Tap an option to see the answer, the reasoning, and why the other three fail.
Which of the following roles is responsible for creating cloud components and the testing and validation of services?
The cloud service developer is responsible for developing and creating cloud components and services, as well as for testing and validating services.
Which of the cloud deployment models offers the easiest initial setup and access for the cloud customer?
Because the public cloud model is available to everyone, in most instances all a customer will need to do to gain access is set up an account and provide a credit card number through the service's web portal. No additional contract negotiations, agreements, or specific group memberships are typically needed to get started.
Firewalls are used to provide network security throughout an enterprise and to control what information can be accessed--and to a certain extent, through what means. Which of the following is NOT something that firewalls are concerned with?
Firewalls work at the network level and control traffic based on the source, destination, protocol, and ports. Whether or not the traffic is encrypted is not a factor with firewalls and their decisions about routing traffic. Firewalls work primarily with IP addresses, ports, and protocols.
When an organization is considering the use of cloud services for BCDR planning and solutions, which of the following cloud concepts would be the most important?
When BCDR is moved to the cloud, its biggest value comes from rapid elasticity: normally only a minimal standby footprint is maintained, and when a disaster is triggered, capacity can be scaled up to full within minutes to meet the RTO, then scaled back down after recovery, and combined with pay-as-you-go billing, the total cost is far lower than building and permanently maintaining an idle disaster recovery center of your own. Traditional disaster recovery requires purchasing a full set of hardware sized for peak load up front and sustaining it long-term — this is exactly the pain point the cloud solves. By comparison, portability, interoperability, and reversibility are concerned with whether you can migrate away and exit — provider-selection constraints, not the core reason to choose the cloud for disaster recovery.
Because of multitenancy, specific risks in the public cloud that don't exist in the other cloud service models include all the following except:
Multitenancy means that different customers share the same batch of physical hardware, hypervisor, and network equipment, giving rise to a set of risks unique to shared environments: information bleed, where other tenants on the same host may obtain your information through side channels, memory, or storage remnants; escalation of privilege, where an attacker who breaks out of the virtualization boundary can have an impact that extends beyond their own tenant to affect neighbors; and legal-seizure entanglement, where law enforcement investigating another tenant on the same physical device seizes the device, and your data gets taken along with it or becomes unavailable. DoS/DDoS is different — any networked system, including a self-built data center, can be hit by it, and it has nothing to do with whether tenants are shared; in fact, the elasticity and scrubbing capacity of the public cloud usually make it better able to absorb this kind of attack.
From a legal perspective, what is the most important first step after an eDiscovery order has been received by the cloud provider?
The contract should include requirements for notification by the cloud provider to the cloud customer upon the receipt of such an order. This serves a few important purposes. First, it keeps communication and trust open between the cloud provider and cloud customers. Second, and more importantly, it allows the cloud customer to potentially challenge the order if they feel they have the grounds or desire to do so.
Which of the following is a risk in the cloud environment that is not existing or is as prevalent in the legacy environment?
In a traditional data center, the physical location of data is fixed, so the law of which country or state applies barely changes. Once in the cloud, resource pooling and cross-region replication mean the same data may reside in data centers across multiple countries at the same time, and each location can potentially assert jurisdiction: data protection laws, data localization requirements, and law-enforcement access procedures differ from place to place and can even conflict with one another — complying with one country's disclosure order while violating another country's transfer restrictions is a real dilemma. This is a risk that is specific to the cloud and barely exists in the traditional environment, and it is why the data's storage location and transfer paths must be locked down during contracting and site selection.
A user signs on to a cloud-based social media platform. In another browser tab, the user finds an article worth posting to the social media platform. The user clicks on the platform's icon listed on the article's website, and the article is automatically posted to the user's account on the social media platform. This is an example of what? Response:
The key to this scenario is that it crosses two independent organizations: the article website does not hold the social platform's account system, and the user did not log in again on the article website — instead, the social platform acts as the identity provider, issuing an assertion or token to the article website, which acts as the relying party and carries out the action on the user's behalf based on that. Establishing trust and exchanging identity and authorization information across independent trust domains like this is federation, technically carried by SAML or OAuth/OpenID Connect. The rule of thumb is: crossing organizational boundaries points to federation, while one login granting access to multiple systems within a single organization points to single sign-on (SSO).
Under GDPR, which principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?
Article 5 of the GDPR lists six principles for processing personal data: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; and integrity and confidentiality, plus the accountability principle in paragraph 2. Purpose limitation requires that the purpose be specified, explicit, and legitimate at the time of collection, and that data not subsequently be processed in a way incompatible with that original purpose; using the data for a new purpose requires either a fresh compatibility assessment or a separate lawful basis. It is the core yardstick for judging whether secondary uses — for example, using service data to train a model — are compliant.
What is the PRIMARY purpose of data classification in a cloud security program?
The purpose of classification is to match the strength of protection to the data's sensitivity, business value, and regulatory requirements, so that a limited security budget is spent in the right places. Once data is classified, encryption strength, access scope and approval level, retention and destruction periods, cross-border transfer eligibility, suitability for use in testing, logging and audit granularity, and masking rules can all be bound as a package to each level, giving controls a clear target to apply to. Without classification, organizations tend toward two extremes: over-protecting low-value data at high cost and to the detriment of the business, or under-protecting highly sensitive data, understating its risk exposure. In the cloud there is an additional layer of value — classification is the input that drives data loss prevention, automatic tagging, policy-driven lifecycle management, and access governance; inaccurate classification throws off every downstream automation that depends on it.