Option A is incorrect; both BC and DR use the RTO and RPO as metrics to determine success.

Option B is incorrect; BC and DR efforts are not specific to the cause of a disruptive event.

Option D is incorrect; health and human safety should be paramount in all security efforts, with very few exceptions.

All the other options are topics that should be addressed in the contract between the current cloud provider and the cloud customer in order to properly address BCDR needs.

All the other options are simply incorrect, especially option D, which is never true.

The provider does not absorb the cost when the customer’s requests a modification of the SLA. Though an even split of the cost between customer and provider may seem fair, the customer pays for all costs associated with modifications to the SLA by the customer. Finally, customer modifications to their SLA are chargeable expenses that will almost certainly be paid for by the customer.

All the other options are topics that are more important to review when an organization is considering cloud migration.

Option A is incorrect because the number of users should not be affected whether the organization is operating in the cloud or a legacy environment. The exception would be the reduced number of privileged users, because the cloud provider will be handling more administrative tasks in the environment; however, because “privileged” was not specified, option B is still a better answer.

Option C is incorrect because that may or may not be true of an organization’s migration to the cloud.

Option D is incorrect because the organization certainly hopes it is not going to lose clientele by moving to the cloud!

Option B may or may not be true, depending on the degree of sensitivity and value of the organization’s data and what controls the organization will request/contract for in the cloud.

Options C and D are not influenced by cloud migration in any way and are wholly dependent on other factors within the organization.

Option A is incorrect; cloud migration should not affect the need for personnel training; employees will just need to be trained in a different manner.

Options B and D should not be affected by cloud migration in any way; whether your organization has a high personnel turnover rate or risk from internal threat is not based on whether the IT environment is owned or leased.

Option A is incorrect because the altitude of the cloud data center does not translate into a reduction of the actual financial benefit the organization would realize in moving to the cloud environment.

Option C is wrong because it should be the opposite of the actual case: losing ownership of the IT assets, and paying only for the use of those assets, should lead directly to a savings over the costs of a traditional IT environment, if compared on a seat-to-seat basis.

Option D should not be true; the cost of connecting users to the Internet should not be significantly greater if the organization operates in the cloud or with an on-premises data center—if the cost is considerably greater, the organization should never have migrated in the first place.

National Institute of Standards and Technology (NIST) SP 800-53 is the list of security controls approved for use by U.S. government agencies and a means to map them to the Risk Management Framework.

The Payment Card Industry Data Security Standard (PCI DSS) is the payment card industry’s framework of compliance for all entities accepting or processing credit card payments.

NIST SP 800-37 is the Risk Management Framework.

They are not, however, cheap, fast, or easy to adopt, implement, and audit against, so all the other answers are incorrect.

However, they are in the public domain, so an organization would not have to pay for the standards material if the organization chose to use NIST standards.

PCI DSS is the payment card industry’s framework of compliance for all entities accepting or processing credit card payments.

NIST SP 800-37 is the Risk Management Framework.

HIPAA is the U.S. law regarding patient data privacy in the medical sector.

All the other options are distractors: SABSA is an IT architecture framework, Biba is an access control model, and NIST SP 800-53 contains guidance for selecting security controls in accordance with the Risk Management Framework.

NIST 800-53 is a standard, not a law, so option A is incorrect.

Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law concerning medical information, so option B is incorrect.

SOX affects publicly traded corporations, making option C incorrect.

The SOC 1 report provides information about financial reporting mechanisms of the target only and is of little interest to the IT security professional, so option A is incorrect.

The SOC 2, Type 1 report describes IT security controls designed by the target only but not how effectively those controls function, so option B is incorrect.

The SOC 3 report is only an attestation that the target was audited and that it passed the audit, without detail, so option D is incorrect.

The SOC 2, Type 1 report describes IT security controls designed by the target only but not how effectively those controls function. While of some interest to the IT security professional, this is of little interest to the investor, so option B is incorrect.

The SOC 2, Type 2 report will provide details on IT security controls used by the target and how well those controls function. While of great interest to the IT security professional, this is of little interest to the investor, so option C is incorrect.

The SOC 3 report is only an attestation that the target was audited and that it passed the audit, without detail, so option D is incorrect.

The SOC 1 report provides information about financial reporting mechanisms of the target only. This information may be of little use to the IT security professional and won’t help you choose a cloud vendor, so option A is incorrect.

The SOC 2, Type 1 report describes IT security controls designed by the target only but not how effectively those controls function. While of some interest to the IT security professional, it is more comprehensive and detailed than a SOC 3 report, so it would take more time; option B is incorrect.

The SOC 2, Type 2 report will provide details on IT security controls used by the target and how well those controls function. While of great interest to the IT security professional, it is very detailed and comprehensive and wouldn’t be a speedy tool to narrow the field. Option C is incorrect.

They can, however, assess fees, suspend processing privileges, and require more auditing, so the other answers are true and therefore incorrect.

All the other options are incorrect because the dollar value of transactions and location of the merchant or processor are not the criteria used for determining PCI DSS merchant levels. Only the transactions a compliant entity engages in over the course of a year is the correct answer.

It may be tempting to choose the highest number when choosing an answer for the highest merchant level. It may be counterintuitive to think that level 1 would be a higher level than a level 4. However, level 1 is the highest merchant level and is the correct answer to this question.

Option A is partially correct and partially incorrect. While the security requirements are partially technical, some requirements are also nontechnical. Therefore, option A is incorrect.

Option B is also partially correct and partially incorrect. While the security requirements are partially nontechnical, some requirements are technical. Therefore, option B is incorrect.

Option C is incorrect because the requirements are technical and nontechnical, not neither technical nor nontechnical.

The other options are distractors and not dictated by PCI DSS. They can, however, be useful in fulfilling certain credit card support services, such as customer support, where the personnel engaged in the activity (customer support agents, for instance) may need access to a limited set of the cardholder’s account information (for instance, name, mailing address, and date of the payment) but do not have a need to know other elements of that data set (particularly, the full credit card number); masking and obfuscation can satisfy that business need without putting data unduly at risk.

The other options may be stored for future transactions with the same merchant. However, unlike the CVV they may be stored by the merchant.

The EAL does not offer any true measure of how well those security features will work in a production environment so options A and C are incorrect. Whether those features are preferable to other features offered by competing products, or whether the product is “good.” Therefore, option D is incorrect.

Option C, EAL 5 is incorrect because that is for solutions that have been semi-formally designed and tested.

Option D is incorrect because EAL 7 is for solutions that have been formally verified design and tested.

EAL 1 is for functionally tested products.

EAL 3 is for solutions that have been methodically tested and checked.

EAL 5 is for solutions that have been semi-formally designed and tested.

NIST does not certify products for Common Criteria. NIST is a U.S. government organization.

Option C is incorrect because the cloud customer does not pay to have IT products certified.

Option D is incorrect because the end user is an individual and individuals do not pay to have IT products certified.

(Note: Of course, the manufacturer/vendor is going to amortize the cost of the certification process across the price of the products they sell, so the customers who purchase the product will eventually “pay” for the certification, but that’s a very oblique and abstract way of reading the question.)

Option A is incorrect because NIST does not perform the review process. NIST approves the independent laboratories that perform the review process.

Option B is incorrect. Of all the activities that the NSA does perform, reviewing the process for Hardware Security Modules in accordance with FIPS 140-2 is certainly not one of them.

Option D is incorrect because the ENISA is a European Union organization that supports European Union institutions and stakeholders.

The question asks what distinguishes the security levels for cryptographic modules. Option A focuses on the sensitivity of the data being protected. The sensitivity of the data that is being protected is important when it comes to the cryptographic module being used, but that is not the distinction between the security levels in FIPS 140-2.

Option C is incorrect because the size of the IT environment the cryptographic module is protecting is not what distinguishes the different levels.

Option D is not correct because whether the cryptographic module is or is not allowed in a certain geographic location has no bearing on whether or not it works. The cryptographic module either works or it does not, regardless of its location.

Option A is incorrect because the U.S. government is not in the business of paying for cryptographic module certifications. The U.S. government can require the use of cryptographic modules in certain situations.

Certification laboratories receive funds for certifying cryptographic modules. They do not pay to have them certified. Therefore, option C is incorrect.

Option D is incorrect. Users do not pay to have solutions certified.

Strangely, option A is not correct in this case. Social engineering is perhaps the aspect of information security that is least understood (by users) and easiest to exploit, and it is the attack tactic most likely to succeed. Social engineering training could probably reduce the greatest number of overall security threats in our field today. However, this specific question is all about application security, and the element of social engineering is negligible.

Option C is not correct because source code testing is only one aspect of code review and would not address as many items on the Top Ten as option B would.

Option D is not correct for much the same reason option A is incorrect; this question is specifically about application security, and the physical protection element is very minor.

Option A is incorrect; this is a description of social engineering.

Option B is incorrect; SQL injection does not typically involve malware.

An attack that allows someone to penetrate a facility is a physical attack. The attacker has to physically be at the facility itself. Option D is incorrect.

Injection attacks target applications, not users, so user training has little to do with preventing injection, making option A incorrect.

The OS usually has little to do with injection attacks, which usually target user-facing web apps that ride on the OS, so option B is not correct.

Injection attacks are logical, not physical, so locks won’t aid the security effort in this case, making option D incorrect.

Authentication schema should be transparent to users, who will have little or (preferably) no control over that element of communication. Thus, training is not applicable in this case, making option B wrong.

Input validation is used to counter injection attacks and has no efficacy in authentication implementations, making option C incorrect.

The X.400 standards are for email communication and are not applicable to session authentication; thus, option D is wrong.

All the other options are practices that can enhance an attacker’s ability to compromise authentication implementations and sessions.

All the other options are practices that can enhance an attacker’s ability to compromise authentication implementations and sessions.

The other options are all actions that OWASP recommends for reducing the risk of XSS attacks: www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet.

This question is particularly difficult as it delves into a level of detail that may or may not appear on the actual exam; however, all source documents listed in the Candidate Information Bulletin, including the OWASP Top Ten, are fair game for the test, so it is best to have at least an understanding of these sources.

Option B is a DoS program string; C is a SQL database command line (which wouldn’t reveal any information on its own; it would prompt for a password); and option D is just an email address.

Option A will not aid in insecure direct object risks; this is not a user issue, usually, but a programming issue. Option C is for physical security, while insecure direct object references are logical attacks. Option D does not reduce the risk of insecure direct object references because classification and categorization are not protections themselves but need to be paired with proper control sets in order to provide protection.

Untrusted users should not have encryption keys, so this is not a misconfiguration; therefore, option A is incorrect.

A public-facing website can be extremely useful for marketing purposes and is not necessarily a security issue in and of itself, so option B is incorrect.

Option D might or might not be true; both turnstiles and mantraps are physical security controls, and we can’t be sure whether one or the other is preferable in any given situation, so we don’t know if this is a misconfiguration or a proper configuration. Option C is therefore preferable.

Option B is bad security practice but not considered a misconfiguration.

Data owners are supposed to classify/categorize the data under their control, so option C is not a correct answer.

Preventing users from reaching untrusted resources may be a proper control in a given environment, so option D is not a misconfiguration, and not a correct answer.

Option B is incorrect because firewalls that inspect inbound traffic only will not notice data exposed accidentally or maliciously as it travels outbound.

Option C is incorrect because it has nothing to do with data disclosure and is instead about business continuity and disaster recovery (BC/DR).

Option D is incorrect because it has nothing to do with data disclosure and is instead about physical security.

All the other options are ways of reducing the risk of sensitive data disclosure. Option A reduces the possibility of disclosure by reducing the amount of data on hand (from the OWASP: “Data you don’t have can’t be stolen”). Option C reduces the chance of disclosing keys, which leads to disclosing the data. Option D reduces the possibility that the form will disclose sensitive data to someone filling it out by prompting with an entry that should be protected.

Option B is used to deter cross-site scripting attacks, so it is incorrect.

Option C is correct but insufficient; option A includes a more restrictive mode, so is therefore a better choice.

Option D is used to deter the possibility of insecure direct object references, so it is incorrect.

According to the OWASP, “automated tools are unlikely to find these problems,” so option B is incorrect.

Option C is incorrect because it is the exact opposite of what you’re trying to accomplish; this is an example of what happens when function-level access controls are missing.

Option D in no way addresses the problem of missing function-level access controls, which is a technical problem, not a user issue.

Option A is incorrect because HTTP requests are usually made by the browser, without the user’s knowledge; the user has no perspective of such requests, so this wouldn’t be a useful mechanism in prevention.

Option B is incorrect because it’s unrealistic. Removing all browsers would decrease the utility of the systems to the point where productivity would be negligible.

Option C is incorrect for similar reasons; the danger from CSRF is not because of links to the target website but because of the browser behavior.

All the other options are possible exploits an attacker might try to accomplish with a CSRF attack.

Option A is not optimal or sensible because it would inhibit all web traffic and remote access.

Option C is not optimal or sensible because it would severely limit your online capabilities.

Option D is not sensible because all browsers use stored tokens/cookies, and no browser is preferable for the purpose over others.

Option B is preferable to the others because, according to the OWASP, publishers of component libraries do not often patch old components but rather issue the fixed component(s) as a new version. This is also why option D is incorrect.

Options A and C are two ways of stating the same thing, and not optimal; trying to use this method would require every one of your software packages to be wholly written by your programmers, which is actually not more secure than using published component libraries because the risk of additional human error and lack of review is introduced to the process.

Option B makes the most sense; some vulnerabilities are known to exist only when a component is used in a specific way or with specific services; if the programmers are not including that way of using the component or the risky service, then the vulnerability would not pose a threat to the software they are creating and may therefore be acceptable.

Option A is not correct because an underwriter would be unlikely to cover a claim resulting solely from negligence; using a component with a known vulnerability and putting the product/user at risk knowingly would probably invalidate any insurance policy.

Option C might conceivably be considered correct in a fashion; different countries have different legislation/regulations, and a vulnerability that could cause noncompliance in one country might not in another. However, this is a rather tortured reading of the question, requiring some convoluted reasoning, and this option is therefore not the best answer.

Option D is not correct because a hidden vulnerability, by definition, is not a known vulnerability.

Option A is incorrect because even standard libraries are subject to vulnerabilities, so you have to review notifications about those as well.

Option C is not correct; this is a method for reducing the risk of cross-site scripting (XSS) attacks.

Option D will not work as users have no influence or effect on which components are used in software design.

Option A is not correct; this is a method for reducing the risk of cross-site scripting (XSS) attacks.

Option C is not correct; it is ridiculous and would result in preventing all remote access.

Option D is not correct; audit logging would only track activity, not prevent a user from being directed/forwarded to an attack site.

Option B is a incorrect because this type of attack is not aimed at stored credentials.

Options C and D are both incorrect because neither of those types of solutions detect or prevent this type of attack.

Scalability might be seen as an attribute of cloud computing that increases the potential for hijacking attacks because a proliferation of users means more attack surface. But even that aspect is contingent on the users accessing cloud resources remotely, so option C is still a better answer than A.

The metered service nature of cloud computing has nothing to do with a hijacking threat; metered service indicates that the customer pays only for those resources users consume.

Cloud customers pool resources might be of concern when considering hijacking attacks because poorly configured cloud environments could leave one cloud customer subject to attack by another tenant in that same environment. But, again, hijacking is predicated on attacking data in transit, so it is the remote access aspect that is the best answer for this question.

Option B is incorrect because APIs are not inherently insecure and it is unlikely that the CSA has stated that they are.

Option C is incorrect because it is predicated on the inaccurate notion that all APIs are inherently insecure and that the vulnerabilities of all known APIs have been published.

Lastly, option B is inaccurate because APIs are not known carcinogens. To be a carcinogen, the carcinogen needs to be a substance that causes cancer in living tissue. As far as we know, APIs do not cause cancer.

Automation is not inherently a source of threats/vulnerabilities, so option B is not correct.

Options C and D are not true.

Not all API interaction involves administrative access, so option A is wrong.

APIs may or may not be cursed.

Secure code practices can be used to design robust APIs, so option D is incorrect.

A lot of attackers/criminals operate internationally; this has no bearing on whether an organization operates in the cloud or otherwise. Option A is incorrect.

There are laws prohibiting DoS attacks, so option B is incorrect.

The volume of DoS traffic necessary to disrupt modern cloud providers is rather significant, so these types of attacks are not simple. Option D is incorrect.

The other options are not applicable to the insider threat.

The other options are not applicable to the threat of abuse of cloud services.

It is imperative that the cloud customer determine whether any application dependencies exist in the legacy environment before migrating to the cloud.

Reviewing the contract between the cloud customer and provider is an essential element of due diligence.

Determining the long-term financial viability of a cloud provider is a way to avoid losing production capability/data in the cloud.

Vendor lock-in is when data portability is limited, either through unfavorable contract language or technical limitations.

Vendor incapacity and unscaled are not meaningful terms in the context of cloud computing.

All the other options are segmentation methods/tools. Option C may be perceived as a viable answer because bridges connect network segments (allowing a segmented network, but not really creating segmentation), but option D is a better choice for this question.

Nothing is impossible; these tasks may become more challenging, but not impossible. So options B and C are incorrect.

Option D is not true because lack of physical endpoints may actually reduce the threat of physical theft/damage.

All the other options are simply incorrect.

All the other options are just wrong, with at least one nonsensical element in each.

International standards do not apply to every organization’s internal needs and individual user roles, so option A is incorrect.

Not all organizations are bound by all (or any) federal regulations, but all organizations should have policies regarding user access rules, so option B is incorrect.

Option D is a nod to Star Trek and also incorrect.

Authorization is granting access based on permissions allocated to a particular user/valid identity assertion.

Nonrepudiation is the security concept of not allowing a participant in a transaction to deny that they participated.

Regression is a statistical concept not relevant to the question in any way.

Authentication is verifying that the user is who they claim to be and assigning them an identity assertion (usually a user ID) based on that identity.

Nonrepudiation is the security concept of not allowing a participant in a transaction to deny that they participated.

Regression is a statistical concept not relevant to the question in any way.

All cloud environments, including PaaS, rely on virtualization, have multitenancy, and are scalable, so those options are not correct.

