What makes a computing environment a cloud rather than ordinary hosted infrastructure?

It provides shared, configurable resources on demand with rapid provisioning and minimal provider interaction. A hosted server without those operating characteristics is not automatically a cloud.

What is the security significance of broad network access?

Services are reachable through standard network mechanisms from varied clients. That reach increases the need for strong identity, transport protection, and endpoint-aware access.

How do resource pooling and multi-tenancy differ?

Resource pooling dynamically assigns shared capacity; multi-tenancy lets multiple customers use that shared environment with logical isolation. Pooling is the allocation model, while multi-tenancy is the customer-sharing model.

What separates elasticity from scalability?

Elasticity adjusts capacity with demand; scalability is the ability to handle growth by adding or changing capacity. Elasticity stresses timely adjustment, often in both directions.

What does measured service provide?

Metered visibility into resource consumption. The measurements support billing, capacity decisions, anomaly detection, and accountability.

What does on-demand self-service let a cloud customer do?

Provision needed capabilities without waiting for a provider employee. Policy and quota controls can still constrain the request.

What does virtualization contribute to cloud computing?

It abstracts physical resources into isolated, assignable compute, storage, or network units. Orchestration turns those units into an on-demand service.

What remains the cloud customer's responsibility in every service category?

Governing its identities, data, configuration choices, and lawful use. The exact technical boundary changes, but accountability does not vanish when infrastructure is outsourced.

What does a cloud service broker add?

Intermediation, aggregation, or management across cloud services. A broker may compare, combine, or govern services without owning their underlying infrastructure.

What is a regulator's cloud-security role?

Set or enforce legal and regulatory obligations that apply to the service and its data. The customer must map those duties into provider selection, controls, and evidence.

What is the cloud service provider's core responsibility?

Deliver the contracted cloud capabilities and secure the layers assigned to it. The service model and contract define the boundary.

What is orchestration in a cloud environment?

Coordinated automation of provisioning, configuration, scaling, and lifecycle actions across resources. It applies policy consistently across many components.

What capability does SaaS give the customer?

Use of a provider-run application. The customer mainly manages users, data, and allowed configuration rather than the platform beneath it.

Which four deployment models does NIST SP 800-145 define?

Public, private, community, and hybrid cloud. Multi-cloud describes using more than one cloud provider or service environment; it is distinct from NIST's canonical four-model taxonomy.

How do portability and interoperability differ?

Portability moves a workload or data between environments; interoperability lets different environments exchange and use information or services. One reduces switching friction, while the other supports cooperation.

What does a cloud service partner do?

Supports or enhances cloud service delivery, use, or assurance. Examples include auditors, integrators, and developers acting beside the customer and provider.

Who controls user entitlements inside a SaaS tenant?

The customer organization. The provider supplies the application and access mechanisms, but the customer decides which of its users need which privileges.

When is hybrid cloud a better description than multi-cloud?

When the architecture deliberately combines distinct private and public environments. Multi-cloud focuses on using multiple cloud services or providers and may contain no private cloud.

What problem does confidential computing address?

Protection of data while it is being processed. Hardware-backed trusted execution environments reduce exposure to the host or platform layer, but do not replace application controls.

When does blockchain add useful assurance to a cloud workflow?

When multiple parties need a shared, tamper-evident record without relying on one writer. It does not make source data true, private, lawful, or immune to key and smart-contract failures.

When does edge computing improve resilience but complicate security?

When local processing reduces central latency or dependency while distributing data, software, and physical exposure. The decision needs remote attestation, patching, inventory, and failure handling.

What does reversibility require in a cloud design?

A practical way to exit or change providers while recovering data, configurations, dependencies, and needed evidence. A theoretical export button is not enough if the result cannot be used elsewhere.

What is the first security question before connecting IoT devices to a cloud service?

Can each device be uniquely identified, updated, constrained, and monitored throughout its lifecycle? Cheap connectivity does not offset unmanaged device risk.

What capability does PaaS give the customer?

Deployment of customer applications onto a provider-managed platform. The provider runs the underlying infrastructure and runtime, while the customer secures code, data, and configuration.

What is a practical cloud decision for quantum-related cryptographic risk today?

Inventory cryptographic dependencies and design for algorithm agility. Replace algorithms according to authoritative migration guidance rather than adopting unreviewed schemes.

Which SLA measure is useful only when paired with a clear measurement method and remedy?

Any availability or performance target. Define the service boundary, observation window, exclusions, data source, notification, and remedy before treating the number as assurance.

How should a team use a Well-Architected pattern, SANS security principles, or CSA enterprise architecture?

As structured design input mapped to the workload's risks, responsibilities, and evidence. A named framework guides decisions but does not prove that the resulting architecture is secure.

What does a FIPS 140 validation establish?

That a named cryptographic module was validated against the stated standard and boundary. It does not prove the surrounding application uses the module safely.

Who normally patches the managed runtime in PaaS?

The cloud provider. The customer still owns secure application code, dependencies it supplies, data, identities, and configuration.

Who should approve a cloud data classification?

The accountable data owner. Security and privacy teams advise, while custodians implement the handling controls.

What should the cloud architect own in secure design?

The documented trust boundaries, security requirements, resilience choices, and responsibility mapping. Operations and product teams then implement and test those decisions.

What does DevSecOps change about security ownership?

It makes security a shared, automated part of delivery rather than a final external gate. Product teams still need independent challenge for high-risk decisions.

Which controls reduce container escape impact?

Hardened runtimes, minimal privileges, trusted images, isolation boundaries, and prompt patching. Treat a container as a process boundary, not automatically as a security boundary equal to a separate host.

Who should own a cloud service's business recovery requirements?

The business or service owner. Technical teams translate the owner's impact tolerance into RTO, RPO, architecture, and tests.

What capability does IaaS give the customer?

Provisioning of fundamental compute, storage, and network resources. The customer usually controls operating systems, workloads, and many network settings.

Which key-management design limits a cloud provider compromise from exposing customer data?

Separate data from independently controlled encryption keys where the threat model requires it. Access policy, rotation, backup, and recovery for those keys matter as much as their location.

What is the safer identity pattern for a cloud workload?

A short-lived, narrowly scoped workload identity. It avoids embedded long-lived credentials and supports rotation and traceability.

When can cryptographic erase sanitize cloud data?

When destroying the correct encryption key makes all protected copies computationally unreadable and the encryption implementation is trustworthy. Key copies, snapshots, and replicas must be in scope.

What is the first network control for limiting east-west movement between cloud workloads?

Explicit segmentation with deny-by-default rules. Identity-aware policy and traffic telemetry strengthen the boundary; geofencing can add a location condition but cannot replace it.

Who normally patches a guest operating system in IaaS?

The cloud customer. The provider secures the underlying facilities and virtualization layer, while the customer manages the guest unless a separate managed service changes that boundary.

What is the most important permission control for a serverless function?

A dedicated least-privilege execution identity. Also restrict triggers, secrets, outbound access, and runtime duration; ephemeral execution does not erase external logs, queues, or data.

How does immutable infrastructure reduce configuration drift?

Replace changed instances from a controlled image instead of repairing them in place. The image pipeline, secrets, and state stores still need protection.

What turns a security baseline into an operating control?

Automated assessment plus timely remediation of deviations. A baseline document alone does not prevent drift.

What control keeps protection aligned as cloud data moves through its lifecycle?

Lifecycle-aware policy tied to classification and ownership. Access, encryption, retention, monitoring, and disposal should change with the data's state and purpose.

What makes a cloud recovery plan credible?

Regular restore, failover, dependency, and failback tests against business targets. A provider's availability claim does not prove the customer's service can recover.

What evidence should be checked first when evaluating a cloud provider?

Evidence mapped to the organization's own requirements and risk criteria. Certifications help only when their scope, period, system, and exceptions cover the intended service.

What should drive a cloud BC/DR design before products are selected?

A business impact analysis. It identifies critical services, dependencies, impact over time, and acceptable recovery targets.

Who is accountable for approving an AI model's intended cloud use?

The designated AI or business system owner. Model builders provide evidence, while risk, security, privacy, and legal roles challenge the use against policy.

What should be tested before accepting a provider's portability claim?

Export the data and configuration, rebuild elsewhere, and measure missing features, time, cost, and dependencies. Contract wording alone cannot prove reversibility.

What control most directly reduces hypervisor compromise risk for a customer?

Use a provider with strong isolation assurance, rapid patching, and evidence for the virtualization layer. The customer cannot harden a provider-managed hypervisor directly.

How should CBA and ROI inform a cloud recovery design after the BIA?

CBA compares each option's lifecycle cost with expected benefit; ROI expresses the expected return relative to investment. Neither overrides mandatory duties or the BIA's approved impact tolerance.

CCSP 2026 Flashcards: August Exam Outline Review

A 340-card, six-domain review for the CCSP outline effective August 1, 2026, including cloud AI/ML, dataset, model, and LLM application security.

Από τον συντάκτη Flashcards Open Source App

Μελετήστε αυτήν τη δέσμη δωρεάν

Το Nibomo ανοίγει για να ξεκινήσετε τη μελέτη.

Λεπτομέρειες δέσμης

Κάρτες: 340 κάρτες
Έκδοση: 1
Δημοσιεύτηκε: 27 Αυγούστου 2026
Τελευταία ενημέρωση: 10 Σεπτεμβρίου 2026
Άδεια χρήσης: Common knowledge · CC0 1.0
Γλώσσες κοινού: en
Αντικείμενο: Cloud security
Επίπεδο: CCSP
Ετικέτες: ccsp-2026, d1-concept, d1-role, d1-decision, d1-control, d2-concept, d2-control, d2-decision, d2-role, d3-role, d3-concept, d3-control, d3-decision, d4-concept, d4-role, d4-control, d4-decision, d5-concept, d5-decision, d5-control, d5-role, d6-concept, d6-role, d6-control, d6-decision

Παρόμοιες δέσμες

Σχετικά με αυτήν τη δέσμη

This 340-card deck reviews all six domains in the English CCSP exam outline effective August 1, 2026: Cloud Concepts, Architecture and Design; Cloud Data Security; Cloud Platform and Infrastructure Security; Cloud Application Security; Cloud Security Operations; and Legal, Risk and Compliance.

What you'll retrieve

Separate cloud service, deployment, architecture, data, identity, assurance, operations, risk, privacy, audit, and contract concepts that are easy to confuse.
Map customer, provider, security, data, privacy, audit, incident, and vendor roles to their primary responsibility boundary.
Choose a practical control for a short cloud scenario, then state the risk or failure mode it chiefly addresses.
Make focused architecture, lifecycle, recovery, testing, monitoring, service-management, and outsourcing decisions from stated requirements, including service-level management, availability management, Quality Assurance, audit planning, and provider-risk assessment.
Recognize revised AI and ML concerns across cloud threat detection, dataset and model privacy, data and model poisoning, provenance, model inversion and extraction, human oversight, and LLM application risks.

