What provides cybersecurity professionals with insight into the traffic on their virtual networks?, Software‐defined visibility (SDV)., What are three key security considerations when working with cloud storage?, Set permissions properly; consider high availability and durability options; and use encryption to protect sensitive data., List and explain two categories of scalability and their advantages., Vertical scalability uses a more capable system or device and helps when all tasks or functions need to be handled on the same system or infrastructure. Horizontal scaling uses more smaller systems or devices. A horizontally scaled system can take advantage of the ability to transparently add and remove more resources, allowing it to adjust as needs grow or shrink and allows opportunities for transparent upgrades, patching, and even incident response., What is cloud computing?, A model for enabling ubiquitous, convenient, on‐demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction., What are the key benefits of the cloud?, On‐demand self‐service computing, scalability, elasticity, measured service, agility and flexibility, What allows engineers to interact with and modify cloud resources through their APIs?, Software‐defined networking (SDN)., What are two categories of cloud storage offerings?, Block storage allocates large volumes of storage for use by virtual server instance(s). Object storage provides customers with the ability to place files in buckets and treat each file as an independent entity that may be accessed over the web or through the provider’s API., List the four cloud deployment models., Public cloud, private cloud, community cloud, and hybrid cloud., What provides application‐level virtualization?, A container., What is RAID 5 and what are its advantages and disadvantages?, RAID 5 is a solution in which data is striped across drives, with one drive used for parity (checksum) of the data. Parity is spread across drives as well as data. RAID 5’s advantages are that data reads are fast; drive failures can be rebuilt as long as only one drive fails. RAID 5’s disadvantages are that it can only tolerate a single drive failure at a time, data writes are slightly slower, and rebuilding arrays after a drive loss can be slow and impact performance., List and explain the five key cloud roles., Cloud service providers offer cloud computing services; cloud consumers purchase cloud services from cloud service providers; cloud partners and brokers offer ancillary products that support or integrate with the offerings of a cloud service provider; cloud auditors are independent organizations that provide assessments of cloud services and operations; cloud carriers serve provide connectivity that allows the delivery of cloud services from providers to consumers., What are two primary types of hypervisors and what are their differences?, Type I hypervisors, also known as bare‐metal hypervisors, operate directly on top of the underlying hardware. This is the model most commonly used in datacenter virtualization because it is highly efficient. Type II hypervisors run as an application on top of an existing operating system. In this approach, the operating system supports the hypervisor and the hypervisor requests resources for each guest operating system from the host operating system., What is SDN?, Software‐defined networking (SDN) uses software‐based network configuration to control networks. SDN designs rely on controllers that manage network devices and configurations, centrally managing the software‐defined network., What is the primary responsibility of the hypervisor?, The primary responsibility of the hypervisor is enforcing isolation between virtual machines. This means that the hypervisor must present each virtual machine with the illusion of a completely separate physical environment dedicated for use by that virtual machine., What are three major cloud service models?, Infrastructure as a service (IaaS), software as a service (SaaS), and platform as a service (PaaS), List and explain two principles we need to apply in application resilience., Scalability says that applications should be designed so that computing resources they require may be incrementally added to support increasing demand; elasticity goes a step further than scalability and says that applications should be able to automatically provision resources to scale when necessary and then automatically deprovision those resources to reduce capacity (and cost) when it is no longer needed., Explain active/active vs. active/passive load balancers., Active/active load balancer designs distribute the load among multiple systems that are online and in use at the same time. Active/passive load balancer designs bring backup or secondary systems online when an active system is removed or fails to respond properly to a health check., What is the function of virtual private clouds?, VPCs are used to group systems into subnets and designate those subnets as public or private, depending on whether access to them is permitted from the Internet., What are two types of proxy servers?, Forward proxies are placed between clients and servers, and they accept requests from clients and send them forward to servers. Reverse proxies are placed between servers and clients, and they are used to help with load balancing and caching of content., What are web application firewalls?, Security devices that are designed to be able to intercept, analyze, and apply rules to web traffic, including tools like database queries, APIs, and other web application tools., What are port mirrors and a SPAN?, A port mirror sends a copy of all the traffic sent to one switch port to another switch port for monitoring. A SPAN can do the same thing but can also combine traffic from multiple ports to a single port for analysis., Describe SASE., Secure access service edge (SASE) combines VPNs, SD‐WAN, and cloud‐based security tools like firewalls, CASBs, and zero‐trust networks to provide secure access for devices regardless of their location., What is a VPN?, A virtual private network (VPN) is a way to create a virtual network link across a