CCSP: Certified Cloud Security ProfessionalDemo

TLS protects the confidentiality and integrity of data transmitted between systems over a network.

Security concerns should be incorporated when the BCDR plan’s scope is defined, ensuring that security roles, protected systems, and constraints are embedded from the outset rather than retrofitted later.

An RSA token is a possession-based authenticator. A retina scan verifies an inherence characteristic—something the user is—so it supplies an independent MFA factor. Access cards, USB thumb drives, and RFID devices are also possession-based factors. CISA describes MFA factors as something known, possessed, or inherent, and lists physical traits such as iris characteristics as inherence factors.

Compliance-focused data-protection controls address information in all three operational states: stored data (at rest), actively processed data (in use), and transmitted data (in transit). A data custodian is an organizational role, not a data state requiring equivalent protection planning. NIST guidance identifies protecting data at rest, in transit, and in use as enterprise data-protection objectives.

Federal discovery rules require production of documents and electronically stored information within a party’s possession, custody, or control. These are the three concepts that define the scope of required disclosure.

Defense in depth combines administrative, physical, and technological controls so that the failure or bypass of one control does not leave assets unprotected. Therefore, every listed control category should be included.

Infrastructure as a service provides foundational infrastructure resources. Its typical storage offerings include volume (block) storage for compute instances and object storage for durable data, whereas databases and data-structure classifications are not the primary storage pair defined by this service category.

Minimal, moderate, and critical are qualitative labels used to classify risk levels. “Accepted” denotes the risk-response decision to accept a risk within the organization’s tolerance, not a risk-level category.

An IDS monitors network or host activity for potential intrusions and produces alerts, while an IPS evaluates traffic using signatures, behavioral analysis, and rules and can actively block or otherwise prevent detected threats.

The physical and geographic location of cloud resources can determine compliance with data-residency requirements and whether a single regional event could disrupt both primary services and disaster-recovery capabilities.

In STRIDE, “I” represents Information disclosure: the unauthorized exposure of information to individuals or systems.

Chef and Puppet enforce desired system configurations, while Active Directory can enforce security configuration baselines through Group Policy Objects. GitHub provides Git repository hosting and collaboration features rather than applying or enforcing configuration baselines on systems.

Data classification is established during the Create phase, when the data is first produced or collected. This enables the appropriate protections and handling requirements to be applied across its lifecycle.

COBIT, ISO 31000:2009, and NIST SP 800-37 are recognized frameworks or standards used to govern, manage, or implement risk management. Hex GBL is not a recognized risk-management framework.

Operational dependencies relevant to a cloud provider’s ability to deliver services include utilities, suppliers, and vendors. Resellers ordinarily act as sales or distribution channels rather than as dependencies required for service operation or recovery.

CSA STAR Level 1 is the Self-Assessment level, in which organizations submit a CAIQ-based assessment of their cloud security controls. Level 2 involves third-party audit options, including attestation.

IPsec, VPNs, and HTTPS protect network communications in transit through encryption and secure channels. DNSSEC authenticates DNS information and helps prevent DNS-record spoofing or tampering, but it does not generally protect arbitrary data transmitted between systems.

The Organizational Normative Framework is the organization-wide structure containing containers for all application-security best-practice components that the organization catalogs and reuses. Application-specific frameworks draw only the applicable subset from that complete organizational framework. ISO/IEC 27034-2 provides the detailed description and implementation guidance for the Organization Normative Framework.

Injection attacks use untrusted input to alter or introduce commands or queries that an application executes, such as unintended SQL queries.

The management plane provides centralized control over cloud identities, permissions, configurations, and resource deployment. A compromise of it can affect many or all cloud resources, enabling widespread unauthorized access or changes.

Data loss prevention controls sensitive information to reduce unauthorized disclosure or sharing. It can therefore help deter loss caused by malicious disclosure.

Injection occurs when untrusted input is interpreted as commands or queries by an application component, enabling unintended execution as part of normal processing.

IAM governs digital identities and access controls so that the appropriate individual can access the appropriate resources at the appropriate time for legitimate reasons.

Leasing data-center space provides greater direct control over the physical servers, infrastructure configuration, and operational environment than procuring cloud services, whose underlying infrastructure is managed by the cloud provider.