Domain 3

A bare-metal hypervisor is Type ________. 1 2 3 4

1

What is the optimal number of entrances to the cloud data center campus? 1 2 3 4

1

A Type ________ hypervisor is probably more difficult to defend than other hypervisors. 1 2 3 4

2

A hypervisor that runs inside another operating system is a Type _________hypervisor. 1 2 3 4

2

In order to support all aspects of the CIA triad, all of the following aspects of a cloud data center need to be engineered with redundancies except ___________. Power supply HVAC Administrative offices ISP/connectivity lines

Administrative offices

When a customer preforms a penetration test in the cloud, why isn't the test an optimum simulation of attack conditions? Attackers don't use remote access for cloud activity Advanced notice removes the element of surprise When cloud customers use malware, it's not the same as when attackers use malware Regulator involvement changes the attack surface

Advanced notice removes the element of surprise

In addition to the security offered by the cloud provider, a cloud customer must consider the security offered by ___________. The respective regulator The end user Any vendor the cloud customer previously used in the on-premises environment Any third parties the provider depends on

Any third parties the provider depends on

Using a virtual machine baseline image could be very useful for which of the following options? Physical security Auditing Training Customization

Auditing

What is the process of granting access to resources? Identification Authentication Authorization Federation

Authorization

Which of the following controls would be useful to build into a VM baseline image for a cloud environment? GPS tracking/locator Automated vulnerability scan on system startup Access control list of authorized personnel Write protection

Automated vulnerability scan on system startup

Which of the following controls would be useful to build a VM baseline image for a cloud environment? Automatic registration with the configuration management system Enhanced user training and awareness media Mechanisms that prevent the file from being copied Keystroke loggers

Automatic registration with the configuration management system

Using one cloud provider for your operational environment and another for your BCDR backup will also give you the additional benefit ________. Allowing any custom VM builds you to use to be instantly ported to another environment Avoiding vendor lock-in/lock-out Increased performance Lower cost

Avoiding vendor lock-in/lock-out

It is best to use variables in _______. Baseline configurations Security control implementations Contract language BCDR test

BCDR test - mix up the scenarios that will be tested

Cloud administration almost necessarily violates the principles of the ____________ security model. Brewer-Nash (Chinese wall) Graham-Denning Bell-LaPadula Biba

Brewer-Nash (Chinese wall)

Which of these determines the critical assets, recovery time objective, and recover point objective for BCDR purposes? Business drivers User input Regular mandate Industry standards

Business drivers

What artifact - which should already exist within the organization - can be used to determine the critical assets necessary to protect in the BCDR activity? Quantitative risk analysis Qualitative risk analysis Business impact analysis Risk appetite

Business impact analysis

When discussing the cloud, we often segregate the data center into the terms compute, storage and networking. Compute is made up of _________ and _________. Routers; hosts APIs; Northbound Interface CPU; RAM Virtualized; actual hardware devices

CPU; RAM

Which of the following is probably the most important element to address if your organization is using two different cloud providers for the production and BCDR environments? Do they cost the same? Do they have similar facility protections in place? What level of end-user support do they offer? Can the backup provider meet the same SLA requirements of the primary?

Can the backup provider meet the same SLA requirements of the primary?

All of the following can be used to properly apportion cloud resources except __________. Reservations Shares Cancellations Limits

Cancellations

Which of the following can enhance application portability? Using the same cloud provider for the production environment and archiving Conducting service trails in an alternate cloud provider environment Providing cloud-usage training for all users Tuning web application firewalls to detect anomalous activity in inbound communications

Conducting service trails in an alternate cloud provider environment - which is testing and important to make sure applications will work in the new environment

The BCDR plan/policy should include all of the following except ________. Tasking for the office responsible for maintaining/enforcing the plan Contact information for essential entities, including BCDR personnel and emergency services agencies Copies of the laws/regulations/standards governing specific elements of the plan Checklists for BCDR personnel to follow

Copies of the laws/regulations/standards governing specific elements of the plan

Industry best practices dictate that cloud customers do not __________. Create their own IAM solutions Create contract language that favors them over the provider Retrain personnel for cloud operations Encrypt data before it reaches the cloud

Create their own IAM solutions

A process for __________ can aid in protecting against data disclosure due to lost devices. User punishment Credential revocation Law enforcement notification Device tracking