Option A is incorrect as backdoors are not a control.

Option B is incorrect because backdoors don’t serve as DoS protection in any way.

Option D is incorrect because backdoors are not distractions for attackers, but means for attack.

Option A does not make logical sense; a Type 1 hypervisor is not more straightforward than other hypervisors. Option A is not the correct answer.

Option B is not true. A Type 1 hypervisor has a smaller attack surface, not a larger one.

Option C is not true in general. Type 2 hypervisors are not necessarily less protected than other hypervisors. Option C is not the correct answer.

The General Data Protection Regulation (GDPR) and GLBA are both legislative mandates; these might dictate a standard of due care, but they are not the due care or due diligence, specifically.

Door locks and turnstiles are physical security controls; they both might be examples of due care efforts, but neither demonstrates due diligence.

Due care and diligence can be demonstrated by either internal or external controls/
processes; there is no distinction to be made based on where the control is situated.

A domain name is used to identify one or more IP addresses. For instance, Microsoft.com and google.com are domain names. Option A is incorrect.

A directory name is typically associated with a file system structure and not something related to LDAP. Option C is incorrect.

“Default Name” is not a common term, and is made up. Option D is not the correct answer.

All the other options are simply untrue and are therefore exceedingly poor choices for answers to CCSP test questions.

Option A is incorrect because the scenario stated in the question does not identify a threat.

Option B is incorrect because the scenario stated in the question does not identify a risk. Allowing the customer to retain their own encryption keys is actually less risky than sharing their encryption keys with the provider.

Option D is incorrect because the provider does not have a right to the customer’s encryption keys, so, there cannot be an infringement on the provider’s rights.

Private clouds typically cost more than public cloud deployments, so option A is incorrect.

Performance is not necessarily enhanced (or decreased) by any of the cloud deployment models, so option B is incorrect.

Retaining a higher degree of control over the cloud environment will necessarily require the cloud customer to have more maintenance capability, not less, so option D is incorrect.

All the other options are incorrect. The options contain legitimate words put together to form gibberish.

All the other options are incorrect because they do not correctly identify who is required to make data breach notifications in accordance with all applicable laws. That responsibility rests with the cloud customer.

All the other options would include some degree of administration of the cloud resources on the part of the cloud customer and so are not as optimal as option C.

The best practice is to not store cryptographic keys with the data they encrypt, to avoid a potential conflict of interest and to enforce separation of duties. Each of the other choices is a reasonable choice and therefore not the answer to this question.

Options B and D are phases of CSU-SAD but do not immediately follow Create.

Option C is not a phase of CSU-SAD.

Options A and B are phases of CSU-SAD but do not immediately precede Share.

Option D is not a phase of CSU-SAD.

Option A might be considered true because the CSU-SAD cycle is not unique to (ISC)², but this is not the best answer; option D is preferable because it is not truly a cycle.

Options B and C are incorrect because activity in each of the phases involves security aspects and all phases relate to how data is involved in the cloud.

Options B and D are phases of the CSU-SAD but are not the proper times to be applying classification/categorization; that would be too late in the cycle.

Option C is not a phase of CSU-SAD.

Option A is incorrect because data dispersion is a means of making data more resilient and secure; in the final phase of the cycle, we want to get rid of the data, not make it resistant to loss.

Option C is incorrect because cryptoparsing is a made-up term and used here as a distractor.

Option D is incorrect because cryptosporidium is a microorganism and is not associated with InfoSec.

The other phases in the options are create, store, and share and are therefore incorrect.

Volume storage is not a hierarchal cloud storage structure and is therefore an incorrect answer for this question.

Option B is incorrect because databases are applications in both traditional and cloud computing.

A CDN is a geographically distributed network of proxy servers and their data centers. Option C is incorrect because it is not a form of cloud storage.

Databases store data in an arrangement of characteristics and values, not in an unstructured drive space, so option B is incorrect.

CDNs are for distributing data with less chance of quality loss, so option C is incorrect.

Object storage arranges data as objects in a structured hierarchy, so option D is incorrect.

Volume storage assigns a logical, unstructured drive space to the user, so option A is incorrect.

Databases store data in an arrangement of characteristics and values, so option B is incorrect.

Neutral storage is not a form of cloud storage, so option D is incorrect.

Ephemeral and long-term storage take place in the software as a service (SaaS) model, and there is no such thing as “nefarious data storage,” so the other options are incorrect.

Options A and C are terms that have no meaning in this context.

Crypto-shredding is a form of device/media sanitization utilizing cryptography and has nothing to do with RAID, so option D is incorrect.

Options A and B have no meaning in this context.

Transposition is a cryptographic technique and does not relate to RAID in any way, so option D is also incorrect.

Because it is designed to prevent the egress of only certain data sets, options B and C are not correct.

Controlling data outside the reach of the organization is difficult at best. While there are some mechanisms that might accomplish this, DLP is not specifically designed for that purpose, so option D is incorrect.

A proper DLP solution will monitor all the technologies in the other options, so those are incorrect.

All the other techniques listed may be used by DLP solutions to detect sensitive data before it leaves the control of the owner.

If you are introducing hardware into the cloud environment, you will need permission from your cloud provider, regardless of the deployment model you use. Therefore, option A is incorrect (and unlikely to occur, as permission is probably not going to be granted).

Although the provider may offer an egress monitoring function as an add-on service, which would be permissible for you to use, the use of an outside vendor’s product may have to be reviewed by the provider before implementation, based on a number of other variables (such as the other possible answers). Option C is preferable, so option B is incorrect.

Affecting all images on a host may impact other customers in a multitenant environment, so option D is not the correct answer.

Implementing an egress monitoring solution should not incur any additional risks of external attack, so option A is incorrect.

Because the tool has already been purchased, explaining the purchase price is irrelevant at this point, so option C is incorrect.

If it was germane (and it was likely not), you should have explained how the tool works before purchasing it; explaining at this point might be interesting but is not as important as option B, so option D is incorrect.

A proper egress monitoring solution should not affect or be affected by the firewalls, routers, or hypervisors, so options B, C, and D are incorrect.

The tool will not work optimally immediately upon implementation, so option A is incorrect.

Egress monitoring tools do not affect morale or revenues, so options C and D are incorrect.

A proper egress monitoring tool should be able to detect all the other types of activity, so the other options are incorrect.

It would be unnecessary (and intrusive, and cumbersome) to install agents on all assets in the cloud data center, which includes not only your organization’s assets but also those of all the other cloud tenants in that data center. This might even be illegal. Option B is incorrect.

Assuming you could install (or even know) all the routers between your users and the cloud data center is ridiculous; option C is incorrect.

Getting your customer to install an egress monitoring client would be nice, in theory…but also pointless. Your customers don’t work for you; they are outside your organization. Egress monitoring tools are used to prevent sensitive data from leaving your environment; by the time it has reached a customer, sensitive information is far outside your control and the egress monitoring tool would be of no use. Option D is therefore incorrect.

Project management software does not really have anything to do with security, so option B is incorrect.

Insurance is a risk transfer mechanism and does not aid in risk mitigation efforts; egress monitoring is for risk mitigation, so option C is incorrect.

The Tier certification program is for the cloud provider and is not used by the cloud customer, so option D is incorrect.

Because data will move across nodes in the data center and will take different forms (such as live data in a virtualized instance or snapshotted data saved in a file store when a virtual machine is not being used at a specific moment), you will have to determine how the tool will function in that environment, and whether it was designed for cloud usage. Option A is incorrect.

Option C is true for any environment, not just the cloud; all security functions necessarily negatively impact operations and production. Option B is a better answer.

Option D is also correct; without administrative privileges to the underlying hardware (which customers should not have), the customer may not be able to install monitoring agents everywhere necessary for those tools to work properly.

Egress monitoring tools do, however, provide all the functions listed in the other options, so those are incorrect.

Encryption is used in all other aspects of cloud data.

The other three options are the components of an encryption deployment.

Volume storage encryption will, however, protect against all the other threats, because any outsider (that is, a person who does not have access to the volume operating system) will be able to steal only encrypted data, which they should not be able to decrypt in a timely fashion. Therefore, all the other options are incorrect.

All the other options are examples of object storage encryption options, so they are incorrect.

All the other options are examples of database encryption options, so they are incorrect.

The operating system is responsible for providing the resources an application needs and for running the applications. The operating system does not do application-level encryption, so option B is incorrect.

Option C is incorrect because application-level encryption is performed by the application that interfaces with the database.

The application-level encryption engine may or may not reside in the same volume as the database engine, so option D is incorrect.

All the other options are incorrect because they are not database encryption techniques.

Options A and B are both viable but not as good as option D, which is more general and includes them both.

Option C is clearly incorrect because it is counter to the best practice advice offered by (ISC)².

Seeding key generation processes with pseudorandom numbers makes decryption that much more difficult and is a desired practice, so option A is incorrect.

Losing keys to encrypted data means that the data stays encrypted, which is a way of applying a denial-of-service attack on yourself, so option C is incorrect.

Symmetric keys, known as shared secrets, ought to be transmitted to recipients over a different medium than the mode of communication intended for the encrypted traffic. If the users intend to use encrypted email, for instance, they should pass the keys via telephone. Option D is therefore incorrect.

The shipping department definitely needs the customer’s address in order to send things to the customer, so option A is not correct.

The billing department needs the customer’s full credit card number to process payments, so option C is incorrect.

HR needs the employee’s full license number in order to verify and validate the employee’s identity, so option D is not correct.

The other options modify the raw production data into something that approximates the real environment without disclosing real data, to a greater or lesser extent; some are better than the others, but they are all better than deletion for testing purposes.

Static testing for customer service use would be overkill; replicating all the customer accounts at once so that the fraction of customers who contact customer service may receive assistance is inefficient and cumbersome, and customer account information is likely to change between static updates, making it less useful. Therefore, option B is incorrect.

Neither regulators nor shareholders need to see masked data, so both options C and D are incorrect.

Trying to mask each data element as it is called by an application in a test environment would be unwieldy and not likely to provide accurate test data, so option A is incorrect.

Neither incident response nor BC/DR purposes need masked data, so both options C and D are incorrect.

Algorithmic masking causes no more risk to production data than the other masking methods, so option A is incorrect.

Accidental disclosure might be interpreted as the same thing as determining the original data from the masked set, so option B might be considered accurate, but option C is a better way of stating the risk, so B is incorrect.

Option D is about the use of the deletion technique for masking, not algorithmic, so it is incorrect.

This is not an easy question, and it involves some abstract thought to arrive at the correct answer.

Username and password are identity assertions and authentication credentials, not identifiers. The username might be a direct identifier, but the password is neither a direct nor an indirect identifier (especially if it is kept secret, as it should be). Option A is thus incorrect.

Option C is incorrect because both elements could be considered direct identifiers (depending on the jurisdiction) if the user’s machine is considered a legal representation of the user.

Option D is incorrect because both elements are indirect identifiers.

All the other answers are incorrect because they are not part of the anonymization process.

GLBA, COPA, and SOX do not specifically require obscuring stored data, so those options are incorrect.

One database will not suffice; a single database holding both the tokens and the sensitive data they represent would not be in compliance with any standard requiring data to be obscured. Option A is thus incorrect.

Option C might be an answer some readers choose; it is easy to overthink this question. You might consider that the data requires two databases (one for tokens, one for sensitive data), and that access control would require a third database (for authentication credentials); however, the tokenization methodology does not strictly require that access be controlled through an authentication server. Option C is therefore incorrect. Be sure not to read more into the question than appears at face value.

Option D is incorrect; that’s just too many databases.

All the other options are good reasons to implement tokenization, and they are therefore not correct.

All the other options have nothing to do with spreading data across multiple storage areas.

Bit-splitting may or may not function as an access control method; option B is preferable to A.

Bit-splitting may or may not move data across jurisdictions, which may or may not be useful to the data owner; option B is preferable to C.

Bit-splitting does not, in itself, provide access logs; option D is incorrect.

Attackers are jurisdiction-agnostic; they don’t care where data is stored or what laws apply. Option B is thus incorrect.

Authorized users can access bit-split data regardless of the location and can disclose information worldwide; option C is incorrect.

Bit-splitting does not pertain to types of access roles; option D is incorrect.

Bit-splitting should make a data set more secure and decrease the chance of unauthorized access, so options A and B are incorrect.

It is unlikely that bit-splitting would violate regulatory standards; even if that were to be the case, it is always true that bit-splitting carries greater overhead, so option C is preferable to D.

There should be no additional management concern; if bit-splitting is not compliant with the data owner’s policy, it won’t be adopted. Option B is incorrect.

Bit-splitting implementations should be transparent to users; option C is incorrect.

There are plenty of vendors offering bit-splitting solutions; option D is incorrect.

Data dispersion should have no effect on physical theft risks and would actually serve to minimize the opportunity for an attacker to acquire useful sensitive data as the data would be on several geographically disparate devices. Option A is incorrect.

Bit-splitting should have no effect on public image whatsoever; option B is incorrect.

Bit-splitting does not have an attendant fire risk; option D is incorrect.

All the other answers are incorrect.

All the other answers are data discovery approaches but not used for this particular application (options C and D are two names for the same thing).

Options B and C are other data discovery technologies, but neither is the correct answer.

Option A is incorrect because obverse polyglotism is just a made up term that does not have any relevance as an answer to the question.

Options B and C are also data discovery techniques, but not involving metadata.

Data hover is a made up term and is therefore, not a data discovery technique, so option D is incorrect.

The other answers are incorrect because they are not the data owners.

Options A and B are incorrect because they are not part of a data labeling process.

Option D is incorrect because the discovery tools need to have the data labeled to work properly.

Digital rights management (DRM) is an additional access control solution for objects, so option B is incorrect.

Internet Small Computer System Interface (iSCSI) allows storage controller commands to be sent over a Transmission Control Protocol (TCP) network and has nothing to do with data discovery; thus, option C is incorrect.

Fibre Channel over Ethernet (FCoE) is a standard for approaching fiber-media speeds of data transfer on an Ethernet network; it has nothing to do with data discovery, so option D is incorrect.

All the other answers are characteristics of content that can be used in content-analysis methods of data discovery.

All the other answers are not affected by dashboarding at all and are incorrect.

All the other answers do not impact data discovery efforts and are only distractors. (Poor bandwidth might slow down data discovery, but it won’t have true negative impact, so option D is still better.)

All the other answers are requirements for the cloud provider to meet the data discovery needs of the customer and should be negotiated before migration.

The other answers are general regulations and standards; they will not contain specific guidance for every customer’s needs and are only distractors.

The other answers represent external entities, some of whom might require that certain information be handled with a certain duty or care (such as Payment Card Industry [PCI] mandates for cardholder information). However, these entities will not impose a classification scheme on the data owner or cloud customer; that responsibility falls on the data owner or cloud customer to do for itself and the data under its control.

All the other answers are factors that an organization might consider when creating a classification scheme, but they are not mandatory for every organization. Option D is still the best answer for this question.

Option A might be considered apt, as labeling and classification fall generally under the auspices of “security,” but option B is more specific and therefore correct.

Classification is not considered a facet of data control or data markup. Therefore, options C and D are incorrect.

Option A is incorrect because even though the word pair may seem pretty technical, together they are meaningless with respect to data classification.

It may be true that data classification can be correct or incorrect, however, option C is not as good of an answer as option B. The goal for the data owner is to correctly classify the data and not to incorrectly classify the data. So, option C is incorrect.

It is difficult to imagine data classification that only takes place at a certain time of day. Therefore, it is not likely to be the correct answer and certainly option D is not as good an answer as option B.

While dollar value may be a good metric for assessing data type in many organizations, it is not the only such trait, and not for all organizations; option C is still a better answer, so A is wrong.

Metadata may or may not be used in a classification/categorization scheme; option B is incorrect.

Policies are not assigned to data types; a policy will dictate how data classifications/categories are assigned to data. Option D is incorrect.

Multitenancy should be a consideration of cloud migration for the potential risks of data leakage and disclosure but not because of data transformation. Option A is not correct.

Remote access and physical distance should not include aspects of data transformation that are not already considered in the traditional IT environment, so options C and D are incorrect.

The other options are parties that may have some partial or contributory responsibility for the breach (especially, in this case, the provider, who was negligent), but the ultimate responsibility lies with the customer.

The other answers are not data subjects, and are therefore incorrect.

Options A, C, and D are all incorrect. The cloud customer provides the subject’s PII to the cloud provider for processing. The regulator ensures that the PII is protected properly and the individual is the data subject. So, options A, C, and D are incorrect answers.

Options B, C, and D are all incorrect. The cloud provider is the entity that processes the PII data. The regulator ensures that the PII is protected properly and the individual is the data subject.

All the other answers are examples of processing and therefore not correct.

All the other options list countries that have such laws, and those options are therefore incorrect.

Under HIPAA, the patient does not have to opt out of information sharing; the default situation is to not share patient data. Option B is incorrect.

HIPAA does not require any kind of screening or template, so Options C and D are incorrect.

Option A is incorrect; under GLBA, the default situation allows banks and insurance providers (owned by the same entity) to share customer data—the customer must opt out of this arrangement if the customer doesn’t want information shared.

Options C and D are incorrect because they do not relate to the sharing of PII data by a bank or insurer.

Options A and D are simply incorrect.

It is very possible to consider option C as correct because European businesses are held to strict standards regarding the privacy data under their control. However, option B has more significance and is more general, so it is the proper selection among this list.

The other answers are not as accurate; “the right to be forgotten” is a very well-known and important aspect of the GDPR.

Option A is wrong because the provider’s liability is already limited under current legal schemes; the PLA would not enhance that limitation.

Options C and D are wrong because agreements (as contracts) are both binding and enforceable, and even if they were not, those are not reasons.

All the other options are included in the CSA CCM and are therefore not correct answers for this question.

All the other answers are laws that are included in the CSA CCM and are therefore not correct answers for this question.

DRM is an enhanced security protocol, so option B is incorrect.

The cloud is not specifically necessary for DRM implementations, even in BYOD environments, so option C is incorrect.

Any DRM solution involving a BYOD environment must be suitable for all devices, not just a certain selection, because the organization can’t easily mandate which devices are used (otherwise, it’s not BYOD). Option D is incorrect.

