Chapter 10: Cloud and Virtualization Security

Kevin added another CPU to an overwhelmed cloud server. What term best describes this action?

Vertical scaling

Fran's organization uses a Type I hypervisor for IaaS. Which security control is least applicable?

The provider must maintain security patches on the host operating system

In what cloud security model does the provider bear the most responsibility for security controls?

SaaS

What document helps map cloud security controls to different regulatory standards?

CSA CCM

Wanda wants preprocessing on remote sensors before sending data to the cloud. What term best describes this?

Edge computing

Which statement about cloud computing is incorrect?

Cloud computing customers provision resources through the service provider's sales team

Helen hosts a payroll system in AWS and customers access it via the web. What tier is this?

SaaS

Which cloud deployment model requires a unifying technology platform tying together components from different providers?

Hybrid cloud

Which would not commonly be available as an IaaS offering?

CRM

Which is not an example of infrastructure as code?

Using a cloud provider's web interface to provision resources

Brian wants a CASB that interacts with the cloud provider directly. Which approach fits?

API-based CASB

In which cloud categories are customers typically charged based on the number of virtual server instances dedicated to them?

IaaS and PaaS

Brian wants to limit users from provisioning expensive cloud instances without permission. What control helps?

Resource policy

Ursula wants to securely link on-prem datacenter networks with cloud VPCs. What technology helps best?

Transit gateway

What component primarily prevents VM escape attacks?

Hypervisor

Ryan wants a control for multicloud with minimal admin effort. What approach best meets his needs?

Third-party control

Kira wants access restrictions across all SaaS solutions used by her organization. What control best meets this need?

CASB

Howard assesses legal risks for PII: US company, EU customers, Japanese datacenters. What law is most important?

All should have equal weight

Brenda's company provides managed incident response services. What term describes this offering?

MSSP

Tony buys Azure VMs exclusively for his organization. What cloud model is this?

Public cloud

What is the formal definition of cloud computing according to the National Institute of Standards and Technology (NIST)?

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.

In cloud computing, what concept describes many different users sharing resources in the same cloud infrastructure?

Multitenancy.

What cloud benefit allows developers to rapidly spin up test environments with minimal effort and cost

Agility and flexibility.

Increasing the capacity of an existing server by adding more CPU cores or memory is known as _____

vertical scaling

Adding more servers to a pool of clustered servers to increase capacity is known as _____

horizontal scaling

What cloud concept, closely related to scalability, allows capacity to expand and contract automatically as needs change to optimize costs?

Elasticity.

What cloud characteristic ensures that customers pay for exactly what they use, as providers track metrics like processing time and storage occupied?

Measured service.

In the context of cloud computing, what is the role of a Cloud Service Provider (CSP)?

They are the firms that offer cloud computing services to their customers.

What is the term for organizations and individuals who purchase cloud services from cloud service providers

Cloud consumers.

What cloud role is filled by independent organizations that provide third-party assessments of cloud services and operations

Cloud auditors.

What is the role of a cloud carrier

To serve as the intermediary that provides the connectivity for delivering cloud services from providers to consumers.

Which major cloud service model allows customers to purchase and interact with the basic building blocks of a technology infrastructure like computing, storage, and networks?

Infrastructure as a Service (IaaS).

Which major cloud service model provides customers with access to a fully managed application running in the cloud, such as web-based email?

Software as a Service (SaaS).

Which cloud service model offers a platform where customers may run applications that they have developed themselves

Platform as a Service (PaaS).

Function as a service (FaaS) is an example of which broader cloud service model

Platform as a Service (PaaS).

FaaS environments are often referred to as _____ computing because customers are not exposed to the actual server instances executing their code

serverless

What is the term for a service organization that provides information technology as a service to its customers, potentially managing both cloud and on-premises deployments?

Managed service provider (MSP).

When a managed service provider (MSP) offers security services like monitoring, vulnerability management, and incident response, what are they commonly called?

Managed security service provider (MSSP).

Which cloud deployment model makes infrastructure accessible to any customer in a multitenant model

Public Cloud.

Which cloud deployment model describes an infrastructure that is provisioned for use by a single customer

Private Cloud.

