deploying cloud service provider resources to maximize availability in the event of a failure? Elasticity Resiliency Clustering Scalability
Resiliency
50. Which logical design decision can be attributed to required regulation? Retention formats Retention periods Database reads/second Database writes/second
Retention periods
33. Which option should an organization choose if there is a need to avoid software ownership? Software as a service (SaaS) Platform as a service (PaaS) Containers as a service (CaaS) Infrastructure as a service (IaaS)
Software as a service (SaaS)
51. Which service model influences the logical design by using additional measures in the application to enhance security? Public cloud Hybrid cloud Platform as a service (PaaS) Software as a service (SaaS)
Software as a service (SaaS)
72. Which security testing approach is used to review source code and binaries without executing the application? Fuzz testing Regression testing Static application security testing Dynamic application security testing
Static application security testing
65. Which detection and analysis technique is performed to capture a point-in-time picture of the entire stack at the time of an incident? Review data access logs Examine configuration data Collect metadata during alert Create a snapshot using API calls
Create a snapshot using API calls
80. Which method should the cloud consumer use to secure the management plane of the cloud service provider? Credential management Network access control list Agent-based security tooling Disablement of management plane
Credential management
71. Which issue occurs when a web browser is sent data without proper validation? Cross-site scripting (XXS) Cross-site request forgery (CSRF) Insecure direct object access (IDOA) Lightweight directory access protocol (LDAP) injection
Cross-site scripting (XXS)
20. Who retains final ownership for granting data access and permissions in a shared responsibility model? Analyst Manager Customer Developer
Customer
12. Which element is protected by an encryption system? Data Public key Ciphertext Management engine
Data
77. Which problem is known as a common supply chain risk? Data breaches Domain spoofing Source code design Runtime application self-protection
Data breaches
28. Which cloud computing tool may help detect data migrations to cloud services? Cloud data transfer Data loss prevention Cloud security gateways Uniform resource locator (URL) filtering
Data loss prevention
96. Which control helps mitigate the risk of sensitive information leaving the cloud environment? Data loss prevention (DLP) Disaster recovery plan (DRP) Web application firewall (WAF) Identity and access management (IAM)
Data loss prevention (DLP)
25. Which message type is generated from software systems to troubleshoot and identify problems with running application codes? Error Debug Warning Informational
Debug
99. Which cloud security control eliminates the risk of a virtualization guest escape from another tenant? Dedicated hosting File integrity monitor Hardware hypervisor Immutable virtual machines
Dedicated hosting
75. Which primary security control should be used by all cloud accounts, including individual users, in order to defend against the widest range of attacks? Perimeter security Logging and monitoring Redundant infrastructure Multi-factor authentication
Multi-factor authentication
95. Which countermeasure helps mitigate the risk of stolen credentials for cloud-based platforms? Host lockdown Data sanitization Key management Multifactor authentication
Multifactor authentication
5. Which cloud data storage architecture allows sensitive data to be replaced with unique identification symbols that retain all the essential information about the data without compromising its security? Obfuscation Tokenization Anonymization Randomization
Tokenization
68. A cloud customer is setting up communication paths with the cloud service provider that will be used in the event of an incident. Which action facilitates this type of communication? Using existing open standards Incorporating checks on API calls Identifying key risk indicators (KRIs) Performing a vulnerability assessment
Using existing open standards
35. Under which method would cloud clients find it impossible to recover or access their own data if their cloud provider goes bankrupt? Multicloud Multitenant Vendor lock-in Vendor lock-out
Vendor lock-out
55. Which technology typically provides security isolation in infrastructure as a service (IaaS) cloud computing? Virtual machines Operating systems Application instance System image repository
Virtual machines
6. Which methodology could cloud data storage utilize to encrypt all data associated in an infrastructure as a service (IaaS) deployment model? Sandbox encryption Client-side encryption Polymorphic encryption Whole-instance encryption
Whole-instance encryption
111. Which process involves the use of electronic data as evidence in a civil or criminal legal case? Due diligence Cloud governance Auditing in the cloud eDiscovery investigations
eDiscovery investigations
27. Which term describes the action of confirming identity access to an information system? Access Concept Coordination Authentication
Authentication
84. Which identity management process targets access to enterprise resources by ensuring that the identity of an entity is verified? Federation Provisioning Authentication Policy management
Authentication
22. Which data retention method is stored with a minimal amount of metadata storage with the content? File system Redundant array Block-based Object-based
Block-based
78. Which phase of the software development life cycle includes determining the business and security requirements for the application to occur? Testing Defining Designing Developing
Defining
4. Which phase of the cloud data life cycle is associated with crypto-shredding? Use Store Share Destroy
Destroy
21. Which data retention solution should be applied to a file in order to reduce the data footprint by deleting fixed content and duplicate data? Saving Backup Caching Archiving
Archiving
85. Which technology improves the ability of the transport layer security (TLS) to ensure privacy when communicating between applications? Volume encryption Whole-disk encryption Virtual private networks (VPNs) Advanced application-specific integrated circuits (ASICs)
Advanced application-specific integrated circuits (ASICs)