The organization cannot dictate specific packages in a BYOD environment—otherwise it is not BYOD—so option A is incorrect.

Turnstiles are for physical access control and have no bearing on BYOD or DRM, so option C is incorrect.

BYOD and DRM should have no effect on BC/DR vendors (or the numbers thereof), and vice versa, so option D is incorrect.

All the other answers are incorrect because they are too specific and not required by any regulation/legislation. Therefore, options A, C, and D are poor choices and also incorrect answers.

All the other answers are distractors.

RIS is a made-up term, so option A is not correct.

Adjusting BIOS settings is not particularly relevant to DRM in any way, so option C is incorrect.

TEMPEST is a program for harvesting data from electromagnetic emanations, so option D is not correct.

All the other answers are traits that should be included in DRM solutions but do not match the definition in the question, so they are incorrect.

All the other answers are traits that should be included in DRM solutions but do not match the definition in the question, so they are incorrect.

All the other answers are traits that should be included in DRM solutions but do not match the definition in the question, so they are incorrect.

All the other answers are traits that should be included in DRM solutions but do not match the definition in the question, so they are incorrect.

All the other answers are traits that should be included in DRM solutions but do not match the definition in the question, so they are incorrect.

All the other options are important, but option D is probably the most important.

Deletion involves using the operating system or an application to obscure the location of an object or file, so option A is wrong.

Crypto-shredding is a secure sanitization technique using cryptographic techniques, so option C is wrong.

Storing is a general term covering all retention of data, so option B is a better answer than option D.

All the other options are elements that should usually be included in policies.

All the other answers are goals of secure sanitization.

Options A and B both include secure destruction methods, but they are not exclusive (obviously, because there are two of them), so therefore they are untrue and also incorrect.

Option D does not make practical sense; if users could not delete files/objects, common workplace activity would become burdensome and difficult.

Options A, B, and D are incorrect because the question is about the difficulty of performing data destruction in the cloud computing environment. Often, the only reliable form of data destruction is to destroy the hardware where it is stored. None of these options address that question the way that option C does.

Delete commands are certainly allowed in the cloud. Otherwise, cloud providers would eventually run out of storage space. Option B is incorrect.

Option C is incorrect because ISPs do not have the authority to prohibit the destruction of data by data owners.

It may be unclear who the “end client” is in option D. If the end client is the individual, then it does not make sense that the individual would prohibit the destruction of data by the cloud provider, given that the cloud provider owns the hardware itself.

Law enforcement can destroy their own data, however, law enforcement is not permitted to destroy data that belongs to other individuals. Option A is therefore incorrect.

Option B is incorrect because data destruction is required from time to time in the cloud as part of system maintenance.

Fortunately, option C is incorrect. If data renewed itself automatically in the cloud then cloud providers would eventually run out of storage space.

Options A and B are also good methods for data destruction, but neither is the best method.

Option D is incorrect because a legal order is not a secure method of data destruction and therefore it cannot be the correct answer.

Option A is incorrect because it is untrue. A gauss is a unit of magnetism. Not all data storage devices in the cloud are magnetic. Some storage space does not require magnetism to work. Solid State Drives (SSDs) are an example of a type of storage space that does not rely on magnetism to store data.

Federal law does not prohibit degaussing of magnetic media in the United States so option C is incorrect.

Option D is incorrect because process of degaussing magnetic media does not produce a blast and therefore it does not produce a blast radius.

All the other options are only distractors. Options A and C describe elements of the overwriting process but not reasons why it’s challenging in the cloud. Option B is true, but overwriting does not require physical access, so the option is incorrect.

All the other answers are actual reasons overwriting is not a viable secure sanitization method in the cloud.

The lack of physical access to the cloud environment should not affect the crypto-shredding process, so option B is incorrect.

External attackers should not affect the crypto-shredding process, so option C is incorrect.

Crypto-shredding should not require input or activity from users, so option D is incorrect.

All the other answers are wrong and just distractors.

All the other answers are incorrect; archiving does none of those things.

All the other answers are incorrect; archiving does not aid in these functions.

Archived data is not an optimum gauge of performance because it is not “live” data—that is, the archived data is no longer in the operational environment and so is not a useful indicator of how well that environment currently operates. Option B is therefore incorrect.

Archiving has nothing to do with investment; option C is incorrect.

Archiving may occur as the result of policy but is not an enforcement tool; thus, option D is incorrect.

Either the cloud customer or provider (or both) may perform archiving, depending on the contract terms, so options A and B are incorrect.

Regulators do not perform archiving; option C is incorrect.

Describing or prescribing the physical specifications of a secure archive facility is probably beyond the responsibility or requirements of a data owner (and belowground storage is not a requirement for archiving and retention), so option B is incorrect.

Although it is important to task and train personnel to take part in data restoration from archived data, naming the specific personnel in the policy is not an optimum or useful practice, so option C is incorrect.

Although management is responsible for publishing and promulgating policy and governance, the name of the specific manager is not the essential element (but their office or position is). Regulators don’t personally approve internal policies of the organizations they oversee, so option D is incorrect.

Options A and C are not correct because specific names don’t belong at the policy level of governance; the specific names (or identification credentials) of allowed third-party recipients should be included at the process/procedure level of governance, and a list of offices or departments whose data will be archived can be included in the policy.

Option D is not correct because the particular ISP should not have any bearing on the archiving policy.

All the other options represent entities that the organization may want to contact in the event of a security incident or breach and so should be included in security procedure documentation.

Option A is a description of confidentiality.

Option B is an element of the Atomicity, Consistency, Isolation, Durability (ACID) test to enhance the utility and security of a database.

Option C is a technique to reduce the likelihood of nonrepudiation but not the definition of the term.

All the other items are part of the critical path and need redundancies.

All the other options are incorrect, as defined by NIST SP 500-292.

A VPN is used for creating an encrypted communications tunnel over an untrusted medium, so option A is incorrect.

ACLs are used as centralized repositories for identification, authentication, and authorization purposes, so option C is incorrect.

RBAC is an access control model used to assign permissions based on job functions within an organization, so option D is incorrect.

Options A and C are incorrect because neither of those options lists any of the SDN infrastructure, be that the controllers or the applications. Option D may be arguably correct, as there might be an NBI handling that traffic between those nodes, but option B is more specific and always true for this definition, so it is the better choice.

All the other options are aspects of SDNs.

KMB is a nonsense term used as a distractor, so it is incorrect.

TGT is a term associated with Kerberos single sign-on systems and is incorrect.

The TCB includes the elements of hardware and software (usually in the operating system) that ensure that a system can only be controlled by those with the proper permissions (i.e., admins with root control), so it is also incorrect.

Option A is incorrect because routers would be considered a part of the networking of a data center (and because option C is a better answer).

Option B involves applications and how traffic flows between them and storage controllers; it has nothing to do with the compute nodes and is therefore wrong.

Option D might obliquely be considered correct because it’s technically true (compute nodes will include both virtual and hardware machines), but option C is a much better and more accurate choice.

Options B and D are also resource apportioning methods, but they do not fall under the definition described in the question.

Option C is incorrect because it has no meaning in this context.

Options A and B are also resource apportioning methods, but they do not fall under the definition described in the question.

Option C is because it has no meaning in this context.

Options A and D are also resource apportioning methods, but they do not fall under the definition described in the question.

Option C is incorrect because it has no meaning in this context.

Option B describes another type of hypervisor; the other options are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

Option A describes another type of hypervisor; the other options are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

A Type 1 hypervisor boots directly from the hardware; it’s much easier to secure a machine’s Basic Input/Output System (BIOS) than an entire OS, so option B is better than option A.

Options C and D are incorrect because there is no such thing as a Type 3 or Type 4 hypervisor.

Options A and C are simply untrue.

Option B is untrue when crypto-shredding is utilized.

Option D is simply untrue. VMs are not easier to operate than actual devices.

Option A is incorrect; the allocation of resources is not performed manually.

The router directs traffic between networks; it does not apportion resources. Therefore, option B is incorrect.

A VM makes resource calls; option C is incorrect.

All the other options are terms used to describe cloud storage areas without file structures.

All the other options are incorrect and option C is not a type of storage.

Regulators do not operate a customer’s management plane, so option A is incorrect.

Option B is ambiguous. However, a consumer of data is unlikely to have been given the elevated privileges necessary of operate the management plane in a cloud environment. Option B is incorrect.

Option D is also an ambiguous answer. Only the most trusted administrators and managers have access to the cloud data center’s management plane. A privacy data subject is neither a most trusted administrator nor a trusted manager. Therefore, option D is incorrect.

Options A and B are also important ways to avoid vendor lock-in, but D is the best answer.

Option C is incorrect and will not aid in avoiding vendor lock-in.

Cloud providers, cloud customers, and ISPs are not particularly concerned about whether an organization’s migration is satisfactory from a compliance perspective. The words, “compliance perspective” should automatically bring to mind regulator(s). Options A, B, and D are therefore incorrect answers.

The other options do not aid in addressing vendor lock-out.

Both the cloud customer and the regulator(s) may have specific control mandates that might require the customer to deploy additional security controls (at the customer side, within the data, as agents on the user devices, or on the provider side or in application programming interfaces [APIs] as allowed by the service model or contract), so options B and C are also partially true, but A is a better answer as it is more general.

Option D untrue because the end user does not determine which controls are selected for the cloud data center and how they are deployed. That is the responsibility of the cloud provider.

Options A and C are other risks of operating in the cloud. Option D can lead to A or B, but B describes the more specific situation and therefore the correct answer.

Options B and C are other risks of operating in the cloud. Option D can lead to A or B, but A is the more specific situation and therefore the correct answer.

All the other options do not cause virtualization sprawl.

Options A and D mean the same thing and could be considered as contributing to sprawl because the technological capabilities of virtualization create the ease of use that can cause sprawl. However, option C is a better answer.

Option B is incorrect; sprawl occurs within the organization.

The other options exist in both the traditional environment and the cloud but are probably actually reduced in the cloud because cloud providers can use economies of scale to invest in means to reduce those risks in ways that individual organizations would not be able to.

Options A and C are security aspects of some environments, and option A is likely to be a necessary trait of managed cloud services, but they are not fundamentals—they are specifics.

Option D is specifically an administrative control; the question is looking for a fundamental aspect of security. Option B is more general (it applies to all types of security, in all industries and uses) and therefore is the correct choice for this question.

All the other options are benefits of automated configuration but are not specifically security enhancements.

Options A and C are not identity federation protocols.

Option D is a federation specification, but it also uses SAML tokens.

Single sign-on (SSO) is similar to federation, but it is limited to a single organization; federation is basically SSO across multiple organizations. Option A is incorrect.

Options B and D are threats listed in the Open Web Application Security Project (OWASP) Top Ten; they are incorrect.

Proxy is another model for federation, so option B is incorrect.

Single sign-on is similar to federation, but it is limited to a single organization; option C is incorrect.

Option D does not have relevance in this context and therefore incorrect as an answer.

Cross-certification is another model for federation, so option A is incorrect.

Single sign-on is similar to federation, but it is limited to a single organization; option C is incorrect.

Option D does not have relevance in this context and is therefore incorrect as an answer.

A trusted third party, regulators, and clientele are not involved in the web of trust model, so the other options are incorrect.

A trusted third party, regulators, and clientele are not involved in the web of trust model, so the other options are incorrect.

GLBA covers financial and insurance service providers, so option A is incorrect.

FMLA dictates how employers give vacation time to employees, so option B is not correct.

PCI DSS is a contractual, not regulatory, standard, so option C is incorrect.

Options A and B are part of the overall identity and access management (IAM) process, as is option C, but they do not specifically describe granting access to resources.

Federation is a means of conducting IAM across organizations; option C is more specific, so D is incorrect.

Identification of personnel is usually verified during the hiring process, when HR checks identification documents (such as a passport or birth certificate) to confirm the applicant’s identity, often as part of a tax registration process.

Options A and B include offices that may play a role in the identification process, but it is usually HR that does the actual verification.

Option D, “Sales” is untrue. If a Sales department exists in an organization, it does not perform the verification part of the provisioning element of the identification process.

The other options are all untrue. Data in the cloud and controls in the cloud can most certainly be audited. So, options A and B are incorrect. D is untrue; there are regulators for all industries, including those that operate in the cloud.

Option A is incorrect because cryptography is sometimes present in traditional environments and audits still take place.

Option B is incorrect; auditors’ opinions are not relevant.

Option C is untrue; equipment does not resist auditing—it is inanimate and unfeeling.

Option B is untrue. The difficulty of standards is not a hindrance to audit.

Option C is untrue. Paperwork does not hinder audits.

Option D is not only untrue, but also hilarious. If you have ever been involved in an audit, you know that there are plenty of auditors to go around.

Option A is incorrect because qualified personnel are still required whether a cloud environment has limited access to their data center or not. In fact, security may be degraded by having unqualified personnel rather than qualified personnel working in the cloud data center.

Option C is incorrect because reducing jurisdictional exposure does not enhance security.

There may be a correlation between ensuring statutory compliance and enhancing security as it applies to limiting access to the cloud data center. However, option B is a better answer because it is certainly true. Therefore, option D is not the best answer to the question.

A physical tracking mechanism won’t be of much aid for virtual devices because they aren’t physically stolen like hardware boxes, so option A is incorrect.

Having an ACL in the image baseline would create a situation where every user from every cloud customer could access every VM in the data center; option C is incorrect.

Write protection is used in forensic analysis of machines (virtual or otherwise); it would not be useful in an operational baseline. Option D is incorrect.

Each organization will have its own training and awareness program, and there is no one-size-fits-all solution that is appropriate; this does not belong in the baseline. Option B is incorrect.

Having a baseline that cannot be copied is pointless; option C is incorrect.

Keystroke loggers will create a huge volume of detailed, stored data that will pose more of a security risk (and may actually be a violation of customer privacy regulations) than any benefit it offers; option D is incorrect.

Not all systems need or can utilize biometrics; option A is incorrect.

Usually, tampering refers to physical intrusion of a device; since the question is about VMs, it is probably not applicable. Option B is incorrect.

Hackback is illegal in many jurisdictions; option D is incorrect.

The VM’s image has very little to do with physical security or training; options A and C are incorrect.

Baseline images are the opposite of customization; option D is incorrect.

A VM image audit is unlikely to involve any form of physical security; A is incorrect.

Baselines won’t predictively show malicious activity; B is incorrect.

Baselines also do not have anything to do with user training and awareness; option D is incorrect.

Custom VMs may or may not work in a new environment; this is actually a risk when porting data out of the production environment; option A is incorrect.

Performance probably will not increase if data is replicated to another cloud provider; in fact, you will probably lose some load balancing capability you might have had if you kept the data and backups together. Option C is incorrect.

Having two providers will always be more costly than a single provider; option D is incorrect.

Ease of compliance will not be determined by the location of the backup, so option A is incorrect.

Traveling should not be a major cost for cloud usage; option B is incorrect.

The location of the backups won’t have any effect on user training; option C is incorrect.

Cloud BC/DR capability does not remove the necessity of security personnel and appropriate policies; both options A and B are incorrect.

Option C makes no sense as an answer to the question. It is unclear how you can cut costs by eliminating your old access credentials. In fact, it is difficult to imagine how that is a true statement. Therefore, option C is a poor choice and option D is the best choice.

Option A is incorrect because the loss of any, single, cloud administrator is unlikely to gravely affect your organization’s RTO.

The loss of a specific VM will probably not gravely affect your organization’s RTO. VMs can be reinstantiated with ease. Option B is incorrect.

The loss of your policy and contract documentation cannot gravely affect your organization’s RTO. Option C is untrue.

All the other options are assets that should be protected, but nothing is as important as option C, so they are incorrect answers for this question.

Recovery time objective (RTO) is a measure of how long an organization can endure an outage without irreparable harm. This may be affected by the replication strategy, but not as much as the RPO. Option A is incorrect.

The maximum allowable downtime (MAD) is how long an organization can suffer an outage before ceasing to be an organization. This is not dependent on the RPO, and the data replication strategy won’t have much effect on it at all. Option C is incorrect.

The mean time to failure (MTTF) is a measure of how long an asset is expected to last (usually hardware), as determined by the manufacturer/vendor. The data replication strategy will have no bearing on this whatsoever. Option D is incorrect.

The backup/archive does not aid in any of the areas in the other options. So, options A, B, and C are incorrect.

Risks of physical intrusion are neither obviated nor enhanced by choosing to use two cloud providers; option A is incorrect.

Using a different cloud provider for backup/archiving actually reduces the risks of outages due to vendor lock-in/lock-out and natural disasters, so options C and D are not correct.

All the other options may constitute some input that will influence the BC/DR, but they are not the prevailing factors, so are incorrect.

The risk analyses options and the risk appetite option may provide input for the BIA, but they are not what is used to determine the critical assets necessary to protect in the BC/DR activity. So, options A, B, and D are incorrect.

All the other questions are important, but not as crucial as option D, so they are incorrect.

It is exceedingly unlikely that “any user” in a managed cloud services arrangement can invoke a BC/DR action. Option D is therefore a poor choice for the answer to the question.

Audits are good, but they will not demonstrate actual performance the way a test will, so options A and B are incorrect.

It is important that the BC/DR capacity and performance be included in the contract, but that will not truly ensure that the functionality exists; a test is required, so option D is incorrect.

All the other options should be included in the BC/DR plan/policy.

The BC/DR plan/process should be written and documented in such a way that someone with the requisite skills can use it. It is unlikely that typical users or regulators have the requisite skills to perform many of the BC/DR activities. Therefore options A and C are poor choices for answers to the question.

It is tempting to choose option B, however, option D is a better answer because it ensures that someone with the requisite skills will be able to read the BC/DR plan and perform the activities they document. Having to rely on essential BC/DR team members being present and available to follow the plan is risky. So option B is incorrect.

The BC/DR plan/process should take into account both the absence of essential personnel and telecommunications capabilities, so options A and D are incorrect.

Option B does present a serious problem for the organization, but C is still a greater risk, so B is incorrect.