Credential revocation

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to review each other, for compliance with security governance and standards they all find acceptable, what is this federation model called? Cross-certification Proxy Single sign-on Regulated

Cross-certification - aka as the "web of trust"

Of the following control techniques/solutions, which can be combined to enhance the protections offered by each? Razor tape/background checks Least privilege/generators DLP/DRM Personnel badging/secure baselines

DLP/DRM

Of the following control techniques/solutions, which can be combined to enhance the protections offered by each? Fence/firewalls Asset inventories/personnel training Data dispersion/encryption Intrusion prevention solutions/intrusion detection solutions

Data dispersion/encryption

A fundamental aspect of security principles, ________ should be implemented in the cloud as well as in legacy environment. Continual uptime Defense in depth Multifactor authentication Separation of duties

Defense in depth

All security controls necessarily _____________. Are expensive Degrade performance Require senior management approval Will work in the cloud environment as well as they worked in the legacy environment

Degrade performance

Software-defined networking (SDN) allows network administrators/architects to perform all the following functions except ________. Reroute traffic based on current customer demand Create logical subnets without having to change any actual physical connections Filter access to resources based on specific rules or settings Deliver streaming media content in an efficient manner by placing it closer to the end user

Deliver streaming media content in an efficient manner by placing it closer to the end user

In a managed cloud services arrangement, who invokes a BCDR action? The cloud provider The cloud customer Depends on the contract Any user

Depends on the contract

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to use the web of trust model for federation, who is/are the identity providers? Each organization A trusted third party The regulator overseeing their industry All of their patients

Each organization

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to use the web of trust model for federation, who is/are the service providers? Each organization A trusted third party The regulator overseeing their industry All of their patients

Each organization

___________ is/are probably the main cause of virtualization sprawl. Malicious attackers Lack of provider controls Lack of customer controls Ease of use

Ease of use

Best practice for planning the physical resiliency for a cloud data center facility includes _________. Having one point of egress for personnel Ensuring that any cabling/connectivity enters the facility from different sides of the building/property Ensuring that all parking areas are jear generators so that personnel in high-traffic areas are always illuminated by emergency lighting, even when utility power is not available Ensuring that the foundation of the facility is rated to withstand earthquake tremors

Ensuring that any cabling/connectivity enters the facility from different sides of the building/property

Risk assessment is the responsibility of ____________. Companies offering managed cloud services Regulatory bodies Every organization Legislative entities

Every organization

Typically, SSDs are ____________. Harder to install than magnetic memory Faster than magnetic drives Harder to administer than tape libraries More likely to fail than spinning platters

Faster than magnetic drives

It is possible for the cloud customer to transfer ________ risk to the provider, but the cloud customer always retains ultimate legal risk. Market Perception Data Financial

Financial

Which entity can best aid the organization in avoiding vendor lock-in? Senior management The IT security office General counsel The cloud security representative

General counsel - they are the ones that are going to write the contract language

Of the following options, which is a reason cloud data center audits are often less trustworthy than legacy audits? Data in the cloud can't be audited Controls in the cloud can't be audited Getting physical access can be difficult There are no regulators for cloud operations

Getting physical access can be difficult

You are in charge of creating the business continuity and disaster recovery plan and procedure for your organization. Your organization has its production environment hosted by a cloud provider, and you have appropriate protections in place. Which of the following is a significant consideration for your BCDR backup? Enough personnel at the BCDR recovery site to ensure proper operations Good cryptographic key management Access to the servers where the BCDR backup is stored Forensic analysis capabilities

Good cryptographic key management

What is the term that describes the situation when a malicious user/attacker can exit the restrictions of a VM and access another VM residing on the same host? Host escape Guest escape Provider exit Escalation of privileges

Guest escape

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). In this federation, all of the participating organizations would need to be in compliance with what US federal regulations? GLBA FMLA PCI DSS HIPAA

HIPAA

Which organizational entity usually performs the verification part of the provisioning element of the identification process? IT Security HR Sales

HR

Which of the following is a device specially purposed to handle the issuance, distribution, and storage of cryptographic keys? Key management box Hardware security module Ticket-granting ticket Trusted computing base