101. Which data retention policy controls how long health insurance portability and accountability act (HIPAA) data can be archived? Enforcement Maintenance Data classification Applicable regulation
Applicable regulation
69. Which security control does the software as a service (SaaS) model require as a shared responsibility of all parties involved? Data Platform Application Infrastructure
Application
11. Which type of control should be used to implement custom controls that safeguard data? Application level Management plane Options for access Public and internal sharing
Application level
30. Which cloud computing technology unlocks business value through digital and physical access to maps? Multitenancy Cloud application On-demand self-service Application programming interface
Application programming interface
58. Which action enhances cloud security application deployment through standards such as ISO/IEC 27034 for the development, acquisition, and configuration of software systems? Applying the steps of a cloud software development lifecycle Providing developer access to supporting components and services Outsourcing the infrastructure and integration platform management Verifying the application has an appropriate level of confidentiality and integrity
Applying the steps of a cloud software development lifecycle
79. Which phase of the software development life cycle includes writing application code? Defining Designing Developing Implementing
Developing
49. Which legislation must a trusted cloud service adhere to when utilizing the data of EU citizens? SOX APPI GDPR EMTALA
GDPR
23. What is a key capability of security information and event management? Secure remote access Intrusion prevention capabilities Automatic remediation of issues Centralized collection of log data
Centralized collection of log data
118. Which artifact may be required as a data source for a compliance audit in a cloud environment? Customer SLAs Change management details Quarterly revenue projections Annual actual-to-budgeted expense reports
Change management details
29. Which cloud computing tool is used to discover internal use of cloud services using various mechanisms such as network monitoring? Data loss prevention (DLP) Web application firewall (WAF) Content delivery network (CDN) Cloud access security broker (CASB)
Cloud access security broker (CASB)
106. Where should the location be for the final data backup repository in the event that the disaster recovery plan is enacted for the CSP of disaster recovery (DR) service? Tape drive Local storage Cloud platform Company headquarters
Cloud platform
76. Which cloud infrastructure is shared by several organizations and supports a specific population that has shared concerns (e.g., mission, security requirements, policy, compliance considerations)? Hybrid Public Private Community
Community
87. Which cloud infrastructure is shared by several organizations with common concerns, such as mission, policy, or compliance considerations? Hybrid cloud Public cloud Private cloud Community cloud
Community cloud
67. A CSP provides services in European Union (EU) countries that are subject to the network information security (NIS) directive. The CSP experiences an incident that significantly affects the continuity of the essential services being provided. Who is the CSP required to notify under the NIS directive? Competent authorities Data protection regulator Provider's services suppliers Personal Information Protection Commission
Competent authorities
90. Which attack vector is associated with cloud infrastructure? Compromised API credentials Data storage locations in multiple jurisdictions Seizure and examination of a physical disk Licensing fees tied to the deployment of software based on a per-CPU licensing model
Compromised API credentials
108. Which aspect of business continuity planning considers the alternatives to be used when there is a complete loss of the provider? Ensuring resiliency Managing plane controls Considering portability options Managing cloud provider outages
Considering portability options
109. What is a key method associated with a risk-based approach to business continuity planning? Using existing network technology Leveraging software-defined networking Applying internal authentication and credential passing Considering the degree of continuity required for assets
Considering the degree of continuity required for assets
19. Which security strategy is associated with data rights management solutions? Static policy control Continuous auditing Unrestricted replication Limited documents type support
Continuous auditing
32. What is a key capability of infrastructure as a service (IaaS)? Multiple hosting environments Hosted application management Converged network and IT capacity pool Leased application and software licensing
Converged network and IT capacity pool
1. Which phase of the cloud data lifecycle allows both read and process functions to be performed? Share Store Create Archive
Create
14. A company has recently defined classification levels for its data. During which phase of the cloud data life cycle should this definition occur? Use Share Create Archive
Create
60. Which regulation requires a CSP to comply with copyright law for hosted content? SOX SCA GLBA DMCA
DMCA
100. Which cloud security control is a countermeasure for man-in-the-middle attacks? Reviewing log data Backing up data offsite Using block data storage Encrypting data in transit
Encrypting data in transit
110. Which testing method must be performed to demonstrate the effectiveness of a business continuity plan and procedures? SAST DAST Failover Penetration
Failover
26. Which technology is used to manage identity access management by building trust relationships between organizations? Federation Single sign-on Biometric authentication Multifactor authentication
Federation
9. Which technique scrambles the content of data using a mathematical algorithm while keeping the structural arrangement of the data? Tokenization Dynamic masking Proxy-based encryption Format-preserving encryption
Format-preserving encryption
107. An architect needs to constrain problems to a level that can be controlled when the problem exceeds the capabilities of disaster recovery (DR) controls. Which aspect of the plan will provide this guarantee? Ensuring data backups Managing plane controls Handling provider outages Evaluating portability alternatives
