Chapter 5: Domain 5: Cloud Security Operations (Ben Malisow) Flashcards

Question

Heating, ventilation, and air conditioning (HVAC) systems cool the data center by pushing warm air into _______________. A. The server inlets B. Underfloor plenums C. HVAC intakes D. The outside world

Answer 1

D. The outside world Explanation: The HVAC system is a heat exchange, swapping warm internal air from the data center to the outside world and drawing fresh air through the HVAC chillers to feed the internal environment. All the other options are incorrect because they will have the opposite effect by pushing warm air into those areas that cools air is supposed to be.

Answer 2

D. Tight gaskets Explanation: When cables come up through a raised floor used as a cold air feed, we don’t want cold air bleeding around the cables in an unplanned manner; this can cause inefficiencies in airflow control. Gaskets are required at all points where cable comes through the floor, to restrict airflow and reduce the possibility of cold air escaping. All the other options are incorrect because we want to minimize obstructions in underfloor plenums we use for airflow. Options A, B, and C do not accomplish this.

Answer 3

D. Removing unused machines Explanation: While minimizing equipment in the operational environment can aid in many efforts, including cable management, it is not strictly an aspect of cable management, so this is the best choice from those available. All the other options are definitely aspects of cable management.

Answer 4

B. Continually Explanation: Cable management is an ongoing process. All the other options are incorrect because they are time based intervals rather than continuous.

Answer 5

C. Either hot aisle or cold aisle Explanation: It shouldn’t matter which design you use as long as airflow is managed. Neither hot nor cold aisle containment is preferable to the other, so options A and B are incorrect. Airflow does need to be managed, though, so option D is incorrect as well.

Answer 6

B. The external ambient environment Explanation: This is a difficult question because almost all of the options are true—they will all have an effect on the cost of running HVAC systems. Because HVAC operates as a heat exchange, the outside environment will dictate how much power is needed to force warm air out of the data center. The warmer the climate in the location of the data center, the more energy it will take to exchange the heat, and the more costly the HVAC operation. This is the most significant factor. Option A is incorrect and it is the only choice that does not affect energy costs; hot and cold aisle containment should be equivalent in terms of operational costs. The initial cost of the HVAC units themselves will probably have an effect on operational costs because better equipment will cost more money, but it will also be more efficient and therefore less expensive to operate than cheaper alternatives. However, the effect still won’t be as significant as the external climate, so option C is still not as good as option B. Good cable management will make airflow more efficient and therefore make HVAC less expensive, but this will not be as dramatic in impact on operating costs as the external environment. Once again, option B is preferable to option D

Answer 7

D At the border of different counties, regions, or states Explanation: Usually, different political regions are served by different utility providers; placing your data center on such a boundary may make it feasible to have redundant, overlapping power providers. Municipalities typically limit selection of power providers by granting an artificial monopoly to a single provider; option A is incorrect. Rural settings are often only served by a single provider because the demand is not sufficient to support competition; option B is incorrect. Coasts do not affect the availability of multiple power providers; option C is a distractor.

Answer 8

B. Maintaining a strict license catalog Explanation: While maintaining a library of software licenses is important, it is not part of the practice we ordinarily consider “hardening.” The other options are all aspects of software hardening.

Answer 9

C. Performing more frequent and thorough audits on the host Explanation: Audits usually aren’t considered an element of hardening. Hardening is the process of provisioning a specific element (in this case, a host) against attack. Audits don’t protect against attack; they only detect and direct response to attacks. All the other options are aspects of host hardening.

Answer 10

B. Social engineering tests of all users Explanation: Users are not an aspect of configuration management. All the other options are elements of secure configuration management.

Answer 11

A. HTTPS Explanation: HTTPS is not a storage protocol. All the other options are.

Answer 12

B. Scalability Explanation: Virtual switches are widely used in virtualized networks. Unlike physical switches, which only lose one connection if a connecting cable is lost, virtual switches can be connected to multiple virtual machines via a single cable; if a cable is lost in a virtualized network, that can affect tens or dozens of devices. In this context, the benefits offered by scalability come with attendant risks. The other options are characteristics that don’t cause additional risk to the environment; in fact, redundancy reduces risk.