A _____ cloud service runs in a multitenant environment, but the tenants are limited to members of a specifically designed community with shared requirements.

community

Which cloud deployment model blends public, private, and/or community cloud services together using technology that unifies them into a single coherent platform?

Hybrid Cloud.

What is the term for using public cloud capacity when demand exceeds the capacity of an organization's private cloud infrastructure

Public cloud bursting.

What is the name of the operating model where cybersecurity responsibilities are divided between cloud service providers and the customer's own teams

The shared responsibility model.

In an IaaS environment under the shared responsibility model, for which components does the customer take over security responsibility?

The operating system, applications, and data.

In a PaaS environment, which major component's security responsibility shifts from the customer to the vendor, compared to IaaS?

The operating system.

In which cloud service model does the provider take on almost all security responsibility, leaving the customer with shared control over data and access control configuration?

Software as a Service (SaaS).

What is the purpose of the Cloud Controls Matrix (CCM) developed by the Cloud Security Alliance (CSA)

It is a reference document to help organizations map cloud security controls to various regulatory standards.

What computing approach places processing power on remote sensors at the 'edge' of the network to preprocess data before sending it to the cloud

Edge computing.

What is fog computing

A concept related to edge computing that uses IoT gateway devices in close proximity to sensors to perform preprocessing before sending results to the cloud.

In a virtualized datacenter, what is the special operating system that runs on the host hardware and mediates access to its resources for virtual machines?

A hypervisor.

What is the primary security responsibility of a hypervisor

Enforcing isolation between virtual machines to prevent them from accessing or altering each other's information or resources.

What is a Type I hypervisor?

Also known as a bare-metal hypervisor, it operates directly on top of the underlying hardware and is most common in datacenters.

What is a Type II hypervisor?

It runs as an application on top of an existing host operating system, which is common on personal computers.

What technology provides application-level virtualization by packaging applications to be portable across different operating systems and hardware platforms

Containerization.

In cloud storage, what type of storage allocates large volumes for use by virtual servers, which are then formatted as virtual disks?

Block storage.

What type of cloud storage allows customers to place files in 'buckets' and treat each file as an independent entity accessible over the web or an API

Object storage.

How do billing models typically differ between block storage and object storage?

Block storage is preallocated and you pay for allocated capacity, while object storage is not preallocated and you pay only for the storage you use.

What cloud networking feature, analogous to a traditional firewall ruleset, is used to define permissible network traffic to and from virtual instances?

Security groups.

In cloud environments, what technology serves the same network segmentation purpose as VLANs do on a physical network?

Virtual Private Clouds (VPCs).

What is the term for a technology that allows the direct interconnection of cloud VPCs with on-premises VLANs for hybrid cloud operations

Cloud transit gateway.

The _____ approach to technology management brings together development and operations teams in a unified, agile process.

DevOps

What is Infrastructure as Code (IaC)?

The process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention.

What is the principle that states data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed?

Data sovereignty.

What is a virtual machine (VM) escape vulnerability

A serious vulnerability where an attacker with access to one VM manages to 'escape' hypervisor restrictions and intrude upon resources assigned to a different VM.

What is the virtualization vulnerability known as 'resource reuse'?

It occurs when a cloud provider reassigns hardware to a new customer without properly removing the previous customer's data, potentially exposing it.

_____ occurs when IaaS users create virtual server instances and then forget about them, leaving them to accrue costs and security issues.

Virtual machine (VM) sprawl

What is the function of a Secure Web Gateway (SWG)?

It monitors web requests from internal users, evaluates them against security policy, and blocks access to malicious content or enforces content filtering.

What type of software tool serves as an intermediary between cloud service users and providers to monitor activity and enforce security policies consistently

Cloud Access Security Broker (CASB).

What is the difference between an inline CASB and an API-based CASB?

An inline CASB sits in the connection path and can block requests, while an API-based CASB interacts directly with the provider and can only monitor and report after the fact.

In cloud environments, what are resource policies used for?

They are used to limit the actions that users can take, such as restricting access to certain regions or preventing the launch of expensive server instances.

What is a Hardware Security Module (HSM)

A special-purpose computing device that manages encryption keys and performs cryptographic operations securely and efficiently.