D320 Managing Cloud Security - Set 2 - Part 2

Correct Answer: ISO/IEC 27005

ISO/IEC 27005 provides guidelines for managing information security risks, including in cloud environments. ISO/IEC 27001 focuses on information security management systems, ISO/IEC 27018 is for protecting personal data in the cloud, and PCI DSS is for payment card security.

Correct Answer: Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is highly effective at preventing unauthorized access by requiring multiple forms of verification. Firewalls and ACLs control network access, and Data Masking protects data in use.

Correct Answer: Disaster Recovery

Disaster Recovery focuses on restoring cloud services quickly after a disruption. Problem Management identifies root causes, Incident Management resolves incidents, and Capacity Management ensures resources meet demand.

Correct Answer: Quantitative Risk Analysis

Quantitative Risk Analysis calculates the potential financial loss associated with a specific risk. Qualitative Risk Analysis ranks risks by severity, and Scenario Analysis evaluates various risk scenarios.

Correct Answer: Gramm-Leach-Bliley Act

The GLBA requires financial institutions to develop information security plans to protect customer data. SOX addresses corporate governance, HIPAA focuses on healthcare, and CCPA protects consumer privacy in California.

Correct Answer: Intrusion Detection System (IDS)

An IDS detects unauthorized access attempts and alerts administrators. Firewalls block unauthorized access, Encryption protects data, and MFA strengthens access controls.

Correct Answer: Auto-Scaling

Auto-Scaling automatically adjusts cloud resources based on demand. Load Balancing distributes traffic, CI/CD automates software deployment, and Backup and Restore manage data protection.

Correct Answer: Risk Register

A Risk Register tracks all identified risks, including severity, potential impact, and mitigation strategies. The Risk Appetite Statement defines acceptable levels of risk, and the Business Continuity Plan and Incident Response Plan address disruptions and incidents.

Correct Answer: Lawfulness, Fairness, and Transparency

GDPR's Lawfulness, Fairness, and Transparency principle ensures personal data is processed fairly, lawfully, and transparently. Integrity and Confidentiality protect data, Data Minimization limits data collection, and Purpose Limitation specifies data use.

Correct Answer: Sandbox

A Sandbox creates an isolated environment for testing and development, protecting production systems from potential security issues. Encryption secures data, MFA strengthens access controls, and VPNs secure network communications.

Correct Answer: Security Information and Event Management (SIEM)

SIEM continuously monitors and analyzes security events to detect and respond to incidents. Incident Management addresses immediate incidents, Disaster Recovery restores services, and Configuration Management ensures systems are properly configured.

Correct Answer: Scenario Analysis

Scenario Analysis evaluates how specific risks could impact business operations by considering different potential scenarios. BIA assesses overall business impact, Risk Mitigation reduces risks, and Risk Transference shifts risks to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA requires organizations to implement security controls to protect electronic health records (EHRs). GLBA and SOX address financial information, and GDPR governs personal data protection in the EU.

Correct Answer: Network Access Control (NAC)

NAC ensures only authorized devices can connect to a network by enforcing security policies. VPN secures remote access, WAF protects web applications, and IDS detects unauthorized access.

Correct Answer: Capacity Management

Capacity Management involves regularly reviewing and adjusting cloud resources to ensure optimal performance and cost-efficiency. Change Management oversees modifications, Incident Management addresses issues, and Service Level Management focuses on meeting SLAs.

Correct Answer: Risk Acceptance

Risk Acceptance involves taking no action to mitigate or transfer a risk and choosing to accept the potential consequences. Risk Avoidance eliminates the risk, Risk Mitigation reduces it, and Risk Transference shifts it to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA protects the privacy and security of health information in the U.S. SOX focuses on financial transparency, GDPR on personal data in the EU, and PCI DSS on payment card security.

Correct Answer: API Gateway

An API Gateway protects cloud APIs from unauthorized access and attacks by enforcing security policies and managing API traffic. Encryption protects data, Data Masking obscures sensitive information, and Biometric Authentication secures user access.

Correct Answer: Change Management

Change Management involves documenting and tracking changes to cloud infrastructure and applications to ensure that they are implemented in a controlled manner. Incident Management addresses immediate issues, Problem Management identifies root causes, and Capacity Management optimizes resource use.

Correct Answer: Risk Transference

Risk Transference is appropriate when an organization insures against potential losses, effectively shifting the financial risk to the insurance provider. Risk Mitigation reduces the risk, Risk Acceptance involves bearing the risk, and Risk Avoidance eliminates it.