701 - Section 3 Flashcards
(130 cards)
1
Q
What document is used by cloud providers that defines the different responsibilities for all of the cloud offerings between the provider and the customer?
A
Responsibility matrix
2
Q
What is it called when you have more than one public and or private cloud?
A
Hybrid cloud
3
Q
What are some security issues with a hybrid cloud?
A
Authentication across the different platforms, firewall configurations, server settings, diverse security monitoring, data leakage
4
Q
What is it called when the servers network and application are all defined in configuration?
A
Infrastructure as code
5
Q
What are some of the advantages with infrastructure as code?
A
The description can be used to build other application instances, and you can create multiple versions similar to application code
6
Q
What is it called when apps are separated into individual autonomous functions that removes the operating system from the equation?
A
Function as a service
7
Q
A developer will create these FaaS as server-side logic and they are executed in what?
A
A stateless container
8
Q
What is an API?
A
Application programming interface
9
Q
What is the glue for micros services which enable them to work together as an application?
A
APIs
10
Q
What are three advantages to micro services?
A
They are scalable, resilient, and offer security and compliance
11
Q
What are three advantages to micro services?
A
They are scalable, resilient, and offer security and compliance
12
Q
What does VLAN stand for?
A
Virtual local area network
13
Q
What does VLAN stand for?
A
Virtual local area network
14
Q
What does a VLAN do?
A
It separates networks logically instead of physically meaning communication cannot happen between the VLANs
15
Q
What does SDN stand for?
A
Software defined networking
16
Q
What are the three layers of SDN?
A
Infrastructure/data plane, control layer/control plane, application layer/management plane
17
Q
In SDN, which layer processes, the network frames and packets does forwarding trunking encrypting and NAT?
A
Infrastructure layer/data plane
18
Q
In SDN, which layer manages the actions of the data plan contains routing tables session, tables, and NAT tables?
A
Control layer/control plane
19
Q
In SDN, which layer configures and manages the device?
A
Application layer/management plane
20
Q
An application container contains what?
A
Everything you need to run an application, including code and other dependencies
21
Q
What does IOT stand for?
A
Internet of things
22
Q
What is another name for large scale multi industrial control systems?
A
SCADA, supervisory control and data acquisition system
23
Q
What are some examples where SCADA is used?
A
Power generation, refining, manufacturing
24
Q
What are some of the attributes for SCADA?
A
They are distributed, contain real time information, no external access
25
What type of operating system has a deterministic processing schedule?
RTOS, real time operating system
26
What kind of system has the hardware and software design for a specific function, that is built with only one task in mind? Give two examples
Embedded system, traffic, light controllers, medical imaging systems
27
What does high availability mean? And what does it take to achieve higher her availability?
Always on, always available… higher costs as you add different components to meet contingencies
28
What type of application infrastructure uses a hypervisor and also has an operating system for each instance?
Virtualized applications
29
What type of application infrastructure uses a docker?
Containerized applications
30
What is MTTR?
Mean time to repair
31
What are five infastructure considerations?
Availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, update schedule, power, processor
32
Which infrastructure consideration has the important metric of system up time?
Availability
33
Which infrastructure consideration is commonly referenced as MTTR?
Resilience
34
Which hardware consideration is defined by how much is required for initial installation, ongoing maintenance, replacement or repair cost, tax implications?
Cost
35
Which infrastructure consideration uses system speed as an important metric?
Responsiveness
36
Which infrastructure consideration is defined by how quickly and easily we can increase or decrease capacity?
Scalability
37
Which infrastructure consideration is defined by how easily updates are applied?
Ease of deployment
38
Which infrastructure consideration uses cyber security insurance, recovery from internal losses, protection against legal issues from customers?
Risk transference
39
Which infrastructure consideration is defined by how easily the system will be made while after an issue?
Ease of recovery
40
Which infrastructure consideration is defined by how frequent the system is maintained?
Patch availability
41
Which infrastructure consideration is defined by backup services such as UPS and generators?
Power
42
Which infrastructure consideration is defined by the applications ability to do heavy processing?
Computing power
43
What simplifies security policy and is defined by the physical location or functional area of the network?
Security zones
44
What are three securities zones?
