Domain 5: Cloud Security Operations Flashcards

Question

Juanita is responsible for a web application that is split between an on-site application environment and a cloud-hosted database. Juanita knows the application performs thousands of small database queries for some transactions. What performance monitoring option is most important to her application’s performance? A. The network routes between the datacenters B. Network throughput between the two datacenters C. The bandwidth between the two datacenters D. Network response time (latency) between the datacenters

Answer 1

**Answer: D. Network response time (latency) between the datacenters** Network latency is the critical factor when transaction volume is key. Bandwidth is less critical for small transactions, even when there are thousands of them. Routes may influence all of these options, but aren’t as critical as the impact they have on the traffic

Answer 2

**Answer: A. Compare the hashes of the VM’s OS and data disks and the snapshots of each.** **Azure’s best practices suggest creating disk snapshots for both the VM’s operating system(OS) and data disks, safely storing the snapshots, then comparing hashes between the images and the originals.** Comparing the hashes of a snapshot to a copy won’t validate it against the original, VMs can’t be exported as hashes, and disk images aren’t signed in a way that makes sense for this type of forensic use. If you’d like to read the full practice document for more detail, you can find it at https://docs.microsoft.com/en- us/azure/architecture/example-scenario/forensics.

Answer 3

**Answer: A. Customer KPI oversight** Businesses typically don’t manage customer capacity. Instead, they would assess their own capacity, known as business capacity management.

Answer 4

**Answer: B. Customers** Data breach regulations typically focus on customer notification. Nick should work with legal counsel to ensure that his organization is compliant with any notification requirements for his industry and location.

Answer 5

**Answer: B. Chain of custody** **Valerie should carefully document the chain of custody for the disk images so that they can be considered valid for potential legal action.** Legal hold is the process for preserving data for legal action, not for documenting actions taken with disk images and other forensic artifacts. Seizure is a type of acquisition but isn’t mentioned here, and disposal would occur after the potential legal case.

Answer 6

**Answer: C. Tagging** **Tagging is a critical part of instance scheduling, but even more so for large numbers of instances.** It allows schedules to be easily applied to all instances with the proper tags. Since Asha wants to use her cloud provider’s scheduling, a third party does not meet her requirements. Auto-scheduling was made up for this question, and disabling unused instances helps with spend, but doesn’t help more than tagging would for scheduling.

Answer 7

**Answer: C. Adding new hardware to provide increased performance** **Adding new hardware to increase performance is not an element of hardening.** Hardening is the process of provisioning a specific element (in this case, a host) against attack. Audits don’t protect against attacks; they only detect and direct responses to attacks.

Answer 8

**Answer: A. The potential to disrupt systems due to a patching issue or bad patch.** Automated patching systems can cause disruptions if a bad patch is released or if there is an installation problem that is not detected. That means that a human is often in the loop for patching, or that patches are installed in nonproduction environments first where they can be validated prior to further installations. **Automated systems typically can report on patches that fail installation and on systems that do not have patches in place, and it is a desirable feature to speed patching and patch accuracy via automation.**

Answer 9

**Answer: B. Ensure that management systems are connected to a different physical network than the production systems** The management systems control the entirety of the virtual environment, and are therefore extremely valuable and need to be protected accordingly. When possible, isolating those management systems, both physically and virtually, is optimum.

Answer 10

**Answer: B. Release management** ITIL v4 categorizes deployment management as part of release management.

Answer 11

**Answer: C. Carlos cannot track temperature and voltages for a virtual CPU, but he can track load via the operating system.** Carlos knows that virtual machines use virtualized processors and that temperature and voltages can’t be tracked for virtual CPUs. He can track load, and most operating systems have a built-in method for doing so. If voltages and temperature are an ongoing concern, he will need to monitor them at the underlying operating system, hardware, or hypervisor level.

Answer 12

**Answer: D. Customer** Megan is a process owner and is responsible for the fit-to-purpose for the continual service improvement effort. Continual service improvement managers (CSI managers) improve ITSM processes and services. Process architects ensure that processes work together and support each other effectively, and customers consume or purchase services.

Answer 13

**Answer: D. Network security groups** Felicia wants to perform firewall-like rules-based filtering, which is a function of network security groups. Honeypots are used to capture and observe attacker behaviors, and IDSs and IPSs are used to detect and, in the case of IPSs, potentially prevent attacks based on behaviors and signatures.