During a contingency, some of the requirements your organization faces may relax somewhat; for instance, if a life-threatening natural disaster occurs, regulators will likely understand if some of the normal compliance activities/controls are not fully incorporated while personnel and assets are moved to safety (depending on the nature of the industry, of course). Options A and B are therefore incorrect; option C poses a greater risk.

Option D is a distractor; not all organizations need encrypted communications during contingencies.

Cloud providers, wherever they are located, should compensate for environmental and physical security factors, so this should have no impact on your potential risk; options B and C are incorrect.

Option D is incorrect because it is blanket statement that is not always true. In fact, for some organizations, the physical location where their data is stored can have serious regulatory consequences.

All the other options are assurance efforts that ENISA’s cloud risk assessment is meant to enhance, so they are incorrect answers for this question.

All the other characteristics are included in the (ISC)² (and NIST) definitions.

Profit is not the hallmark of every opportunity (or every organization—many organizations are nonprofit or government-based), so option A is incorrect.

Likewise, not all risky activities offer a chance to enhance performance, so option B is incorrect.

Cost is not a benefit, so that doesn’t even make sense in the context of the question; option C is not correct and a distractor.

Option A is ridiculous; data should be secured whether it is in an on-premise environment or in the cloud.

Option B does not create a true equivalence; disclosing data under controlled conditions is not the same as public disclosure.

Option C is not equivalent to the costs/benefits of the other forms of collaboration; it would be too cumbersome for the organization to truly benefit from collaboration in a modern business environment.

Option A is ridiculous; risks can and should be mitigated, even in the cloud.

Option B is not correct; cloud migration will require some risk acceptance, but that is true for everything except avoided risk.

Option D is incorrect; cloud providers can choose not to offer services or not to accept certain clients.

All the other answers are threats that exist in both environments and are therefore incorrect.

Regulators and end users do not provide security to the enterprise, so options A and B are incorrect.

The vendors used for on-premise security will no longer affect the data, so option C is incorrect.

All the other options portray risks faced by both cloud and on-premise environments.

In a public cloud, this is more likely and would be more significant, so option A is incorrect.

The service model doesn’t specifically dictate the likelihood of occurrence or impact (both PaaS and IaaS could be in a private or public cloud, which is the more important factor), so both options C and D are incorrect.

All the other options include risks that exist in the traditional, on-premise environment, as well as the cloud, so they are incorrect.

Options B and D are security controls used to protect all sorts of assets, including intellectual property, but they are not as specifically addressing the creation of new intellectual property in the cloud the way explicit contract clauses would, so option C is still the better answer.

Likewise, it may be possible for the viewer to leverage knowledge of this usage as part of a social engineering attack, but that would be subsequent to the inference itself; option B is still better than C.

Lack of resource isolation does not affect physical intrusions, which is just a distractor here.

However, all the other factors listed in the other answers do, and that means that a malicious user in the cloud would be more likely (statistically) to guess/predict the random number used to create/seed an encryption key made in that same cloud environment. Cloud customers should take this into account when designing/planning their cloud configuration.

All the other options are not affected by lack of standards.

While geographical dispersion of cloud assets might make securing those assets more difficult in the notional sense (customer administrators can’t physically visit the devices that host their data), remoteness does not necessarily inhibit good security practices, which can be performed at a remove. This is not as detrimental as rules against port scanning/pen testing, so option B is incorrect.

There are no rules against user training or laws against securing your own assets, in the cloud or otherwise; options C and D are incorrect.

All the other options are access control security models; cloud administrators will not (or should not) be assigning access rights, so all these options are wrong.

All the other options are mission-critical elements of the cloud data center and must have redundancy capabilities.

For health and human safety, multiple egress points from each facility is preferred (and often required by law); option A is incorrect.

Emergency lighting should receive power regardless of their proximity to the power source, and parking vehicles near generators is a bad idea from a safety perspective; option C is incorrect.

Not all facilities need to withstand earthquakes; this may be true of data centers in California, but not in Sydney, so it is not an industry-wide best practice. Option D is incorrect.

All the other options are facility elements that require redundancy.

Recovering in the primary facility would probably be cheaper than having a different test facility, so option A is incorrect.

A proper test is worth the financial expenditure, so option B is incorrect.

Option D is incorrect because any BCDR plan would account for sufficient personnel workspace.

Though option A is an act of benevolence on the part of the organization towards the community, option B is still a better answer for the question.

Option C is an act of benevolence on the part of the organization towards the employee, option B is still a better answer for the question.

Option D is incorrect because it makes assumptions that cannot be counted upon. Regulatory oversight should not be avoided, and should always be assumed.

All the other answers are incorrect because those individuals/organizations do not accept responsibility for securing cloud-based applications.

Strong contract language in favor of the customer is always desirable for the customer, so option B is incorrect.

Training for specific conditions is always advisable, so option C is incorrect.

There is nothing wrong with having encryption take place before data is sent to the cloud, so option D is incorrect.

The other answers are not relevant in this context.

Punishing a user and notifying law enforcement does not prevent data from being disclosed; options A and C are incorrect.

Tracking devices may assist recovery efforts, but it won’t protect against data disclosures during the period the device is not under the organization’s control; option D is incorrect.

All logins should utilize strong passwords, whether they are critical or not, so option A is incorrect.

Some form of physical perimeter security is useful, but not necessarily chain-link fences, and not only for critical assets (perimeter security will protect all assets on the campus), so option B is incorrect.

Homomorphic encryption is a theoretical technology; option C is incorrect.

Options B and D are management issues, not security issues; option A is preferable to both of them.

Option C is incorrect; users don’t care if their devices are catalogued and annotated. Option C is a poor choice for an answer to the question.

None of the other options are relevant to the issue of data portability.

None of the other options are relevant to the issue of application portability.

It is good to know that services will operate in the alternate environment and that first response contact info is current, but neither determines the speed with which services and data will be available during contingency operations; options A and B are incorrect.

Regulators will usually not dictate MAD/RTO for a given organization; option D is incorrect.

Options A and B are just marketing materials and should not, by themselves, be all that convincing for making a migration decision.

Option C is a good factor to consider, but it is only a very small piece of what migration entails; D is still a much better option.

All the other options are items the provider will want to know before the customer launches the test.

All the other options are legitimate activities a customer might perform during a penetration test (with provider permission).

None of the other answers make sense with respect to the question.

Everyone uses remote access for cloud activity, so option A is incorrect.

Cloud customers will not be able to deploy malware as part of a test because that is a crime, so option C is wrong.

Regulators are not involved in penetration tests, so option D is incorrect.

All the other options are incorrect because they do not cite the technology that creates most of the cost saving in the cloud environment. Only virtualization provides this cost savings.

The risks and regulatory requirements for an organization do not go away when the organization moves into the cloud, so there is no cost savings associated with these elements. Therefore, all of the other options are incorrect.

Moving into the cloud reduces neither risk nor data; options A and D are incorrect.

Arguably, the cloud customer may realize some cost savings through cloud migration because the customer will not be solely responsible for acquiring, deploying, and managing security controls. However, security controls still exist—they are, instead, the responsibility of the cloud provider, and the price of applying them is enclosed in the cost of the cloud service. Moreover, this savings is not nearly as significant as the savings realized through reduction in personnel, so option C is still preferable.

Option A actually represents a risk in the physical environment that is reduced by the use of virtual machines and is incorrect.

VMs are not any more or less susceptible to malware or EMP, so options C and D are incorrect.

Option A is incorrect because the CPU in a traditional environment performs calculations, while the operating system manages resources and performs process scheduling.

The security team in a traditional environment has a narrow and focused role, not like the operating system that manages the entire system and its resources.

Pretty Good Privacy is an application that performs a specific, limited role. Option D is incorrect.

All the other options are older technologies that employ magnetic media in one form or another, while SSD employs electronic circuitry to store data.

Options A and B are different names for the same type of storage arrangement and incorrect.

Option D has no meaning in this context.

Of the choices, option C best represents this definition.

The router manages traffic flow, which might be considered as resolving contention issues for resource requests outside the local device (for example, from a given device to the storage cluster) but wouldn’t handle resource requests inside a given device (such as a VM on the device making a request to the device CPU), so option D is a better answer.

An emulator virtualizes programs, not machines, and is not responsible for orchestrating resource calls, so option B is incorrect.

Regulators do not manage resources, so option C is incorrect.

All user access to the VMs will be done remotely; option A is simply incorrect.

Security controls on OSs that are not scanned or subject to version control may be out of date or not optimized, but they will still function (just not as well), so option D is still preferable to B and C.

Size and shape are not defining criteria of SSDs or tapes; options B and C are irrelevant (and also somewhat wrong).

The physical nature of the drive does not affect its vulnerability to malware; option D is incorrect.

SSDs are not typically more difficult to install or administer than traditional technology, nor are they more likely to fail than other storage devices, so all the other options are incorrect.

All the other options are untrue and are therefore inappropriate answers.

Cloud providers will not perform risk assessments on behalf of their customers.

Regulatory bodies and legislative entities do not perform risk assessments.

Senior management can assist the organization to avoid vendor lock-in by tasking the correct resources (offices/personnel) to perform vendor selection activities, but option A is not as accurate as C.

Security personnel will have the technical skills and knowledge to properly determine the organization’s IT needs and can inform general counsel as to what services/resources will best meet the organization’s needs, but these entities are not as adept and trained at crafting contract language as the attorneys. Options B and D are not preferable to C.

None of the other options address vendor lock-out and are therefore unsuitable as answers.

While DDoS and phishing may include an element of user gullibility and ignorance, at least one party (the attacker) is not engaged in inadvertent activity—their behavior is very purposeful. Options A and B are incorrect.

While inadvertent action can often result in incidents, disasters are usually at a much greater scale and aren’t as likely to be the result of unknowing action; option D is incorrect.

DDoS and physically attacking the utility lines, options A and D, only affect availability, which is a significant negative impact but not as bad as option B, which can affect integrity and confidentiality as well.

Guest escape is a breach limited to a specific device and the virtual machines on that device; this is not as much impact as breaching the management plane, which gives full access to the entire environment.

All the other options are incorrect.

None of the other options address vendor lock-out and are therefore unsuitable as answers.

All the other options are distractors as they are included in option C.

All the other options are risks that have similar likelihoods and impacts in the cloud and traditional environments and are therefore incorrect.

Option A is a generalization that may or may not be true depending on several variables. Some security controls are inexpensive to implement.

Senior management approval may be required before security controls can be implemented, however, some may not need prior approval. It depends on the organization and how it is managed. Option C is incorrect.

Option D is another generalization that may or may not be true. Whether a security control will work in the cloud environment as well as they worked in the traditional environment depends on the control and how it is implemented. Option B is a better choice.

All the other options are risks faced by organizations in both the cloud and traditional environments and are therefore incorrect.

DDoS does not affect value, confidentiality, or liability; all the other options are incorrect.

Typically, cloud customers do not pay extra for additional consumption of floor space or power usage for the number of virtual machines; these costs are rolled into the per-instance price, so options A and B are incorrect.

Option D is incorrect; users don’t require more training if they have more virtual assets.

All the other answers represent elements that should avoid variables as much as possible and are incorrect.

HTML is a language used to tag text files so that they can be displayed with different fonts, colors, graphics and hyperlinks. HTML is not used in SOAP. Option A is incorrect.

Option B is incorrect because X.509 is a standard and the question is about a programming language.

Option D is incorrect because HTTP is protocol and the question is about a programming language.

These interactions obviously involve servers and clients, so options C and D are not correct.

Using REST does not eliminate the need for credentials, so option A is not correct.

All the other options are incorrect because the REST APIs do not use HTML, XML or ASCII as protocol verbs.

All the other options are incorrect because they do not answer the question about the architecture of the World Wide Web.

X.509 certificates are used for passing session encryption information, not data requests, so option B is incorrect.

Servers usually return data requests in some sort of display format, not plain text or ASCII, so option C is incorrect.

HTML responses would simply be an entire web page, not specific data, so option D is incorrect.

Each of the other options includes at least one element that programmers don’t need to know (specifically, the native language, Internet service provider [ISP], country code) and is therefore incorrect.

Option A doesn’t reduce any risk for a specific application; it trades the risk of one application not operating correctly with the risk of another application not working correctly. This answer is wrong.

All applications should be reasonably patched and updated, whether it is in the traditional environment or the cloud. Option C is incorrect.

An emulator won’t reduce the risk of degraded performance; it will probably result in degraded performance. Option D is incorrect.

All the other functions are expected in the majority of cloud operations.

Neither regulators nor programmers are responsible for the security of the applications in the production environment. That is the responsibility of the cloud customer.

It may appear as though the cloud provider should be responsible for application security, however, as the cloud customer acquires more responsibility for their cloud environment, the cloud provider assumes less responsibility. Option B is incorrect.

In this context, quality would be synonymous with performance and requirements, so D is a better answer than A or C.

Brevity is not a trait we look for in testing, even though it may be desirable in programming, so B is incorrect.

Options B and C are other phases of the SDLC, but not all SDLC models incorporate user input in these phases, so the options are not correct.

Option D is not a phase of the SDLC and is incorrect.

All the other options are also SDLC phases, however, crypto-shredding is much more likely to be used in the disposal phase.

All the other options are SDLC phases where requirements are not mapped to software construction.

All the others are usually nonfunctional requirements. Exceptions to this are when the characteristic listed is the actual desired function. For instance, if the product is a tool that enunciates text so that a blind user can hear the words, then sound would be the functional requirement. If the product is a security tool such as a firewall or data loss prevention (DLP) solution, then security would be a functional requirement. Otherwise, these are nonfunctional requirements for standard products.

Even traditional apps require IAM and field validation functions, so options A and D are incorrect.

Most anti-DDoS activity will be performed by hardware and communication software run by the cloud provider or Internet service provider (ISP); developers should not typically need to include anti-DDoS elements in their programs. Option B is incorrect.

Inference framing is a nonsense term, used here only as a distractor.

Software should include known secure components, and testing should include known bad data (fuzz testing), whether it is going to be used in the cloud or in a traditional environment, so options C and D are incorrect.

All the other options are things that can (and should) be done with software whether the application is being used in traditional or cloud environments, so those options are incorrect.

All the other options are security controls that will degrade performance because they require additional overhead; these options are incorrect.

Inversion is a nonsense term in this context and just a distractor.

Options B and C are threat modeling elements but are not correct answers for this question.

All the other options are elements of STRIDE (escalation of privilege, repudiation, and spoofing, respectively) and are therefore not correct.

All the other options are untrue and therefore cannot be the correct answer. For test-taking purposes, be very suspicious of words like, “constantly” and “can’t ever” in answer choices.

Option A is an unfair generalization.

Option C is another broad generalization that may or may not be true. Option B is a better answer.

Option D does not relate to the question about the SDLC and is therefore a poor choice for an answer.

The question is which is the “most” secure form of code testing and review. That would be the most extensive. Since the correct answer is a combination of open source and proprietary, the least secure would be least extensive. Option A is strictly open source so that is incorrect. Option C is neither open source nor proprietary, which is even less extensive. Option C is incorrect. Proprietary/internal is also less extensive than Option D. So Option B is incorrect.

This decision, however, should be informed by pertinent externalities, which include regulatory mandates (option A), user requirements and management requests (option C), and, to some degree, the trade-off of performance and security (option D, and both characteristics should also be dictated by senior management as an aspect of acceptable risk). While these externalities and options all play a part in determining appropriate access, they are all subordinate to business needs and acceptable risk, which are paramount; B is still the best answer to this question.

The cloud provider is not typically the data owner; option A is incorrect.

Ostensibly, senior management is the data owner (the organization, as a whole, is the legal owner of the data, and the senior managers are the legal representatives of the organization). However, in practice, this responsibility can be (and usually is) delegated down to a manageable level, where the data owner for a given data set understands it best and can provide a sufficiently granular control of that data set. This is rarely senior management and is more likely department heads, branch managers, or some other form of middle management. Option C is preferable to B.

System administrators will usually be the literal granters of access, insofar as admins will modify access control systems that allow or disallow access for specific individuals or roles. However, the sysadmin does not make the decision of who is granted access and instead responds to direction from data owners (middle management); again, option C is preferable to D.

WS-Federation is a federation protocol that is part of the WS-Security family of standards and reliant on Simple Object Access Protocol (SOAP), so option A is incorrect.

Option C is incorrect; SOC 2 is a type of Statement on Standards for Attestation Engagements (SSAE) 18 audit report, not a federation standard.

OWASP is a volunteer group of and for web app developers, not a federation standard or protocol, so option D is incorrect.

All the other options are typical authentication mechanisms and so are incorrect.

A password and PIN are both something you know, so option B is incorrect.

Using a voice sample and fingerprint are two forms of something you are, so option C is incorrect.

A birth certificate and credit card are both something you have, so option D is incorrect.

Requiring multifactor authentication for every transaction is an undue burden on both the users and the systems and is a needless addition of extra overhead, so option A is incorrect.

All cloud access will entail remote login; this is a common operation, so adding multifactor authentication is an unnecessary burden in most cases. Option C is incorrect.

The decision to use multifactor authentication should be based on the risk of the operation and the sensitivity of the data, not on whether it takes place in the traditional or online environment, so option D is incorrect.

All the other options are incorrect.

Option A is technically correct; a WAF can be given a ruleset that recognizes certain forms of attack traffic. However, this answer is too general, and D is a much better response for this question.

Options B and C are protocols not usually inspected by WAFs and are therefore incorrect.

WAFs do not protect against social engineering or physical attacks in any way, so options A and B are incorrect.

Option C is a nonsense term and is therefore incorrect.

All the other options are incorrect.

DAMs do not protect against cross-site scripting, insecure direct-object reference, or social engineering attacks in any way, so options B, C, and D are incorrect.

The WAF and DAM are also security tools that inspect traffic but do not usually handle SFTP content, so options A and B are incorrect.

Option D, single sign-on, concerns authentication functions, not communications traffic, and is only a distractor in this context.

XML gateways, WAFs, and DAMs are also tools used frequently in cloud-based enterprises, but they do not handle microservice requests in a meaningful way.

All the other options are methods firewalls can use to recognize attacks.

In this context, privacy and security mean much the same thing; privacy is synonymous with confidentiality, which is a subset of the overall topic of security. Therefore, option A is repetitive and not correct.

