D320 Managing Cloud Security - Set 3 - Part 2

Correct Answer: GDPR

The General Data Protection Regulation (GDPR) governs the protection of personal data within the European Union. HIPAA is for healthcare data, SOX focuses on corporate governance, and PCI DSS is for payment card security.

Correct Answer: Multi-Factor Authentication (MFA)

MFA provides strong protection against unauthorized access by requiring multiple forms of verification. Firewalls and ACLs control access, while Data Masking protects data in applications but does not prevent unauthorized access.

Correct Answer: Capacity Management

Capacity Management ensures that cloud resources are used efficiently and can meet future demand. Incident Management addresses issues, Problem Management identifies root causes, and Change Management handles modifications.

Correct Answer: SSL/TLS

SSL/TLS is used to secure communication between a web browser and a cloud service by encrypting data in transit. Symmetric and Asymmetric encryption are encryption methods, while Hashing ensures data integrity.

Correct Answer: SOC 2

SOC 2 reports provide assurance about a cloud providers internal controls related to security, availability, processing integrity, confidentiality, and privacy. ISO/IEC 27001, PCI DSS, and HIPAA focus on specific industries and compliance.

Correct Answer: Distributing incoming traffic across multiple servers

A Load Balancer distributes incoming traffic across multiple servers to optimize performance and prevent any single server from being overwhelmed. Other options focus on encryption and security.

Correct Answer: Qualitative risk assessments rank risks based on severity

Qualitative risk assessments rank risks based on their severity, often using subjective judgment. Quantitative risk assessments, on the other hand, use numerical values to estimate the impact of risks.

Correct Answer: Risk Transference

Risk Transference is appropriate when an organization insures against potential losses, effectively shifting the financial risk to the insurance provider. Risk Mitigation reduces the risk, Risk Acceptance involves bearing the risk, and Risk Avoidance eliminates it.

Correct Answer: Data Breach Notification

GDPR requires organizations to notify individuals in the event of a data breach that affects their personal data. Purpose Limitation and Data Minimization are principles for data use and collection, while Integrity and Confidentiality protect data.

Correct Answer: Sandbox

A Sandbox is an isolated environment used for testing and development to prevent potential security issues from affecting production systems. Encryption protects data, MFA strengthens access control, and VPN secures network communications.

Correct Answer: Security Information and Event Management (SIEM)

SIEM involves continuous monitoring and analysis of security events to detect and respond to incidents. Incident Management addresses immediate issues, Disaster Recovery focuses on restoring services after a disruption, and Configuration Management ensures systems are configured correctly.

Correct Answer: Scenario Analysis

Scenario Analysis evaluates how specific risks could impact business operations by considering different risk scenarios. BIA assesses the impact on business functions, Risk Mitigation reduces risks, and Risk Transference shifts risks to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA requires organizations to implement security controls to protect electronic health records (EHRs). GLBA and SOX address financial information, and GDPR focuses on personal data protection in the EU.

Correct Answer: Network Access Control (NAC)

NAC ensures that only authorized devices can connect to a network by enforcing security policies at the point of entry. VPN secures remote access, WAF protects web applications, and IDS detects unauthorized access, but NAC specifically controls device access.

Correct Answer: Capacity Management

Capacity Management involves regularly reviewing and adjusting cloud resources to ensure they are used efficiently and meet demand. Change Management controls modifications, Incident Management addresses issues, and Service Level Management ensures service agreements are met.

Correct Answer: Risk Acceptance

Risk Acceptance occurs when an organization chooses to take no action to mitigate or transfer a risk, instead accepting the potential consequences. Risk Avoidance eliminates the risk, Risk Mitigation reduces it, and Risk Transference shifts it to another party.

Correct Answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA is designed to protect the privacy and security of health information in the U.S. SOX focuses on corporate financial practices, GDPR on personal data protection in the EU, and PCI DSS on payment card security.

Correct Answer: Sandbox

A Sandbox is an isolated environment used for testing and development to prevent potential security issues from affecting production systems. Encryption protects data, MFA strengthens access control, and VPN secures network communications.

Correct Answer: Security Information and Event Management (SIEM)

SIEM involves continuous monitoring and analysis of security events to detect and respond to incidents. Incident Management addresses immediate issues, Disaster Recovery focuses on restoring services after a disruption, and Configuration Management ensures systems are configured correctly.

Correct Answer: Scenario Analysis

Scenario Analysis evaluates how specific risks could impact business operations by considering different risk scenarios. BIA assesses the impact on business functions, Risk Mitigation reduces risks, and Risk Transference shifts risks to another party.