Internet, screened, inside
45
What are the two failure modes for an IPS and what do they mean?
Fail open, which means when a system fails, the data continues to flow… fail closed, which means when a system fails, the data does not flow
46
What is the difference between an IPS and an IDS?
Both watch network traffic, and IP stops an attack before it gets into the network while and IDS sends an alarm or an alert when an attack is detected
47
what is the difference between active monitoring and passive monitoring?
With active monitoring, the device will deny passage of the traffic when it detects an attack… with passive monitoring, the device will allow data to pass through it and it will send a copy of the traffic to the IDS or IPS
48
What network appliance provides access to a protected network? And what is the security concern with it?
Jump server, if it is compromised, it can lead to a significant breach
49
What is used to connect to the jump server?
SSH, a tunnel, a VPN
50
What network appliance sits between the users and the external network, it receives user requests and sends their request on their behalf,
Proxy server
51
What are some of the uses of a proxy server?
Cashing, access control, URL filtering, content scanning
52
What type of proxy server is used to protect and control user access to the Internet?
A forward proxy
53
What type of proxy server is used to protect and control user access to the Internet?
A forward proxy
54
What type of proxy server sits between an internal server and the Internet?
A reverse proxy
55
What type of proxy is not controlled and is operated by a third-party and is often used to circumvent existing security controls?
An open proxy
56
What type of proxy is very commonly used and understands the way an application works?
An application proxy
57
What is used to distribute requests across multiple servers, is used in large scale implementation like Web server farms and is fault tolerant?
Load balancers
58
What type of load balancing offers TCP offload, SSL offload, cashing, prioritization, and content switching?
Active/active load balancing
59
What is used to collect and aggregate information from network devices?
Collectors and sensors
60
What does EAP stand for and what is it?
Extensible authentication protocol and it is an authentication framework
61
What standard does EAP integrate with?
802.1X
62
What is the principle for EAP 802.1x?
No access to the network until authentication succeeds
63
What are the three principles of 802.1X and EAP?
Supplicant or the client, the authenticator, which is the device that provides access and the authentication server which validates the client credentials
64
What are the two ways that a firewall can filter traffic? And what OSI layers are they?
By port number layer 4 or by application layer 7
65
Most firewalls can also perform this function…
Router
66
What is NAT?
Network address translation
67
What is a another name for a firewall that also serves as an all-in-one security appliance?
UTM, unified threat management
68
What does NGFW mean?
Next generation firewall
69
What does an NGFW do with network traffic?
It inspects every packet and categorizes them before a security decision is determined
70
What does an NGFW control traffic based on?
Applications
71
What other function does NNGFW perform? And how does it do that?
Intrusion prevention, by applying application specific vulnerability signatures to the traffic
72
What is a WAF? And how does it work?
Web application firewall… it allows or denies traffic based on an expected input. Unexpected input is a common method of exploiting an application.
73
What function does a VPN perform? And what is another name for that VPN channel?
It encrypts data traversing a public network… a tunnel
74
What protocol does a SSL/TLSVPN use
SSL/TLS
75
What are three advantages to an SSL/TLS VPN?
No big VPN clients, no requirement for digital certificates or shared passwords for authentication, can run from a browser or other light VPN client across many operating systems
76
What software configuration does a site to site IPsec VPN use?
VPN concentrators on both sides, usually firewalls serve this purpose
77
What does a VPN concentrator do? And what is it often integrated with?
It will encrypt outgoing traffic and decrypt incoming traffic as it has it passes through…the firewall
78
What does a VPN concentrator do? And what is it often integrated with?
It will encrypt outgoing traffic and decrypt incoming traffic as it has it passes through…the firewall
79
What is an SD-WAN? And what infrastructure is it built for?
Software defined networking in a wide area network it is built for the cloud
80
What does SASE stand for?
Secure access service edge… it is a complete network and security solution that provides secure, and efficient access to applications and data, regardless of their location
81
What are three components of SASE?
Network as a service, security as a service, SASE client on all devices
82
What is the data type that is managed by a third-party and governed by laws and statues?
Regulated
83
What is the data type that is often unique to an organization and includes an organizations secret formulas?
Trade secret
84
What is the data type that includes copyright and trademark restrictions?