TLS does not optimize performance or add any sort of enhancement, so options B and D are incorrect.

Options B and C are names for another type of encryption. Asymmetric encryption is also used in establishing a secure TLS connection; however, the keys used in this portion of the process will not change from session to session, and therefore these options are incorrect.

Option D is a nonsense term and is therefore incorrect.

Option A is subtly misleading; the VPN secures the connection between two endpoints, not the ends of the connection. This option is incorrect.

Option C is not correct; VPN is not used for encrypting databases—it is used for encrypting communications.

Option D is incorrect; the symmetric key used in VPN is shared only between two parties (the endpoints), and the elements of the asymmetric key pair are either held by only one party (the owner of each private key) or by anyone at all (public key).

The developers should not be involved in any form of testing the software as they have an inherent conflict of interest, so options A and B are incorrect.

Dynamic testing does not involve social engineering; option D is incorrect.

All the other answers are incorrect.

Options A, B, and D are not correct because the sandbox should be completely disconnected (air-gapped) from the production environment so that users can’t perform productive activity there.

All the other options aren’t uses for sandboxes and are incorrect.

Because the virtualization engine encapsulates the application from the native runtime environment, patches can’t be applied through virtualized programs; option B is incorrect.

Virtualization really doesn’t have anything to do with access control; option C is incorrect.

The overhead of running a software virtualization engine will actually add to system overhead, not decrease it, so option D is incorrect.

Virtualization really doesn’t have anything to do with access control; option A is incorrect.

Virtualization neither detects nor responds to DDoS; option B is incorrect.

Virtualization does not replace encryption; if data needs to be secure within the virtualization environment, encryption may still have to be utilized. Option C is incorrect.

All the other options are distractors and incorrect.

Technically, the controls for each application within an organization compliant with ISO 27034 will be listed in the Organizational Normative Framework (ONF), because the ONF is the list of all controls for all applications; however, for a given application, only the controls used for that application are listed in an ANF, so option B is a preferable answer to A.

TTF (time to failure) has no meaning in this context, so option C is incorrect.

FTP (File Transfer Protocol) is a protocol for transferring files and not applicable here; option D is incorrect.

Black-box testing does not include access to source code, which is required for SAST. Option B is therefore incorrect.

Option C is a combination of black-box and white-box testing so option C is an incorrect answer for this question.

Option D has no meaning in this context.

While determining “software outcomes” may be considered a possible goal of SAST, “source code” is a much better answer as it is more specific and applicable to the question. Option D is still preferable.

SAST does not check user performance or system durability; options B and C are incorrect.

White-box testing requires the tester to have access to source code, which is not provided in DAST. Option A is therefore incorrect.

Option C is a combination of black-box and white-box testing so option C is an incorrect answer for this question.

Option D has no meaning in this context.

Software testing should not take place in the production environment; option A is incorrect.

DAST, like other forms of testing, may or may not take place in the cloud and is not confined to any particular service model (although it is unlikely to occur in software as a service [SaaS] environments); options C and D are incorrect.

Vulnerability scans do not typically require administrative access to function; option A is incorrect.

Both malware libraries and forensic analysis of existing vulnerabilities may be used to create the signatures that vulnerability scanning tools utilize to detect and report vulnerabilities; however, these answers are too specific (limiting the answer), making option B a better answer than either C or D.

Penetration tests may or may not be comprehensive, depending on the intended scope and area of analysis. Option B is incorrect.

While it’s nice to think of any security assessment as total, that is an extreme term, like all or never; such terms can rarely be used in security because there are no absolutes when dealing with risk, and it has no meaning in this context. Option C is not correct.

Although the cost of a penetration test will vary according to a vast range of variables, it will rarely be considered inexpensive, especially relative to other forms of security testing. Option D is not correct.

Source code review is not part of dynamic testing; option A is incorrect.

For accurate quality testing, user familiarity with the target software should be minimal and should not be assessed; option B is not correct.

Penetration includes active steps to overcome security measures; this is rarely the purpose of software testing; option C is not the best answer.

The number of testers involved means very little when discussing testing coverage; this is a distractor and not correct.

In some cases, testing reports might include a statistic representing the number of flaws discovered in the code; however, this is usually not a pertinent metric (undetected flaws can’t be measured, so counting the ones that have doesn’t add to your surety the code is secure), and code coverage is used more often. Option C is preferable to option B.

Testing should first occur in an environment where the software has not even been exposed to the possibility of malware infection. Option D is incorrect.

User coverage is a distractor and has no real meaning in this context; option A is incorrect.

Code coverage is the metric used in static testing, making option B incorrect.

While it would be nice to test each and every data pathway through an application, with both known good and known bad data, that could be unrealistic, depending on the number of possible branches in the application; this goes up exponentially every time another option/choice is added to the program. Total coverage is not a metric—it’s a hope. Option D is incorrect.

Testing does not attempt to mimic managers, regulators, or vendors, so the other answers are incorrect.

Option A is the other answer that could be perceived as accurate, but there is a bit of nuance that makes it less preferable than B. Security is a business requirement—it may not be a functional requirement, but it is a requirement nonetheless. Therefore, these two terms are repetitive; security requirements are just a subset of business requirements. Option B is still the better answer.

Options C and D do not make sense in this context.

Option A incorrect because not all personnel require task-centric training. Training required for all personnel in an organization cannot be task-centric training, by definition (not all personnel perform the same tasks).

Options C and D are incorrect because they would only answer a subset of the question. Management personnel would receive management training and HR personnel would receive HR training. The correct answer is task-centric training is for specific personnel.

Specific personnel, management personnel, and HR personnel would all receive task-centric training in addition to the awareness instruction that all personnel receive. Options B, C, and D are incorrect.

Options A and B are actually the same concept, reworded, which is patently untrue: depending on the cloud deployment and service models the organization chooses to use, software developers may or may not be crucial (for instance, in a software as a service [SaaS] public cloud, many organizations won’t even need internal development teams).

Option C is just wrong: security controls can be added to software after it has been fielded. This is just not a best practice, as it is usually less effective and more expensive (in terms of both money and overhead).

The hacking threat (foreign or otherwise) does not change whether the target is the cloud or the (connected) traditional environment; option A is incorrect.

Likewise, the threat of DDoS attacks does not increase; if anything, it may decrease, because the cloud provider may be more resistant to such attacks than individual organizations would be. Option C is not correct.

Regulatory requirements may or may not change when moving into the cloud. Moreover, developers are not likely to be the ones interpreting and responding to these new mandates; that is a level of abstraction above developer insight into software requirements. Option D is not preferable to B.

Management oversight should not change from a policy perspective, regardless of where the processing is taking place; option A is incorrect.

There is no additional workload resulting from cloud migration; in fact, the load should decrease, because the cloud customer cannot impose governance on the cloud provider. Option B is wrong.

Malware threat does not increase or decrease in the cloud environment; option C is incorrect.

Anonymization strips out identifying information from a record. This would not aid in limiting customer service personnel from viewing sensitive data, but it would make it impossible for customer service personnel to know who they were communicating with and leave them unable to identify customers, which would defeat the purpose of their existence. Option A is incorrect.

Encryption of sales/account records would not limit customer service personnel in their review of account records. It would either disallow them to see the records at all or allow them to see the entirety of the records (depending on whether the representatives were given keys to that encrypted data). Option C is incorrect.

Training does not limit access; option D is incorrect.

All the other phases are not normally appropriate for external participation.

Excessive use of controls should not lead to more data breaches; if anything, it may reduce their occurrence. However, it is more likely that there will be no effect. Option A is incorrect.

Many controls don’t affect the electromagnetic spectrum in any way. Option B is incorrect.

Regulations don’t usually mandate a maximum set of controls but rather a minimum. Option D is incorrect.

Overuse of controls should not result in greater risks of DDoS, malware, or environmental threats in any way. Options A, B, and C are incorrect.

Some security controls (particularly physical controls) can affect health and human safety, such as if extraneous fencing/walls/barriers are put in place to control access/egress, and this hinders emergency escape from facilities. However, not all security controls pose this risk, so option B is a bit too specific; option A is still preferable.

Security controls should not affect stock price or, in and of themselves, negate insurance needs (risk mitigation does not automatically offset the benefits of risk transference). Options C and D are incorrect.

However, personnel actions and draconian enforcement efforts at this point would be pointless and vindictive, and probably counter to the company’s interests. Options A, B, and C are incorrect.

It is impossible to encrypt devices that don’t belong to the organization. Option A is incorrect.

Securing access to user-owned devices is admirable, but it has no effect at all on securing the device (or production environment) from risks due to installed APIs; option C is incorrect.

This is a security question, and option D addresses performance; this is incorrect.

Additional personnel security measures will not, in this case, yield any relevant security benefit; options B and D are not correct.

It is always good to refer to regulations in policies; this isn’t something to be performed in response to the policy change but should have been included when the policy was created. Option C is incorrect.

All the other answers are incorrect; securing the connection between endpoints and the cloud is irrelevant in protecting against risks caused by software installed on the client devices.

SSL has been deprecated because of severe vulnerabilities; this eliminates options A and C. Whole drive encryption protects against loss or theft of a device but does not secure API access to the data, which eliminates option D.

Options A and B are really only feasible if the organization is using a cloud service (or other managed service); the terms managed and provider suggest this. This makes these options less desirable for a question that also includes the traditional environment.

It is not reasonable to expect that the organization can impose administrative controls in a cloud environment (for the provider environment), so option D is not correct.

The data subject may grant permission for a data owner to have the subject’s data but will not govern the granular assignment of access rights. Option A is incorrect.

The data processor does not have the right to grant data access and must only act at the direction of the data owner. Option C is incorrect.

Regulators dictate how data must be secured, and possibly in what manner, but do not supervise explicit access to that data. Option D is incorrect.

All the other answers are simply not correct.

The goal of federation is to enhance the user experience, the exact opposite of making the environment more hostile to them.Option A is incorrect.

Option B is incorrect because it is meaningless in this context.

Option D is incorrect. Users typically do not pay for the organization’s IT environment.

Tokenization is not encryption; there is no encryption engine and no key involved in the process. Option A is incorrect.

Tokenization does not necessarily enhance or detract from the user experience; option C is incorrect.

Management is not allowed any additional oversight into any particular function by tokenization; option D is incorrect.

The data owner is the merchants themselves, and the data subject is the person to whom the privacy data applies, so privacy data cannot be outsourced to either of these, and options B and C are incorrect.

The PCI Council is the body that promulgates and enforces the PCI DSS; they will not process data on behalf of any merchant. Option D is incorrect.

Option A masks only one letter in a four-letter string; this is not sufficient because the original string could be identified with a very low-work factor, brute-force attack of only 26 possible combinations.

Option B is likewise easy to break; it only reverses the content of the string, which is very simple to determine, and would allow easy recovery of any other similar strings in the data set.

Option D mixes numeric characters into what was originally only an alphabetic string; this may detract from the utility of the string if the masked version is to be used for software testing.

Option C completely obscures the original content but retains the qualities of the original (all alphabetic characters). It may affect the use of the string by mixing uppercase and lowercase, but this is still the best choice of the four possible answers.

All the other options are good uses of cloud-based sandboxes.

Adding functionality at each stage of the SDLC is the definition of scope creep, which is what we’d like to avoid. Option A is incorrect.

Management should not have to shepherd software through the development process; this is the process of the development team. Option B is incorrect.

Option D is a distractor and makes no actual sense.

Adding functionality at each stage of the SDLC is the definition of scope creep, which is what we’d like to avoid. Option A is incorrect.

Management should not have to shepherd software through the development process; this is the process of the development team. Option B is incorrect.

Option D makes no sense: you can’t repurpose something that has just been developed.

Options C and D are incorrect because the inclusion of security aspects in software design should not affect interoperability in any significant way.

800-37 is the Risk Management Framework, which is about the organization’s overall security, not software development, so option A is incorrect.

The AICPA is a standards-making body, not a standard itself, so option B is incorrect.

HIPAA deals with health care privacy, so option D is incorrect.

Not every organization is a software development company. Even in software development companies, not everyone participates in development (there are other departments/offices, such as sales, accounting, etc.). Option A is a poor choice.

Option B is only a correct answer if the organization is a software development company. Otherwise, it is not a correct answer. Option B is incorrect.

If software development poses the most significant risk to your organization, you probably shouldn’t be doing software development. Option C is incorrect.

Dynamic testing does not involve source code review or social engineering; options B and C are incorrect.

Penetration tests occur in the production environment, not on pre-deployment software; option D is incorrect.

All the other options are incorrect.

Options A and B are not true because most cloud providers of any appreciable size are purchasing hardware on a scale that makes the per-unit failure rate fairly irrelevant; the bulk nature of IT purchases by cloud providers makes differences in MTTR and MTBF between vendors and products statistically insignificant.

Option C is incorrect because RTO is a quality involving business continuity and disaster recovery (BC/DR) planning, not IT architecture.

SDN does not really involve monitoring outbound traffic (that is done by egress monitoring solutions) or inbound traffic (that is usually performed by firewalls and routers), nor does it really prevent DDoS attacks (nothing can prevent such attacks, and risk reduction is usually done by routers), so all the other options are incorrect.

The other options are all about enhancing the customer’s ability to perform business function or meeting the customer’s business needs. Although this is paramount from the customer’s perspective and may tangentially fulfill some security purpose (increased processing capacity may, for instance, allow the use of additional encryption, where the overhead may otherwise deter the use of that tool), these are not direct security purposes and therefore are not correct answers to this specific question.

All the other options either involve a nonphysical risk (DRM will be necessary, because the entertainment industry relies heavily on copyrighted material) or a method other than physical design to address a risk (floods are physical threats, but insurance is an administrative control for risk transfer), so D is the best choice of these options.

Tiers 3 and 4 would be much more expensive, and they are not necessary for your business purposes; options B and C are thus incorrect.

There is no Tier 8 in the Uptime Institute system.

DDoS and mirroring are availability protections, and availability is not your company’s main concern for cloud services from the question description; long-term storage is not focused on availability. Options A and B are thus incorrect.

Hashing is an integrity protection, and though hashes may be useful in this case (to determine whether stored data is accurate), they won’t be as important as compliance with credit card standards. Option C is the preferable answer compared to D.

Fully automated security controls are useful from the provider’s perspective (allowing more profitability and scalability), but this is not a major concern of the customer. Option A is incorrect.

Global remote access and reducing the risk of malware infections (to include ransomware) are basic functions of almost all cloud providers; these functions aren’t useful discriminators when choosing cloud providers because all cloud providers have them. Options C and D are thus incorrect.

All the other elements are necessary for safe and secure data center operations, for both the personnel and the equipment within the data center.

Option B is not optimum because of the potential for vendor lock-in, restrictions on buildout, and privacy concerns.

Option C is not optimum because Tier 2 is not sufficient for medical uses.

Option D is not optimum because there was obviously a reason to consider a new option.

We are therefore left with option A, which is the most expensive of the choices but allows the greatest amount of control and security.

The size of the plot may or may not matter, depending on if you are allowed to build up or dig down to make use of additional space—these options will be limited by municipal building codes, so option D is preferable to option A.

Utilities and personnel are usually easy to acquire in an urban setting, so options B and C are incorrect.

Natural disasters affect all locations, rural or urban, so a rural setting is not any more or less limiting in planning accordingly; option A is incorrect.

Oddly enough, because of the very limited need for personnel within modern data centers with significant automation, recruiting and placing the number of people necessary to serve the purpose should not be too difficult; option B is not correct.

One of the appeals of a rural setting is that building codes are often rudimentary or nonexistent. Option D is incorrect.

Moisture in the air can, however, create mold/mildew, short circuits, and rust, so all the other options are incorrect.

Options A and C are incorrect because that air is already cold; using these locations as set points will not consume as much energy and may result in somewhat warmer air entering the servers. This will be less expensive than option B.

Option D is an outlying distractor; if you set your heating, ventilation, and air conditioning (HVAC) controls to respond to the temperature outside the data center, your HVAC units are responding to temperatures that have nothing to do with the internal environment. In effect, you’d be trying to adjust the temperature of the outside world, which is ridiculous.

All the other options are incorrect because they will have the opposite effect by pushing warm air into those areas that cools air is supposed to be.

All the other options are incorrect because we want to minimize obstructions in underfloor plenums we use for airflow. Options A, B, and C do not accomplish this.

Because HVAC operates as a heat exchange, the outside environment will dictate how much power is needed to force warm air out of the data center. The warmer the climate in the location of the data center, the more energy it will take to exchange the heat, and the more costly the HVAC operation. This is the most significant factor.

Option A is incorrect and it is the only choice that does not affect energy costs; hot and cold aisle containment should be equivalent in terms of operational costs.

The initial cost of the HVAC units themselves will probably have an effect on operational costs because better equipment will cost more money, but it will also be more efficient and therefore less expensive to operate than cheaper alternatives. However, the effect still won’t be as significant as the external climate, so option C is still not as good as option B.

Good cable management will make airflow more efficient and therefore make HVAC less expensive, but this will not be as dramatic in impact on operating costs as the external environment. Once again, option B is preferable to option D.

Municipalities typically limit selection of power providers by granting an artificial monopoly to a single provider; option A is incorrect.

Rural settings are often only served by a single provider because the demand is not sufficient to support competition; option B is incorrect.

Coasts do not affect the availability of multiple power providers; option C is a distractor.

The other options are all aspects of software hardening.

All the other options are aspects of host hardening.

All the other options are elements of secure configuration management.

The other options are characteristics that don’t cause additional risk to the environment; in fact, redundancy reduces risk.

iSCSI traffic should be encrypted as another layer of defense within the environment; option B is wrong.

HIDSs may or may not be cost-effective, depending on the value and sensitivity of the data on each guest; the additional overhead may not justify their use. Option C is incorrect.

Firewalls should be hardened regardless of the nature of the network whether virtual or physical.

All the other options are incorrect because they imply that virtual and physical cannot coexist when in fact they need to coexist to work correctly.

All the other options are not risks specific to a virtualized environment and are therefore incorrect.

All the other options are not risks due to pooled resources; they exist in all environments. These options are not correct.