Answer 14

**Answer: B. Preventing any chance of service interruption** Risk can’t be entirely prevented, but it can be drastically reduced. **Hardware redundancy, local sharing and balancing, and failure mode design are all common practices when designing redundancy into cloud datacenters.**

Answer 15

**Answer: A. An attestation of compliance** **Cloud providers who are PCI-compliant will typically provide an attestation of compliance upon request. This type of documentation is important for regulators as part of compliance validation.** SOC audits don’t specifically test PCI compliance, and most vendors will not allow customers to conduct PCI assessments of their underlying infrastructure.

Answer 16

**Answer: A. She can only scan her own internal systems.** IaaS vendors typically allow customers to scan their own internal systems, but may recommend that certain types of instances with lower resources are not scanned to avoid disruption. While vendors may provide scanning tools, they typically don’t require customers to use them in an IaaS environment. Since external scans can inadvertently impact other customers, external scanning is typically prohibited or limited, and scheduling a time and date may be required for more advanced or specialized testing.

Answer 17

**Answer: B. Stand up new, patched instances, then replace the unpatched systems using load balancers.** **Using load balancing to drain load from existing systems and then replacing them with new, patched instances is a common best practice for cloud-hosted service environment patching.** Manual and scripted patching can cause outages, as could re-IPing as systems are swapped over.

Answer 18

**Answer: B. Turn off logging** Disabling logging would prevent administrators from diagnosing problems. Transferring users, preventing new connections, and notifying customers are all common practices when entering maintenance mode.

Answer 19

**Answer: C. Virtual TPM** **A virtual trusted platform module (vTPM) is the only solution that will meet Jack’s needs.** HSMs (hardware security modules) are used to create, store, and manage secrets, including cryptographic keys and certificates, but aren’t used for boot security. Cloud TPM was made up for this question, but hardware and cloud HSMs do exist.

Answer 20

**Answer: D. Type 2** Yarif is running a Type 2 hypervisor, which is defined as a hypervisor that runs on top of an operating system rather than on bare metal like a Type 1 hypervisor. Classic and advanced hypervisors are not commonly used terms.

Answer 21

**Answer: C. Restoring a service as soon as possible after an incident.** While ITIL focuses on identification, containment, resolution, and maintenance, the overall goal is to restore service as soon as possible after an incident. It does not focus on third- party responders. Problem escalations to incidents are part of identification, but aren’t the main goal, nor is identifying incidents to allow response.

Answer 22

**Answer: A. As an incident** Incidents are defined in ITIL as interruptions of normal service, including reductions in the quality of services that may violate an SLA. Problem management resolves the cause of problems, while incident response restores services to normal levels.

Answer 23

**Answer: D. Every incident is the result of a problem, but not all problems are incidents.** All problems are potential causes of incidents, but not all problems result in incidents.

Answer 24

**Answer: D. The number of individuals impacted by service interruptions** The number of individuals impacted is of interest to customers and management, but is not a useful KPI for availability.

Answer 25

**Answer: C. Information security policies** Information security policies— particularly what ITIL calls “underpinning information security policies”— are the basis of security management in ITIL.

Answer 26

**Answer: C. Automated testing and validation must be completed successfully.** In a continuous integration/continuous delivery pipeline, automated testing is conducted, and the code must pass testing before code is released. Human intervention or approval is not typically required for CI/CD pipelines.

Answer 27

**Answer: B. Use of the provider’s snapshot tool** Snapshots are the most common means of capturing disk images from virtual machines in IaaS environments. Using forensic image acquisition tools can be challenging in cloud environments due to a lack of access to the underlying hardware. DBAN is a wiping tool, and file copy utilities often don’t provide a complete forensically sound copy, although they may be the only option in some cases.

Answer 28

**Answer: C. Infrastructure as code** These are examples of infrastructure- as- code (IaaS) tools. While Agile pipelines may use Terraform, they would do so as part of an infrastructure as code strategy. They aren’t specifically used for incident response or legal hold strategies, but could be leveraged for both, once again as part of an infrastructure as code solution.

Answer 29

**Answer: A. ISO 20000- 1** ISO 20000-1 describes service management. ISO 27001 describes an information security management system. ITIL is not an ISO standard, nor is COBIT— in fact, they’re their own standards.

