Cloud Practice Exam 1

#1. Which of the four methods is not a potential options for handling key management?

Hybrid

Proxy encryption

Virtual appliance/software

Cloud provider service

hardware security module (HSM)

#2. Targets US financial and insurance institutions and requires them to protect account holders’ private information.

Gramm-Leach-Bliley Act

Sarbanes–Oxley Act (SOX)

FIPS 140-2

NIST 800-53

FIPS 140-5

#3. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

Community Cloud

Public Cloud

Hybrid Cloud

Private Cloud

#4. General Data Protection Regulation (GDPR) includes the following except.

Accountability Obligations

Cross-border Data Transfer Restrictions

Breaches of Security

Sanctions

Encryption Standards

Data Subjects’ Rights:

Discrepancies among Member States:

#5. What are the components of PaaS Encryption (choose all that apply)

Select all that apply:

Provider-managed encryption

Proxy encryption

Application layer encryption

Database encryption

#6. Application security encompasses the following except.

Encryption protocol

DevOps

Independent virtual machines.

Higher baseline security

Responsiveness.

Isolated environments.

Elasticity

#7. DLP implementation in the cloud comes with related difficulties and costs, True or False?

True

False

#8. A third-party entity offering independent identity and access management (IAM) services to CSPs and cloud customers, often as an intermediary

Cloud Service Provider (CSP)

Cloud Broker

Inter-Cloud Provider

Cloud Access Security Broker (CASB)

#9. Replacing sensitive data with unique identification symbols is known as?

Randomization

Masking

obfuscation

Tokenization

#10. Privacy laws are either Omnibus-covers all categories of personal data or sectoral;covers only specific categories of personal data. True or False

True

False

#11. Detects application vulnerabilities by scanning the source code and binaries to detect problems before the code is loaded into memory and run

Encrypting Application security testing (EAST)

Dynamic Application Security Testing (DAST)

Static application security testing (SAST)

#12. A community cloud can also be provisioned by a third party on behalf of the various members of the community. (FEDramp cloud) True or False?

True

False

#13. In application security testing involves the following is true, except.

Backlogging test results

Code Review

Dynamic Application Security Testing (DAST)

Unit testing, regression testing, and functional tests

Static Application Security Testing (SAST)

#14. The key difference between cloud and traditional computing is the metastructure. True or False.

False

True

#15. One of the core tenants of risk management is that you can manage, transfer, accept, or avoid risks. True or False

True

False

#16. It is best practice to identify requirements, design the architecture, and then identify the gaps based on the capabilities of the underlying cloud platform. True or False

False

True

#17. The three methods of data discovery are the following.

preservation, dispersion and replication

Data distribution, labels and e-discovery

Dynamic. Transactional and Static

metadata, labels, and content analysis.

#18. Categorized and detail specific cloud security controls or categories of controls, such as the CSA CCM

Design patterns

Reference architectures

Controls models or frameworks

Conceptual models or frameworks

#19. A NIST document that describes the process for accrediting and cryptosystems for use by the US federal government.

The Gramm-Leach-Bliley Act

NIST 800-53

FIPS 140-2

The Sarbanes–Oxley Act (SOX)

#20. Multitenant environments; multiple customers will share the underlying resources that are owned and operated by the provider.

IaaS

Public Cloud

SaaS

PaaS

Private Cloud

#21. Google Docs, Microsoft’s Office 365, and QuickBooks Online are all examples of what Cloud Service?

NIST

IaaS

SaaS

PaaS

#22. Widely considered to be the gold standard when it comes to security of information systems and their data.

Directive 95/46/EC of the European (Data Protection Directive)

ISO 27001, (27001:2013)

FIPS 140-2

NIST 800-53

#23. The five main phases in secure application design and development include the following except.

Assign

Develop

Design

Define

Test

Training

#24. Cloud customers should also consider implementing some form of egress monitoring in during this phase.

Create

Use

Share

Store

#25. Acts as the glue that binds the technologies together and enables management and configuration remotely of a customer’s cloud environment.

Infastructure

Metastructure

Infostructure

Applistructure

#26. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management.

Acceptable Use Policy

recovery service level (RSL)

recovery file assessment

recovery point objective (RPO)

#27. Determining the costs of compliance should which include the following (choose all that apply)

Select all that apply:

The legislative and contractual requirements mandated for your organization

The industry the organization is in

The type of encryption your company uses

The types and locations of your customers

Your organization’s regulatory restrictions.

#28. What is the second stage of the data life cycle?

#29. What are the six stages of the Data Life Cycle?

Archive,Destroy,Use,Store,Share,Create

Store,Share,Create,Archive,Destroy,Use

Create,Archive,Destroy,Use,Store,Share

Create,Store,Use,Share,Archive,Destroy

#30. ITAR is a Department of State program. EAR is a Commerce Department program, True or False?

True

False

#31. Cloud vendor becomes responsible for administering, patching, and updating this software as well as all the infrastructure, computer and storage needs.

NaaS

IaaS

PaaS

SaaS

#32. Used for publicly high-level report by an independent CPA, a SOC engagement was performed.

SOC 3

Type 1

Type 2

SOC 1

SOC 2

#33. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management is known as.

recovery point level (RPL)

data recovery implementation

recovery point objective (RPO)

recovery service level (RSL)

#34. The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or by a third party and may be located on-premises or off premises.

Public Cloud

Private Cloud

Community Cloud

Hybrid Cloud

#35. To establish a A Simple Cloud Security Process Model is it best practice to do the following except.

Define the architecture.

Design and implement controls to fill the gaps

Identify control gaps.