Hardware security module

You are in charge of creating the business continuity and disaster recovery plan and procedure for your organization. Which of the following strategies is an optimum technique to avoid major issues? Have another full backup of the production environment prior to the test Assign all personnel roles to perform during the test Have the cloud provider implement a simulated disaster at a random moment in order to maximize realistic testing Have your regulators present at the test so they can monitor performance

Have another full backup of the production environment prior to the test

What is the term that describes the situation when a malicious user/attacker can exit the restrictions of a single host and access other nodes on the network? Host escape Guest escape Provider exit Escalation of privileges

Host escape

Orchestrating resource calls is the job of the _________. Administrator Router VM Hypervisor

Hypervisor

Resolving resource contentions in the cloud will most likely be the job of the _____________. Router Emulator Regulator Hypervisor

Hypervisor - Hypervisor is the orchestrator of resources

If the cloud is used for BCDR purposes, the loss of ______ could gravely affect your organization's RTO (recovery time objective). The cloud server A specific VM Your policy and contract documentation ISP connectivity

ISP connectivity

A user signs on to a cloud-based social media platform. In another browser tab, the user finds an article worth posting to the social media platform. The user clicks on the platform's icon listed on the article's website, and the article is automatically posted to the user's account on the social media platform. This is an example of what? Single sign-on Insecure direct identifiers Identity federation Cross-site scripting

Identity federation

In addition to BCDR, what other benefit can your data archive/backup provide? Physical security enforcement Access control methodology Security control against data breach Identity management testing

Identity management testing - "Reach back" capability to add users in recovering accidently deleted data

Where should multiple egress points be included? At the power distribution substation Within the data center In every building on the campus In the security operations center

In every building on the campus - health and human safety

What could be the result of failure of the cloud provider to secure the hypervisor in such a way that one user on a virtual machine can see the resource calls of another user's virtual machine? Unauthorized data disclosure Inference attacks Social engineering Physical intrusion

Inference attacks

DDoS attacks do not affect __________ for cloud customers. Productivity Availability Connectivity Integrity

Integrity

Which of the following can enhance data portability? Interoperable export formats Egress monitoring solutions Strong physical protections Agile business intelligence

Interoperable export formats

Which of the following is a risk in the cloud environment that is not existing or as prevalent in the legacy environment? DDoS Isolation failure External failure Internal attack

Isolation failure - legacy ops isolation failure only will expose to data to other members in organization / In cloud ops isolation may expose you to other tenants in the cloud

Why does the physical location of your data backup and/or BCDR failover environment matter? It may affect regulatory compliance Lack of physical security Environmental factors such as humidity It doesn't matter. Data can be saved anywhere without consequence

It may affect regulatory compliance

Which of the following is a risk in the cloud environment that is not existing or is as prevalent in the legacy environment? Legal liability in multiple jurisdictions Loss of productivity due to DDoS Ability of users to gain access to their physical workplace Fire

Legal liability in multiple jurisdictions

Which of the following poses a new risk in the cloud, not affecting the legacy, on-premises environment? Fire Legal seizure of another firm's assets Mandatory privacy data breach notification Flooding

Legal seizure of another firm's assets

The cloud customer will usually not have a physical access to the cloud data center. This enhances security by _________. Reducing the need for qualified personnel Limiting access to sensitive information Reducing jurisdictional exposure Ensuring statutory compliance

Limiting access to sensitive information

Which of the following is a method for apportioning resources that involves setting maximum usage amounts for all tenant/customers within the environment? Reservations Shares Cancellations Limits

Limits

A cloud provider will probably require all of the following except _______ before a customer conducts a penetration test. Notice Description of scope of the test Location of the launch point Knowledge of time frame/duration

Location of the launch point

VM configuration management tools should probably include __________. Biometric recognition Anti-tampering mechanisms Log file generation Hackback capabilities

Log file generation

Which of the following is a risk in the cloud environment that is not existing or is as prevalent in the legacy environment? Loss of availability due to DDoS Loss of value due to DDoS Loss of confidentiality due to DDoS Loss of liability due to DDoS

Loss of availability due to DDoS - users wont be able to access any data since the connection is severed to the cloud data

Which of the following risks exists in the legacy environment but is dramatically increased by moving into the cloud? Physical security breaches Loss of utility power Financial upheaval Man-in-the-middle attacks

Man-in-the-middle attacks

Sprawl is mainly a(n) _________ problem. Technical External Management Logical

Management

Of the following, which is probably the most significant risk in a managed cloud environment? DDoS Management plane breach Guest escape Physical attack on the utility service lines