Answer 30

**Answer: B. SIEM** Security information and event manager (SIEM) is the ideal tool for this purpose. A network operations center (NOC) and an IPS (intrusion prevention system) won’t centralize logs and incident information, and DLP (data loss prevention) is intended to stop data from leaving an organization.

Answer 31

**Answer: C. Flow logging** Turning on flow logging can provide the visibility Amanda wants. Flows show which IP address contacted another IP address, the source and destination ports, and the volume of data. None of the other types of logging listed will be as useful for this task.

Answer 32

**Answer: B. An IPS can block legitimate traffic.** Unlike an IDS, an IPS needs to be placed in-line with traffic. This means that an IPS can block legitimate traffic if it is improperly identified or if the IPS fails in a closed state. An IDS cannot fail open or closed, as it is not in-line. Both IDSs and IPSs can use signature and behavior-based detection.

Answer 33

**Answer: A. AI** AI features in SIEM devices are often used to analyze and learn network traffic patterns, then use log correlation and threat intelligence features to identify unexpected and potentially malicious behavior while leveraging learning capabilities. Log correlation and threat intelligence alone will not do this; reporting is needed afterward.

Answer 34

**Answer: A. A default gateway, subnet mask, DNS server, and IP address** A typical DHCP response will provide a default gateway, a subnet mask, DNS server information, and an IP address for the host to use. It does not assign MAC addresses to systems— that’s a hardware-level setting, and it doesn’t define a default route, just a default gateway, nor does it provide firewall rule definitions.

Answer 35

**Answer: D. Use the virtual machine console whenever possible.** Using secure boot, disabling cut and paste between VMs and the console, and removing unnecessary hardware are all common security practices. Since the virtual machine console is equivalent to direct access to the system, use of the console should be limited to only critical actions, and the virtualization management platform should be used for the majority of actions.

Answer 36

**Answer: A. Honeypots** Honeypots are used to capture attack traffic for study, but aren’t used to stop attacks. Firewalls, security groups, and IPSs are all used to stop attacks by preventing malicious traffic from entering a network.

Answer 37

**Answer: A. Using instances running on alternate CPU architectures ** Using alternate CPU architectures isn’t a common high availability technique. Using multiple vendors, having SLAs in place, and using self-hosted failover capabilities are all methods that can achieve this goal.

Answer 38

**Answer: A. Availability management** Susan’s outage points to a need for availability management. Susan may invest in redundant systems, additional monitoring, or other practices and design elements that can ensure her organization’s website will be more resilient and thus more available.

Answer 39

**Answer: A. Logs** The only data that Li is likely to be able to obtain for forensic investigation is log files. Disk images, VM snapshots, and network packet capture data require lower-level access to systems and the network that an SaaS provider will normally make available.

Answer 40

**Answer: B. Service capacity management** Service capacity management measures performance and checks it against requirements set in SLAs and service-level requirements. Business capacity management involves inter preting business needs into requirements for services and architecture. Component capacity management focuses on the actual components of an infrastructure. Finally, contract capacity management is not an ISO/IEC 20000- 1 configuration management subprocess.

Answer 41

**Answer: D. SOC** An SOC, or security operations center, can be physical or virtual, and typically consists of a team that monitors for security events on an ongoing basis. An SOC team is likely to use a SIEM (security information and event management) tool. NAS is network-attached storage, and SCCM is the name for Microsoft’s now-outmoded Systems Center Configuration Manager, now branded as Endpoint Configuration Manager.

Answer 42

**Answer: C. Orchestration** Hui’s organization is using a cloud orchestration technology to automate tasks in their cloud environment. That may include scheduling, but it covers a much broader set of tasks than just scheduling. Maintenance mode is used to remove running systems from a VM cluster to allow for hardware or software upgrades. Abstraction is a term that describes a means of hiding the details of a system, often as a way of making management or other tasks simpler.

Answer 43

**Answer: B. Artificial intelligence** Megan is using an artificial intelligence (AI)- based tool that learns from the data it is exposed to and improves its capabilities. An IPS looks for malicious or unwanted network traffic and can block it. Log analysis may be involved in Megan’s tasks, but the problem describes far more than log analysis, and forensic data capture is done as part of investigations.