Answer 13

A. Using distinct ports and port groups for various virtual local area networks (VLANs) on a virtual switch rather than running them through the same port Explanation: It is possible to route multiple VLANs through a switch port (physical or virtual) with proper frame tagging. However, to optimize isolation of subnets and processes in a virtual network environment, it is better to use different ports instead. iSCSI traffic should be encrypted as another layer of defense within the environment; option B is wrong. HIDSs may or may not be cost-effective, depending on the value and sensitivity of the data on each guest; the additional overhead may not justify their use. Option C is incorrect. Firewalls should be hardened regardless of the nature of the network whether virtual or physical.

Answer 14

B. Ensure that management systems are connected to a different physical network than the production systems Explanation: The management systems control the entirety of the virtual environment and are therefore extremely valuable and need to be protected accordingly. When possible, isolating those management systems, both physically and virtually, is optimum. All the other options are incorrect because they imply that virtual and physical cannot coexist when in fact they need to coexist to work correctly.

Answer 15

A. Live virtual machines in the production environment are moved from one host to another in the clear. Explanation: When an active virtual machine is moved from a given host to another (for instance, when the host is going into maintenance state), it is passed along the network without encryption. Theoretically, an insider threat observing the line along which the virtual machine is moving could capture/copy it in its entirety. All the other options are not risks specific to a virtualized environment and are therefore incorrect.

Answer 16

D. Loss of data to law enforcement seizure of neighboring assets Explanation: In a pooled environment, law enforcement may acquire physical or logical assets (drives, data stores, etc.) that include your organization’s data, even if your organization was not the target of the investigation. All the other options are not risks due to pooled resources; they exist in all environments. These options are not correct.

Answer 17

C. Cloud data centers need very few of these devices. Explanation: The cost of each device is spread across many machines in the data center; unlike a desktop-based environment, where every user and every machine need their own KVM setup, just a few devices can serve an entire data center. While the cloud provider may generate a great deal of revenue, no company likes to throw away money unnecessarily; option A is incorrect. Cloud providers are not typically invested in KVM vendors. Option B is incorrect. Option D is simply incorrect.

Answer 18

D. 32 Explanation: The range suggested by the ASHRAE Technical Committee 9.9 is 64 to 81 degrees Fahrenheit. All the other options are incorrect (although A is particularly distracting, because it is higher than the recommended range, but that is not what the question is asking).

Answer 19

A. The risk of transferring data from one customer to another is significant. Explanation: Secure KVMs support drastically isolated operations; they cut down on the possibility of data being inadvertently shared from one customer to another. Option B is incorrect because devices will not leave the cloud data center simply because they are not managed by secure KVMs. Option C is incorrect because using secure KVMs will not have an effect on physical inventories. Option D does contain enough information to be the correct answer. “Audit purposes” is ambiguous.

Answer 20

A. Terminate a connection before creating a new connection Explanation: Referred to as “break before make,” these devices often take the form of manual pushbutton controls; as the button is pushed, the current connection is forced to physically separate, and when the button is fully engaged, the new connection is made. Options B and C have more to do with risks of electromagnetic emanations than with air-gapped selectivity; even air-gapped devices can leak data through emanations. Option D is incorrect because portability is not a property we seek in device selectors.

Answer 21

D. Customer production activities Explanation: The production activities will make full use of pooled resources, so they will not be isolated (unless the customer is paying for that specific characteristic of service). All the other options are functions that should take place on isolated networks/segments.

Answer 22

B. Broadcast packets sent from outside the VLAN will not reach other machines outside the VLAN. Explanation: Broadcast packets sent by machines outside the VLAN will reach machines outside the VLAN that are on the same network/segment. All the other options are characteristics of a VLAN.

Answer 23

A. The communications must go through a gateway Explanation: Gateway devices enforce the VLAN rules and can allow or deny outbound traffic. Communications traffic from a VLAN may or may not be encrypted; option B is incorrect. Repeaters are used to enhance signals along a line over a certain distance; they have nothing to do with VLANs. Option C is incorrect. Option D makes no sense in this context.

Answer 24

B. X.509 certificates Explanation: TLS uses X.509 certificates to establish a connection and create a symmetric key that lasts for only one session. SAML is used for federation authentication/identification; option A is incorrect. 802.11 is the suite of wireless standards; option C is incorrect. Diffie-Hellman uses asymmetric key pairs to create a symmetric key; option D is incorrect.