Management plane breach - someone gets entire control of the environment

The cloud data center campus physical access point should include all of the following except _______. Reception area Video surveillance Badging procedure Mantrap structures

Mantrap structures - usually reserved for sensitive areas within a building

Typically, SSDs are __________. More expensive than spinning platters Larger than tape backup Heavier than tape libraries More subject to malware than legacy drives

More expensive than spinning platters

Critical components should be protected with _______. Strong passwords Chain-link fences Homomorphic encryption Multifactor authentication

Multifactor authentication

Which of the following poses a new risk in the cloud, not affecting the legacy, on-premises environment? Internal threats Multitenancy Natural disasters DDoS attacks

Multitenancy

If you use the cloud for BCDR purposes, even if you don't operate your production in the cloud, you can cut costs by eliminating your __________. Security personnel BCDR policy Old access credentials Need for a physical hot site/warm site

Need for a physical hot site/warm site

Key generation is a cloud environment might have less entropy than the legacy environment for all the following reasons except _________. Lack of direct input devices No social factors Uniform build Virtualization

No social factors

Typically, SSDs are ______________. Impossible to destroy physically Not vulnerable to degaussing Subject to a longer warranty Protected by international trade laws

Not vulnerable to degaussing

The tasks performed by the hypervisor in the virtual environment can most be likened to the tasks of the ________ in the legacy environment. CPU Security team OS PGP

OS

What is the type of cloud storage arrangement that involves the use of associating metadata with the saved data? Volume Block Object Redundant

Object

Which of the following terms describes a cloud storage area that uses a file system/hierarchy? Volume storage Object storage Logical unit number (LUN) Block storage

Object storage

Typically, which form of cloud storage is used in the near term for snapshotted VM images? Volume storage Object storage Logical unit number (LUN) Block storage

Object storage - stored as an object

Risk should always be considered from a business perspective. Risk is often balanced by corresponding _________. Profit Performance Cost Opportunity

Opportunity

What do you need to do in order to fully ensure that a BCDR action will function during a contingency? Audit all performance functions Audit all security functions Perform a full-scale test Mandate this capability in the contract

Perform a full-scale test

Managed cloud services exist because the service is less expensive for each customer than creating the same services for themselves in a legacy environment. Using a managed service allows the customer to realize significant cost savings through the reduction of ________. Risk Security controls Personnel Data

Personnel

What is the most important asset to protect in cloud BCDR activities? Intellectual property Hardware at the cloud data center Personnel Data on portable media

Personnel

The physical layout of a cloud data center campus should include redundancies of all the following except _______. Generators HVAC units Generator fuel storage Points of personnel ingress

Points of personnel ingress

It's important to maintain a current asset inventory list, including surveying your environment on a regular basis, in order to ________. Prevent unknown, unpatched assets from being used as back doors to the environment Ensure that any lost devices are automatically entered into the acquisition systems for repurchasing and replacement Maintain user morale by having their devices properly catalogued and annotated Ensure that billing for all devices is handled by the appropriate departments

Prevent unknown, unpatched assets from being used as back doors to the environment

Where is isolation failure probably least likely to pose a significant risk? Public cloud Private cloud PaaS environment SaaS environment

Private cloud

Who operates the management plane? Regulators End consumers Privileged users Privacy data subjects

Privileged users

The ENISA's definition of cloud computing differs slightly from the definition offered by ISC2 and NIST. What is one of the characteristics listed by ENISA but not included in the ISC2 definition? Metered service Shared resources Scalability Programmatic management

Programmatic management

What can hamper the ability of a cloud customer to protect their own assets in a managed services arrangement? Prohibitions on port scanning and penetration testing Geographical dispersion Rules against training users Laws that prevent them from doing so

Prohibitions on port scanning and penetration testing

Which of the following risks is probably most significant when choosing to use one cloud provider for your operational environment and another for BCDR backup/archive? Physical intrusion Proprietary formats/lack of interoperability Vendor lock-in/lockout Natural disasters

Proprietary formats/lack of interoperability

A cloud customer performing a penetration test without the provider's permission is risking ________. Malware contamination Excessive fees for SLA violations Loss of market share Prosecution