Selected reverse and contrast prompts are included where they improve retrieval, such as elasticity versus scalability, portability versus interoperability, RTO versus RPO, hashing versus encryption, controller versus processor, IDS versus IPS, and incident versus problem management. The deck does not mechanically reverse every fact.

Exam-format multiple choice, memorized answer patterns, dumps, vendor-console trivia, copied course wording, and legal advice are excluded. The cards do not reproduce real or simulated ISC2 exam items. They also stay outside deep cryptographic mathematics, product-specific implementation recipes, and specialist AI research that does not change a cloud-security control decision.

The order is deliberate. Each domain advances through short, coherent topic tracks from prerequisite concepts and responsibility boundaries to controls and applied decisions. The final 340-card sequence was reviewed as one topic-progressive order, with identified forward, reverse, near-duplicate, and answer-cue variants deliberately separated to reduce short-range cueing. Its topic tracks are interleaved so the sequence does not become a concept run followed by role, control, and decision runs. Domain 1 establishes cloud characteristics, actors, service and deployment models, secure design, provider evidence, and AI governance. Domain 2 follows data through flows, storage, protection, discovery, classification, rights, retention, evidence, and dataset or model risk. Domains 3 and 4 apply those foundations to infrastructure, resilience, secure development, software supply chains, APIs, LLM applications, and IAM. Domains 5 and 6 close with secure operations, monitoring, incident response, forensics, law, privacy, audit, enterprise risk, and contracts.

Reviewed for the CCSP outline effective August 1, 2026. Coverage was bounded by the official English exam outline PDF, the ISC2 outline page, and ISC2's June 2026 revision notice. NIST and OWASP primary publications were used to check standard control and AI/application-security distinctions.

Every prompt, answer, explanation, sequence choice, and metadata field was independently written from common cloud-security knowledge. The CC0 label applies to that original expression, organization, metadata, and generated cover to the extent applicable rights exist; it does not claim ownership of facts, standards, certification marks, or third-party material.

This is an independently authored, unofficial educational deck by Flashcards Open Source App. It is not affiliated with, sponsored by, or endorsed by ISC2. CCSP is a registered certification mark of ISC2. No ISC2 exam questions, answer keys, course text, outline prose, logos, badges, or trade dress were copied.