While the cloud provider may generate a great deal of revenue, no company likes to throw away money unnecessarily; option A is incorrect.

Cloud providers are not typically invested in KVM vendors. Option B is incorrect.

Option D is simply incorrect.

Option B is incorrect because devices will not leave the cloud data center simply because they are not managed by secure KVMs.

Option C is incorrect because using secure KVMs will not have an effect on physical inventories.

Option D does contain enough information to be the correct answer. “Audit purposes” is ambiguous.

Options B and C have more to do with risks of electromagnetic emanations than with air-gapped selectivity; even air-gapped devices can leak data through emanations.

Option D is incorrect because portability is not a property we seek in device selectors.

All the other options are functions that should take place on isolated networks/segments.

All the other options are characteristics of a VLAN.

Communications traffic from a VLAN may or may not be encrypted; option B is incorrect.

Repeaters are used to enhance signals along a line over a certain distance; they have nothing to do with VLANs. Option C is incorrect.

Option D makes no sense in this context.

SAML is used for federation authentication/identification; option A is incorrect.

802.11 is the suite of wireless standards; option C is incorrect.

Diffie-Hellman uses asymmetric key pairs to create a symmetric key; option D is incorrect.

Options C and D are incorrect and untrue.

All the other options are goals of the site survey.

All the other options are capabilities allowed by redundancy.

Options A and B are incorrect because they do not make senses given the question is about a system that displaces oxygen in the facility.

Option A assumes that there isn’t already enough of whatever the infusion of capital will purchase. Option A is incorrect.

Thankfully, option B is incorrect. It would be costly to obtain an alternate data center each time the virtual machine management tools are updated.

Peer review is not required when updating virtual machine management tools. Option D is incorrect.

The other options are incorrect because they do not restrict access to the virtualization management tool set as specifically as role-based access control does. If someone’s role changes and they no longer require access, then their access should be terminated.

Standards and laws don’t usually specify builds for products or brands, so options A and B are incorrect.

Expert opinion, while useful, is not sufficient to demonstrate due care in many cases; option D is not the best response.

Personnel training is important for secure system use, but it is not an element of baselining. Option A is incorrect.

A secure baseline for a given system may include HIDS and/or encryption, but they are not essential elements, so options C and D are incorrect.

Option B is incorrect because planned modifications are not yet part of the actual baseline.

Option C may be a good answer in some situations; however, it is not essential, and option A is still a better answer.

Option D is incorrect because every environment (and, therefore, the baseline used in that environment) should be exclusively tailored for the organization using that environment.

Requiring normalized processing for patching may delay patching and expose the organization to undue risk; option A is thus incorrect.

Patching still needs to involve testing and confirmation to avoid interoperability and additional security problems, making option B incorrect.

Third parties can identify security problems as well as vendors; external patches need to be considered as well as vendor patches. Option C is thus incorrect.

All the other options are attributes provided by host clustering.

All the other options are methods for allocating shared resources.

The physical backplane can be a limiting factor in a tightly coupled architecture but has less effect in a loosely coupled cluster; option A is incorrect.

Because each node in a loosely coupled cluster has its own limitations, the number of nodes will not affect overall performance. Option B is incorrect.

Option C is incorrect because “usage demanded” is not a factor in performance and capacity of a loosely coupled storage cluster.

All the other options are necessary measures for maintenance mode.

All the other options are characteristics of stand-alone hosting.

All the other options are methods cloud providers use to achieve “high availability” environments.

Unique attacks would not be detected by signature matching because no signatures exist for unique attacks; option A is incorrect.

Content filtering is less a means of detection and more a means of controlling traffic that users/systems are exposed to; while it may be useful for mitigating the possibility of malware infection, it’s less suited to the purpose posed in the question. Option C is incorrect.

Firewalls don’t work with biometrics; option D is a distractor.

All the other options are locations/ways to implement firewalls.

All the other options are purposes of a honeypot.

The honeypot should not contain anything of value; all the other options are incorrect.

All the other options are aspects that should be used in cloud access.

All the other options are actual methods for breaking encryption but are not the best answer for this question.

All the other options are functions offered by patching.

All the other options are activities that should take place with patching.

Users don’t usually apply patches and aren’t involved in automatic patching; option A is incorrect.

It is rare that an automated patch tool will be exploited to install malware; option C is incorrect.

Automated patching is faster and more efficient than manual patching; option D is incorrect.

Patches can be applied remotely or locally; option B is not true or correct.

Patching may be the responsibility of the cloud customer or provider, depending on the service model, type, and contract. Option C is incorrect.

Cloud service providers should apply patches ubiquitously throughout their service environment; option D is incorrect.

Option B is untrue. Patches do work with SaaS models. Option B is incorrect.

Option C is untrue. Patches do work with private cloud builds. Option C is incorrect.

On the contrary, vendors do issue patches to cloud providers. Option D is incorrect.

Manual patching is slower than automated patching. Option A is incorrect.

Option B is incorrect; this is true in both traditional and cloud environments.

Option D is incorrect; users should not be performing patching.

With human involvement in patching, there is an opportunity to be aware of imminent patch impacts and to determine applicability of the patch before it is applied; options A and B are incorrect.

Option C is a risk involved with all patching and not limited to manual patching; option D is preferable as it is specific to the question.

All the other options are untrue.

The cloud provider will not suspend your access or sue your organization if you delay patching because of concerns about interoperability afterwards. Options A and B are incorrect.

Option D is incorrect. The opposite may actually be true. Your end clients may appreciate that you delay or test the patch before installing it on production systems.

None of the other entities listed in the other options can assess penalties, so they are incorrect. (End clients may try to recover damages realized from an attack through a known vulnerability, but those penalties will be imposed by a court if the end clients conduct successful litigation.)

Option A is incorrect. Users should not be performing patching.

Option B is incorrect; a contract specifying who is responsible for specific patching activities actually reduces risk by enhancing the probability of proper patch application.

Option D is incorrect; attacker activity should be irrelevant to the patch process.

Synthetic monitoring approximates user activity but is not as exact as RUM; option A is incorrect.

SIEM monitors more than web applications, so option C is not ideal for this question.

DAM is an OSI Layer 7 tool for monitoring database activity, specifically, so it is not the ideal answer for this question.

Option A is incorrect. False positives are typical for real-user monitoring systems.

Option B has no relevance in this context. Option B is incorrect.

Sandboxed environments are not a concern when using real-user monitoring for web application activity analysis. Option D is incorrect.

All the other options are incorrect; synthetic agents may cost more than RUM, are less accurate than actual user activity, and both can take place on the cloud.

Logging everything would result in log storage that exceeds the amount of data in the production environment and would actually make it more difficult to locate pertinent information. Option A is incorrect.

Option C is incorrect. Logging data after the fact is impossible.

Option A sounds great, but the better answer is option D. A person with knowledge of the operation is a better fit than someone who is trained to review logs.

Options B and C are incorrect. Auditors are not the ones who should be reviewing logs for an organization.

All the other options are incorrect because they are simply IT terms. When it comes to useful logs, having the correct time relevant to all logged activity is vital.

All the other options are functions that the SIEM system can perform on its own as automated tasks.

We don’t want to have less protection on the logs than on the systems they monitor; the controls on those systems were chosen according to what threats and risks they may be exposed to—the level of security provided by those controls are, at a minimum, required for the log data. Option A is incorrect.

Encryption may or may not be used for securing log data, depending on the level of sensitivity of the systems/data they are protecting; option C is too specific and thus incorrect.

NIST guidelines are not suitable for all organizations and uses; option D is too broad and incorrect.

All the other options are elements typically considered in the risk context.

A quantitative risk assessment requires a significant budget of time and money as well as well-trained, experience personnel familiar with risk; option A is not correct.

Options C and D are incorrect; these are not types of risk assessments.

The other options are factors that may bear on how you determine the dollar value of the asset but are not as useful as option B.

Threat intelligence information is useful but not as good as historical data in predicting ARO; option A is not as good as option B.

Vulnerability scans and aggregation do not really aid in predicting rate of occurrence at all; options C and D are incorrect.

Options B and D are incorrect. The ARO is a number, not a dollar amount.

It is unlikely that the plant would burn down 12 times a year or every month. Option A is incorrect.

All the other options are incorrect; we can’t make a suitable choice from the available information.

All the other options are factors we need to know: The amount of revenue and the pace at which it is generated by the plant and the duration of downtime for the plant in the event of fire (so as to calculate possible lost revenue) will help us arrive at the annualized loss expectancy (ALE). In fact, additional information would also be useful, such as potential loss of market share if product was not delivered for the duration of the downtime, etc.

First, we need to determine the single loss expectancy (SLE) and annualized rate of occurrence (ARO). ARO can be assumed to be 1; absent any other information about the plant, we don’t expect more than one fire per year (and perhaps less, but we don’t have that information, either). The SLE is $36 million ($24 million for the cost of rebuilding the plant, assuming no increase in costs over the previous construction, plus $2 million per month of lost revenue, for the six months it will take to rebuild).

Therefore, the ALE is $36 million (36 [SLE] × 1 [ARO]).

Either the fire suppression system or the insurance policy would be appealing, from a strictly financial standpoint, if we only compared the ALE to the annualized cost of the countermeasure ($15 million for the suppression system, $12 million for the insurance policy).

However, other factors have a bearing on this consideration too. For instance, fire poses a threat to health and human safety; obviating such risks should be a paramount concern to senior management. An insurance policy doesn’t truly protect people, it only offsets the damages people experience through loss. Also, the insurance policy would be a recurring, continual cost; it costs less than the fire suppression system in the first year of the plant’s operation ($12 million for insurance versus $15 million for the system), but once the system is purchased, though it may need upkeep and maintenance, we can assume it won’t cost the same amount in future years, and it probably won’t cost anywhere near as much as the continual costs of the insurance.

All the other options are not as good as B.

Risk mitigation does not always involve risk transfer, or risk avoidance. “Risk attenuation” is not an industry-standard term associated with risk management Options B, C, and D are incorrect.

All the other options are not causes of secondary risk (except if we draw out unreasonable conclusions from the most extreme, ridiculous cases, for example, “the secondary risk is the risk that the control doesn’t work”).

All the other options are true statements about risk mitigation.

All other options are incorrect because certification comes first in the certification/accreditation model of system approval.

All the other options are true regarding the RMF.

Two key pairs are not used in symmetric encryption; option A is incorrect.

Parties most often must be known to each other using symmetric encryption; option B is incorrect.

Certificates require public-private key pairs, which is not an element of symmetric encryption; option C is incorrect.

DH is usually used for asymmetric encryption, to establish a temporary symmetric key; option A is incorrect.

Option C describes asymmetric encryption and is therefore incorrect.

Option D describes hashing and is therefore incorrect.

ISO 27001 is an international audit standard.

The Sarbanes-Oxley Act (SOX) is a U.S. law pertaining to publicly traded corporations.

There is no such thing as the IEC 43770 standard.

All the other options are incorrect because they are simply legal terms that do not correctly answer the question.

• Their own country has nationwide laws that comply with the EU laws.
• The entity creates contractual language that complies with the EU laws and has that language approved by each EU country from which the entity wishes to gather citizen data.
• The entity voluntarily subscribes to its own nation’s Privacy Shield program.

There is no process for the entity to appeal to the EU for permission to do so, however.

FISMA is the federal law requiring agencies to comply with National Institute of Standards and Technology (NIST) guidance; option A is broader than B, so B is better in this case.

Options C and D are not American laws and therefore not applicable.

Level 1 is a self-assessment; option A is incorrect.

Level 3 requires continual monitoring by a third party; option C is incorrect.

There is no Level 4 of the STAR program.

Due diligence is the processes and activities used to ensure that due care is maintained; option B is incorrect.

Liability is the measure of responsibility an entity has for providing due care; option C is incorrect.

Option D has no meaning in this context.

Both directives and regulations can be enforced by either member states or EU international tribunals; option A is not correct.

Both directives and regulations are statutory; option B is not correct.

Both directives and regulations deal with both internal EU matters and those that extend outside Europe; option C is not correct.

Option A is incorrect. There is no requirement for hardcopy.

Option B is incorrect because the provider is a government agency.

Option D is incorrect. The scenario in the question is illegal whether or not the visitor is asked about their nationality.

All the other options are incorrect.

This does not constitute a data breach because no data has been disclosed to unauthorized entities; option A is incorrect.

This is not an intrusion because no external entity has gained access to the environment; option C is incorrect.

While shadow IT may be considered a particular kind of insider threat, we usually consider insider threats as malicious, and shadow IT is typically the result of benign intentions. Option B is better than option D.

The SAS 70 and SSAE 18 are audit standards for service providers and include some review of security controls but not a cohesive program (and the SAS 70 is outdated); options A and B are not correct.

The SOC reports are how SSAE 18 audits are conducted; option C is incorrect.

The SOC 1 is for financial reporting; the SOC 2, Type 2 is to review the implementation (not design) of controls; and the SOC 3 is just an attestation that an audit was performed. All these options are incorrect.

SOC reports are specific kinds of audits; option A is incorrect.

The scoping statement is a pre-audit function that aids both the organization and the auditor to determine what, specifically, will be audited. Option C is incorrect.

Federal guidelines are government recommendations on how something should be done. Option D is incorrect.

The SAS 70 and SSAE 18 are audit standards for service providers and include some review of security controls but not a cohesive program (and the SAS 70 is outdated); options A and B are not correct.

NIST SP 800-53 allows the organization to craft a set of controls to meet the requirements created for and by the organization when using NIST SP 800-37; option D is incorrect.

All the other options are incorrect as they are all facets of audit scoping.

All the other options are incorrect as they are all facets of audit scoping.

NIST (which also administers FedRAMP) is designed specifically for federal agencies in the United States and is not applicable for European providers, so options A and B are incorrect.

ISO 27034 deals with an organization’s use of security controls for software; while this may be pertinent to your organization, it is not a comprehensive view of cloud services and is not as beneficial or equivalent to the CSA STAR or Uptime Institute certifications. Option D is preferable to option C.

Options A and B are incorrect because this poses a conflict of interest.

Option D is incorrect. Audits often reveal sensitive information that does not need to be shared with an external audit body that was not part of the original audit.

All the other options are incorrect because they are intended goals for IT security audits.

Option A is incorrect because NIST SP 800-37 describes the Risk Management Framework and is not an international privacy standard.

The Personal Information Protection and Electronic Documents Act is a Canadian law relating to data privacy. Option B is incorrect.

Option C is incorrect because the PCI DSS is specifically for merchants who accept credit cards, not cloud providers (while cloud providers may process credit cards, and therefore must follow PCI DSS, option D is preferable, and a better answer).

All the other entities have published such guidance, and those options are therefore incorrect.

Applicable law is the regulation/legislation affecting a certain circumstance. Option A is incorrect.

Judgments are legal conclusions or decisions. Option B is incorrect.

Option C is incorrect because criminal law is the body of law that pertains to crime.

All the other options are incorrect because they do not hold to the preponderance of the evidence requirement.

Options A, B, and C are incorrect because they are 25%, 75% and 0% of the full weight of the breach.

The doctrine of plain view allows law enforcement to act on probable cause when evidence of a crime is within their presence; option A is incorrect.

The GDPR is a European Union (EU) privacy law and not applicable here; option C is incorrect.

FISMA is the American law requiring federal agencies to adhere to National Institute of Standards and Technology (NIST) standards; option D is incorrect.

Belgian law will be superseded at that point, and the GDPR has primacy over Belgian law. Option A is incorrect.

Options C and D are an American standard and law, respectively, and are not applicable to companies in the European Union (EU), so they are therefore incorrect.

It’s important to note that the GDPR covers all entities that are located and/or operate in the EU, regardless of other details such as where the business entity stores the data or where the customers are located.

An audit scoping letter outlines the parameters for an audit engagement; option B is incorrect.

Options C and D do not have meaning in this context.

Destroying evidence is not fraud; fraud can be a crime or tort on its own, but option B is incorrect.

Jurisdiction describes the geographical area over which a court has power; option C is incorrect.

Recompositing is a made-up word and has no meaning in this context. Option D is incorrect.

Regulators do not take part in e-discovery; option B is incorrect.

In this situation, your company is the cloud customer and will not have a great deal of access to event logs, which may be a crucial element of e-discovery; options C and D are incorrect.

The other options are aspects of cloud computing but do not have anything to do with the risk of unauthorized disclosure due to seizure by law enforcement.

All the other aspects of software development may continue as long as no destructive measures or methods are utilized; all the other options are incorrect.

The other options are simply incorrect.

All the other options describe important facets of an overall organizational security program but are not especially helpful in e-discovery efforts.

All the other options are either incorrect because they are too limited (A and B) or just absurd (D).

Scripting testimony is usually frowned on by the court; coaching witnesses how to perform and what to expect in court is all right, but it does not lead to credibility. Option A is incorrect.

Your expert witnesses are not allowed to withhold any evidence from their testimony if it is pertinent to the case, even if that evidence aids the other side. Option B is incorrect.

You should pay your employees for their time, regardless of whether they’re performing on the job site or in a courtroom, but this has nothing to do with enhancing credibility. Option D is incorrect.

It is important for forensic investigators to have proper training, background checks, and approved tools in every jurisdiction, so all the other options are incorrect as they are not specific enough.

Evidence is only inadmissible if it has no probative value—that is, if it has no bearing on the case. Modified data is still admissible, as long as the modification process was documented and presented along with the evidence. Option A is incorrect.

Option C is ambiguous as to its meaning and is therefore an incorrect choice for an answer.

Option D is true if the data modification process is not documented and presented in detail.

Options A and B are not sufficient compared to C.

Option D is a distractor in this case; battery is not a form of racketeering, unless linked to a larger pattern of crimes.

It is unlikely that the company would be prosecuted for causing the crime because the company did not engage in the wrongful behavior; in this case, there was a very specific attacker and victim. Option A is incorrect.

The victim does not get prosecuted for crimes committed against them. Option C is incorrect.

If you had ordered the attack, or somehow caused it to occur, you might be prosecuted, but this is not detailed in the question and is an unlikely circumstance; option D is incorrect.

