When using a SaaS solution, what is the capability provided to the customer?
D
Explanation:
According to The NIST Definition of Cloud Computing, in SaaS, The capability provided to the
consumer is to use the providers applications running on a cloud infrastructure. The applications are
accessible from various client devices through either a thin client interface, such as a web browser
(e.g., web-based e-mail), or a program interface. The consumer does not manage or control the
underlying cloud infrastructure including network, servers, operating systems, storage, or even
individual application capabilities, with the possible exception of limited user-specific application
configuration settings.
Which of the following is the dominant driver behind the regulations to which a system or
application must adhere?
B
Explanation:
The locality--or physical location and jurisdiction where the system or data resides--is the dominant
driver of regulations. This may be based on the type of data contained within the application or the
way in which the data is used. The contract and SLA both articulate requirements for regulatory
compliance and the responsibilities for the cloud provider and cloud customer, but neither artifact
defines the actual requirements. Instead, the contract and SLA merely form the official
documentation between the cloud provider and cloud customer. The source of the data may place
contractual requirements or best practice guidelines on its usage, but ultimately jurisdiction has legal
force and greater authority.
Limits for resource utilization can be set at different levels within a cloud environment to ensure that
no particular entity can consume a level of resources that impacts other cloud customers.
Which of the following is NOT a unit covered by limits?
A
Explanation:
The hypervisor level, as a backend cloud infrastructure component, is not a unit where limits may be
applied to control resource utilization. Limits can be placed at the service, virtual machine, and cloud
customer levels within a cloud environment.
Which of the following is not a risk management framework?
B
Explanation:
Hex GBL is a reference to a computer part in Terry Pratchetts fictional Discworld universe. The rest
are not.
Which of the following report is most aligned with financial control audits?
C
Explanation:
The SOC 1 report focuses primarily on controls associated with financial services. While IT controls
are certainly part of most accounting systems today, the focus is on the controls around those
financial systems.
Which of the following frameworks focuses specifically on design implementation and management?
A
Explanation:
ISO 31000:2009 specifically focuses on design implementation and management. HIPAA refers to
health care regulations, NIST 800-92 is about log management, and ISO 27017 is about cloud specific
security controls.
Gap analysis is performed for what reason?
A
Explanation:
The primary purpose of the gap analysis is to begin the benchmarking process against risk and
security standards and frameworks.
Which of the following best describes a cloud carrier?
A
Explanation:
A cloud carrier is the intermediary who provides connectivity and transport of cloud services
between cloud providers and cloud customers.
Legal controls refer to which of the following?
D
Explanation:
Legal controls are those controls that are designed to comply with laws and regulations whether they
be local or international.
Which of the following methods of addressing risk is most associated with insurance?
B
Explanation:
Avoidance halts the business process, mitigation entails using controls to reduce risk, acceptance
involves taking on the risk, and transference usually involves insurance.
Which of the following is not an example of a highly regulated environment?
D
Explanation:
Wholesalers or distributors are generally not regulated, although the products they sell may be.
Which of the following is the primary purpose of an SOC 3 report?
C
Explanation:
The SOC 3 report is more of an attestation than a full evaluation of controls associated with a service
provider.
Which is the lowest level of the CSA STAR program?
B
Explanation:
The lowest level is Level 1, which is self-assessment, Level 2 is an external third-party attestation,
and Level 3 is a continuous-monitoring program. Hybridization does not exist as part of the CSA STAR
program.
Which of the following terms is not associated with cloud forensics?
D
Explanation:
Plausibility, here, is a distractor and not specifically relevant to cloud forensics.
Which of the following is not a way to manage risk?
D
Explanation:
Enveloping is a nonsense term, unrelated to risk management. The rest are not.