Κάρτες σε αυτήν τη δέσμη

Κάρτα 1
Ερώτηση
What makes a computing environment a cloud rather than ordinary hosted infrastructure?
Απάντηση
It provides shared, configurable resources on demand with rapid provisioning and minimal provider interaction. A hosted server without those operating characteristics is not automatically a cloud.
Κάρτα 2
Ερώτηση
What is the security significance of broad network access?
Απάντηση
Services are reachable through standard network mechanisms from varied clients. That reach increases the need for strong identity, transport protection, and endpoint-aware access.
Κάρτα 3
Ερώτηση
How do resource pooling and multi-tenancy differ?
Απάντηση
Resource pooling dynamically assigns shared capacity; multi-tenancy lets multiple customers use that shared environment with logical isolation. Pooling is the allocation model, while multi-tenancy is the customer-sharing model.
Κάρτα 4
Ερώτηση
What separates elasticity from scalability?
Απάντηση
Elasticity adjusts capacity with demand; scalability is the ability to handle growth by adding or changing capacity. Elasticity stresses timely adjustment, often in both directions.
Κάρτα 5
Ερώτηση
What does measured service provide?
Απάντηση
Metered visibility into resource consumption. The measurements support billing, capacity decisions, anomaly detection, and accountability.
Κάρτα 6
Ερώτηση
What does on-demand self-service let a cloud customer do?
Απάντηση
Provision needed capabilities without waiting for a provider employee. Policy and quota controls can still constrain the request.
Κάρτα 7
Ερώτηση
What does virtualization contribute to cloud computing?
Απάντηση
It abstracts physical resources into isolated, assignable compute, storage, or network units. Orchestration turns those units into an on-demand service.
Κάρτα 8
Ερώτηση
What remains the cloud customer's responsibility in every service category?
Απάντηση
Governing its identities, data, configuration choices, and lawful use. The exact technical boundary changes, but accountability does not vanish when infrastructure is outsourced.
Κάρτα 9
Ερώτηση
What does a cloud service broker add?
Απάντηση
Intermediation, aggregation, or management across cloud services. A broker may compare, combine, or govern services without owning their underlying infrastructure.
Κάρτα 10
Ερώτηση
What is a regulator's cloud-security role?
Απάντηση
Set or enforce legal and regulatory obligations that apply to the service and its data. The customer must map those duties into provider selection, controls, and evidence.
Κάρτα 11
Ερώτηση
What is the cloud service provider's core responsibility?
Απάντηση
Deliver the contracted cloud capabilities and secure the layers assigned to it. The service model and contract define the boundary.
Κάρτα 12
Ερώτηση
What is orchestration in a cloud environment?
Απάντηση
Coordinated automation of provisioning, configuration, scaling, and lifecycle actions across resources. It applies policy consistently across many components.
Κάρτα 13
Ερώτηση
What capability does SaaS give the customer?
Απάντηση
Use of a provider-run application. The customer mainly manages users, data, and allowed configuration rather than the platform beneath it.
Κάρτα 14
Ερώτηση
Which four deployment models does NIST SP 800-145 define?
Απάντηση
Public, private, community, and hybrid cloud. Multi-cloud describes using more than one cloud provider or service environment; it is distinct from NIST's canonical four-model taxonomy.
Κάρτα 15
Ερώτηση
How do portability and interoperability differ?
Απάντηση
Portability moves a workload or data between environments; interoperability lets different environments exchange and use information or services. One reduces switching friction, while the other supports cooperation.
Κάρτα 16
Ερώτηση
What does a cloud service partner do?
Απάντηση
Supports or enhances cloud service delivery, use, or assurance. Examples include auditors, integrators, and developers acting beside the customer and provider.
Κάρτα 17
Ερώτηση
Who controls user entitlements inside a SaaS tenant?
Απάντηση
The customer organization. The provider supplies the application and access mechanisms, but the customer decides which of its users need which privileges.
Κάρτα 18
Ερώτηση
When is hybrid cloud a better description than multi-cloud?
Απάντηση
When the architecture deliberately combines distinct private and public environments. Multi-cloud focuses on using multiple cloud services or providers and may contain no private cloud.
Κάρτα 19
Ερώτηση
What problem does confidential computing address?
Απάντηση
Protection of data while it is being processed. Hardware-backed trusted execution environments reduce exposure to the host or platform layer, but do not replace application controls.
Κάρτα 20
Ερώτηση
When does blockchain add useful assurance to a cloud workflow?
Απάντηση
When multiple parties need a shared, tamper-evident record without relying on one writer. It does not make source data true, private, lawful, or immune to key and smart-contract failures.
Κάρτα 21
Ερώτηση
When does edge computing improve resilience but complicate security?
Απάντηση
When local processing reduces central latency or dependency while distributing data, software, and physical exposure. The decision needs remote attestation, patching, inventory, and failure handling.
Κάρτα 22
Ερώτηση
What does reversibility require in a cloud design?
Απάντηση
A practical way to exit or change providers while recovering data, configurations, dependencies, and needed evidence. A theoretical export button is not enough if the result cannot be used elsewhere.
Κάρτα 23
Ερώτηση
What is the first security question before connecting IoT devices to a cloud service?
Απάντηση
Can each device be uniquely identified, updated, constrained, and monitored throughout its lifecycle? Cheap connectivity does not offset unmanaged device risk.
Κάρτα 24
Ερώτηση
What capability does PaaS give the customer?
Απάντηση
Deployment of customer applications onto a provider-managed platform. The provider runs the underlying infrastructure and runtime, while the customer secures code, data, and configuration.
Κάρτα 25
Ερώτηση
What is a practical cloud decision for quantum-related cryptographic risk today?
Απάντηση
Inventory cryptographic dependencies and design for algorithm agility. Replace algorithms according to authoritative migration guidance rather than adopting unreviewed schemes.
Κάρτα 26
Ερώτηση
Which SLA measure is useful only when paired with a clear measurement method and remedy?
Απάντηση
Any availability or performance target. Define the service boundary, observation window, exclusions, data source, notification, and remedy before treating the number as assurance.
Κάρτα 27
Ερώτηση
How should a team use a Well-Architected pattern, SANS security principles, or CSA enterprise architecture?
Απάντηση
As structured design input mapped to the workload's risks, responsibilities, and evidence. A named framework guides decisions but does not prove that the resulting architecture is secure.
Κάρτα 28
Ερώτηση
What does a FIPS 140 validation establish?
Απάντηση
That a named cryptographic module was validated against the stated standard and boundary. It does not prove the surrounding application uses the module safely.
Κάρτα 29
Ερώτηση
Who normally patches the managed runtime in PaaS?
Απάντηση
The cloud provider. The customer still owns secure application code, dependencies it supplies, data, identities, and configuration.
Κάρτα 30
Ερώτηση
Who should approve a cloud data classification?
Απάντηση
The accountable data owner. Security and privacy teams advise, while custodians implement the handling controls.
Κάρτα 31
Ερώτηση
What should the cloud architect own in secure design?
Απάντηση
The documented trust boundaries, security requirements, resilience choices, and responsibility mapping. Operations and product teams then implement and test those decisions.
Κάρτα 32
Ερώτηση
What does DevSecOps change about security ownership?
Απάντηση
It makes security a shared, automated part of delivery rather than a final external gate. Product teams still need independent challenge for high-risk decisions.
Κάρτα 33
Ερώτηση
Which controls reduce container escape impact?
Απάντηση
Hardened runtimes, minimal privileges, trusted images, isolation boundaries, and prompt patching. Treat a container as a process boundary, not automatically as a security boundary equal to a separate host.
Κάρτα 34
Ερώτηση
Who should own a cloud service's business recovery requirements?
Απάντηση
The business or service owner. Technical teams translate the owner's impact tolerance into RTO, RPO, architecture, and tests.
Κάρτα 35
Ερώτηση
What capability does IaaS give the customer?
Απάντηση
Provisioning of fundamental compute, storage, and network resources. The customer usually controls operating systems, workloads, and many network settings.
Κάρτα 36
Ερώτηση
Which key-management design limits a cloud provider compromise from exposing customer data?
Απάντηση
Separate data from independently controlled encryption keys where the threat model requires it. Access policy, rotation, backup, and recovery for those keys matter as much as their location.
Κάρτα 37
Ερώτηση
What is the safer identity pattern for a cloud workload?
Απάντηση
A short-lived, narrowly scoped workload identity. It avoids embedded long-lived credentials and supports rotation and traceability.
Κάρτα 38
Ερώτηση
When can cryptographic erase sanitize cloud data?
Απάντηση
When destroying the correct encryption key makes all protected copies computationally unreadable and the encryption implementation is trustworthy. Key copies, snapshots, and replicas must be in scope.
Κάρτα 39
Ερώτηση
What is the first network control for limiting east-west movement between cloud workloads?
Απάντηση
Explicit segmentation with deny-by-default rules. Identity-aware policy and traffic telemetry strengthen the boundary; geofencing can add a location condition but cannot replace it.
Κάρτα 40
Ερώτηση
Who normally patches a guest operating system in IaaS?
Απάντηση
The cloud customer. The provider secures the underlying facilities and virtualization layer, while the customer manages the guest unless a separate managed service changes that boundary.
Κάρτα 41
Ερώτηση
What is the most important permission control for a serverless function?
Απάντηση
A dedicated least-privilege execution identity. Also restrict triggers, secrets, outbound access, and runtime duration; ephemeral execution does not erase external logs, queues, or data.
Κάρτα 42
Ερώτηση
How does immutable infrastructure reduce configuration drift?
Απάντηση
Replace changed instances from a controlled image instead of repairing them in place. The image pipeline, secrets, and state stores still need protection.
Κάρτα 43
Ερώτηση
What turns a security baseline into an operating control?
Απάντηση
Automated assessment plus timely remediation of deviations. A baseline document alone does not prevent drift.
Κάρτα 44
Ερώτηση
What control keeps protection aligned as cloud data moves through its lifecycle?
Απάντηση
Lifecycle-aware policy tied to classification and ownership. Access, encryption, retention, monitoring, and disposal should change with the data's state and purpose.
Κάρτα 45
Ερώτηση
What makes a cloud recovery plan credible?
Απάντηση
Regular restore, failover, dependency, and failback tests against business targets. A provider's availability claim does not prove the customer's service can recover.
Κάρτα 46
Ερώτηση
What evidence should be checked first when evaluating a cloud provider?
Απάντηση
Evidence mapped to the organization's own requirements and risk criteria. Certifications help only when their scope, period, system, and exceptions cover the intended service.
Κάρτα 47
Ερώτηση
What should drive a cloud BC/DR design before products are selected?
Απάντηση
A business impact analysis. It identifies critical services, dependencies, impact over time, and acceptable recovery targets.
Κάρτα 48
Ερώτηση
Who is accountable for approving an AI model's intended cloud use?
Απάντηση
The designated AI or business system owner. Model builders provide evidence, while risk, security, privacy, and legal roles challenge the use against policy.
Κάρτα 49
Ερώτηση
What should be tested before accepting a provider's portability claim?
Απάντηση
Export the data and configuration, rebuild elsewhere, and measure missing features, time, cost, and dependencies. Contract wording alone cannot prove reversibility.
Κάρτα 50
Ερώτηση
What control most directly reduces hypervisor compromise risk for a customer?
Απάντηση
Use a provider with strong isolation assurance, rapid patching, and evidence for the virtualization layer. The customer cannot harden a provider-managed hypervisor directly.
Κάρτα 51
Ερώτηση
How should CBA and ROI inform a cloud recovery design after the BIA?
Απάντηση
CBA compares each option's lifecycle cost with expected benefit; ROI expresses the expected return relative to investment. Neither overrides mandatory duties or the BIA's approved impact tolerance.
Κάρτα 52
Ερώτηση
What control helps validate training or detection data before AI use?
Απάντηση
Provenance, integrity checks, schema checks, and approval for the intended source. Statistical anomaly checks can add evidence but should not replace ownership.