Due care is the duty owed by one entity to another, in terms of a reasonable expectation; option A is incorrect.

Liability is the measure of responsibility an entity has for providing due care; option C is incorrect.

Answer D has no meaning in this context; option D is incorrect.

Hypervisors do not particularly aid in evidence collection, although they may provide log data; option C is still preferable to option A.

Pooled resources actually complicate evidence collection; option B is quite wrong.

Live migration does not aid in evidence collection; option D is incorrect.

While highly trained forensic personnel will be very useful in forensic activities, that is not usually an operational benefit. Option A is incorrect.

The more secure the data archive, the less useful it is for operational purposes; option C is not as good as option B.

Option D is wrong because homomorphic encryption is still theoretical and currently serves no actual purpose.

Backups and constant uptime may aid in availability efforts for operational purposes, but they don’t really help in configuration management; options A and B are incorrect.

Multifactor authentication provides neither configuration management nor forensic benefits; option C is wrong.

Hardware RAM is probably as volatile as virtual RAM, but the virtualization aspect of option A may make it a more suitable answer for this particular question.

Log data and drive storage should both be durable and not volatile at all, so options C and D are incorrect.

None, some, or all of the other options might be true, however, the liability of possibly disclosing someone else’s privacy data is an overwhelming business risk; therefore, option C is the best answer.

Your professional opinion is vital, but your personal opinion should not have bearing on the case; option A is incorrect.

Option B is only incorrect because it limits the presentation to your side of the case, where C is broader and more accurate.

Unless instructed by counsel, bringing up similar past activity is not germane to the current case; option D is incorrect.

All the other options are simply incorrect for integrity check purposes.

The other options are not necessary for accessing an electronic storage file for forensic purposes. Options A, B, and C are incorrect.

All the other options are traits of forensic testing we do want our tests to include.

All the other options are PII elements under both jurisdictions.

All the other options are all U.S. law and therefore incorrect.

Storing data in the cloud is not illegal in most jurisdictions (as long as certain rules are followed, for specific industries and data sets); option A is incorrect.

Storing often happens at or soon after the time of collection, but they are not the same function; option B is incorrect.

Opt-in is the concept under which a data subject must give clear consent to personally identifiable information (PII) data collection and use; option C is incorrect.

The State Department is involved with controlling some exports, under the International Traffic in Arms Regulations (ITAR) regulations; option A is incorrect.

There is no Privacy Protection Office; option B is meaningless term and is incorrect.

HHS is in charge of managing the Health Information Portability and Accountability Act (HIPAA); option D is incorrect.

The CSA STAR and EuroCloud Star programs are certifications based on applicable control sets and compliance with standards and regulations, not process maturity; options A and D are incorrect.

The RMF is National Institute of Standards and Technology (NIST) guidance on how to assess risk in an environment; option B is incorrect.

All the other options are incorrect.

The provider is the entity that should be seeking CSA STAR certification, not the customer; option C is incorrect.

Be wary of any provider that asks for security deposits and/or acts of fealty; options A and D are incorrect.

All the other options are forms of legislation or regulators that do have some content that addresses privacy; however, option A is the most specific and preferable answer because the privacy principles of the AICPA, OECD, and EU are so very similar.

All the other options are just wrong.

All the other options are incorrect.

All PCI DSS–compliant merchants must meet all the control and audit requirements of the standard; options A and C are incorrect.

PCI DSS does not dictate costs of controls; option D is wrong.

All the other options are incorrect because they are not related to FIPS 140-2.

All the other options are incorrect because they are not relevant in terms of the question.

Option A is incorrect because it is possible to trust more than two organizations.

Option B is not true. There is no law/rule that limits the government to sharing data to five or less parties.

Option D is incorrect. Sharing data does not automatically affect the value of the data.

The other options are incorrect, because they use finite, specific durations; there is no single value that is optimum for all organizations.

If you were creating security products, security would be a functional requirement; games are not security products. A game with security flaws is still a game and fulfills the purpose. Option A is therefore incorrect (although hotly debated among IT security personnel—remember, the game can exist without a security department, but the security department couldn’t exist without games).

Thus far, regulations have not imposed particular security conditions on delivered products by statute. This does not obviate all liability from shipping defective products, of course; the need for due care and due diligence remains. However, this is a much lower threshold than direct statutory guidance, which exists in fields other than software development (to date). Option C is incorrect.

Outsourcing may or may not be used when performing software security reviews; there is not enough information in the question to determine which method your company uses, so option D is too specific for the vague data provided.

Because this is being done in runtime, it is neither code review nor static testing; options A and C are incorrect.

Using a small pool of specified individuals is not truly open source, which would involve releasing the game to the public. Option D is incorrect.

Having managers in attendance would present a form of unnecessary micromanagement; option A is wrong.

There is no need for a database administrator (DBA) to be involved in the test; option B is wrong.

The security team should use the data gathered from the test, but they don’t need to be present for the testing; option D is incorrect.

The other parties don’t need to participate in the testing process but are not as undesirable as the developers; all the other options are incorrect.

Managerial oversight is not at all necessary at this level of development and would actually be a form of micromanagement; option A is incorrect.

Health benefits are in no way appropriate for temporary, unpaid testers; option C is only a distractor.

Programmers should be prevented from participating in testing as they have inherent bias and may unduly influence the results; option D is wrong.

This is one of the very few questions where “health and human safety” is not the correct answer to a security issue; there just isn’t much danger involved in either producing or consuming video games (aside from dated, anecdotal reports of seizures resulting from flashing images, which lacked scientific substantiation). Though this will be something you must consider (such as workplace violence issues), it will not be a daily activity. Option A is incorrect.

Security flaws in your products will most likely not be critical or of grave impact; people who hack your game after shipping may be able to include additional functionality or violate some elements of copy protection, but this is not as threatening as pre-release exposure of the material. Option B is incorrect.

Current laws do not dictate much in the way of either content or functionality for software (other than very specific industries, such as health care or financial services); option D is incorrect.

All the other options are incorrect.

Source code review, just like it sounds, is a review of the actual program code; option A is incorrect.

Deep testing is a made-up term; option B is incorrect.

White-box testing is a term used to describe a form of code review; option D is incorrect.

All the other options represent solutions that not only probably lack efficacy but are also often illegal.

Only crimes involve arrest, detention, and prosecution; most copyright cases such as this would not be tried as a crime, and the government would not be involved (other than in the form of the judge/court). Options A and D are incorrect.

Public hearings are not used to gain restitution for harmful acts; option B is incorrect.

Although infrastructure as a service (IaaS) is not a terrible option and would give your team additional control of the entire test, it would also require the team to duplicate many different platforms and OSs, requiring a much greater level of effort and additional expertise at what would likely be a much greater cost. Option B is preferable to option A.

A software as a service (SaaS) model will not allow your team to install and run the game; option C is incorrect.

TaaS is a made-up term with no meaning in this context, making option D incorrect.

The other options represent activity that is obviously beneficial but secondary to the importance of masking production data. Think of it this way: even if there is a vulnerability, breach, or malware in the test environment, if raw data is included something of value is lost; if dummy or masked data is the only content included, nothing of value is lost.

In platform as a service (PaaS) and software as a service (SaaS), this will be performed by the provider; options B and C are incorrect.

QaaS is an invented term and not meaningful; option D is wrong.

These contract terms can be described as favorable only from the provider’s perspective; option D is preferable to option A for describing this situation.

There was no description of negotiation included in the question; option B is incorrect.

IaaS is a service model and doesn’t really apply to anything in this context; option C is incorrect.

Photoelectric detectors use a light source instead. Option A is incorrect.

Options C and D are incorrect because they are meaningless in this context.

Most modern systems don’t suffer performance degradation at the lower ends of the temperature spectrum; it’s the higher temperatures that are of concern for that aspect of the data center. Option B is preferable to option A.

Similarly, high temperature invokes a greater risk of fire, not low temperature, and this environmental aspect is perhaps the factor least impacting risk of fire anyway. Option C is incorrect.

Any regulatory issues stemming from a workplace that is too cold correlates directly with risks to health and human safety, so option B is still preferable to option D.

All the other options are storage protocols that will involve storage controllers.

Federal law rarely dictates application of vendor guidance, or any other specific security method for individual platforms; option A is incorrect.

Aggressors will almost always be on the offensive and adapt attack methodology faster than our industry creates defenses; even vendor guidance is usually reactive. Option C is incorrect.

Customers rarely have any idea of (or reason to know) configuration settings; option D is incorrect.

The toolset may be available via remote access but is not in any way to be considered public-facing; option A is incorrect.

Resource pooling contradicts direct connections to any particular storage mechanism; option C is incorrect.

Usually, virtualization management will be a responsibility of the provider because it is a crucial element for all customers; option D is incorrect.

Options B and D have no meaning in this context and are therefore incorrect.

All the other options are actual baselining functions.

All the other options are actual baselining functions.

All the other options are actual baselining functions.

With infrastructure as a service (IaaS), your company will still retain a great deal of the administrative responsibility, so PaaS is a better option; option B is preferable to A.

Option D has no applicability in this context and is incorrect.

All the other options are not terms with any particular meaning in this context.

All the other options are facets of cloud computing but are not as pertinent to the question.

All the other options are cloud deployment models but do not suit this particular case.

The other options simply are not as preferable as option A for this question.

The other options are not as preferable as C for this question.

The other options are not as preferable as B for this question.

DDoS is an availability threat, not something to do with confidentiality, so isolation does not serve much purpose in reducing it. Option A is incorrect.

Unencrypted message traffic is not the prevailing, general reason for the need for isolation; it might be one specific, particular aspect of a confidentiality concern, but option C is preferable to B.

Insider threat is not countered by isolation in the same way that isolation protects against threats due to multitenancy; option C is preferable to D.

The other options simply are not as preferable as A for this question.

Interoperability describes how systems work together (or don’t); because the question did not mention the use of your own company’s systems, interoperability does not seem to be a major concern in this case. Option B is incorrect.

Resiliency is how well an environment can withstand duress. While this is of obvious importance to all organizations in the cloud, it is usually seen as a defense against availability concerns, while the question has more to do with portability; option A is still preferable to option C.

Nothing in the question suggests a need for the company to retain some form of governance; option D is incorrect.

Cloud customers do, however, make continual operational expenditures for IT resources, in the form of their payments to cloud providers. Option B is incorrect.

Modern business is driven by data as much as any other input, regardless of sector or industry; this does not change whether the organization operates in the cloud or in the traditional IT environment. Option C is incorrect.

The cloud does not obviate the need to satisfy customers. Option D is incorrect.

An argument could be made that there is an administrative component to these controls as well: the firewall rules, the DLP data discovery strategy, etc.—these are expressed in the form of a list or set of criteria, which might be viewed as an administrative control. However, the system itself (which is what the question asked) is still a technical control. Option A is preferable to option B.

Because these devices/systems do not deter physical intrusion, but rather logical intrusion, they are not considered physical controls. Option C is incorrect.

“Competing” is not a control type; option D is incorrect.

All the other options are simply incorrect.

All the other options are simply incorrect.

Hypertext Markup Language (HTML) is used for displaying web pages; it is not inherently secure. Option B is incorrect.

DEED is an invented term with no meaning in this context. Option C is incorrect.

Domain Name System (DNS) is for resolving IP addresses to URLs; it has no inherent security benefits. Option D is incorrect.

Obfuscation and masking don’t really serve the purpose because they obscure data, making it unreadable; storing payment information that is unreadable does not aid in the efficiency of future transactions. Moreover, neither technique meets PCI requirements. Options A and B are incorrect.

Hashing does not serve the purpose because it is a one-way conversion of data; there is no way to retrieve payment information for future transactions once it has been hashed. Option D is incorrect.

All the other mechanisms can be (and are) used by DLP solutions to sort data.

The origin of the products probably does not matter in any significant way; options A and B are incorrect.

Hastily migrating out of the current cloud environment (whether to another cloud provider or back on-premises) is reactionary and could prove expensive. Option D is incorrect.

Neither the cloud provider, nor the ISP, nor federal regulators determine the risk appetite of your organization. Options A, B, and C are incorrect.

Portability is always a concern for cloud customers, as it is an indication of how likely the customer is to be subject to the risk of vendor lock-in. However, because you are using your own proprietary software and not that of another company, this is not a major issue in this case. Option A is incorrect.

Resiliency is how well an environment can withstand duress. Although this is of obvious importance to all organizations, it is usually seen as a defense against availability concerns; the question has more to do with interoperability, and thus option B is still preferable to option C.

Nothing in the question suggests a need for the company to retain some form of governance; option D is incorrect.

Although infrastructure as a service (IaaS) could offer similar cross-platform benefits, it would require additional effort and expertise on the part of the customer, which would not be nearly as appealing and efficient. Option A is incorrect.

Software as a service (SaaS) does not allow the customer to install software and would be useless for this purpose, making option C incorrect.

LaaS is not a cloud service model and has no meaning in this context. Option D is incorrect.

Control Objectives for Information and Related Technology (COBIT) is ISACA’s framework for managing IT and IT controls, largely from a process and governance perspective. Though it includes elements of risk management, NIST 800-37 is still closer in nature to ISO 31000, so option A is preferable to B.

ITIL (Information Technology Infrastructure Library) is a framework mostly focused on service delivery as opposed to risk management; option C is incorrect.

The General Data Protection Regulation (GDPR) is a European Union law regarding privacy information, not risk management; option D is incorrect.

All the other options are standards bodies but do not have a publication that matches the description in the question as well.

All the other options are standards bodies that involve a specific board or other centralized authority for publishing requirements.

All the other options define other privacy-related roles.

All the other options define other privacy-related roles.

All the other options define other privacy-related roles.

The other options are the names of other privacy-related roles.

The other options are the names of other privacy-related roles.

The compliance officer might be considered a representative of the data controller (your company), or perhaps the data steward, depending on how much actual responsibility and interaction with the data you have on a regular basis. Option A is not as accurate as option D.

The cloud provider (and anyone working for the provider) would be considered the data processor under most privacy regulations; option B is incorrect.

Your company is the data controller, the legal entity ultimately responsible for the data. Option C is incorrect.

All the other options are excellent examples of items that can and should be included in the SLA.

Availability may be an aspect of portability; the ease and speed at which the customer can access their own data can influence how readily the data might be moved to another provider. However, this is less influential than the format and structure of the data; option A is preferable to option B.

Storage space has little to do with vendor lock-in; option C is incorrect.

A list of OSs the provider offers might be influential for the customer’s decision of which provider to select, but it is not typically a constraining factor that would restrict portability. Option D is incorrect.

Regulatory oversight usually affects the customer, not the provider; option A is incorrect.

The performance details are often included in the SLA but aren’t the motivating factor; option C is incorrect.

In a perfect world, option D would be the correct answer; B is a better answer to this question, however.

Option A is incorrect because the cloud provider would be the entity that would face financial penalties for not fulfilling the SLA.

Options B and D are incorrect because regulatory oversight and media attention cannot be controlled by the contract between cloud provider and customer.

All the other options are good reasons for performing audits.

FIPS 140-2 is a list of cryptographic system products approved for use by U.S. federal customers; option A is incorrect.

The GDPR is a European Union law regarding privacy; ostensibly, an audit could be performed to ensure that an organization is meeting the law’s requirements, but the law itself is not a tool for the purpose. Option B is incorrect.

ISO 27001 details the information security management system an organization can adopt; it is not specifically a tool for reviewing cloud security controls. Option C is not correct.

The International Organization for Standardization (ISO) is an international standards body and does not dictate American government practices. Option A is incorrect.

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 is the Risk Management Framework (RMF) not specifically related to the cloud; option D is preferable to option B.

The European Union Agency for Network and Information Security (ENISA) is a European Union standards body and does not dictate American government practices. Option C is incorrect.

The other options are common facets of cloud computing but do not typically serve the purpose of auditing.

All the other options are typical methods for enhancing authentication.

All the other options are actual common identity federation standards.

All the other options are typical aspects used in multifactor authentication.

All the other options are common aspects of cloud computing, but don’t particularly serve BC/DR purposes.

All the other options are common aspects of cloud computing but don’t particularly serve BC/DR purposes.

All the other options are common aspects of cloud computing but don’t particularly serve BC/DR purposes.

The SDLC is a system development/acquisition tool; it doesn’t particularly assist in BC/DR efforts. Option A is incorrect.

Honeypots are a threat intelligence tool; they don’t serve any useful BC/DR purpose. Option C is incorrect.

Identity management is a part of the entitlement process but does not add any value to BC/DR efforts; option D is incorrect.

All the other options are common security tools but don’t really serve to enhance BC/DR efforts.

All the other options are common aspects of cloud computing but don’t particularly serve BC/DR purposes.

All the other options represent information sources that can aid in predicting BC/DR events.

All the other options are common aspects of BC/DR preparation and do not typically pose a threat to the organization.

All the other options are common aspects of BC/DR preparation and do not typically pose a threat to the organization.

All the other options are aspects of containerization.

The other options are typical SDLC steps.

All the other options represent common capabilities of API gateways.

All the other options are various types of firewalls that a customer could implement in a cloud managed services environment.

All the other options are incorrect.

All the other options are incorrect because they are not the usual means of establishing trust between the parties in a typical TLS session.

All the other options are incorrect because they are not the form of cryptography used for the session key in a TLS session.

All the other options are simply incorrect.

Freeware and shareware are licensing arrangements and ways of distributing intellectual property. Options A and D are incorrect.

Malware is harmful software designed for attack purposes; option B is incorrect.

SOAP is not particularly lightweight; in fact, it is kind of cumbersome. Option A is not true.

SOAP is not especially more secure than DCOM or CORBA; option C is incorrect.

SOAP is newer than the other technologies; however, that is not the reason it is preferable in a web context. Option B is still preferable to D.

Extensible Markup Language (XML) may be used for REST, but it is not a requirement as it is in Simple Object Access Protocol (SOAP). Option A is incorrect.

Security Assertion Markup Language (SAML) is a form of XML used in passing identity assertions; option B is incorrect.

Transport Layer Security (TLS) is a secure virtual private network (VPN) mechanism, not an element of SOAP. Option D is incorrect.

All the other options are incorrect because they are not the form of output one would expect from REST.