Answer 25

B. It can harm the environment. Explanation: This question is an outlier because it is one of the few such questions where the answer is not that it poses a threat to health and human safety (although, in fact, it does; option A is true, but incorrect). Halon was not prohibited because of this property. Halon was outlawed because it, like other CFCs (chlorofluorocarbons), was blamed for depleting the earth’s ozone layer. Halon is still allowed in some very specialized cases (such as fire-suppression systems on aircraft), but this is an exception. Options C and D are incorrect and untrue.

Answer 26

B. Human interaction Explanation: User interaction with the cloud is not described in this term. All the other options are characteristics of cloud computing mentioned in ping, power, pipe.

Answer 27

C. Penetration testing Explanation: The penetration test is not part of the site survey, which is one of the initial steps in securing/auditing a facility. The penetration test will, however, probably make use of the site survey information later. All the other options are goals of the site survey.

Answer 28

B. Preventing any chance of service interruption Explanation: There is no such thing as zero risk; there will always be some chance of service interruption, no matter how minimized. All the other options are capabilities allowed by redundancy.

Answer 29

D. Failsafe or “last person out” switches Explanation: Before flooding an enclosed space with a gas that will displace oxygen, it is important to ensure that all personnel are out of the area. While this requires personnel training, such training is ineffective without a system to support this capability. Option C is true, but not as accurate as option D. Options A and B are incorrect because they do not make senses given the question is about a system that displaces oxygen in the facility.

Answer 30

A. Logical design Explanation: The logical design should come before the physical design; function dictates form. Audit and revision come after creation.

Answer 31

C. Strict access control mechanisms Explanation: While physical controls that inhibit movement affect personnel, they are not regarded as personnel controls. All the other options are examples of personnel controls.

Answer 32

C. Sufficient redundancy Explanation: Because updating the virtualization toolset may require server downtime, it is essential to have a sufficient amount of redundant machines to roll out the update over the environment without significant disruption of operations. Option A assumes that there isn’t already enough of whatever the infusion of capital will purchase. Option A is incorrect. Thankfully, option B is incorrect. It would be costly to obtain an alternate data center each time the virtual machine management tools are updated. Peer review is not required when updating virtual machine management tools. Option D is incorrect.

Answer 33

B. Role-based Explanation: It is important to limit access to the virtualization toolset to those administrators, engineers, and architects who are vital for supporting the virtualized environment and nobody else. The other options are incorrect because they do not restrict access to the virtualization management tool set as specifically as role-based access control does. If someone’s role changes and they no longer require access, then their access should be terminated.

Answer 34

C. Vendor guidance Explanation: Toolset vendors will specify secure configurations of their products; these must be followed in order to fulfill due care requirements. Standards and laws don’t usually specify builds for products or brands, so options A and B are incorrect. Expert opinion, while useful, is not sufficient to demonstrate due care in many cases; option D is not the best response.

Answer 35

B. Documentation Explanation: In order to understand, optimize, and re-create your secure baseline, proper and full documentation is absolutely essential. Personnel training is important for secure system use, but it is not an element of baselining. Option A is incorrect. A secure baseline for a given system may include HIDS and/or encryption, but they are not essential elements, so options C and D are incorrect.

Answer 36

A. Capturing and storing an image of the baseline Explanation: An image of the baseline should be stored securely, preferably in more than one location (to include the archive, the disaster kit, and any alternate site, to name a few). It is essential to have a copy on hand for reconstructing the environment during contingency operations, and it is also useful for audit/review purposes. Option B is incorrect because planned modifications are not yet part of the actual baseline. Option C may be a good answer in some situations; however, it is not essential, and option A is still a better answer. Option D is incorrect because every environment (and, therefore, the baseline used in that environment) should be exclusively tailored for the organization using that environment.

Answer 37

D. The configuration or change management committee or board may grant blanket approval for patches (at a certain impact level) without the need to go through the formal change process. Explanation: In order to ensure timely application of patches, patching may receive blanket approval and only be reviewed by the committee or board after the fact for final approval. Requiring normalized processing for patching may delay patching and expose the organization to undue risk; option A is thus incorrect. Patching still needs to involve testing and confirmation to avoid interoperability and additional security problems, making option B incorrect. Third parties can identify security problems as well as vendors; external patches need to be considered as well as vendor patches. Option C is thus incorrect.

Answer 38

D. Apply updates, patches, or configuration modifications instantly Explanation: Clustering does not preclude the time and diligence necessary to perform patching or updates. All the other options are attributes provided by host clustering.

Answer 39

C. Tokens Explanation: Tokenization is a method for obscuring or protecting data using two distinct databases, not a resource allocation method. All the other options are methods for allocating shared resources.