Κάρτα 53
Ερώτηση
What is the human reviewer's role in AI-assisted security operations?
Απάντηση
Validate consequential findings and actions before relying on them. Automation can rank and enrich signals, but the accountable human handles ambiguity and impact.
Κάρτα 54
Ερώτηση
Why read an assurance report's scope before relying on its conclusion?
Απάντηση
The report may exclude the exact service, region, control, subservice, or period you need. Assurance cannot be extended beyond its stated boundary.
Κάρτα 55
Ερώτηση
Which controls make model extraction harder at a cloud API?
Απάντηση
Strong access control, rate and budget limits, query monitoring, response minimization, and abuse detection. No single control removes the risk from a publicly queryable model.
Κάρτα 56
Ερώτηση
Why is high predictive accuracy insufficient for a cloud data-science or AI model?
Απάντηση
The use can still create unacceptable legal, privacy, fairness, security, safety, or operational risk. Accuracy is one quality measure, not automatic authorization to deploy.
Κάρτα 57
Ερώτηση
How should SOAR handle a high-impact containment action?
Απάντηση
Use explicit authorization, bounded playbooks, and human approval when impact or uncertainty is high. Automation should be reversible and fully logged.
Κάρτα 58
Ερώτηση
When is Common Criteria evidence relevant to provider evaluation?
Απάντηση
When a specific evaluated product and assurance target match the component and threat being assessed. It does not certify an entire cloud service by association.
Κάρτα 59
Ερώτηση
Which data lifecycle sequence is useful for cloud control planning?
Απάντηση
Create, store, use, share, archive, and destroy. Real data may move between phases, but each transition needs an owner and handling rule.
Κάρτα 60
Ερώτηση
What is data dispersion in cloud computing?
Απάντηση
The distribution of data and copies across systems, regions, media, services, and providers. Replicas, caches, logs, snapshots, and backups all expand the control boundary.
Κάρτα 61
Ερώτηση
What does a cloud data flow describe?
Απάντηση
Where data originates, moves, is transformed, is stored, and exits. A useful flow also names trust boundaries, actors, purposes, and protections.
Κάρτα 62
Ερώτηση
How do object and volume storage differ?
Απάντηση
Object storage addresses data as objects with metadata; volume storage presents block-like storage to a host. Their access paths, sharing models, snapshots, and permission risks differ.
Κάρτα 63
Ερώτηση
How does ephemeral storage differ from long-term storage?
Απάντηση
Ephemeral storage is tied to a short-lived workload or execution; long-term storage is designed to persist independently. Ephemeral does not mean automatically sanitized.
Κάρτα 64
Ερώτηση
What is raw data storage?
Απάντηση
Storage of collected data before full cleaning, transformation, or enrichment. Its broad content and uncertain quality make isolation, discovery, provenance, and access control especially important.
Κάρτα 65
Ερώτηση
What makes a data-flow map useful for control design?
Απάντηση
It names sources, destinations, transformations, actors, purposes, trust boundaries, and protections. Update it when architecture or processing changes.
Κάρτα 66
Ερώτηση
What should decide whether data may move to another cloud region?
Απάντηση
Classification, purpose, residency and transfer rules, contract terms, threat model, and required controls. Region availability alone is not authorization.
Κάρτα 67
Ερώτηση
Which storage type fits immutable, widely shared blobs better than a mounted transactional filesystem?
Απάντηση
Object storage. Use volume storage when the workload needs block-style filesystem or database access semantics.
Κάρτα 68
Ερώτηση
A short-lived AI training node is terminated. Why can data risk remain?
Απάντηση
Ephemeral compute can leave snapshots, caches, logs, attached volumes, or provider-level remnants. Verify the full storage and key lifecycle, not only instance deletion.
Κάρτα 69
Ερώτηση
What control exposes unknown cloud data stores before they bypass policy?
Απάντηση
Continuous asset and data discovery across accounts, regions, services, and shadow paths. Findings need ownership and remediation, not just inventory.
Κάρτα 70
Ερώτηση
What security property does encryption primarily provide?
Απάντηση
Confidentiality against parties without the key. Integrity and authenticity require an appropriate authenticated mode or separate mechanism.
Κάρτα 71
Ερώτηση
What does tokenization do?
Απάντηση
Replaces sensitive data with a non-sensitive token whose mapping is protected separately. The token can preserve application format while reducing where original data appears.
Κάρτα 72
Ερώτηση
How do structured, semi-structured, and unstructured data differ?
Απάντηση
Structured data follows a fixed schema, semi-structured data carries flexible labels or structure, and unstructured data lacks a consistent field model. Discovery needs techniques suited to each form.
Κάρτα 73
Ερώτηση
What is data masking?
Απάντηση
A transformation that hides selected data while preserving a usable shape or view. Reversible or weak masking is not anonymization.
Κάρτα 74
Ερώτηση
What does Data Loss Prevention monitor or restrict?
Απάντηση
Sensitive-data movement or use across selected channels. DLP depends on discovery, classification, context, coverage, and tuned response.
Κάρτα 75
Ερώτηση
What security property does a cryptographic hash support?
Απάντηση
Integrity by detecting change. A plain hash does not hide the input, prove who created it, or prevent guessing of low-entropy values.
Κάρτα 76
Ερώτηση
What does Information Rights Management add beyond storage permissions?
Απάντηση
Persistent usage rules attached to protected content, such as view, print, copy, expiry, or revocation. Enforcement still depends on trusted identities, clients, and key services.
Κάρτα 77
Ερώτηση
Where should application secrets be kept?
Απάντηση
In a managed secret store with narrow access, audit logs, rotation, and short-lived retrieval. Source code, images, and general configuration files are poor secret stores.
Κάρτα 78
Ερώτηση
What is anonymization trying to achieve?
Απάντηση
Make data no longer reasonably linkable to an identifiable person. Re-identification risk must be assessed against auxiliary data and the release context.
Κάρτα 79
Ερώτηση
Why separate key-custodian duties from data administration?
Απάντηση
To reduce the chance that one person can both reach ciphertext and independently unlock it. Separation of duties should also cover recovery and emergency access.
Κάρτα 80
Ερώτηση
What control reduces dependence on provider-held encryption keys?
Απάντηση
Customer-controlled keys with independent policy and lifecycle management. The choice adds recovery, availability, rotation, and administrator risks that must be designed explicitly.
Κάρτα 81
Ερώτηση
How can tokenization reduce exposure in an application database?
Απάντηση
Store tokens in routine workflows and isolate the token vault or mapping service. Access to detokenization should be rarer and more tightly logged.
Κάρτα 82
Ερώτηση
How can a hash support evidence integrity?
Απάντηση
Record a strong hash at acquisition and verify it after each transfer or analysis step. Chain-of-custody records explain who handled the evidence and why.
Κάρτα 83
Ερώτηση
What is the safer source for non-production test data?
Απάντηση
Synthetic or appropriately transformed data that meets the test need without exposing production identities. Validate re-identification risk before release.
Κάρτα 84
Ερώτηση
What makes DLP enforcement practical instead of noisy?
Απάντηση
Accurate discovery and classification, contextual rules, staged response, tuned exceptions, and incident ownership. Blocking every pattern match can disrupt work without reducing real leakage.
Κάρτα 85
Ερώτηση
What enables IRM revocation after a file leaves its original repository?
Απάντηση
A trusted client that checks current rights and can no longer obtain the needed key or license. Offline copies and screenshots remain boundary cases.
Κάρτα 86
Ερώτηση
How should cloud data discovery handle false positives?
Απάντηση
Route uncertain matches for risk-based validation and tune detection with evidence. Silently discarding them hides coverage gaps; blocking them all creates operational failure.
Κάρτα 87
Ερώτηση
What keeps certificates trustworthy after issuance?
Απάντηση
Inventory, protected private keys, renewal, revocation, validation, and monitored expiry. Issuing a certificate is only the start of its lifecycle.
Κάρτα 88
Ερώτηση
What is envelope encryption?
Απάντηση
Encrypt data with a data-encryption key, then protect that key with a separate key-encryption key. Rotating or rewrapping the key-encryption key can protect existing data-encryption keys without re-encrypting payload data; replacing a data-encryption key may require payload re-encryption.
Κάρτα 89
Ερώτηση
What is data classification?
Απάντηση
Assignment of a sensitivity or business category that drives handling requirements. The category should reflect impact, law, contract, and business need.
Κάρτα 90
Ερώτηση
When is tokenization preferable to ordinary encryption?
Απάντηση
When workflows can use a surrogate while original values stay in a tightly isolated mapping service. Encryption is better when authorized systems must recover data directly with keys.
Κάρτα 91
Ερώτηση
Should a password be encrypted or hashed for verification?
Απάντηση
Hash it with a password-specific salted, slow derivation function. Reversible encryption creates unnecessary recovery of the original password.
Κάρτα 92
Ερώτηση
When is masking insufficient for a public dataset release?
Απάντηση
When remaining fields or external data can reasonably re-identify people. Public release needs a defensible anonymization assessment, not cosmetic redaction.
Κάρτα 93
Ερώτηση
Why should DLP not be the only control against cloud exfiltration?
Απάντηση
It sees only covered channels and recognized content. Least privilege, segmentation, egress control, encryption, monitoring, and response reduce gaps.
Κάρτα 94
Ερώτηση
When is IRM more useful than a repository access control list?
Απάντηση
When usage restrictions must follow a file beyond the original repository. If data never leaves a controlled service, native authorization may be simpler and stronger.
Κάρτα 95
Ερώτηση
Why perform discovery before broad classification enforcement?
Απάντηση
You need to know what data exists and where it lives before applying reliable labels and controls. Enforcement on an incomplete inventory leaves blind spots.
Κάρτα 96
Ερώτηση
What should trigger data reclassification?
Απάντηση
A change in content, use, law, contract, business impact, aggregation, or identifiability. Review should also occur on a defined schedule.
Κάρτα 97
Ερώτηση
Why rotate encryption keys?
Απάντηση
To limit exposure, meet policy, and replace keys after age, role, algorithm, or compromise changes. Rotation must preserve authorized access to older data until it is safely reprotected or retired.
Κάρτα 98
Ερώτηση
Who sets a cloud dataset's business classification?
Απάντηση
The accountable data owner. Automated tools can propose labels, but the owner resolves business context and exceptions.
Κάρτα 99
Ερώτηση
How does a data label differ from a classification policy?
Απάντηση
The label marks a specific asset; the policy defines what the category means and how it must be handled. Labels without enforcement are only metadata.
Κάρτα 100
Ερώτηση
What is a data steward responsible for?
Απάντηση
Day-to-day quality, definition, and policy consistency for data. A steward supports the owner but does not replace the owner's accountability.
Κάρτα 101
Ερώτηση
How do retention and archiving differ?
Απάντηση
Retention states how long data must or may be kept; archiving moves data into a managed long-term state. Archived data remains subject to access, integrity, discovery, and deletion rules.
Κάρτα 102
Ερώτηση
What does a data controller decide?
Απάντηση
The purposes and essential means of processing personal data. The exact legal definition depends on the applicable law.
Κάρτα 103
Ερώτηση
When should a derived dataset inherit its source classification?
Απάντηση
By default, until an accountable owner proves the transformation changed sensitivity. Aggregation can reduce or increase risk depending on content and linkability.
Κάρτα 104
Ερώτηση
How should classification labels affect cloud controls?
Απάντηση
Drive access, encryption, sharing, location, retention, monitoring, and deletion policy. Enforcement should follow the label across supported copies and transformations.
Κάρτα 105
Ερώτηση
What does a legal hold do?
Απάντηση
Suspends normal deletion for information relevant to a legal or regulatory matter. It preserves authorized access and evidence until the hold is released.
Κάρτα 106
Ερώτηση
What should a privacy role contribute to cloud data design?
Απάντηση
Purpose, minimization, transparency, rights, transfer, retention, and impact requirements. Security protects data, while privacy also asks whether processing should occur and under what conditions.
Κάρτα 107
Ερώτηση
What control turns a retention schedule into repeatable cloud behavior?
Απάντηση