Answer 44

**Answer: A. A honeypot** Jim has deployed a honeypot, a system designed to capture attacker tools and techniques to allow for analysis. Honeynets are networks set up in a similar manner to detect network attacks and attack techniques. Darknets are unused IP ranges that are instrumented to look for unexpected traffic indicating probes by potential attackers. Bastion hosts are used to provide secure access from a lower security zone to a higher security zone.

Answer 45

**Answer: D. Preservation** Olivia knows that once the data or artifacts have been identified, preservation is the next step. Even if you’re not familiar with digital forensics techniques, you can consider the flow for a likely forensic capture process. Analysis, documentation, and presentation can’t be done until data is captured!

Answer 46

**Answer: D. IaC can cause errors to spread quickly.** IaC can cause errors to spread quickly. It actually helps increase consistency by removing opportunities for human error, it is easily updated, and it increases speed in most cases.

Answer 47

**Answer: A. Lower cost** The benefits of any clustered environment come at the cost of higher prices. Keith should expect to spend more money, but gain performance, availability and reliability, and capacity depending on his configuration and design choices.

Answer 48

**Answer: A. Configuration Control** ITIL’s configuration identification subprocess includes identifying and specifying the attributes for each configuration item type and subcomponent and the relationships between each CI or subcomponent and others in the organization. Configuration control focuses on managing changes in the configuration management system. Configuration verification and audit is a single subprocess, and validates that configurations match what is expected.

Answer 49

**Answer: A. CPU utilization** The only metric among those listed that is typically available to customers in an infrastructure as a service environment is CPU utilization to help track usage.

Answer 50

**Answer: C. Configuration item** CIs (configuration items) are the components or services that are managed as part of a configuration management effort. Configuration models are used to evaluate changes and causes of incidents. Configuration records are the records that describe configuration item relationships and settings. Service assets include a range of things that allow organizations to deliver services, including third-party vendor services.

Answer 51

**Answer: D. Latency** While bandwidth, compute, and storage usage are all typically measured and billed, latency is usually not directly charged for. Instead, providers are likely to provide a distinct low-latency service if they charge for latency-related items.

Answer 52

**Answer: A. The hypervisor’s memory state** Customers are typically unable to obtain forensic data from the underlying infrastructure as a service environment. Memory for instance, disk volumes, and logs are all common cloud forensic artifacts.

Answer 53

**Answer: D. Consider asking the SaaS provider about their own patching and scanning practices.** SaaS providers are unlikely to allow third parties to scan their production services. While Selah could just scan her provider anyway, this is often prohibited in contracts that customers sign with their provider. Instead, Selah should ask the vendor about their patching and scanning practices to determine if they are appropriate to her organization’s risk tolerance and to see if documentation or attestation of practices like an SOC audit is available.

Answer 54

**Answer: C. Periodically restore from backups.** If backups aren’t working properly, or cannot be restored, checking all of the other actions described won’t be of use.

Answer 55

**Answer: B. ISO/IEC 27037:2012** A number of ISO standards related to forensics exist, including 27037, 27041, 27043, and 27050-1. ISO 27001 covers the best practice standards for information security management, and 27002 describes security controls. The ISO 9000 series covers quality management.

Answer 56

**Answer: D. eDiscovery** **Security operations centers typically do not provide eDiscovery services.** They take on threat and intelligence monitoring, incident response and recovery, threat and vulnerability management, and data protection tasks, among many others.

Answer 57

**Answer: B. Use the API to clone the repository.** Ryan’s best option is to use GitHub’s APIs to download the repository and then to store it in a secure location. Relying on GitHub’s own backup practices leaves GitHub in control of the code and Ryan vulnerable to outages, and reliance on third-party sites doesn’t give Ryan control of the backups either.

Answer 58

**Answer: A. Business capacity management, service capacity management, component capacity management ** ISO/IEC 20000- 1 focuses on business capacity management, service capacity management, and component capacity management.

Answer 59

**Answer: D. Decommissioning** Release and deployment plans focus on creating and deploying releases. Lifecycle management is handled under other sections of the ISO standard and not within RDM plans.

Answer 60

**Answer: A. Establish, approve, and communicate an information security policy.** ISO/IEC 20000- 1 requires that organizations establish, approve, and communicate their information security policy. If you’re not familiar with ISO/IEC 20000-1 or similar standards, review the list of answers for unlikely answers— like requirements for third-party review. Using a standardized template can help to narrow down answers for questions like these.