Answer 40

D. The performance and capacity in each node Explanation: In a loosely coupled storage cluster, each node acts as an independent data store that can be added or removed from the cluster without affecting other nodes. This, however, means that the overall cluster’s performance/capacity depends on each node’s own maximum performance/capacity. The physical backplane can be a limiting factor in a tightly coupled architecture but has less effect in a loosely coupled cluster; option A is incorrect. Because each node in a loosely coupled cluster has its own limitations, the number of nodes will not affect overall performance. Option B is incorrect.

Answer 41

B. Turn off logging Explanation: Auditing is probably even more important during maintenance mode than normal operation because administrator activity is almost always involved. All the other options are necessary measures for maintenance mode.

Answer 42

D. Lower costs for the environment Explanation: Almost invariably, stand-alone hosting will cost more than pooled resources and multitenancy. All the other options are characteristics of stand-alone hosting.

Answer 43

D. Failover capability back to the customer’s on-premises environment Explanation: In many cases, the customer will no longer have an on-premises environment after a cloud migration. All the other options are methods cloud providers use to achieve “high availability” environments.

Answer 44

B. Behavioral outliers Explanation: Behavioral detection looks for activity beyond the norm of the organization’s usual traffic. Unique attacks would most likely fall into this category. Unique attacks would not be detected by signature matching because no signatures exist for unique attacks; option A is incorrect. Content filtering is less a means of detection and more a means of controlling traffic that users/systems are exposed to; while it may be useful for mitigating the possibility of malware infection, it’s less suited to the purpose posed in the question. Option C is incorrect. Firewalls don’t work with biometrics; option D is a distractor.

Answer 45

C. Bandwidth providers used to connect to the cloud Explanation: Internet service providers don’t usually offer firewall services. All the other options are locations/ways to implement firewalls.

Answer 46

B. Luring attackers Explanation: It is very important to distinguish the purpose of the honeypot. It is not for luring in attackers; a lure is an invitation, and inviting an attack decreases the organization’s ability to have the attacker prosecuted or conduct successful litigation against the attacker. All the other options are purposes of a honeypot.

Answer 47

D. Detection systems Explanation: The honeypot is used to gather information about the attacker, the attacker’s tools, and the attacker’s techniques. The honeypot should not contain anything of value; all the other options are incorrect.

Answer 48

C. Once in-all in Explanation: It’s preferable to have compartmentalized zones of trust within the production environment and not allow total access with one set of credentials. All the other options are aspects that should be used in cloud access.

Answer 49

B. Misconfigurations Explanation: Historically, when encryption had been used as a security mechanism, it was not defeated by attacking the encryption directly but rather by subverting the encryption implementation. All the other options are actual methods for breaking encryption but are not the best answer for this question.

Answer 50

D. Assigning permanent administrators to select customer accounts Explanation: Cloud vendors do not typically assign individual administrators permanently to specific accounts. All the other options (A–C) are methods used to reduce risks associated with privileged accounts.

Answer 51

C. Periodically restore from backups. Explanation: All the options are useful for enhancing the security and efficacy of the BC/DR effort, but only option C ensures that the BC/DR has a likely chance of success.

Answer 52

B. Solve cloud interoperability problems Explanation: Patches can, and often do, create interoperability problems. All the other options are functions offered by patching.

Answer 53

B. Put the patch through the formal change management process Explanation: In many cases, patches are released to deal with an imminent vulnerability/risk. Some organizations will give blanket preapproval for applying these patches and having the formal change management process approve the patch after the fact. All the other options are activities that should take place with patching.

Answer 54

B. A patch may not be applicable to a given environment. Explanation: Not all patches are necessary for all environments. Automated patching won’t always account for variations in organizations and could cause interoperability problems in some. Users don’t usually apply patches and aren’t involved in automatic patching; option A is incorrect. It is rare that an automated patch tool will be exploited to install malware; option C is incorrect. Automated patching is faster and more efficient than manual patching; option D is incorrect.

Answer 55

A. Snapshot/saved virtual machine (VM) images won’t take a patch. Explanation: When a VM instance is inactive, it is saved as a snapshot image in a file; patches can’t be applied until the instance is running. Automated patching set to a certain scheduled time may miss inactive VMs. Patches can be applied remotely or locally; option B is not true or correct. Patching may be the responsibility of the cloud customer or provider, depending on the service model, type, and contract. Option C is incorrect. Cloud service providers should apply patches ubiquitously throughout their service environment; option D is incorrect.