Policy-driven lifecycle automation with holds, approvals, exceptions, and audit evidence. Automation must cover replicas and backups where the platform supports it.
Κάρτα 108
Ερώτηση
What is a data custodian responsible for?
Απάντηση
Implementing and operating the technical handling controls. Storage, backup, access, logging, and deletion are typical custody duties.
Κάρτα 109
Ερώτηση
Who should own the retention schedule?
Απάντηση
The records or information-governance function with legal and business input. Technology teams implement the approved schedule and evidence.
Κάρτα 110
Ερώτηση
What does a data processor do?
Απάντηση
Processes personal data for a controller under documented instructions. Using the data for its own new purpose may change the role and obligations.
Κάρτα 111
Ερώτηση
What proves a cloud deletion request was completed responsibly?
Απάντηση
Provider and customer evidence tied to the asset, method, scope, time, and remaining copies. A successful API response alone may not cover backups, replicas, or exported data.
Κάρτα 112
Ερώτηση
Which controls protect a long-term cloud archive?
Απάντηση
Restricted access, durable integrity checks, format and key preservation, redundancy, retention policy, and tested retrieval. An archive that cannot be read or trusted has failed its purpose.
Κάρτα 113
Ερώτηση
Who should approve a training dataset and model version for production?
Απάντηση
The accountable model or system owner using evidence from data, security, privacy, and validation roles. Approval must bind the exact versions and intended use.
Κάρτα 114
Ερώτηση
Which event fields most often establish accountability for cloud data access?
Απάντηση
Trusted identity, action, target, result, timestamp, source context, and relevant network or location data. Collect only attributes needed for the security, legal, and privacy purpose.
Κάρτα 115
Ερώτηση
Why synchronize clocks across cloud evidence sources?
Απάντηση
To correlate events into a defensible timeline. Record time source, zone, drift, and collection context when precision matters.
Κάρτα 116
Ερώτηση
Which risk is present when model outputs reveal features of sensitive training records?
Απάντηση
Model inversion or related privacy inference. Data minimization, privacy testing, output controls, and access limits reduce exposure.
Κάρτα 117
Ερώτηση
Who authorizes and scopes a legal hold?
Απάντηση
An authorized legal or records function. Cloud administrators implement it without deciding the legal scope themselves.
Κάρτα 118
Ερώτηση
What must AI dataset validation check besides file integrity?
Απάντηση
Source authority, consent or permitted use, representativeness, quality, labeling, poisoning indicators, and intended-use fit. A matching checksum only proves the bytes did not change after that checkpoint.
Κάρτα 119
Ερώτηση
Why is an archive not a substitute for a recovery backup?
Απάντηση
An archive optimizes long-term preservation and retrieval; a backup supports restoration after loss or corruption. One system can sometimes serve both only if it meets both control sets and tests.
Κάρτα 120
Ερώτηση
What protects AI dataset and model provenance?
Απάντηση
Versioned inventories, signed or hashed artifacts, controlled pipelines, approval records, and lineage from source to deployment. Bind validation results to the exact artifact versions.
Κάρτα 121
Ερώτηση
Which context should be omitted from a data event log?
Απάντηση
Data that is unnecessary for the defined security, accountability, or legal purpose. More logging can create privacy, cost, and breach risk without improving evidence.
Κάρτα 122
Ερώτηση
What happens when a valid legal hold conflicts with scheduled deletion?
Απάντηση
The authorized hold suspends deletion for the in-scope data. Keep access limited, document the exception, and resume policy when the hold is released.
Κάρτα 123
Ερώτηση
What adds non-repudiation evidence beyond a plain event log?
Απάντηση
Strong identity binding, protected timestamps, integrity controls, and controlled custody. The strength depends on the whole evidence process, not a single hash field.
Κάρτα 124
Ερώτηση
What privacy question does a membership-inference attack answer?
Απάντηση
Whether a particular record was likely part of a model's training data. Limit exposed confidence, query abuse, overfitting, and unnecessary sensitive training data.
Κάρτα 125
Ερώτηση
What is the clearest sign that training-data poisoning controls failed?
Απάντηση
Untrusted or manipulated examples changed model behavior or inserted a hidden trigger. Investigate provenance, pipeline access, validation, and the exact affected versions.
Κάρτα 126
Ερώτηση
What is the strongest first step when an AI use case asks for every available customer field?
Απάντηση
Reduce collection to data necessary for the approved purpose. Minimization lowers privacy, poisoning, access, retention, and breach exposure before technical controls are added.
Κάρτα 127
Ερώτηση
What is the cloud network team's primary security role?
Απάντηση
Implement approved segmentation, routing, edge protection, secure connectivity, and network telemetry. Application teams still define workload access needs.
Κάρτα 128
Ερώτηση
Which layers make up a cloud infrastructure trust stack?
Απάντηση
Physical facilities, network, compute, storage, virtualization, and management services. A workload inherits dependencies and failure modes from every layer beneath or beside it.
Κάρτα 129
Ερώτηση
How do the management plane and data plane differ?
Απάντηση
The management plane configures and governs resources; the data plane carries or processes workload traffic and data. Compromise of the management plane can change many data-plane controls at once.
Κάρτα 130
Ερώτηση
What is a trust boundary in cloud architecture?
Απάντηση
A point where identity, control, ownership, or assurance changes. Data crossing it needs an explicit policy, validation, and protected channel.
Κάρτα 131
Ερώτηση
Who owns a customer's cloud network and identity configuration?
Απάντηση
The customer for the configuration choices it controls. Provider defaults and guardrails help, but do not approve the customer's architecture.
Κάρτα 132
Ερώτηση
What logical control prevents one tenant from reaching another tenant's resources?
Απάντηση
Enforced tenant partitioning across identity, network, compute, storage, and management paths. Test the negative boundary, not only valid access.
Κάρτα 133
Ερώτηση
Why is the cloud management plane a high-value target?
Απάντηση
It can create, modify, expose, or destroy many resources through one privileged interface. Protect it more strongly than routine workload access.
Κάρτα 134
Ερώτηση
What limits lateral movement after one cloud workload is compromised?
Απάντηση
Microsegmentation with identity-aware, least-privilege communication policy. Monitor denied and unusual flows to find attempted spread.
Κάρτα 135
Ερώτηση
How does infrastructure as code improve control assurance?
Απάντηση
It makes configuration reviewable, repeatable, testable, and traceable. Protect the repository, pipeline, state, modules, and deployment identity.
Κάρτα 136
Ερώτηση
How should a team verify an infrastructure control still works?
Απάντηση
Test its intended outcome with current evidence and representative failure or attack conditions. Configuration presence alone does not prove effectiveness.
Κάρτα 137
Ερώτηση
What security boundary should virtualization create between tenants?
Απάντηση
Strong isolation of compute, memory, storage, network, and management operations. Shared hardware still creates side-channel, escape, and noisy-neighbor considerations.
Κάρτα 138
Ερώτηση
Which controls should protect cloud management-plane access?
Απάντηση
Phishing-resistant MFA, privileged access management, separate admin identities, conditional access, least privilege, and immutable logging. Restrict source networks where practical.
Κάρτα 139
Ερώτηση
How do type 1 and type 2 hypervisors differ?
Απάντηση
A type 1 hypervisor runs directly on hardware; a type 2 hypervisor runs on a host operating system. The extra host layer changes attack surface and operational use.
Κάρτα 140
Ερώτηση
Who secures the public cloud facility and physical host?
Απάντηση
The cloud provider. Customers still evaluate the provider's physical assurance and design their service around disclosed locations and failure domains.
Κάρτα 141
Ερώτηση
What protects a cloud AI training cluster from unrelated tenant traffic?
Απάντηση
Dedicated identities, microsegmentation, controlled data paths, hardened images, and monitored management access. Accelerator scheduling and storage paths belong in the boundary.
Κάρτα 142
Ερώτηση
When is packet capture useful in cloud infrastructure?
Απάντηση
When network-level detail is needed and collection is lawful, technically available, scoped, and protected. Flow logs may be safer and sufficient for many investigations.
Κάρτα 143
Ερώτηση
Which control protects detached cloud volumes and snapshots?
Απάντηση
Encryption with governed keys plus explicit access policy. Inventory and delete orphaned copies because detachment does not remove their data.
Κάρτα 144
Ερώτηση
Why correlate infrastructure logs across layers?
Απάντηση
To connect identity, management, network, host, and workload events into one incident path. Preserve original records and normalization context.
Κάρτα 145
Ερώτηση
What is a platform owner's responsibility for tenant isolation?
Απάντηση
Configure, patch, monitor, and test the shared platform so one workload cannot cross its authorized boundary. Consumers must use the platform's isolation features correctly.
Κάρτα 146
Ερώτηση
When should an AI training cluster use stronger isolation than ordinary batch compute?
Απάντηση
When valuable models, sensitive datasets, untrusted code, or high-cost accelerators raise confidentiality, integrity, or exhaustion risk. Match isolation to the workload threat model.
Κάρτα 147
Ερώτηση
What does an HSM protect in cloud infrastructure?
Απάντηση
Cryptographic keys and operations inside a hardened, policy-controlled boundary. An HSM does not decide whether the requesting workload is authorized unless surrounding policy enforces it.
Κάρτα 148
Ερώτηση
What is a failure domain?
Απάντηση
A set of components likely to fail together because they share a dependency. Regions, zones, racks, power feeds, control services, or software versions can define one.
Κάρτα 149
Ερώτηση
A volume is deleted but its snapshots remain. Is the data gone?
Απάντηση
No. The snapshots are separate retained copies. Apply inventory, retention, hold, encryption-key, and deletion policy to every snapshot and replica.
Κάρτα 150
Ερώτηση
How should a platform reduce virtualization escape risk?
Απάντηση
Minimize and patch the virtualization stack, isolate management interfaces, restrict device exposure, monitor anomalies, and contain workloads by risk. Stronger workload boundaries may be needed for hostile tenants.
Κάρτα 151
Ερώτηση
What is the first response to an internet-exposed cloud management endpoint?
Απάντηση
Remove unnecessary public reachability, then enforce strong identity and monitored privileged access. A hidden URL or uncommon port is not a control.
Κάρτα 152
Ερώτηση
What is the facilities team's role in a private cloud data center?
Απάντηση
Operate physical access, power, cooling, fire protection, and environmental monitoring. Security requirements should define evidence and escalation for those systems.
Κάρτα 153
Ερώτηση
Which site-location condition creates direct legal exposure for a cloud workload?
Απάντηση
The jurisdictions that can reach the facility, operator, customers, or data. Cost, hazards, utilities, connectivity, workforce, and physical threats require separate location analysis.
Κάρτα 154
Ερώτηση
How does diverse pathway connectivity improve resilience?
Απάντηση
It prevents one cable route, conduit, carrier handoff, or excavation from cutting every link. Verify physical diversity rather than relying on different circuit names.
Κάρτα 155
Ερώτηση
When does building a private data center make more sense than buying cloud capacity?
Απάντηση
When requirements for control, latency, sovereignty, specialized hardware, or long-term economics outweigh the build and operating burden. Compare full lifecycle cost and resilience, not purchase price alone.
Κάρτα 156
Ερώτηση
Which physical controls protect cloud hardware from unauthorized handling?
Απάντηση
Zoned access, least privilege, identity checks, surveillance, visitor controls, alarms, and custody records. The strength should match asset and data impact.
Κάρτα 157
Ερώτηση
What power design reduces a data center's single-point risk?
Απάντηση
Independent feeds, conditioned distribution, UPS capacity, generators, fuel plans, and tested transfer. Maintenance paths must preserve the intended redundancy.
Κάρτα 158
Ερώτηση
What should environmental monitoring detect in a data center?
Απάντηση
Temperature, humidity, airflow, water, smoke, power, and equipment conditions that threaten service. Alerts need thresholds, escalation, and tested response.
Κάρτα 159
Ερώτηση
How does resilience differ from simple redundancy?
Απάντηση
Redundancy adds alternatives; resilience keeps or restores acceptable service despite disruption. Redundant components can still share one failure domain or bad configuration.