public network that allows the endpoints to act as though they are on the same network., What are security zones?, Network segments, physical or virtual network segments, or other components of an infrastructure that are able to be separate from less secure zones through logical or physical means., What do administrators use as a way to securely operate in security zones with different security levels?, Jump server., What are two decision points for VPN implementation?, Whether the VPN will be used for remote access, or if it will be a site‐to‐site VPN; and whether they will be a split‐tunnel VPN or a full‐tunnel VPN, What is the function of a web application firewall?, A web application firewall (WAF) plays an important role in protecting web applications against attacks. It sits in front of a web server and receives all network traffic headed to that server. It then scrutinizes the input headed to the application, performing input validation before passing the input to the web server., What is port security?, A capability that allows you to limit the number of MAC addresses that can be used on a single port., What are two different approaches to cloud access security broker (CASB) solutions?, Inline CASB solutions physically or logically reside in the connection path between the user and the service and can see requests before they are sent to the cloud service, allowing the CASB to block requests that violate policy. API‐based CASB solutions do not interact directly with the user but rather interact directly with the cloud provider through the provider’s API. This approach provides direct access to the cloud service without custom user device configuration., What are the four major information classification categories used by the U.S. government?, Top secret, secret, confidential, and unclassified, What category of information includes any information that uniquely identifies an individual person, including customers, employees, and third parties?, Personally identifiable information (PII) includes any information that uniquely identifies an individual person, including customers, employees, and third parties., What should we do if we can’t completely remove data from a dataset?, We can transform it into a format where the original sensitive information is deidentified. The deidentification process removes the ability to link data back to an individual, reducing its sensitivity. An alternative to deidentifying data is transforming it into a format where the original information can’t be retrieved. This is a process called data obfuscation., What is data minimization and how can we do it?, Data minimization techniques seek to reduce risk by reducing the amount of sensitive information that we maintain on a regular basis. The best way to achieve data minimization is to simply destroy data when it is no longer necessary to meet our original business purpose., What is a data custodian?, An individual or team who does not have controller or stewardship responsibility but is responsible for the secure safekeeping of information., What is a data subject?, An individual whose personal data is being processed., What are three types of data we must think about when developing a cryptographic system for the purpose of providing confidentiality?, Data at rest, data in transit, data in use, What is a data protection officer (DPO)?, The European Union’s General Data Protection Regulation (GDPR) requires that every data controller designate a data protection officer (DPO) who bears overall responsibility for carrying out the organization’s data privacy efforts., What term refers to medical records maintained by health‐care providers and other organizations that are subject to HIPAA?, Protected health information (PHI), What is a data steward?, An individual who carries out the intent of the data controller or stewardship responsibility but is responsible for the secure safekeeping of information., What are three states where data might exist?, Data at rest, data in transit, data in use, What principle states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed?, Data sovereignty is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed., What ensures that acquired images are intact?, Hashing and validating, Give four important considerations that come into play with cloud and off‐site third‐party backup options., Bandwidth requirements for both the backups themselves and restoration time if the backup needs to be restored partially or fully; time to retrieve files and cost to retrieve files; reliability is also crucial; and new security models may also be required for backups., List three common elements in designs for redundancy., Geographic dispersion of systems, separation of servers and other devices in datacenters, use of multiple network paths (multipath) solutions, redundant network devices, protection of power, systems and storage redundancy, and platform diversity, What are three areas for capacity planning?, Three areas for capacity planning are people, technology, and infrastructure., What are four common methods of testing resilience and recovery controls?, Tabletop exercises, simulation exercises, parallel processing, and failover exercises, List all steps in site restoration., Restore network connectivity and a bastion or shell host; restore network security devices (firewalls, IPS); restore storage and database services; restore critical operational servers; restore logging and monitoring service; and restore other services as soon as possible., List at least three backup and replication methods., RAID, journaling, full and incremental backups, snapshots, images, copies of individual files, backup media, cloud backups, and off‐site or on‐site storage, What type of testing involves discussing what a staff member would do in a given scenario?, Tabletop exercises leverage discussions and conversations to help organizations prepare for actual events., What are three major types of disaster recovery sites used for site resilience?, Hot sites, warm sites, and cold sites

Domain3

by
Print
Embed

Leaderboard

Visual style

Options

Switch template

Continue editing: ?