Answer 56

A. Patches may interfere with some tenants’ production environments. Explanation: Because a multitenant environment may have a variety of different configurations for various customers, a given patch might interfere with a certain number of customers due to interoperability problems. Option B is untrue. Patches do work with SaaS models. Option B is incorrect. Option C is untrue. Patches do work with private cloud builds. Option C is incorrect. On the contrary, vendors do issue patches to cloud providers. Option D is incorrect.

Answer 57

C. It’s not scalable. Explanation: Manual patching requires a significant degree of effort and time and is simply not feasible in a large enterprise, much less in the vast environment of the cloud. Manual patching is slower than automated patching. Option A is incorrect. Option B is incorrect; this is true in both traditional and cloud environments.

Answer 58

D. The possibility for human errors exists Explanation: Patching is a mundane, repetitive process, and people have trouble focusing on such tasks, especially for the number of times necessary to patch a cloud environment. Automation can aid in addressing this aspect of patching. With human involvement in patching, there is an opportunity to be aware of imminent patch impacts and to determine applicability of the patch before it is applied; options A and B are incorrect. Option C is a risk involved with all patching and not limited to manual patching; option D is preferable as it is specific to the question.

Answer 59

C .Your organization is subject to the vulnerability the patch addresses. Explanation: It is perfectly reasonable to not want to use the first version of a patch as there may be interoperability problems or even additional vulnerabilities contingent with its implementation. However, for as long as your environment remains unpatched, you are subject to attack through that new vulnerability. All the other options are untrue. The cloud provider will not suspend your access or sue your organization if you delay patching because of concerns about interoperability afterwards. Options A and B are incorrect. Option D is incorrect. The opposite may actually be true. Your end clients may appreciate that you delay or test the patch before installing it on production systems.

Answer 60

B. Regulators Explanation: If your organization doesn’t apply a patch for a known vulnerability, regulators may claim the organization was not performing adequate due diligence and penalize it accordingly. None of the other entities listed in the other options can assess penalties, so they are incorrect. (End clients may try to recover damages realized from an attack through a known vulnerability, but those penalties will be imposed by a court if the end clients conduct successful litigation.)

Answer 61

C. VMs located physically in one location but operating in different time zones Explanation: If patches are rolled out across an environment where users are operating virtual machines (VMs) at different times, there is a possibility that VMs will not be patched uniformly, which could lead to data disruption. Option A is incorrect. Users should not be performing patching. Option B is incorrect; a contract specifying who is responsible for specific patching activities actually reduces risk by enhancing the probability of proper patch application. Option D is incorrect; attacker activity should be irrelevant to the patch process.

Answer 62

B. Real-user monitoring (RUM) Explanation: RUM harvests information from actual user activity, making it the most realistic depiction of user behavior. Synthetic monitoring approximates user activity but is not as exact as RUM; option A is incorrect. SIEM monitors more than web applications, so option C is not ideal for this question. DAM is an OSI Layer 7 tool for monitoring database activity, specifically, so it is not the ideal answer for this question.

Answer 63

C. Privacy concerns Explanation: Depending on the jurisdiction, RUM may entail unlawful surveillance, so the practitioner must take this into account and plan accordingly. Option A is incorrect. False positives are typical for real-user monitoring systems. Option B has no relevance in this context. Option B is incorrect. Sandboxed environments are not a concern when using real-user monitoring for web application activity analysis. Option D is incorrect.

Answer 64

C. It is more comprehensive Explanation: Synthetic agents can simulate user activity in a much faster, broader manner and perform these actions 24/7 without rest. All the other options are incorrect; synthetic agents may cost more than RUM, are less accurate than actual user activity, and both can take place on the cloud.

Answer 65

B. Sufficient logging to reconstruct a narrative of events at some later date Explanation: Logging should suffice for the purpose of reconstructing the pertinent information (who, what, where, when, etc.) necessary to form a narrative of what transpired. This will be different for every organization and environment (so option D is incorrect). You will have to make this determination for your organization. Logging everything would result in log storage that exceeds the amount of data in the production environment and would actually make it more difficult to locate pertinent information. Option A is incorrect.