Κάρτα 160
Ερώτηση
Which on-premises physical control remains a customer duty when workloads move to public cloud?
Απάντηση
Protection of customer-controlled offices, endpoints, network links, and any retained equipment. The provider's data-center controls do not secure the customer's physical environment.
Κάρτα 161
Ερώτηση
What are the core outputs of an infrastructure risk assessment?
Απάντηση
Prioritized risks tied to assets, threats, vulnerabilities, likelihood, impact, existing controls, and owners. The output should lead to treatment and follow-up.
Κάρτα 162
Ερώτηση
Who may accept residual infrastructure risk?
Απάντηση
The authorized business risk owner, not the engineer who found it. Acceptance should state scope, duration, rationale, and review trigger.
Κάρτα 163
Ερώτηση
How do a threat, vulnerability, and risk differ?
Απάντηση
A threat can cause harm, a vulnerability is a weakness it may exploit, and risk combines uncertain harm with business impact. A weakness without relevant exposure may be lower priority.
Κάρτα 164
Ερώτηση
What reveals that two supposedly redundant cloud systems share fate?
Απάντηση
They depend on the same control plane, account, region, identity service, network path, software defect, operator, or key. Model those dependencies before counting redundancy.
Κάρτα 165
Ερώτηση
What does a security control owner do?
Απάντηση
Ensures an assigned control is designed, implemented, evidenced, monitored, and corrected. The role may coordinate several technical operators.
Κάρτα 166
Ερώτηση
Which risk treatment options should a cloud team recognize?
Απάντηση
Avoid, mitigate, transfer or share, and accept. Treatment changes exposure or ownership; it does not erase accountability.
Κάρτα 167
Ερώτηση
What is a recovery service level?
Απάντηση
The minimum service capacity or functionality that must be restored, often stated as a percentage of normal service. RSL defines how much service must work; RTO sets the time limit, while RPO sets the maximum data-loss interval.
Κάρτα 168
Ερώτηση
What makes a machine image trustworthy for cloud deployment?
Απάντηση
Known provenance, minimal contents, current patches, signed or verified integrity, vulnerability results, and controlled promotion. Revalidate it when dependencies age.
Κάρτα 169
Ερώτηση
When do multiple availability zones materially improve resilience?
Απάντηση
When the service, data, network, identities, and operations can continue after one zone and its shared dependencies fail. Merely placing instances in two zones is not a tested design.
Κάρτα 170
Ερώτηση
What should determine the strength of an infrastructure security control?
Απάντηση
The asset impact, threat, vulnerability, exposure, legal duties, and risk tolerance. Use control frameworks as structured input, not as an automatic one-size baseline.
340 κάρτες
CCSP 2026 Flashcards: August Exam Outline Review
Μελετήστε αυτήν τη δέσμη δωρεάν
Το Nibomo ανοίγει για να ξεκινήσετε τη μελέτη.
Κάρτα 171
Ερώτηση
Which layered controls improve availability against cloud DDoS?
Απάντηση
Provider edge absorption, rate controls, resilient scaling, caching, WAF or protocol filtering, and an exercised response plan. Scaling alone can turn attack traffic into cost exhaustion.
Κάρτα 172
Ερώτηση
A cloud contract shifts breach costs to a provider. Has the risk been removed?
Απάντηση
No. Financial risk may be transferred, while operational, legal, reputational, and customer harm can remain. Retained exposure still needs mitigation and acceptance.
Κάρτα 173
Ερώτηση
Why map dependencies across compute, storage, and network services?
Απάντηση
A resilient application can still fail when a shared supporting service fails. Dependency maps expose hidden single points, circular recovery steps, and shared fate.
Κάρτα 174
Ερώτηση
What does RPO constrain in an infrastructure recovery design?
Απάντηση
The maximum acceptable data-loss interval measured backward from disruption. It drives backup or replication frequency and consistency choices.
Κάρτα 175
Ερώτηση
What should trigger automated failover?
Απάντηση
Reliable health evidence that the primary cannot meet the service objective, with safeguards against split-brain and false triggers. Manual approval may remain appropriate for ambiguous high-impact cases.
Κάρτα 176
Ερώτηση
When is an IPS preferable to an IDS?
Απάντηση
When inline blocking is justified, tested, and safe for the traffic and availability requirements. Use detection-only when false positives or inline failure would create unacceptable impact.
Κάρτα 177
Ερώτηση
What makes residual infrastructure risk ready for acceptance?
Απάντηση
A clear scenario, affected assets, existing controls, likelihood and impact, owner, duration, alternatives, and review trigger. Vague acceptance is not governance.
Κάρτα 178
Ερώτηση
What makes a cloud backup resistant to account compromise?
Απάντηση
Separate administration, immutable or offline retention, encryption, protected deletion, and tested restore. Keep recovery credentials outside the routine production trust path.
Κάρτα 179
Ερώτηση
What does a BC/DR coordinator own during cloud recovery planning?
Απάντηση
The cross-team plan, exercises, dependencies, contacts, evidence, and follow-up. Service owners still set business priorities and targets.
Κάρτα 180
Ερώτηση
Which recovery design supports a near-zero RPO?
Απάντηση
Synchronous or otherwise strongly consistent replication across independent failure domains, if latency and shared-fate limits are acceptable. Backups still protect against corruption and deletion.
Κάρτα 181
Ερώτηση
Which overlooked dependency can stop users from reaching replicated application servers after failover?
Απάντηση
The identity service. Recovery planning should also cover DNS, keys, secrets, routes, data stores, quotas, and external services.
Κάρτα 182
Ερώτηση
Why test restore separately from backup completion?
Απάντηση
A completed backup may be corrupt, incomplete, inaccessible, or too slow for the target. Restore testing proves usability and measures recovery performance.
Κάρτα 183
Ερώτηση
Why plan failback before declaring a DR design complete?
Απάντηση
Returning to the preferred environment can create another outage, conflict, or data loss. Define authority, synchronization, validation, rollback, and communication.
Κάρτα 184
Ερώτηση
Which design choice most directly supports a short RTO?
Απάντηση
Pre-provisioned or rapidly deployable recovery capacity with automated, tested orchestration. Data, identities, network, dependencies, and operators must be ready too.
Κάρτα 185
Ερώτηση
What should application-security awareness change in a cloud team?
Απάντηση
Daily design and delivery decisions, not just annual quiz results. Use role-specific OWASP, ASVS, SANS Top 25, and LLM-risk examples as practical boundaries, then reinforce them with real defects.
Κάρτα 186
Ερώτηση
What makes an SDLC a secure SDLC?
Απάντηση
Security requirements, design analysis, implementation controls, verification, release evidence, maintenance, and retirement are built into the lifecycle. A final penetration test alone is not a lifecycle.
Κάρτα 187
Ερώτηση
How do functional and non-functional security requirements differ?
Απάντηση
Functional requirements specify security behavior; non-functional requirements set qualities such as availability, performance, resilience, or assurance. Both need measurable acceptance criteria.
Κάρτα 188
Ερώτηση
Who turns business needs into testable application security requirements?
Απάντηση
The product or business owner with security, privacy, legal, and engineering input. Requirements need an accountable owner and acceptance evidence.
Κάρτα 189
Ερώτηση
How should a security requirement remain visible through delivery?
Απάντηση
Trace it to design decisions, code or configuration, tests, approval, and operating evidence. Untraceable requirements are easy to drop during change.
Κάρτα 190
Ερώτηση
What is the purpose of threat modeling?
Απάντηση
Identify likely abuse paths and design mitigations before or during development. Keep the model tied to assets, trust boundaries, architecture changes, and evidence.
Κάρτα 191
Ερώτηση
What makes developer security training actionable?
Απάντηση
Role-specific examples, secure alternatives, practice in the delivery toolchain, and feedback from real defects. Refresh it as platforms and threats change.
Κάρτα 192
Ερώτηση
Should agile delivery remove formal security gates?
Απάντηση
No. It should make them smaller, earlier, automated where reliable, and tied to risk. High-impact changes can still require independent approval.
Κάρτα 193
Ερώτηση
Which cloud-specific application risks need explicit SDLC decisions before coding?
Απάντηση
Shared-technology exposure, provider insiders, limited visibility or control, and legal or jurisdiction boundaries. Record the provider boundary, evidence, data location, isolation, and compensating controls.
Κάρτα 194
Ερώτηση
How do federation and SSO differ?
Απάντηση
Federation establishes trust across identity domains; SSO lets a user authenticate once for multiple services. Federation can enable SSO, but the concepts are not identical.
Κάρτα 195
Ερώτηση
What is a developer's responsibility in secure cloud delivery?
Απάντηση
Use approved patterns, validate inputs and outputs, protect secrets, handle errors safely, review dependencies, and fix findings. Security tools support that judgment rather than replace it.
Κάρτα 196
Ερώτηση
What should a peer security reviewer verify?
Απάντηση
That the change preserves requirements, trust boundaries, authorization, data handling, failure behavior, and evidence. Review the actual diff and deployment effect, not only style.
Κάρτα 197
Ερώτηση
What is the application security architect accountable for?
Απάντηση
Security patterns, trust boundaries, threat decisions, control integration, and documented exceptions. Teams share implementation, but architecture needs coherent ownership.
Κάρτα 198
Ερώτηση
Which threat categories does STRIDE prompt a team to examine?
Απάντηση
Spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. It is a coverage aid, not a risk score.
Κάρτα 199
Ερώτηση
What secure-coding rule most directly prevents broken object authorization?
Απάντηση
Check the current subject's permission for the specific object on every request. ASVS or SAFECode guidance can structure assurance, but hiding identifiers or checking only authentication is insufficient.
Κάρτα 200
Ερώτηση
What should a secret-scanning gate do when it finds a real credential?
Απάντηση
Block exposure, revoke or rotate the credential, remove it from reachable history, and investigate use. Deleting the latest line does not invalidate copied history.
Κάρτα 201
Ερώτηση
How does protected version control support software assurance?
Απάντηση
It creates tamper-evident, access-controlled history for reviewed code and configuration changes. Protect references from unauthorized rewrite, retain audit logs, control bypass, and bind signed artifacts to approved releases; content-addressed commits alone do not make branch history immutable.
Κάρτα 202
Ερώτηση
Which threat-model method is the simplest checklist for threat categories at trust boundaries?
Απάντηση
STRIDE. Use a process-centered method when business impact, attacker paths, and staged analysis need deeper treatment.
Κάρτα 203
Ερώτηση
What is an abuse case?
Απάντηση
A description of how an actor could misuse a feature or violate a security goal. It turns attacker intent into testable defensive behavior.
Κάρτα 204
Ερώτηση
Why should a team avoid treating DREAD scores as objective truth?
Απάντηση
Its ratings are judgment-based and can create false precision. Document evidence, assumptions, impact, and uncertainty instead of relying on one number.
Κάρτα 205
Ερώτηση
How do SAST and DAST differ?
Απάντηση
SAST examines code or compiled artifacts without running the full application; DAST probes a running application from the outside. They find different classes of weakness.
Κάρτα 206
Ερώτηση
What does Software Composition Analysis examine?
Απάντηση
Third-party components, versions, licenses, and known vulnerability or policy data. It does not prove that a dependency is safe in context or detect every malicious package.
Κάρτα 207
Ερώτηση
When should a cloud application's threat model be updated?
Απάντηση
When trust boundaries, data, identities, dependencies, deployment, features, or threats materially change. Periodic review catches slow drift.
Κάρτα 208
Ερώτηση
How do black-box and white-box security testing differ?
Απάντηση
Black-box testing uses external behavior with little internal knowledge; white-box testing uses code, design, or configuration knowledge. Gray-box testing combines partial knowledge with external interaction.
Κάρτα 209
Ερώτηση
What should a CI/CD security gate block?
Απάντηση
A defined, evidence-based release condition such as an exposed secret, failed critical control, unapproved artifact, or unacceptable vulnerability. Keep exceptions explicit, owned, and time-bounded.
Κάρτα 210
Ερώτηση
When is PASTA or ATASM more useful than a short threat checklist?
Απάντηση
When the team needs a structured path from business objectives and architecture to attacker behavior, attack surfaces, and mitigations. Match method depth to decision risk.
Κάρτα 211
Ερώτηση