Physical access control is important, but less for controlling exposure and more for preventing theft. Option B is preferable to A in this context.

Policies are crucial but don’t actually offset the risk; they are the underlying structure for creating programs and methods for dealing with the risk. Option B is preferable to C in this case.

Backup power has nothing to do with data exposure, therefore option D is incorrect.

All other options are conditions that are true during maintenance mode.

VMs are moved as image snapshots when they are transitioned from production to storage; option A is incorrect.

During live migration, the VM moves in unencrypted form. Option B is incorrect.

Live migration goes over the network; portable media is not necessary. Option D is incorrect.

All the other options are mechanisms used by IDS/IPS solutions to detect threats.

All the other options are insufficient for the question; D is, by far, the best answer.

All the other options are legitimate recipients of proof of vulnerability scans.

The other options are also ways to protect intellectual property, but they are not usually associated with logos.

Because there was no agreement between your company and the competitor in question, there is no contract, so no breach of contract dispute is pertinent. Option A is incorrect.

Although statutes concerning intellectual property protections exist, they are usually in the form of torts (that is, laws that define how civil actions can pursue restitution for private harm). This is not the government prosecuting someone in order to protect the public; criminal proceedings are rare when it comes to enforcing intellectual property rights. Option B is incorrect.

The military does not often get involved in intellectual property disputes and most often uses the civil courts when it does. Option D is incorrect.

All the other options may be factors the court takes into account when making its decision, but option C is the best answer.

All the other options are SSAE 18 reports but not the correct answer.

All the other options are SSAE 18 reports but not the correct answer.

All the other options are examples of countries that do not.

Alaska is not a country—it is a state. Option B is wrong.

Neither Belize nor Madagascar has privacy laws sufficient to meet EU requirements; options C and D are incorrect.

The cloud provider(s), in this case, would be those entities selling services to Cloud Services Corp. Option A is incorrect.

The cloud customer, in this case, would be your company. Option B is incorrect.

No aspect of the question describes a cloud database specifically. Option D is incorrect.

All the other options are aspects of cloud computing but do not aid in addressing the concerns described in the question.

All the other options are defining characteristics of cloud computing.

An infrastructure as a service (IaaS) solution may be viable for this situation, because it allows the same functionality, but it also requires the customer (your company) to install and maintain the OS(s) that run the software. In looking to decrease cost of investment and maintenance, the PaaS model is probably preferable. Option A is not as good as option B, in this case.

A software as a service (SaaS) model does not allow the customer to install software; option C is incorrect.

A hybrid cloud model usually requires the customer to maintain at least part of the hardware infrastructure; in accordance with the description of the situation in this question, option D is not as optimum as option B.

A software as a service (SaaS) or infrastructure as a service (IaaS) model would not be optimum for software testing; options B and D are incorrect.

A community cloud model involves the joint ownership of infrastructure among many providers and customers; option C is not correct.

Infrastructure as a service (IaaS) and platform as a service (PaaS) models require the customer to participate in some administration of the environment; options A and B are incorrect.

A private cloud entails customer involvement in at least the detailing of governance of the environment; option C is incorrect.

The customer is still responsible for some software licensing and maintenance activities (and therefore costs) in infrastructure as a service (IaaS) and platform as a service (PaaS) models; options A and B are incorrect.

A hybrid deployment usually entails the customer maintaining some infrastructure elements, and that usually would also include software licensing requirements. Option D is incorrect.

Options B, C, nor D would not be the optimal choices for a cloud deployment model in this case, because each of those requires personnel with more experience/training. Options B, C, and D are incorrect.

All the other options are cloud deployment models that allow the customer less control over the environment as a whole.

Options A, C, and D provide less confidentiality than option B and are therefore incorrect.

Cloud migration can, however, aid in reducing overhead costs, including energy costs associated with operating a data center, and can enhance BC/DR capability through the provider’s increased investment in redundancy and continuity.

Audits and regulators might help this effort, somewhat, by ensuring that the provider adheres to certain mandates and standards, but these are less convincing (and occur after the fact of delivery) than profit motive. Options A and C are incorrect.

Training does not really aid the efforts described in the question; option D is incorrect.

A shift from a capital expenditure scheme to an operational expenditure arrangement does not necessarily mean that overall costs decrease; in fact, costs might very likely increase because the sum of the OpEx installments may total more than the CapEx would have been. Option A is incorrect.

CapEx usually reduces tax exposure because it allows for depreciation of assets, whereas OpEx does not. Option B is not correct.

Whether the business uses CapEx or OpEx financing does not necessarily increase or decrease profit. Option D is incorrect.

A firewall uses aspects of administrative controls. The firewall policy is a set of rules that dictate the type of traffic and source/destination of that traffic. Option A is incorrect.

Firewalls can be set to change activity in reaction to detected threats, which is a corrective action; option C is incorrect.

Firewall rules can also prevent certain kinds of traffic/access; option D is incorrect.

However, the effect of a deterrent control is the result of its perception by someone who might engage in wrongdoing—unless it is perceived, the control is not really a deterrent. Most firewalls don’t function in that manner; they are transparent to both legitimate users and attackers. Option B is therefore correct.

Internet Protocol Security (IPSec) may or may not involve tunneling. Option A is incorrect.

Infrastructure as a service (IaaS) may or may not use tunneling for remote access/
administration; option C is incorrect.

Extensible Markup Language (XML) is a format for communicating data; option D is incorrect.

SABSA is a means of looking at security capabilities from a business perspective; option A is incorrect.

COBIT is designed for all types of business, regardless of their purpose; option C is incorrect.

TOGAF is a means to incorporate security architecture with the overall business architecture; option D is incorrect.

All the other options are principles detailed in the TCI.

Tools cannot deliver testimony; only people can testify. Option B is incorrect.

DLP solutions do not perform prosecutorial work; that is the function of law enforcement agencies. Option C is incorrect.

While DLP tools can locate intellectual property assets, they do not, strictly speaking, enforce the rights attendant to those assets. Option A is still preferable to D in this case.

All the other options are good aspects of a security program but not exactly germane to DLP function.

Archiving does not really offer any of the other benefits; when data is taken out of the production environment and put into long-term storage, the organization loses the capability to manipulate it and create new assets from it. Options A, C, and D are incorrect.

All the other options are not benefits directly associated with data archiving.

All the other options are important aspects of a data archiving policy but are not as important as option A (for instance, data that is not encrypted might pose a risk of loss, but data in the wrong format may not be recoverable at all).

The other options are all sources that may dictate the customer’s destruction of data.

Databases and data warehousing are typically associated with platform as a service (PaaS), where the provider owns and maintains the infrastructure and data management engine but the customer can install programs and interfaces to manipulate the data. Options B and D are incorrect.

Volume storage is typically associated with infrastructure as a service (IaaS); option C is incorrect.

RTOs vary for every organization; there is no set answer for all organizations. Options A and B might be correct for a given organization but incorrect in the general case because it’s impossible to know an organization’s RTO without knowing more about the organization.

The RPO is a measure of data that can be lost, not time; option D is incorrect.

All the other options are incorrect.

All the other options are included in the OWASP Top Ten.

All the other options should be concerns of any cloud customer, but they are not of specific or increased concern for this situation.

All the other options are management risks that do not have anything specific to do with the cloud environment and should not affect it/be affected by it.

All the other options increase risk and should not be recommended.

All the other options are incorrect because those entities are not the owner of the PII.

All the other options are recommended techniques for privileged user management.

A public cloud arrangement would preclude the customer hosting the key management system on its premises; option A is incorrect.

The service model is slightly irrelevant to where the key management system is located; whereas customer-hosted key management is usually associated with an SaaS model, it is not strictly required. Options B and D are incorrect.

All the other options are security principles but are not intrinsically applicable to the concept of storing encryption keys away from encrypted data.

Homomorphic encryption is a theoretical conversion of data into ciphertext that can be analyzed as if it were in its original form. Option C is incorrect.

Option D is incorrect because it uses public and private key pairs to encrypt and decrypt data.

SSMS involves encrypting a data set, then splitting the data into pieces, splitting the key into pieces, then signing the data pieces and key pieces and distributing them to various cloud storage locations. Option B is incorrect.

Option D is incorrect because it uses public and private key pairs to encrypt and decrypt data.

Option A is incorrect because it refers to a data transformation.

Option C is a made up term and is therefore incorrect.

Option D is incorrect because it is a data dispersion term.

Encryption may be applied to data at rest (even VM snapshots); option A is incorrect.

Insider threats within the cloud data center probably pose just as much risk to the storage nodes as the processing nodes; option B is incorrect.

Option D is incorrect.

All the other options are resources provisioned to the virtual machine(s) by the management plane.

The other options are all backup options but do not actually demonstrate whether the backup is suitable for the business continuity and disaster recovery (BC/DR) requirements.

All the other options are characteristics of a cloud data center, but they don’t serve much BC/DR purpose; option C is the best choice.

An inadvertent initiation of the plan can result in a disaster, but that would only be one disaster, not two; for instance, if senior management got faulty information during the event anticipation phase and decided to switch to contingency operations, but there was no actual causative event, that would be a single disaster. Options A and D are incorrect.

The act of planning and crafting policy cannot take the form of a disaster. Option B is incorrect.

The SOC is an audit report; this does not aid in BC/DR planning. Option A is incorrect.

The risk analysis and ALE calculation are used to select reasonable and cost-effective controls suitable for the environment; this does not aid in BC/DR efforts. Options C and D are incorrect.

Usually, a cloud solution may also be faster and easier to engineer than a physical solution; options A and D are incorrect.

“Larger,” in this context, has no meaning, because the “size” of the cloud is a misnomer; option C is incorrect.

The SOC 1 audit reviews the accuracy and correctness of the organization’s financial reporting. Option A is incorrect.

The SOC 3 is an attestation of an audit. Option C is incorrect.

There is no SOC 4 report. Option D is incorrect.

All the other options are excellent items to include in an SLA.

All the other options are common physical access control mechanisms in a cloud data center.

All the other options are common cloud access types and don’t necessarily need to be limited in duration.

All the other threats are currently faced by cloud customers but also existed in the traditional environment.

A SAN typically presents storage devices to users as attached/mounted drives. Option A is incorrect.

An HSM is designed for encryption generation and management; option C is incorrect.

A CDN typically replicates multimedia content at multiple, geographically diverse locations to ensure high quality for recipients. Option D is incorrect.

All the other options are existing threats in the company’s current environment.

Cold aisle containment is a configuration where the fronts of devices face each other. Option B is incorrect.

Option C is not relevant in this context. Option C is incorrect.

Option D does not describe the data center configuration in the question. Option D is incorrect.

While it is possible that mismanaged cabling could cause slip/trip/fall hazards, this is much less common in modern data centers; option A is preferable in this case.

Cabling does not really have much of an environmental footprint, so discipline applied to cabling won’t affect the environment much, one way or the other; option C is incorrect.

Regulators do not usually enforce cable management; option D is incorrect.

All the other options are incorrect as they include warmer air.

Neither type uses the techniques described in the other options, as they are all incorrect answers.

All the other options are common fire detection methods.

All the other options are true statements about FM-200 used in fire suppression.

All the other options are true statements about FM-200.

All the other options are common functions of DHCP servers.

Domain Name System Security Extensions (DNSSEC) protects data in transit by reducing the risk of DNS poisoning; Transport Layer Security (TLS) and Internet Protocol Security (IPSec) reduce the risk of eavesdropping and interception of data.

All the other options are common steps of OS hardening.

The BIA and financial records may offer an auditor insight into asset valuation/risk but will not provide meaningful data for a control audit. Options A and C are incorrect.

The SOC 3 report is only an attestation by an auditor that an audit has taken place; it does not provide any useful information about security controls.

All the other actions are recommended for a cloud node entering maintenance mode.

All the other options are actions the cloud provider should undertake when conducting scheduled maintenance.

The other options do not have a set maximum capacity and are therefore incorrect.

Open Web Application Security Project (OWASP) is an open source web application development project and does not involve the use of any of the tools mentioned in the question. Option A is incorrect.

OAuth is a set of standards for identity federation. Option B is incorrect.

Mozilla is a company that produces and administers open source software such as the Firefox web browser. Option D is incorrect.

Encrypting the data in storage but allowing call center personnel to decrypt it creates a vast opportunity for fraud and abuse; option A is incorrect.

Encrypting the data while the call center is trying to make the refund would be counterproductive; the call center personnel would be unable to determine which card gets the refund. Option B is incorrect.

Relying on the customer to provide the correct card number invites inaccuracy and exposes the transaction to fraud; option D is not correct.

All the other options are common phases of the SDLC.

A WAF is a Layer 7 firewall that understands hostile HTTP traffic. Option A is incorrect.

An API gateway filters API traffic. Option B is incorrect.

DLP solutions are used for egress monitoring, not incoming SQL commands. Option C is incorrect.

All the other options are service/deployment models that are not as optimum for software testing as PaaS.

Software testing should not include raw production data, so there is no purpose for using DLP and DRM solutions; options A and B are incorrect.

The WAF is used to filter web traffic; in the testing environment, there should not be any live traffic going to the software. Option D is incorrect.

Vulnerability scans will only detect known problems, not programming defects that have not yet been identified; option A is incorrect.

Neither SOC audit nor regulatory review have anything to do with finding software flaws; options C and D are incorrect.

All the other options are personnel who do not need to be present but will not necessarily cause undue influence of the testing process.

All the other options are elements that will most likely be increased by transitioning to an Agile model.

All the other options are not essential roles in Agile development.

Dependence on planning is directly contrary to Agile methodology; option A is incorrect.

In Agile, prototyping is favored over testing; option B is incorrect.

Agile relies on cooperative development instead of stovepiped expertise; option C is incorrect.

Agile methodology spurns the use of specific tools and concrete planning; options B and C are incorrect.

Agile also favors customer collaboration and prototyping instead of an elaborate contract mechanism; option D is incorrect.

REST relies more often on uniform resource identifiers (URIs) than XML; option B is incorrect.

SAML is a protocol for passing identity assertions over the Internet; option C is incorrect.

DLP is a data egress monitoring tool; option D is incorrect.

All the other options are aspects addressed by the STRIDE model.

Under 27034, the organization only needs one ONF, of which every ANF is a subset. Option A is incorrect.

There is no INF. The term is a distractor; option C is incorrect.

SOC 3 reports are for the Statement on Standards for Attestation Engagements (SSAE) standard, not ISO 27034; option D is incorrect.

All the other options are included in the OECD principles.

All the other options are other privacy-data-related roles.

All the other options are U.S. government agencies not involved with Privacy Shield.

All the other options are incorrect because they do not allow non–European Union companies to process personal data of EU citizens.

All the other options are greater maturity levels of the CMM.

ISO 27002 is a standard for applying controls to the ISMS; option B is incorrect.

NIST 800-37 is the Risk Management Framework; option C is incorrect.

SSAE is an audit standard for financial reporting and the controls within an environment; option D is incorrect.

All the other options are entities that are unlikely to receive a SOC 2, Type 2 report from a cloud provider.

All the other options are incorrect.

All the other options are incorrect answers.

The UL is a standards and certification entity concerned with product safety; option A is incorrect.

FIPS 140-2 is a standard for certifying cryptographic modules; option B is incorrect.

PCI DSS is a security standard for credit card merchants and processors; option C is incorrect.

The SOC reports are part of the Statement on Standards for Attestation Engagements (SSAE) 18 audit standard; option A is incorrect.

The NIST RMF is only mandated for U.S. federal agencies and not part of the CSA purview; option C is incorrect.

The ISMS is one of the ISO standards and not part of the CSA purview; option D is incorrect.

Options A and B are other typical cloud computing roles; option D is a not a term with any meaning in this context.

All the other options are distractors and not entities that are assigned specific roles in a federation motif.

All the other options are standards or regulations.

Option A is two elements of the same kind: something you know. This is incorrect.

Option B is two elements of the same kind: something you are. This is incorrect.

Option C is two elements of the same kind: something you have. This is incorrect.

Options B and C are useful elements to be included in the contract, but not specifically the SLA. Options B and C are incorrect.

Option A is too ambiguous; “excellent” is not a discrete value. Option A is incorrect.

Enterprise networking is a general term, not specifically related to the cloud. Option B is incorrect.

Legacy networking or traditional networking is designed for traditional networks that use physical devices and components rather than virtual. Option D is incorrect.

The other options contain uppercase and lowercase letters that may or may not be related to the cloud. Option D is the only option that answers the question correctly. The acronym QoS represents Quality of Service. QoS is used to set priorities for specific types of data to dependably run high-priority applications and traffic.

Tort law refers the body of laws that provide remedies to individuals who have been caused harm by unreasonable acts of others. Negligence is the most common type of tort lawsuit. Therefore, option A is incorrect.

Option C is incorrect because civil law pertains to contracts, property, and family law as opposed to crimes like murder and theft that are associated with criminal law.

Contracts are agreements between parties to exchange goods and services; Option D is incorrect.

Option B is incorrect. SSDs do not necessarily last longer than magnetic drives.

Options C and D are incorrect because SSDs are not noticeably easier or quicker to replace than traditional drives.

Options B and C are incorrect. Public awareness and increased costs are not risks associated with virtualization.

Option D is incorrect because the loss of data is not associated with virtualization anymore than the loss of data is associated with non-virtualization.

The question focuses on the handling of all input/output (I/O) instructions. Only the CPU does that. Options B, C, and D function as a result of the CPU handling all of I/O for the hypervisor, user interface, and supervising application. The CPU is the core of computing systems. Options B, C, and D are incorrect.

IANA oversees global IP address allocation among other Internet tasks. IANA does not establish standards and protocols for the Internet. Option A is incorrect.

Option B is incorrect because the ISO/IEC develops, maintains and promotes standards in information technology and information communication technology.

Option C is incorrect because NIST is a federal government standards body in the US.

Option A is incorrect because MD5 is a cryptographic hash function used to verify that a file has not been altered.

SSL uses certificates to create a secure connection using encryption. Option B is incorrect.

Blowfish is a symmetric-key block cipher that has been replaced by AES encryption. The U.S. government uses AES and not Blowfish. Option C is incorrect.