Answer 66

D. Someone with knowledge of the operation and a security background Explanation: It is important for the log review to be performed by someone who understands the normal operations of the organization so that they can discern between regular activity and anomalous behavior. This person also needs a security background so they can recognize common attack patterns/activity. Option A sounds great, but the better answer is option D. A person with knowledge of the operation is a better fit than someone who is trained to review logs. Options B and C are incorrect. Auditors are not the ones who should be reviewing logs for an organization.

Answer 67

C. Clock Explanation: The clock needs to be synched throughout the environment so that all activity can be contextualized and mapped and a true narrative of events can be reconstructed later. All the other options are incorrect because they are simply IT terms. When it comes to useful logs, having the correct time relevant to all logged activity is vital.

Answer 68

B. Responding to alerts Explanation: Response to anomalous activity detected by the SIEM tool will still require human involvement. All the other options are functions that the SIEM system can perform on its own as automated tasks.

Answer 69

B. At least at the same sensitivity level as the systems from which it was collected Explanation: Because the logs are essential to reconstructing a record of what occurred within the environment, they are a valuable target for attackers. They therefore need a sufficient level of protection commensurate with the data/systems they are about. We don’t want to have less protection on the logs than on the systems they monitor; the controls on those systems were chosen according to what threats and risks they may be exposed to—the level of security provided by those controls are, at a minimum, required for the log data. Option A is incorrect. Encryption may or may not be used for securing log data, depending on the level of sensitivity of the systems/data they are protecting; option C is too specific and thus incorrect. NIST guidelines are not suitable for all organizations and uses; option D is too broad and incorrect.

Answer 70

D. According to risks recently realized by other organizations in the same industry Explanation: While historical information, especially that specific to the organization’s industry, can be useful in assessing threats, risk must be considered independently from other occurrences; whether something has occurred elsewhere does not necessarily directly affect the likelihood it will or will not occur for a certain target. All the other options are elements typically considered in the risk context.

Answer 71

D. Customers Explanation: We usually do not evaluate our customer base as an aspect of risk management. All the other options are aspects of common risk management practices.

Answer 72

B. Money Explanation: While all the options are somewhat true, because all of that information can be used to provide the most comprehensive risk picture, the best answer among those listed is money; it is a discrete, numeric metric that can be used both for comparison to countermeasure/control cost and for recompense efforts (insurance claims, lawsuits, etc.).

Answer 73

B. Qualitative Explanation: Qualitative risk assessments are preferable in situations where the organization has personnel who understand the IT environment but may not have a lot of experience with risk functions and where the organization does not have a great deal of time or money to spend on the project. A quantitative risk assessment requires a significant budget of time and money as well as well-trained, experience personnel familiar with risk; option A is not correct. Options C and D are incorrect; these are not types of risk assessments.

Answer 74

B. The dollar value of the asset Explanation: The monetary value of the asset is the most objective, discrete metric possible and the most accurate for the purposes of SLE determination. The other options are factors that may bear on how you determine the dollar value of the asset but are not as useful as option B.

Answer 75

B. Historical data Explanation: While previous activity is not a great predictor of future outcomes (especially in the field of IT security), it is the best source we have. Threat intelligence information is useful but not as good as historical data in predicting ARO; option A is not as good as option B. Vulnerability scans and aggregation do not really aid in predicting rate of occurrence at all; options C and D are incorrect.

Answer 76

A. The type of threat vector Explanation: The threat vector is the multiplier involved in determining exposure factor; of the options listed, this is the best answer (and, other than C, the only one that actually has bearing on EF).

Answer 77

C. 1 Explanation: Absent any other information about a total physical loss, we can consider the rate of occurrence as 1: We would not expect the plant to burn down more than once in a year. In fact, we would expect that unless the plant was involved in some particularly flammable activity, the ARO would be less than 1 (that is, a fire is not expected every year) due to controls involved in the planning and building process of the plant (location of flammable material, fire-resistant construction techniques, etc.). Options B and D are incorrect. The ARO is a number, not a dollar amount. It is unlikely that the plant would burn down 12 times a year or every month. Option A is incorrect.

Answer 78

D. It is impossible to decide from this information. Explanation: What we can’t determine from the available information is the actual annualized loss expectancy (ALE); the cost of the physical plant itself is not the actual value of the asset, so it’s impossible to determine the ALE and therefore impossible to compare the ALE against the cost of possible controls and countermeasures. All the other options are incorrect; we can’t make a suitable choice from the available information.

