Which of the following would be considered an example of insufficient due diligence leading to security or operational problems when moving to a cloud?

• A.Monitoring
• B.Use of a remote key management system
• C.Programming languages used
• D.Reliance on physical network controls

Comment: *

Name: *

Email: *

Verification: *

Which United States law is focused on PII as it relates to the financial industry?

• A.HIPAA
• B.SOX
• C.Safe Harbor
• D.GLBA

Comment: *

Name: *

Email: *

Verification: *

Why does a Type 2 hypervisor typically offer less security control than a Type 1 hypervisor?

• A.A Type 2 hypervisor runs on top of another operating system and is dependent on the security of the OS for its own security.
• B.A Type 2 hypervisor allows users to directly perform some functions with their own access.
• C.A Type 2 hypervisor is open source, so attackers can more easily find exploitable vulnerabilities with that access.
• D.A Type 2 hypervisor is always exposed to the public Internet for federated identity access.

Comment: *

Name: *

Email: *

Verification: *

When a customer performs a penetration test in the cloud, why isn't the test an optimum simu-lation of attack conditions?
Response:

• A.Advanced notice removes the element of surprise
• B.Attackers don't use remote access for cloud activity
• C.When cloud customers use malware, it's not the same as when attackers use malware
• D.Regulator involvement changes the attack surface

Comment: *

Name: *

Email: *

Verification: *

Which of the following threat types involves an application developer leaving references to internal information and configurations in code that is exposed to the client?

• A.Sensitive data exposure
• B.Security misconfiguration
• C.Insecure direct object references
• D.Unvalidated redirect and forwards

Comment: *

Name: *

Email: *

Verification: *