Prosecution

A group of clinics decides to create an identification federation for their users (medical providers and clinicians). If they opt to hire a third party to review each organization, for compliance with security governance and standards they all find acceptable, what is this federation model called? Cross-certification Proxy Single sign-on Regulated

Proxy

Having your BCDR backup stored with the same cloud provider as your production environment can help you _________. Maintain regulatory compliance Spend less of your budget on traveling Train your users about security awareness Recover quickly from minor incidents

Recover quickly from minor incidents

When considering cloud data replication strategies (i.e., whether you are making backups at the block, file or database level) which element of your organization's BCDR plan will be most affected by your choice? Recovery time objective Recovery point objective Maximum allowable downtime Mean time to failure

Recovery point objective - RPO is a measure of data that can be lost in an outage without irreparably damaging the organization

The process of identity management includes all the following elements except _________. Provisioning Maintenance Deprovisioning Redaction

Redaction

According to the European Union Agency for Network and Information Security (ENISA), a cloud risk assessment should provide a means for customers to accomplish all these assurance tasks except ___________. Assess risks associated with cloud migration Compare offerings from different cloud providers Reduce the risk of regulatory noncompliance Reduce the assurance burden on cloud providers

Reduce the risk of regulatory noncompliance

From a security perspective, automation of configuration aids in ___________. Enhancing performance Reducing potential attack vectors Increasing ease of use of the systems Reducing need for administrative personnel

Reducing potential attack vectors

Which of the following is probably the most important activity, of those listed? Regularly update the BCDR plan/process Have contact information for all personnel in the organization Have contact information for essential BCDR personnel Have contact information for local law enforcement

Regularly update the BCDR plan/process

The minimum essential characteristics of a cloud data center are often referred to as "ping, power, pipe." What does this mean? Remote access for customer to racked devices in the data center; electrical utilities; connectivity to an ISP/the Internet Application suitability; availability; connectivity IaaS; SaaS; PaaS Anti-malware tools; controls against DDoS attacks; physical/environmental security controls, including fire suppression

Remote access for customer to racked devices in the data center; electrical utilities; connectivity to an ISP/the Internet

Which of the following is a method for apportioning resources that involves setting guaranteed minimums for all tenants/customers within the environment? Reservations Shares Cancellations Limits

Reservations

Which of the following poses a new risk in the cloud, not affecting the legacy, on-premises environment? User carelessness Inadvertent breach Device failure Resource exhaustion

Resource exhaustion - in extreme cases such as something that hits an entire region where cloud providers will be unable to handle an increased load

Which of the following probably poses the most significant risk to the organization? Lack of data confidentiality during a contingency Lack of regulatory compliance during a contingency Returning to normal operations too late Lack of encrypted communications during a contingency

Returning to normal operations too late

Which of the following probably poses the most significant risk to the organization? Not having essential BCDR personnel available during a contingency Not including all BCDR elements in the cloud contract Returning to normal operations too soon Telecommunications outages

Returning to normal operations too soon

__________ is the most prevalent protocol used in identity federation. HTTP SAML FTP WS-Federation

SAML

In software-defined networking (SDN), the northbound interface (NBI) usually handles traffic between the ______ and ________. Cloud customer; ISP SDN controllers; SDN applications Cloud provider; ISP Router; host

SDN controllers; SDN applications

Which of the following would probably best aid an organization in deciding whether to migrate from a legacy environment to a particular cloud provider? Rate sheets comparing a cloud provider to other cloud providers Cloud provider offers to provide engineering assistance during the migration The cost/benefit measure of closing the organization's relocation site and using the cloud for disaster recovery instead SLA satisfaction surveys from other (current and old) cloud customers

SLA satisfaction surveys from other (current and old) cloud customers

In which cloud service model does the customer lose the most control over governance? IaaS PaaS SaaS Private Cloud

SaaS

What should the cloud customer do to ensure that disaster recovery activities don't exceed the maximum allowable downtime (MAD)? Make sure any alternate provider can support the application needs of the organization Ensure that contact information for all first responder agencies are correct and up to date at all times Select an appropriate recovery time objective (RTO) Regularly review all regulatory directives for disaster response

Select an appropriate recovery time objective (RTO)