Where does SAST provide the earliest useful feedback?
Απάντηση
During coding and pull-request review, before deployment. Tune rules, confirm reachability and context, and fix root causes rather than chasing raw counts.
Κάρτα 212
Ερώτηση
When is IAST worth adding to a cloud test pipeline?
Απάντηση
When representative automated tests exist and runtime path-to-code insight will improve triage. Without exercised paths, instrumentation has little to observe.
Κάρτα 213
Ερώτηση
How should an application handle LLM output before passing it to a browser, shell, database, or tool?
Απάντηση
Treat it as untrusted data and validate, encode, constrain, or approve it for the destination. Model fluency is not a security guarantee.
Κάρτα 214
Ερώτηση
What should an abuse-case test assert for a sensitive workflow?
Απάντηση
The application safely rejects or contains a realistic misuse path and leaves useful evidence. Test rate, sequence, privilege, data, and failure-state abuse where relevant.
Κάρτα 215
Ερώτηση
What environment makes DAST results most useful?
Απάντηση
A representative running deployment with safe test data, reachable paths, and observable results. Production testing needs explicit authorization and safeguards.
Κάρτα 216
Ερώτηση
Who owns risk from a third-party software component?
Απάντηση
The organization that chooses and operates it. The supplier supplies evidence and remediation, but outsourcing the component does not outsource customer accountability.
Κάρτα 217
Ερώτηση
How do an SBOM and SCA work together?
Απάντηση
SCA identifies component and policy findings; an SBOM records the released component inventory. Bind both to the exact artifact and update risk when new information appears.
Κάρτα 218
Ερώτηση
What does artifact signing protect in a software supply chain?
Απάντηση
Integrity and authenticated provenance of the signed artifact. Verification policy must also trust the signer, build path, and release authorization.
Κάρτα 219
Ερώτηση
What makes open-source software validated for a cloud application?
Απάντηση
Its source, release, integrity, dependencies, license, maintenance, vulnerabilities, and intended use have been assessed. Open code is inspectable, not automatically safe.
Κάρτα 220
Ερώτηση
Which cloud application control validates XML message structure before processing?
Απάντηση
An XML firewall. A WAF filters web traffic, an API gateway applies API-facing policy, DAM monitors database activity, and a load balancer distributes traffic.
Κάρτα 221
Ερώτηση
What authorization check belongs behind every sensitive API operation?
Απάντηση
A server-side decision for the current identity, action, object, tenant, and context. Gateway authentication alone cannot decide application-level ownership.
Κάρτα 222
Ερώτηση
How should an API treat untrusted input?
Απάντηση
Validate type, structure, size, range, encoding, and allowed semantics before use. Reject unexpected fields where ambiguity or mass assignment creates risk.
Κάρτα 223
Ερώτηση
What is an Identity Provider responsible for in federation?
Απάντηση
Authenticating subjects and issuing trustworthy identity assertions under agreed policy. The relying application still authorizes each requested action.
Κάρτα 224
Ερώτηση
What does sandboxing add to cloud application security?
Απάντηση
A constrained execution boundary for untrusted or risky code and content. Restrict identity, network, files, secrets, time, and compute outside the sandbox too.
Κάρτα 225
Ερώτηση
What should block adoption of a third-party software component?
Απάντηση
Unacceptable provenance, integrity, vulnerability, maintenance, license, access, or exit risk. Popularity and a clean scan do not settle supplier risk.
Κάρτα 226
Ερώτηση
Which test perspective should verify hidden authorization logic?
Απάντηση
White-box review and testing, supported by black-box attempts to cross the boundary. Internal knowledge finds code paths; external tests confirm observable enforcement.
Κάρτα 227
Ερώτηση
Which practice verifies that a cloud release consistently meets defined quality and security criteria?
Απάντηση
Quality Assurance (QA). It plans and tracks repeatable reviews, tests, acceptance evidence, defect handling, and process improvement across delivery.
Κάρτα 228
Ερώτηση
Which IAM controls reduce takeover of a federated cloud account?
Απάντηση
Strong MFA, trusted federation configuration, short sessions, conditional access, lifecycle automation, and monitored privilege. Secure both the IdP and relying service.
Κάρτα 229
Ερώτηση
What is the safest response when retrieved content tells an LLM to ignore system rules?
Απάντηση
Treat the instruction as untrusted data, preserve higher-priority policy, and prevent unauthorized tool or data access. Input filtering alone cannot eliminate prompt injection.
Κάρτα 230
Ερώτηση
How should an LLM application reduce sensitive information disclosure?
Απάντηση
Minimize prompt and training data, enforce retrieval authorization, redact where justified, constrain outputs, and test leakage. A system prompt telling the model to keep secrets is not sufficient.
Κάρτα 231
Ερώτηση
A model repository account is compromised and a backdoored model is published. Which risks overlap?
Απάντηση
Supply-chain compromise and data or model poisoning. Pin trusted versions, verify provenance and signatures, scan safely, validate behavior, and control promotion.
Κάρτα 232
Ερώτηση
What identity should one microservice use to call another?
Απάντηση
A distinct, short-lived workload identity with least-privilege authorization. Avoid sharing broad static credentials across services.
Κάρτα 233
Ερώτηση
How should an agentic LLM be constrained before it can delete cloud resources?
Απάντηση
Give it minimal scoped tools, validate arguments, require approval for destructive actions, enforce budgets, and log every decision and result. Capability should match the smallest authorized task.
Κάρτα 234
Ερώτηση
Should a system prompt be treated as a secret control boundary?
Απάντηση
No. Design as if instructions may be exposed. Keep credentials and authorization outside the prompt, minimize sensitive details, and enforce policy in trusted code.
Κάρτα 235
Ερώτηση
What is the main risk of weak authorization in a shared vector store?
Απάντηση
Retrieval can cross tenant or user boundaries and expose embeddings, documents, or poisoned context. Partition, authorize, validate provenance, and monitor ingestion and queries.
Κάρτα 236
Ερώτηση
When does a CASB add value beside an IdP?
Απάντηση
When the organization needs visibility or policy over cloud-service use, data movement, sessions, or unmanaged access beyond authentication. The IdP establishes identity; the CASB governs selected cloud interactions.
Κάρτα 237
Ερώτηση
How should a high-impact workflow use an LLM answer that may be plausible but false?
Απάντηση
Verify it against authoritative data or require qualified human review before action. Communicate uncertainty and preserve source evidence.
Κάρτα 238
Ερώτηση
Which controls address unbounded LLM consumption?
Απάντηση
Per-user and per-task quotas, rate limits, token and tool budgets, timeouts, concurrency limits, anomaly alerts, and safe cancellation. Monitor financial as well as availability impact.
Κάρτα 239
Ερώτηση
How do an HSM and a TPM differ?
Απάντηση
An HSM protects shared or service cryptographic operations; a TPM anchors trust to one platform. Both protect keys, but their scope and use cases differ.
Κάρτα 240
Ερώτηση
What does secure by default mean for cloud infrastructure?
Απάντηση
A new resource starts in the least exposed, least privileged, approved state. Users must make an explicit, reviewed choice to widen access or capability.
Κάρτα 241
Ερώτηση
Why do virtual CPU, memory, storage, and network settings have security impact?
Απάντηση
They define resource exposure, isolation, exhaustion limits, and device access. Overbroad virtual hardware can create attack paths or noisy-neighbor risk.
Κάρτα 242
Ερώτηση
Which hypervisor type is usually preferred for production cloud hosts?
Απάντηση
A type 1 hypervisor because it removes the general-purpose host OS layer. The actual choice still depends on assurance, patching, management, and workload needs.
Κάρτα 243
Ερώτηση
How can TPM-backed measured boot support cloud host assurance?
Απάντηση
Measurements anchor boot components to hardware so an attestation service can compare them with approved state. The decision still depends on trusted reference values and response policy.
Κάρτα 244
Ερώτηση
How should guest OS virtualization tools be installed and maintained?
Απάντηση
Use provider-authorized packages, enable only needed features, match supported versions, patch promptly, and monitor their privilege. Remove stale tools that widen the host-to-guest boundary.
Κάρτα 245
Ερώτηση
What is cloud platform operations responsible for after secure build?
Απάντηση
Maintaining approved configuration, availability, patching, monitoring, backup, access, and evidence. Operations should feed recurring defects back into design.
Κάρτα 246
Ερώτηση
What does a privileged access administrator control?
Απάντηση
The issuance, elevation, monitoring, review, and revocation of administrative access. Separate the access-control role from routine use where practical.
Κάρτα 247
Ερώτηση
What is the safer pattern for remote SSH administration?
Απάντηση
Short-lived identity-based access through a controlled path with host verification, least privilege, session logging, and no shared keys. Disable direct root login.
Κάρτα 248
Ερώτηση
When should a cloud workload require platform attestation?
Απάντηση
When access depends on proof that the host or confidential environment is in an approved measured state. Define what is measured, who verifies it, and what failure does.
Κάρτα 249
Ερώτηση
Which protocol adds origin authentication and integrity to DNS data?
Απάντηση
DNSSEC. TLS protects a transport session, a VPN protects traffic across an untrusted boundary, and DHCP safeguards prevent rogue address or configuration assignment.
Κάρτα 250
Ερώτηση
What should enforce separation between cloud network zones?
Απάντηση
Routing and firewall or security-group policy tied to explicit allowed flows. VLANs can organize segments but do not enforce policy by themselves.
Κάρτα 251
Ερώτηση
How do IDS and IPS differ operationally?
Απάντηση
An IDS alerts on suspected activity; an IPS sits inline and can block it. Inline prevention adds availability and false-positive risk.
Κάρτα 252
Ερώτηση
What reduces RDP exposure in a cloud environment?
Απάντηση
Remove direct internet access, require a hardened gateway or private path, strong MFA, current patches, device checks, and session monitoring. Limit clipboard and drive redirection by need.
Κάρτα 253
Ερώτηση
What makes a honeypot safe enough to operate?
Απάντηση
Isolation, no production trust, controlled data, monitored egress, legal approval, and an incident plan. It should observe attackers without becoming their launch point.
Κάρτα 254
Ερώτηση
How do high availability and backup differ?
Απάντηση
High availability keeps service running through component failure; backup restores data or state after loss or corruption. One does not replace the other.
Κάρτα 255
Ερώτηση
How should firewall, IDS, and IPS controls be layered?
Απάντηση
Firewalls constrain allowed paths, IDS detects suspicious activity, and IPS may block selected attacks inline. Central telemetry and tuned ownership make the layers useful.
Κάρτα 256
Ερώτηση
When is a cloud security group insufficient as the only network control?
Απάντηση
When application-aware filtering, centralized inspection, advanced threat detection, or cross-environment policy is required. Keep security groups as workload-level least-privilege boundaries.
Κάρτα 257
Ερώτηση
How should management-plane tools be installed?
Απάντηση
From verified sources through a controlled, minimal, hardened build with separate privileged access and logging. Remove sample accounts, unused plugins, and default exposure.
Κάρτα 258
Ερώτηση
What is patch management?
Απάντηση
A controlled lifecycle for identifying, prioritizing, testing, deploying, verifying, and documenting security and reliability updates. Asset inventory and exception ownership are prerequisites.
Κάρτα 259
Ερώτηση
How do performance and capacity monitoring differ?
Απάντηση
Performance monitoring measures current service behavior; capacity monitoring forecasts whether resources can meet future demand. Both need business thresholds and trends.
Κάρτα 260
Ερώτηση
How do change, release, and deployment management differ?
Απάντηση
Change management authorizes and controls modification; release management packages approved capability; deployment management moves it into an environment. One workflow may integrate all three without erasing their goals.
Κάρτα 261
Ερώτηση
What should decide whether an IPS blocks automatically?
Απάντηση
Detection confidence, asset criticality, attack impact, false-positive cost, bypass behavior, and rollback. Start with observation when evidence is weak.
Κάρτα 262
Ερώτηση
Who owns a patch exception?
Απάντηση
The authorized system or risk owner, with technical evidence from operations and security. The exception needs compensating controls, expiry, and review.
Κάρτα 263
Ερώτηση
What does a capacity manager protect?