Handling provider outages
86. Which multi-factor authentication (MFA) option uses a physical universal serial bus (USB) device to generate one-time passwords? Biometrics Hard tokens Out-of-band passwords Transaction authentication numbers
Hard tokens
53. Which result is achieved by removing all nonessential services and software of devices for secure configuration of hardware? Patching Lockdown Hardening Maintenance
Hardening
46. Which item should be part of the legal framework analysis if a company wishes to store prescription drug records in a SaaS solution? U.S. Patriot Act Sarbanes-Oxley Act Federal Information Security Modernization Act Health Insurance Portability and Accountability Act
Health Insurance Portability and Accountability Act
17. Which jurisdictional data protection safeguards protected health information (PHI)? Directive 95/46/EC Safe harbor regime Personal Data Protection Act of 2000 Health Insurance Portability and Accountability Act (HIPAA)
Health Insurance Portability and Accountability Act (HIPAA)
52. Which environmental consideration should be addressed when planning the design of a data center? Heating and ventilation Utility power availability Expansion possibilities and growth Telecommunications connections
Heating and ventilation
31. What is a key component of the infrastructure as a service (IaaS) cloud service model? High reliability and resilience Allows choice and reduces lock-in Ease of use and limited administration Supports multiple languages and frameworks
High reliability and resilience
105. Which disaster recovery (DR) site results in the quickest recovery in the event of a disaster? Hot Cold Passive Reserve
Hot
112. Which standard addresses the privacy aspects of cloud computing for consumers? ISO 19011:2011 ISO 27001:2013 ISO 27018:2014 ISO 27017:2015
ISO 27018:2014
66. A CSP operating in Australia experiences a security breach that results in disclosure of personal information that is likely to result in serious harm. Who is the CSP legally required to notify? Cloud Security Alliance Information commissioner Australian privacy foundation Asian-Pacific privacy control board
Information commissioner
34. Which cloud model offers access to a pool of fundamental IT resources such as computing, networking, or storage? Data Platform Application Infrastructure
Infrastructure
64. The security administrator for a global cloud services provider (CSP) is required to globally standardize the approaches for using forensics methodologies in the organization. Which standard should be applied? Sarbanes-Oxley act (SOX) Cloud controls matrix (CCM) International electrotechnical commission (IEC) 27037 International organization for standardization (ISO) 27050-1
International organization for standardization (ISO) 27050-1
40. Which security technology can provide secure network communications from on-site enterprise systems to a cloud platform? Web application firewall (WAF) Data loss prevention (DLP) Domain name system security extensions (DNSSEC) Internet protocol security (IPSec) virtual private network (VPN)
Internet protocol security (IPSec) virtual private network (VPN)
92. Which cloud-specific risk must be considered when moving infrastructure operations to the cloud? Denial of service Natural disasters Regulatory violations Lack of physical access
Lack of physical access
104. Which assumption about a CSP should be avoided when considering risks in a disaster recovery (DR) plan? Provider's history Continuity planning Level of resiliency Costs will remain the same
Level of resiliency
97. Which countermeasure mitigates the risk of a rogue cloud administrator? Data encryption Platform orchestration Logging and monitoring Multifactor authentication
Logging and monitoring
62. Which risk is related to interception of data in transit? Virtualization Traffic blocking Man-in-the-middle Software vulnerabilities
Man-in-the-middle
56. Which technology allows an administrator to remotely manage a fleet of servers? Bastion host Management plane VPN concentrator KVM switch
Management plane
57. What part of the logical infrastructure design is used to configure cloud resources, such as launching virtual machines or configuring virtual networks? Management plane Database management Identity access management Management orchestration software
Management plane
103. Which disaster recovery plan metric indicates how long critical functions can be unavailable before the organization is irretrievably affected? Recovery time objective (RTO) Mean time to switchover (MTS) Recovery point objective (RPO) Maximum allowable downtime (MAD)
Maximum allowable downtime (MAD)
94. Which countermeasure enhances redundancy for physical facilities hosting cloud equipment during the threat of a power outage? Tier 2 network access providers Multiple and independent power circuits to all racks Radio frequency interference (RFI) blocking devices Automated license plate readers (ALPR) at entry points
Multiple and independent power circuits to all racks
121. Which risk during the eDiscovery process would limit the usefulness of the requested data from the cloud by third parties? Direct access Authentication Native production Discovery by design
Native production
8. Which platform as a service (PaaS) storage architecture should be used if an organization wants to store presentations, documents, and audio files? Block Object Distributed Relational database
Object
102. Which technology should be included in the disaster recovery plan to prevent data loss? Locked racks System patches Offsite backups Video surveillance
Offsite backups
114. Which group is legally bound by the general data protection regulation (GDPR)? Only corporations headquartered in the EU Only corporations that processes the data of EU citizens Only corporations that have operations in more than one EU nation Only corporations located in countries that have adopted the GDPR standard
Only corporations that processes the data of EU citizens
119. A business is concerned about the usage of its third-party provided, leased cloud resources. Which audit process should be used to investigate this concern? Review traffic logs for the leased cloud resources. Monitor the uptime availability of the leased cloud resource. Review the SLA for stated uptime availability requirements for the leased cloud resource. Monitor the number of available gigabytes of storage allocated to each cloud-based application.