When considering the option to migrate from an on-premises environment to a hosted cloud service, an organization should weigh the risks of allowing external entities to access the cloud data for collaborative purposes against ___________. Not securing the data in the legacy environment Disclosing the data publicly Inviting external personnel into the legacy workspace in order to enhance collaboration Sending the data outside the legacy environment for collaborative purposes

Sending the data outside the legacy environment for collaborative purposes

Which of the following is a method for apportioning resources that involves prioritizing resource requests to resolve contention situations? Reservations Shares Cancellations Limits

Shares

A cloud provider will probably not allow _________ as part of a customer's penetration test. Network mapping Vulnerability scanning Reconnaissance Social engineering

Social engineering

Sprawl in the cloud can lead to significant additional costs to the organization because of _________. Larger necessary physical footprint Much larger utility consumption Software licensing Requisite additional training

Software licensing - more vms = more $$

Which of the following terms describe a means to centralize logical control of all networked nodes in the environment, abstracted from the physical connections to each? VPN SDN ACLs RBAC

Software-defined networking (SDN)

Mass storage in the cloud will most likely currently involve __________. Spinning platters Tape drives Magnetic disks Solid-state drives

Solid-state drives

There are many ways to handle risk. However, the usual methods for addressing risk are not all possible in the cloud because ___________. Cloud data risks cannot be mitigated Migrating into a cloud environment necessarily means you are accepting all risks Some risks cannot be transferred to a cloud provider Cloud providers cannot avoid risk

Some risks cannot be transferred to a cloud provider

The BCDR plan/process should be written and documented in such a way that it can be used by ___________. Users Essential BCDR team members Regulators Someone with the requisite skills

Someone with the requisite skills - 'Requisite' made necessary by a certain event or circumstance

_______________ can often be the result of inadvertent activity. DDos Phishing Sprawl Disasters

Sprawl

Which of these does the cloud customer need to ensure protection of intellectual property created in the cloud? DRM IAM Strong contractual clauses Crypto-shredding

Strong contractual clauses

Managed cloud services exist because the service is less expensive for each customer than creating the same services for themselves in a legacy environment. From the customer perspective, most of the cost differential created between the legacy environment and the cloud through virtualization is achieved by removing ________. External risks Internal risks Regulatory compliance Sunk capital investment

Sunk capital investment - in the cloud you are only paying for what your using - therefore, saving dat money

You are in charge of creating the business continuity and disaster recovery plan and procedure for your organization. You decide to have a tabletop test of the BCDR activity. Which of the following will offer value during the test? Have all participants conduct their individual activities via remote meeting technology Task a moderator well-versed in BCDR actions to supervise and present scenarios to the participants, including randomized special events Provide copies of the BCDR policy to all participants Allow all users in your organization to participate

Task a moderator well-versed in BCDR actions to supervise and present scenarios to the participants, including randomized special events

Return to normal operations is a phase in BCDR activity when the contingency event is over and regular production can resume. Which of the following can sometimes be the result when the organization uses two different cloud providers for the production and BCDR environments? Both providers are affected by the contingency, extending the time before return to normal can occur The BCDR provider becomes the new normal production environment Regulators will find the organization in violation of compliance guidance All data is lost irretrievably

The BCDR provider becomes the new normal production environment

Who is the cloud carrier? The cloud customer The cloud provider The regulator overseeing the cloud customer's industry The ISP between the cloud customer and provider

The ISP between the cloud customer and provider

Security controls installed on a guest virtual machine operating system (VM OS) will not function when _______________. The user is accessing the VM remotely The OS is not scanned for vulnerabilities The OS is not subject to version control The VM is not active while in storage

The VM is not active while in storage

The physical layout of a cloud data center campus should include redundancies of all the following except _______. Physical perimeter security controls The administration/support staff building Electrical utility lines Communications connectivity lines

The administration/support staff building

In an IaaS arrangement, who accepts responsibility for securing cloud-based applications? The cloud provider The cloud customer The regulator The end user/client

The cloud customer

In a managed cloud services arrangement, who creates governance that will determine which controls are selected for the environment and how they are deployed? The cloud provider The cloud customer The regulators The end user

The cloud provider

Which of the following is a risk posed by the use of virtualization? Internal threats interrupting service through physical accidents (spilling drinks, tripping on lines) The ease of transporting stolen virtual machine images Increased susceptibility of virtual systems to malware Electromagnetic pulse