Answer 79

D. The amount of product the plant creates Explanation: Unless this number is being used to determine the measures of options A or B, or we’re trying to better estimate the cost of the impact of the first occurrence (i.e., including the value of lost product in the single loss expectancy [SLE]), the amount of product the plant creates is not as important as the attendant revenue that amount generates for the company. All the other options are factors we need to know: The amount of revenue and the pace at which it is generated by the plant and the duration of downtime for the plant in the event of fire (so as to calculate possible lost revenue) will help us arrive at the annualized loss expectancy (ALE). In fact, additional information would also be useful, such as potential loss of market share if product was not delivered for the duration of the downtime, etc.

Answer 80

B. Get the fire suppression system. Explanation: The fire suppression system is the most cost-effective, reasonable means of dealing with the risk, if we use the formula for determining annualized loss expectancy (ALE). First, we need to determine the single loss expectancy (SLE) and annualized rate of occurrence (ARO). ARO can be assumed to be 1; absent any other information about the plant, we don’t expect more than one fire per year (and perhaps less, but we don’t have that information, either). The SLE is $36 million ($24 million for the cost of rebuilding the plant, assuming no increase in costs over the previous construction, plus $2 million per month of lost revenue, for the six months it will take to rebuild). Therefore, the ALE is $36 million (36 [SLE] × 1 [ARO]). Either the fire suppression system or the insurance policy would be appealing, from a strictly financial standpoint, if we only compared the ALE to the annualized cost of the countermeasure ($15 million for the suppression system, $12 million for the insurance policy). However, other factors have a bearing on this consideration too. For instance, fire poses a threat to health and human safety; obviating such risks should be a paramount concern to senior management. An insurance policy doesn’t truly protect people, it only offsets the damages people experience through loss. Also, the insurance policy would be a recurring, continual cost; it costs less than the fire suppression system in the first year of the plant’s operation ($12 million for insurance versus $15 million for the system), but once the system is purchased, though it may need upkeep and maintenance, we can assume it won’t cost the same amount in future years, and it probably won’t cost anywhere near as much as the continual costs of the insurance.

Answer 81

A. Risk acceptance Explanation: Because risk can never be mitigated to zero (there is no such thing as “no risk” or “perfect security”), there will always be some residual risk after risk mitigation; this residual risk must be accepted. Risk mitigation does not always involve risk transfer, or risk avoidance. “Risk attenuation” is not an industry-standard term associated with risk management Options B, C, and D are incorrect.

Answer 82

B. Oxygen-displacing fire suppression Explanation: Secondary risk is any risk resulting from enacting a control/countermeasure to the original risk. In this case, a fire suppression system that displaces oxygen is a means to mitigate the original risk (fire) but adds a new risk (suffocating people). All the other options are not causes of secondary risk (except if we draw out unreasonable conclusions from the most extreme, ridiculous cases, for example, “the secondary risk is the risk that the control doesn’t work”).

Answer 83

D. Risk mitigation is always the best means to address risk. Explanation: The best means to address risk is completely dependent on the business needs of the specific entity and process. Mitigation may or may not be the optimum choice. All the other options are true statements about risk mitigation.

Answer 84

D. Risk is fluid, so all risk assessments are pointless. Explanation: A risk assessment may, indeed, be an estimate of a moving target, but it is invaluable in terms of measuring risk at any given point in time.

Answer 85

D. Certification Explanation: In the certification/accreditation model of system approval, certification is the fundamental step. All other options are incorrect because certification comes first in the certification/accreditation model of system approval.

Answer 86

C. Is based on cost metrics and perceived threats Explanation: The RMF is based on perceived risk as opposed to threats (threats may factor into risk assessment but are not the driver for the RMF). All the other options are true regarding the RMF.

Answer 87

D. A shared secret Explanation: In symmetric encryption, a single key is used to both encrypt and decrypt a message. This is often referred to as a shared secret. Two key pairs are not used in symmetric encryption; option A is incorrect. Parties most often must be known to each other using symmetric encryption; option B is incorrect. Certificates require public-private key pairs, which is not an element of symmetric encryption; option C is incorrect.

Answer 88

B. Passing keys out of band Explanation: In symmetric encryption, the key must usually be passed through a different medium than will be used for sending and receiving the encrypted messages. DH is usually used for asymmetric encryption, to establish a temporary symmetric key; option A is incorrect. Option C describes asymmetric encryption and is therefore incorrect. Option D describes hashing and is therefore incorrect.