Intellectual property
85
What is the data type that includes court records and documents, PII and other sensitive details?
Legal information
86
What is the data type that contains internal company details, customer, sensitive data, payment records?
Financial information
87
What is the data type that is not easily understood by humans and includes barcode and images?
Non-human readable
88
What are three data classifications?
Organization proprietary, PII, PHI
89
Why are different levels of security classifications applied to data?
They are classified because of the sensitive nature of the data… The more sensitive the data is the higher the classification level and the controls placed on it
90
What are the three states of data?
Data at rest, data in transit, data in use
91
What are three methods to encrypt data at rest?
Whole disk, database file or folder level
92
What protocols are used to encrypt data in transit?
TLS and IPsec
93
What is data sovereignty?
Data that resides in a country is subject to the laws of that country
94
What is GDPR?
General data protection regulation… It is a complex mesh of technology and legalities regarding data collected on EU citizens
95
What is the name for attaching a location Details to data?
Geolocation
96
What are the three types of UPS?
Off-line or standby, line interactive, online or double conversion
97
This type of UPS is lower in cost and lower in backup time it can provide?
Offline or Standby
98
This type of UPS is useful in areas that have brownouts?
Line interactive
99
What can be used to provide long-term power back up?
A generator
100
What are the three types of geographic restrictions for wireless
Communications?
By network location which is based on the IP subnet, Geo location, Geo fencing
101
What are the three types of Geo location and what is their accuracy?
GPS very accurate, 802.11 wireless less accurate, by IP address not not very accurate
102
What is it called when you are automatically allowed or restricted access when in a particular location?
Geo fencing
103
With this type of data protection, everything is encoded into an unreasonable form and will need a key for it to be read?
Encryption
104
In this form of data protection, the represented data is converted into a short string of text that is impossible to be reversed engineered?
Hashing
105
In this form of data protection, we are converting normally readable text into something very difficult to understand?
Obfuscation
106
In this form of data protection, some of the original data is hidden or masked?
Masking
107
And this form of data protection, sensitive data is replaced with a nons sensitive placeholder, and this is commonly used with credit card processing?
Tokenization
108
In this form of data protection, the data is separated and stored in different locations?
Segmentation
109
In this form of data protection, access to an account is controlled?
Permission restrictions
110
In this form of resiliency, two or more servers are combined and appear to operate as one?
Server clustering
111
In this type of resiliency, traffic is distributed across multiple servers that also can be running different operating systems?
Load balancing
112
With this type of resiliency, a recovery site is prepped, and #DATA is synchronized?
Site resiliency
113
With this type of resiliency, an exact replica of software, data and hardware are maintained?
A hot site
114
With this type of resiliency, only a physical site may be chosen, meaning no duplicate hardware software or data is maintained
A cold site
115
With this type of resiliency, a physical site and the hardware needed to run the system is ready and waiting?
A warm site
116
With this type of resiliency, different types of systems are used to run the same application as the risk is distributed across these different environments?
Platform diversity
117
With this type of resiliency, more than one cloud system may be used to spread out the risk?
Multi cloud system
118
What is the disaster planning called?
Continuity of operations planning, COOP
119
What is it called when you are trying to identify the right balance of hardware software and people to build the best infrastructure?
Capacity planning
120
What are the three considerations in capacity planning?
People, technology (pick one that will scale easily), infrastructure
121
What is it called to test yourself before an actual event occurs?
Recovery testing
122
Because a full scale disaster drill can be costly and time-consuming, companies will perform these with key team members and talk through a simulated disaster?
Table top exercise
123
What is it called when a company will build redundant infrastructure that will be used when something negatively impacts the system?
Failover
124
What is it called when you split a process through multiple/parallel CPUs?
Parallel processing
125
What kind of back up is immediately available and generally less expensive?
On site
126
What kind of back up transfers, data over an Internet or WAN Link?
Offsite back up
127
What do organizations use to protect a back up from being easily readable?
Encryption
128
This type of backup became popular with virtual machines and contains a copy of an entire system?
A snapshot
129
What is the type of back up that is almost real time, ongoing, and keeps #DATA synchronized in multiple locations?
Replication
130
What type of back up writes the data into a predefined location prior to writing that data to storage?
Journaling