The ease of transporting stolen virtual machine images

Who will determine whether your organization's cloud migration is satisfactory from a compliance perspective? The cloud provider The cloud customer The regulators The ISP

The regulators

There are two reasons to conduct a test of the organization's recovery from backup in an environment other than the primary production environment. Which of the following is one of them? It costs more to conduct a test at the same location as the primary workplace You don't want to waste travel budget on what is only a test The risk of negative impact to both production and backup is too high There won't be enough room for everyone to sit in the primary facility

The risk of negative impact to both production and backup is too high

Of the following options, which is a reason cloud data center audits are often less trustworthy than legacy audits? They frequently rely on third parties The standards are too difficult to follow The paperwork is cumbersome There aren't enough auditors

They frequently rely on third parties

Of the following options, which is a reason cloud data center audits are often less trustworthy than legacy audits? Cryptography is present Auditor's don't like the cloud Cloud equipment is resistant to an audit They often rely on data the provider chooses to disclose

They often rely on data the provider chooses to disclose

All of the following can be used in the process of anomaly detection except ____________. The ratio of failed to successful logins Transactions completed successfully Event time of day Multiple concurrent logins

Transactions completed successfully

You are in charge of creating the business continuity and disaster recovery plan and procedure for your organization. Your organization has its production environment hosted in a cloud environment. You are considering using cloud backup services for your BCDR purposes as well. What would probably be the best strategy for this approach, in terms of redundancy and resiliency? Have your cloud provider also provide BCDR backup Keep a BCDR backup on the premises of your corporate headquarters Use another cloud provider for the BCDR backup Move your production environment back into your corporate premises, and use your cloud provider to host your BCDR backup

Use another cloud provider for the BCDR backup

What is probably the best way to avoid problems associated with vendor lockout? Use strong contract language Use nonproprietary data and media formats Use strong cryptography Use another provider for backup purposes

Use another provider for backup purposes

What is probably the optimum way to avoid vendor lock-in? Use non-proprietary data formats Use industry-standard media Use strong cryptography Use favorable contract language

Use favorable contract language

Perhaps the best method for avoiding vendor lock-out is also a means for enhancing BCDR capabilities. This is ___________. Having a warm site within 250 miles of the primary production environment Using one cloud provider for primary production and another for backup purposes Building a data center above the flood plain Cross-training all personnel

Using one cloud provider for primary production and another for backup purposes

Lack of industry-wide standards for cloud computing creates a potential for ________. Privacy data breach Privacy data disclosure Vendor lock-in Vendor lock-out

Vendor lock-in - without standards customer would have trouble moving from one vendor to the other

According to the NIST Cloud Computing Reference Architecture, which of the following is most likely a cloud carrier? Amazon web services Netflix Verizon Nessus

Verizon

One of the security challenges of operating in the cloud is that additional controls must be placed on file storage systems because ________. File stores are always kept in plain text in the cloud There is no way to sanitize file storage space in the cloud Virtualization necessarily prevents the use of application-based security controls Virtual machines are stored as snapshotted files when not in use

Virtual machines are stored as snapshotted files when not in use

Managed cloud services exist because the service is less expensive for each customer than creating the same services for themselves in a legacy environment. What is the technology that creates most of the cost savings in the cloud environment? Emulation Secure remote access Crypto-shredding Virtualization

Virtualization

What can be revealed by an audit of a baseline virtual image, used in a cloud environment? Possible intrusions after they have happened Potential criminal activity before it occurs Whether necessary security controls are in place and functioning properly Lack of user training and awareness

Whether necessary security controls are in place and functioning properly

What is the main reason virtualization is used in the cloud? VMs are easier to administer If a VM is infected with malware, it can easily be replaced With VMs, the cloud provider does not have to deploy an entire hardware device for every new user VMs are easier to operate than actual devices

With VMs, the cloud provider does not have to deploy an entire hardware device for every new user

A SAML identity assertion token uses the _________ protocol. XML HTTP HTML ASCII

XML

There are two reasons to conduct a test of the organization's recovery from backup in an environment other than the primary production environment. Which of the following is one of them? It is good to invest in more than one community You want to approximate contingency conditions, which includes not operating in the primary location It is good for your personnel to see other places occasionally Your regulator's wont follow you offsite, so you'll be unobserved during your test

You want to approximate contingency conditions, which includes not operating in the primary location