A. Focuses on security only during the testing phase

B. Relies only on automated security testing tools

C. Integrates security early in the development process

D. Emphasizes post-deployment security audits

A. They focus on the technical aspects of cloud security with less consideration on the broader organizational goals.

B. They dictate specific implementation methods for securing cloud environments, tailored to individual cloud providers.

C. They are standards that cannot be modified to suit the unique needs of different cloud environments.

D. They provide outcome-focused guidelines for desired controls, ensuring measurable and adaptable security measures

A. Poor Documentation

B. Low Availability

C. Insufficient Redundancy

D. Misconfiguration

A. Management plane

B. Intrusion detection options

C. Network access points

D. Secondary authentication factors

E. Mobile security configuration options

A. False

B. True

A. ISO 27001 certification

B. Provider can obfuscate system O/S and versions

C. Lock-In

D. More efficient and timely system updates

E. Greater compatibility with customer IT infrastructure

A. Excessive SBOM focus

B. Lack of sensitive data encryption

C. Failure to update access controls after employee role changes

D. Lack of 3rd party service provider specialized in patch management procedures

A. Increased on-premise hardware

B. Unlimited data storage capacity

C. Elasticity of cloud resources

D. Fixed resource allocations

A. A number of requirements to be implemented, based upon numerous standards and regulatory requirements

B. Network traffic rules for cloud environments

C. Federal legal business requirements for all cloud operators

D. A list of cloud configurations including traffic logic and efficient routes

E. The command and control management hierarchy of typical cloud company

A. All cloud-hosted email accounts are easily searchable.

B. You can easily search across your environment using any E-Discovery tool.

C. The cloud provider must conduct the search with the full administrative controls.

D. You might not have the ability or administrative rights to search or access all hosted data.

E. Search and discovery time is always factored into a contract between the consumer and provider.

A. Web filtering

B. Provisioning

C. Intrusion detection

D. Authentication

E. Spam filtering

A. Establishing/asserting the identity to the application

B. Enforcing the rules by which access is granted to the resources

C. Giving a third party vendor permission to work on your cloud solution

D. The process of specifying and maintaining access policies

E. Checking data storage to make sure it meets compliance requirements

A. Compute, network, and storage resource pools

B. Load balancers, firewalls, and backup solutions

C. Network configuration tools, storage encryption, and virtualization platforms

D. User authentication systems, application deployment services, and database management

A. Discovery

B. Scope

C. Subpoena

D. Risk Assessment

E. Custody