Assess the security controls

Identify provider access controls

Identify necessary security and compliance requirements, and any existing controls.

Refresh The Page to Try Again!!!

#1. Which of the four methods is not a potential options for handling key management?

#2. Targets US financial and insurance institutions and requires them to protect account holders’ private information.

#3. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

#4. General Data Protection Regulation (GDPR) includes the following except.

#5. What are the components of PaaS Encryption (choose all that apply)

#6. Application security encompasses the following except.

#7. DLP implementation in the cloud comes with related difficulties and costs, True or False?

#8. A third-party entity offering independent identity and access management (IAM) services to CSPs and cloud customers, often as an intermediary

#9. Replacing sensitive data with unique identification symbols is known as?

#10. Privacy laws are either Omnibus-covers all categories of personal data or sectoral;covers only specific categories of personal data. True or False

#11. Detects application vulnerabilities by scanning the source code and binaries to detect problems before the code is loaded into memory and run

#12. A community cloud can also be provisioned by a third party on behalf of the various members of the community. (FEDramp cloud) True or False?

#13. In application security testing involves the following is true, except.

#14. The key difference between cloud and traditional computing is the metastructure. True or False.

#15. One of the core tenants of risk management is that you can manage, transfer, accept, or avoid risks. True or False

#16. It is best practice to identify requirements, design the architecture, and then identify the gaps based on the capabilities of the underlying cloud platform. True or False

#17. The three methods of data discovery are the following.

#18. Categorized and detail specific cloud security controls or categories of controls, such as the CSA CCM

#19. A NIST document that describes the process for accrediting and cryptosystems for use by the US federal government.

#20. Multitenant environments; multiple customers will share the underlying resources that are owned and operated by the provider.

#21. Google Docs, Microsoft’s Office 365, and QuickBooks Online are all examples of what Cloud Service?

#22. Widely considered to be the gold standard when it comes to security of information systems and their data.

#23. The five main phases in secure application design and development include the following except.

#24. Cloud customers should also consider implementing some form of egress monitoring in during this phase.

#25. Acts as the glue that binds the technologies together and enables management and configuration remotely of a customer’s cloud environment.

#26. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management.

#27. Determining the costs of compliance should which include the following (choose all that apply)

#28. What is the second stage of the data life cycle?

#29. What are the six stages of the Data Life Cycle?

#30. ITAR is a Department of State program. EAR is a Commerce Department program, True or False?

#31. Cloud vendor becomes responsible for administering, patching, and updating this software as well as all the infrastructure, computer and storage needs.

#32. Used for publicly high-level report by an independent CPA, a SOC engagement was performed.

#33. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management is known as.

#34. The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or by a third party and may be located on-premises or off premises.

#35. To establish a A Simple Cloud Security Process Model is it best practice to do the following except.

Results

Disclaimer

Facebook

Cloud Practice Exam 1

Refresh The Page to Try Again!!!

#1. Which of the four methods is not a potential options for handling key management?

#2. Targets US financial and insurance institutions and requires them to protect account holders’ private information.

#3. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

#4. General Data Protection Regulation (GDPR) includes the following except.

#5. What are the components of PaaS Encryption (choose all that apply)

#6. Application security encompasses the following except.

#7. DLP implementation in the cloud comes with related difficulties and costs, True or False?

#8. A third-party entity offering independent identity and access management (IAM) services to CSPs and cloud customers, often as an intermediary

#9. Replacing sensitive data with unique identification symbols is known as?

#10. Privacy laws are either Omnibus-covers all categories of personal data or sectoral;covers only specific categories of personal data. True or False

#11. Detects application vulnerabilities by scanning the source code and binaries to detect problems before the code is loaded into memory and run

#12. A community cloud can also be provisioned by a third party on behalf of the various members of the community. (FEDramp cloud) True or False?

#13. In application security testing involves the following is true, except.

#14. The key difference between cloud and traditional computing is the metastructure. True or False.

#15. One of the core tenants of risk management is that you can manage, transfer, accept, or avoid risks. True or False

#16. It is best practice to identify requirements, design the architecture, and then identify the gaps based on the capabilities of the underlying cloud platform. True or False

#17. The three methods of data discovery are the following.

#18. Categorized and detail specific cloud security controls or categories of controls, such as the CSA CCM

#19. A NIST document that describes the process for accrediting and cryptosystems for use by the US federal government.

#20. Multitenant environments; multiple customers will share the underlying resources that are owned and operated by the provider.

#21. Google Docs, Microsoft’s Office 365, and QuickBooks Online are all examples of what Cloud Service?

#22. Widely considered to be the gold standard when it comes to security of information systems and their data.

#23. The five main phases in secure application design and development include the following except.

#24. Cloud customers should also consider implementing some form of egress monitoring in during this phase.

#25. Acts as the glue that binds the technologies together and enables management and configuration remotely of a customer’s cloud environment.

#26. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management.

#27. Determining the costs of compliance should which include the following (choose all that apply)

#28. What is the second stage of the data life cycle?

#29. What are the six stages of the Data Life Cycle?

#30. ITAR is a Department of State program. EAR is a Commerce Department program, True or False?

#31. Cloud vendor becomes responsible for administering, patching, and updating this software as well as all the infrastructure, computer and storage needs.

#32. Used for publicly high-level report by an independent CPA, a SOC engagement was performed.

#33. The amount of data a company would need to maintain and recover in order to function at a level acceptable to management is known as.

#34. The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or by a third party and may be located on-premises or off premises.

#35. To establish a A Simple Cloud Security Process Model is it best practice to do the following except.

Results

Share this: