Chapter 2 - Concepts To Know

Question 1

What are the methods to address risk?

Answer 1

Avoidance
Acceptance
Transference
Mitigation

Question 2

What are the design requirements related to business requirements analysis?

Answer 2

1. Assets can be tangible, intangible, or personnel
2. Business impact analysis defines which of the assets provide the intrinsic value of an organization
3. Criticality denotes those aspects of an organization without which the organization could not operate or exist
4. Risk appetite is the level, amount, or type of risk that an organization finds acceptable

Question 3

What are the boundaries of the cloud model?

Answer 3

IaaS
PaaS
SaaS

Question 4

What are the roles related to layered defenses?

Answer 4

Cloud Provider

Cloud Customer

Question 5

This cloud role includes:
* strong personal controls, involving background checks and continual monitoring
*technological controls such as encryption, event logging, and access control enforcement
*physical controls related to both the overall campus
governance mechanisms and enforcement, such as strong policies and regular, thorough audits

Answer 5

Cloud Provider

Question 6

This cloud role includes:

• training programs for staff and users that include good coverage of security topics
• contractual enforcement of policy requirements
• use of encryption and logical isolation mechanisms
• strong access control methods

Answer 6

Cloud Customer

Question 7

What are the ways for securing devices in the datacenter?

Answer 7

1. All guest accounts are removed
2. No default passwords remain
3. Systems are patched, maintained, and updated according to vendor guidance
4. All unused ports are closed
5. Physical access is severely limited and controlled