Answer 61

**Answer: B. Distributed resource scheduling** Distributed resource scheduling in VMWare moves virtual machines from heavily loaded hosts to those with more resources available to help balance the load across the cluster. Automatic instance management and instance segregation were made up for this question, and round-robin load balancing is a form of load balancing where requests are distributed to each server in a cluster as they come in based on a list.

Answer 62

**Answer: D. Used capacity** The amount of data stored on a drive isn’t considered a hardware monitoring item. Powered-on time, temperature, and drive health are all elements of hardware monitoring.

Answer 63

**Answer: C. Pricing structures and penalties** The missing fourth item should be agreement sign-off and service activation, including service-level agreements and the service acceptance criteria. Pricing is not part of ITIL v4 service management processes.

Answer 64

**Answer: D. Use a virtual client.** Michelle should select a virtual client that allows her to run her application in a cloud-hosted environment. This will allow the application to run in a secure location while still allowing her to access it from lower-trust devices.

Answer 65

**Answer: B. Maintaining a strict license catalog** While maintaining a library of software licenses is important, it is not part of hardening practices.

Answer 66

**Answer: B. The recovery plan** In ITIL the recovery plan includes detailed plans for returning systems and services to a working state and can also include recovering data to a known consistent state. The business continuity strategy sets the strategy for business functions. IT service continuity plans focus on how to ensure continuity during specified disasters for services and systems. Disaster Recovery invocation guidelines explain how and when to invoke the DR procedures.

Answer 67

**Answer: B. Engage third-party forensic professionals.** For many organizations, the best option to select when facing cloud forensic investigations is to engage a third party. In this case, without an internal expert and as a small company, Jason’s best bet is third-party experts.

Answer 68

**Answer: A. Geographic location** A facility’s geographic location influences both the requirements for things like HVAC as well as environmental threats like extreme weather. Proximity to population centers may have a secondary influence on utilities or staffing, and both cost and security requirements may influence the design, but the larger impact is from its geographic location.

Answer 69

**Answer: C. A requirement to prevent deviation from the baselines established in the policy** Change management practices and baselines need to include methods for handling deviations in reasonable ways. That means Rick should ensure that the policy includes an assignment of tasks, including deviation notification and documentation.

Answer 70

**Answer: D. Customer production activities** The production activities will make full use of pooled resources, so they will not be isolated unless the customer is paying for that specific characteristic of service. Provisioning, management, and access to storage should all be isolated to ensure the security of those functions.

Answer 71

**Answer: B. Human interaction** User interaction with the cloud is not described in this phrase. Ping, power, and pipe refers to connectivity, power, and facility space with services like HVAC.

Answer 72

**Answer: A. 1** For the purposes described in the question, a Tier 1 datacenter should suffice; it is the cheapest, and you need it only for occasional backup purposes (as opposed to constant access). The details of location and market are irrelevant and just distractors.

Answer 73

**Answer: C. Moving to a cloud-hosted datacenter** The most effective way for Isaac to acquire meaningful BC/DR capabilities is to move to a cloud-hosted datacenter. This means that his organization doesn’t have to make major investments in its datacenter to add capabilities. Of course, staying with the current datacenter doesn’t meet his needs already

Answer 74

**Answer: A. Nonrepudiation** Creating and maintaining proper chain of custody documentation provides nonrepudiation for the process, ensuring that the handling will survive scrutiny at a later date. Data tampering by investigators could still occur, but would be identified in a properly documented chain. Chain of custody might be required by law enforcement, but it won’t help the company engage with them, and plausible deniability is not a forensic concept.

Answer 75

**Answer: B. VLANs ** VLANs (virtual local area networks) are logical overlays used to segregate network devices. DHCP (Dynamic Host Control Protocol) provides a means of giving systems IP addresses and other important network information automatically when requested. VPNs (Virtual Private Networks) are used to create secure channels between networks, typically over untrusted networks, and STP (Spanning Tree Protocol) is used to prevent loops in networks.

Answer 76

**Answer: C. Extended battery backup** Backup power does not have to be delivered by batteries; it can be fed to the datacenter through redundant utility lines or from a generator.