D320 Managing Cloud Security - Set 4 - Part 3

Correct Answer: NAC

Network Access Control (NAC) prevents unauthorized devices from accessing a cloud network. VPN secures remote access, IDS detects unauthorized access, and WAF protects web applications.

Correct Answer: Isolating environments for testing and development

A sandbox isolates environments for testing and development to prevent potential security issues from affecting production systems. Encryption, access control, and compliance are handled by other controls.

Correct Answer: Risk Assessment

Risk Assessment involves evaluating the impact and likelihood of risks in a cloud environment. Risk Transference, Mitigation, and Acceptance are strategies for managing risks after assessment.

Correct Answer: SSL/TLS

SSL/TLS is commonly used to encrypt data during transmission over the internet. Disk Encryption protects data at rest, Homomorphic Encryption allows data processing while encrypted, and Symmetric Encryption is a general encryption method.

Correct Answer: Preventing unauthorized access

MFA helps prevent unauthorized access by requiring multiple forms of verification. Performance management, data encryption, and network traffic monitoring are separate controls.

Correct Answer: Qualitative Risk Analysis

Qualitative Risk Analysis ranks risks based on subjective factors like impact and likelihood. Quantitative Risk Analysis uses numerical estimates, Scenario Analysis explores different risk scenarios, and Business Impact Analysis assesses the impact on business functions.

Correct Answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires U.S. financial institutions to protect customer data. HIPAA governs healthcare data, GDPR protects personal data in the EU, and SOX focuses on corporate governance.

Correct Answer: IaaS

IaaS (Infrastructure as a Service) allows the customer to control the operating system but not the underlying hardware. SaaS and PaaS offer more managed services, while Public Cloud is a deployment model.

Correct Answer: Collect only necessary data

Data Minimization requires organizations to collect only the data necessary for specific purposes. Accuracy, encryption, and breach notification are governed by other GDPR principles.

Correct Answer: Risk Mitigation

Risk Mitigation involves reducing the likelihood or impact of a risk through security controls. Risk Acceptance involves tolerating the risk, Risk Avoidance eliminates the risk, and Risk Transference shifts it to another party.