Review traffic logs for the leased cloud resources.
63. Which method is being used when a company evaluates the acceptable loss exposure associated with a cloud solution for a given set of objectives and resources? Risk appetite Risk management Business impact analysis Business continuity planning
Risk appetite
48. Which regulation in the United States defines the requirements for a CSP to implement and report on internal accounting controls? SOX GDPR HIPAA FERPA
SOX
122. Which type of control is important in order to achieve compliance for risk management? Security Privacy Validation Technical
Security
42. Which document addresses CSP issues such as guaranteed uptime, liability, penalties, and dispute mediation process? Service level agreement (SLA) Service organization control 3 (SOC 3) General data protection regulation (GDPR) Common criteria assurance framework (CC)
Service level agreement (SLA)
59. Which type of agreement aims to negotiate policies with various parties in accordance with the agreed-upon targets? User license (ULA) Service-level (SLA) Privacy-level (PLA) Operation-level (OLA)
Service-level (SLA)
3. Which phase of the cloud data life cycle uses content delivery networks? Share Create Destroy Archive
Share
2. Which phase of the cloud data security lifecycle typically occurs simultaneously with creation? Use Share Store Destroy
Store
7. There is a threat to a banking cloud platform service. The developer needs to provide inclusion in a relational database that is seamless and readily searchable by search engine algorithms. Which platform as a service (PaaS) data type should be used? Structured Unstructured Long-term storage Short-term storage
Structured
120. Which item would be a risk for an enterprise considering contracting with a cloud service provider? 99.99% up time guarantees No SLA exclusion penalties Very expensive SLA provider penalties Suspension of service if payment is delinquent
Suspension of service if payment is delinquent
89. Which security method should be included in a defense-in-depth, when examined from the perspective of a content security policy (CSP)? Training programs Technological controls Strong access controls Contractual enforcement of policies
Technological controls
13. A cloud administrator recommends using tokenization as an alternative to protecting data without encryption. The administrator needs to make an authorized application request to access the data. Which step should occur immediately before this action is taken? The application collects a token. The application stores the token. The tokenization server generates the token. The tokenization server returns the token to the application.
The application stores the token.
117. Why is eDiscovery difficult in the cloud? The process is time consuming. The cloud service provider may lack sufficient resources. The client may lack the credentials to access the required data. The customer is responsible for their data on a multitenant system.
The client may lack the credentials to access the required data.
125. Which factor exemplifies adequate cloud contract governance? The bandwidth that is contractually provided The emphasis of privacy controls in the contract The frequency with which contracts are renewed The flexibility of data types in accordance with a contract
The frequency with which contracts are renewed
98. Which consideration should be taken into account when reviewing a cloud service provider's risk of potential outage time? The type of database The provider's support services The unique history of the provider The amount of cloud service offerings
The unique history of the provider
41. How do immutable workloads effect security overhead? They reduce the management of the hosts. They create patches for a running workload. They restrict the amount of instances in a cluster. They automatically perform vulnerability scanning as they launch.
They reduce the management of the hosts.
18. How is the compliance of the cloud service provider's legal and regulatory requirements verified when securing personally identifiable information (PII) data in the cloud? E-discovery process Contractual agreements Researching data retention laws Third-party audits and attestations
Third-party audits and attestations
73. Which issue can be detected with static application security testing (SAST)? Malware Threading Authentication Performance
Threading