D320 Managing Cloud Security - Set 1 - Part 2

Correct Answer: ISO/IEC 27005

ISO/IEC 27005 provides guidelines for managing information security risks within an organization, including cloud environments. ISO/IEC 27001 is a broader standard for information security management systems, ISO/IEC 27018 focuses on protecting personal data in the cloud, and PCI DSS is for payment card security.

Correct Answer: Multi-Factor Authentication (MFA)

MFA provides strong protection against unauthorized access by requiring multiple forms of verification. Firewalls and ACLs control access at the network and resource levels, while Data Masking protects data in applications but does not prevent unauthorized access.

Correct Answer: Disaster Recovery

Disaster Recovery focuses on restoring cloud services quickly and effectively after a disruption. Problem Management identifies root causes, Incident Management deals with resolving incidents, and Capacity Management ensures resources are sufficient to meet demand.

Correct Answer: Quantitative Risk Analysis

Quantitative Risk Analysis calculates the potential financial loss associated with a risk, providing numerical estimates. Qualitative Risk Analysis ranks risks based on severity, BIA assesses the impact on business functions, and Scenario Analysis explores different risk scenarios.

Correct Answer: Gramm-Leach-Bliley Act (GLBA)

GLBA requires financial institutions to develop written information security plans to protect customer information. SOX addresses corporate financial practices, HIPAA focuses on healthcare data, and CCPA protects consumer privacy in California.

Correct Answer: Intrusion Detection System (IDS)

IDS is designed to detect unauthorized access attempts and alert administrators. Firewalls prevent unauthorized access, Encryption protects data, and MFA strengthens access control, but IDS specifically focuses on detection and response.

Correct Answer: Auto-Scaling

Auto-Scaling automatically adjusts the number of running instances of an application based on demand, ensuring efficient resource use. CI/CD automates software deployment, Load Balancing distributes traffic, and Backup and Restore manage data protection.

Correct Answer: Risk Register

A Risk Register records all identified risks, including their severity, potential impact, and mitigation strategies. The Risk Appetite Statement defines acceptable risk levels, while the Business Continuity Plan and Incident Response Plan address operational disruptions and incidents.

Correct Answer: Lawfulness, Fairness, and Transparency

The principle of Lawfulness, Fairness, and Transparency under GDPR requires that personal data be processed in a fair, lawful, and transparent manner. Integrity and Confidentiality protect data, Data Minimization limits data collection, and Purpose Limitation ensures data is used only for its intended purpose.

Correct Answer: Sandbox

A Sandbox is an isolated environment used for testing and development to prevent potential security issues from affecting production systems. Encryption protects data, MFA strengthens access control, and VPN secures network communications, but none of these provide isolation like a Sandbox.

Correct Answer: Security Information and Event Management (SIEM)

SIEM involves continuous monitoring and analysis of security events to detect and respond to incidents. Incident Management addresses immediate incidents, Disaster Recovery focuses on restoring services after a disruption, and Configuration Management ensures systems are configured correctly.

Correct Answer: Scenario Analysis

Scenario Analysis evaluates how specific risks could impact business operations by considering different scenarios. BIA assesses the overall impact on business functions, Risk Mitigation reduces risks, and Risk Transference shifts risks to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA requires organizations to implement security controls to protect electronic health records (EHRs). GLBA and SOX address financial information, and GDPR focuses on personal data protection in the EU.

Correct Answer: Network Access Control (NAC)

NAC ensures that only authorized devices can connect to a network by enforcing security policies at the point of entry. VPN secures remote access, WAF protects web applications, and IDS detects unauthorized access, but NAC specifically controls device access.

Correct Answer: Capacity Management

Capacity Management involves regularly reviewing and adjusting cloud resources to ensure they are used efficiently and meet demand. Change Management controls modifications, Incident Management addresses issues, and Service Level Management ensures service agreements are met.

Correct Answer: Risk Acceptance

Risk Acceptance occurs when an organization chooses to take no action to mitigate or transfer a risk, instead accepting the potential consequences. Risk Avoidance eliminates the risk, Risk Mitigation reduces it, and Risk Transference shifts it to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA is designed to protect the privacy and security of health information in the United States. SOX focuses on financial transparency, GDPR on personal data in the EU, and PCI DSS on payment card security.

Correct Answer: API Gateway

An API Gateway protects cloud APIs from unauthorized access and attacks by enforcing security policies and managing API traffic. Encryption protects data, Data Masking obscures sensitive information, and Biometric Authentication secures user access.

Correct Answer: Change Management

Change Management involves documenting and tracking changes to cloud infrastructure and applications to ensure that they are implemented in a controlled manner. Incident Management addresses immediate issues, Problem Management identifies root causes, and Capacity Management optimizes resource use.

Correct Answer: Risk Transference

Risk Transference is appropriate when an organization insures against potential losses, effectively shifting the financial risk to the insurance provider. Risk Mitigation reduces the risk, Risk Acceptance involves bearing the risk, and Risk Avoidance eliminates it.