Απάντηση
The service's ability to meet current and forecast demand within cost and resilience constraints. The role tracks trends, thresholds, quotas, and scaling lead time.
Κάρτα 264
Ερώτηση
What is the change manager's security role?
Απάντηση
Ensure risk, testing, authorization, scheduling, rollback, and communication are proportionate to the change. Emergency changes still need retrospective evidence.
Κάρτα 265
Ερώτηση
What should a backup-and-restore control verify for guest systems?
Απάντηση
Required data and configuration are captured, protected, retained, and restored within targets. Include application consistency, keys, dependencies, and documented restore order.
Κάρτα 266
Ερώτηση
Which management process keeps a cloud service able to meet its agreed uptime and reliability targets?
Απάντηση
Availability management. It analyzes failure patterns, resilience, maintainability, and recovery so the service can meet those targets.
Κάρτα 267
Ερώτηση
What improves patch prioritization beyond a severity score?
Απάντηση
Exploitability, exposure, asset importance, compensating controls, dependency, and business impact. Verify remediation and track unsupported assets separately.
Κάρτα 268
Ερώτηση
What turns performance and capacity alerts into an availability control?
Απάντηση
Thresholds tied to service objectives, trend analysis, ownership, safe scaling, and tested response. Alert volume without action is not capacity management.
Κάρτα 269
Ερώτηση
What should a configuration-management system record?
Απάντηση
Approved items, owners, versions, relationships, baselines, changes, and current state. Cloud discovery should reconcile actual resources with declared configuration.
Κάρτα 270
Ερώτηση
Why place a cluster host into maintenance mode?
Απάντηση
To drain or protect workloads before planned work while preserving cluster policy. Verify capacity, placement constraints, and stateful-service behavior first.
Κάρτα 271
Ερώτηση
Which management process agrees, monitors, and reviews measurable service targets with customers?
Απάντηση
Service-level management. It turns business needs into agreed service objectives, tracks results, and drives action when performance misses them.
Κάρτα 272
Ερώτηση
Which hardware signals should cloud facilities monitor?
Απάντηση
Disk health, CPU and memory errors, fan and temperature state, power, and vendor fault telemetry. Correlate physical signals with host and workload impact.
Κάρτα 273
Ερώτηση
How should an OS hardening baseline be maintained?
Απάντηση
Version it, test it, measure compliance, remediate drift, record exceptions, and update it for new threats and platform changes. Apply separate profiles to distinct workloads.
Κάρτα 274
Ερώτηση
How do incident management and problem management differ?
Απάντηση
Incident management restores service and limits harm; problem management finds and removes underlying causes. The same event can open both tracks.
Κάρτα 275
Ερώτηση
Which management process coordinates security risk and controls across cloud service operation?
Απάντηση
Information security management. It aligns policy, risk treatment, control operation, evidence, incidents, and improvement with the service-management system.
Κάρτα 276
Ερώτηση
Which management process turns recurring service-control gaps into measured improvements?
Απάντηση
Continual service improvement management. It prioritizes opportunities, defines a measurable target and owner, implements change, and verifies the outcome.
Κάρτα 277
Ερώτηση
How should operations choose among NIST, ISO, COBIT, CIS Controls, COSO, ITIL, or ISO/IEC 20000-1?
Απάντηση
Map the applicable framework or standard to the organization's legal duties, risks, service goals, and evidence needs. The names are not interchangeable, and adoption alone does not prove control effectiveness.
Κάρτα 278
Ερώτηση
A service is restored after repeated crashes. Which process continues the root-cause work?
Απάντηση
Problem management. Incident management can close after stable restoration while the underlying defect, workaround, and prevention remain tracked.
Κάρτα 279
Ερώτηση
Which management process owns tested arrangements for sustaining or restoring critical services after severe disruption?
Απάντηση
Continuity management. Incident management handles the current event, while availability management focuses on meeting service uptime and reliability targets.
Κάρτα 280
Ερώτηση
What does a cloud forensic lead decide?
Απάντηση
The lawful collection strategy, volatile-data priorities, tools, provider coordination, preservation, and analysis plan. The lead should understand cloud-specific evidence limits.
Κάρτα 281
Ερώτηση
What does chain of custody record?
Απάντηση
Who collected, handled, transferred, stored, analyzed, and disposed of evidence, when and why. Integrity checks support the record but do not replace it.
Κάρτα 282
Ερώτηση
What does an incident commander own?
Απάντηση
Priorities, roles, decisions, coordination, cadence, and safe handoffs during an incident. Technical responders investigate and act within that structure.
Κάρτα 283
Ερώτηση
What does the incident communications lead control?
Απάντηση
Approved messages, audiences, channels, timing, records, and coordination with legal and leadership. Technical certainty and disclosure obligations may change during the event.
Κάρτα 284
Ερώτηση
How do a SOC, SIEM, and SOAR relate?
Απάντηση
A SOC is the operating function, a SIEM centralizes and analyzes security events, and SOAR coordinates automated workflows. People, process, authority, and evidence connect the tools.
Κάρτα 285
Ερώτηση
What is an evidence custodian responsible for?
Απάντηση
Controlled storage, access, transfer, integrity verification, retention, and chain-of-custody records. The custodian preserves evidence without altering its meaning.
Κάρτα 286
Ερώτηση
How should a SOC use threat intelligence?
Απάντηση
Map relevant, timely indicators and adversary behavior to assets, detections, hunts, and decisions. Expire stale indicators and separate confidence from fact.
Κάρτα 287
Ερώτηση
How should AI-assisted security monitoring be governed?
Απάντηση
Validate data and models, measure errors and drift, limit action authority, log reasoning inputs and outcomes, and keep human review for consequential cases. Compare against a safe manual path.
Κάρτα 288
Ερώτηση
When is a cloud snapshot suitable forensic evidence?
Απάντηση
When collection is authorized, scope and timing are documented, integrity is protected, and the snapshot preserves relevant state. It may omit memory, external services, or rapidly changing logs.
Κάρτα 289
Ερώτηση
Who decides whether a regulator must be notified during a cloud incident?
Απάντηση
The authorized legal or compliance owner under the incident plan. Vendor and communications owners coordinate channels; engineers supply verified facts.
Κάρτα 290
Ερώτηση
What should a forensic plan obtain from the cloud provider before an incident?
Απάντηση
Available logs and APIs, retention, time sources, support contacts, legal process, evidence formats, isolation options, and responsibility boundaries. Confirm access with an exercise.
Κάρτα 291
Ερώτηση
How should vulnerability assessment and penetration testing work together?
Απάντηση
Assessment finds and prioritizes likely weaknesses broadly; authorized penetration testing demonstrates selected exploit paths and impact. Both require scoped remediation and retest.
Κάρτα 292
Ερώτηση
How should a SIEM protect cloud log value?
Απάντηση
Normalize without losing source evidence, control access, preserve time and integrity, correlate identities and assets, tune detections, and retain by purpose. Monitor collection gaps.
Κάρτα 293
Ερώτηση
What should SOAR do when a playbook's evidence is incomplete?
Απάντηση
Pause or take only a safe reversible step, preserve context, and escalate to an authorized human. Do not let automation convert uncertainty into broad containment damage.
Κάρτα 294
Ερώτηση
When should incident communication wait?
Απάντηση
Only when authorized coordination is needed to verify facts, protect response, or meet a defined legal strategy. Do not delay a mandatory notice past its trigger or deadline.
Κάρτα 295
Ερώτηση
When is penetration testing more useful than another vulnerability scan?
Απάντηση
When the organization needs authorized evidence that selected weaknesses can combine into a meaningful attack path. Scanning remains better for broad, repeatable coverage.
Κάρτα 296
Ερώτηση
Which evidence should be collected first from a running cloud workload?
Απάντηση
The most volatile, relevant evidence that will disappear earliest, if collection is authorized and safe. Balance volatility against service impact and contamination risk.
Κάρτα 297
Ερώτηση
Why can cloud data be subject to more than one jurisdiction?
Απάντηση
Customers, providers, processing, storage, people, contracts, and affected individuals may sit in different places. Location and legal reach are related but not identical.
Κάρτα 298
Ερώτηση
Why are privacy roles contextual rather than permanent labels?
Απάντηση
An organization can be controller for one processing purpose and processor for another. Determine the role from actual decisions and instructions, not the company type.
Κάρτα 299
Ερώτηση
What should legal counsel contribute to cloud design?
Απάντηση
Interpret applicable law, privilege, contracts, disputes, preservation, disclosure, and legal risk. Counsel advises; accountable business owners still decide within authority.
Κάρτα 300
Ερώτηση
What is eDiscovery?
Απάντηση
The identification, preservation, collection, processing, review, and production of electronically stored information for a legal matter. Cloud scale and provider control affect each step.
Κάρτα 301
Ερώτηση
How do contractual and regulated private data differ?
Απάντηση
Contractual duties come from agreed terms; regulated duties come from applicable law. The same data can be subject to both, and the stricter combined obligations may govern.
Κάρτα 302
Ερώτηση
What is the controller's contract duty toward a cloud processor?
Απάντηση
Give documented instructions, choose and oversee a capable processor, and define required privacy and security terms. Applicable law may add specific clauses and audit duties.
Κάρτα 303
Ερώτηση
What is a Privacy Impact Assessment?
Απάντηση
A structured evaluation of how planned processing affects people and how privacy risk will be handled. Perform it early enough to change the design.
Κάρτα 304
Ερώτηση
What is an ISMS?
Απάντηση
A managed system of policies, risk processes, controls, evidence, review, and continual improvement for information security. It is broader than a control checklist or toolset.
Κάρτα 305
Ερώτηση
What does a contract's choice-of-law clause do?
Απάντηση
Names the law intended to govern the contract. It does not automatically override mandatory laws or every court's jurisdiction.
Κάρτα 306
Ερώτηση
What makes a legal hold operationally defensible in cloud systems?
Απάντηση
Authorized scope, prompt preservation, deletion suspension, controlled collection, access logging, periodic review, and documented release. Test whether provider features cover all copies.
Κάρτα 307
Ερώτηση
Does calling a field PII or PHI settle every privacy obligation?
Απάντηση
No. Applicability depends on the data, person, entity, purpose, context, and governing law or contract. Classify with qualified privacy and legal input.
Κάρτα 308
Ερώτηση
Which design control reduces privacy risk before consent screens and notices?
Απάντηση
Data minimization tied to a specific approved purpose. Collecting less reduces exposure, rights handling, retention, and breach impact.
Κάρτα 309
Ερώτηση
What is a processor's core duty toward controller data?
Απάντηση
Process it only under authorized instructions and required legal obligations, while applying agreed controls and assistance. Subprocessors need governed approval and flow-down terms.
Κάρτα 310
Ερώτηση
What control reveals cross-border cloud data processing before it becomes a compliance surprise?
Απάντηση
A maintained data and subprocessors map tied to locations, purposes, roles, transfers, and safeguards. Reconcile contracts with actual telemetry and provider disclosures.
Κάρτα 311
Ερώτηση
How do internal and external audits differ?
Απάντηση
Internal audit provides independent assurance inside the organization; external audit is performed by an outside party for a defined objective. Both require scope, criteria, evidence, and independence.
Κάρτα 312
Ερώτηση
When should a PIA be reopened?
Απάντηση
When purpose, data, people, model, provider, location, sharing, retention, or risk materially changes. A one-time assessment becomes stale as processing evolves.
Κάρτα 313
Ερώτηση
How should a cloud team use GDPR, PIPEDA, India's DPDP Act, FERPA, HIPAA, ISO/IEC 27018, or GAPP?
Απάντηση
First determine which laws apply, then map their obligations and any selected framework guidance to actual processing and controls. A named standard or provider region is not automatic compliance.
Κάρτα 314
Ερώτηση
Two countries impose conflicting duties on the same cloud records. What is the first move?
Απάντηση
Escalate to qualified counsel with the exact data, actors, locations, contracts, orders, and timelines. Preserve evidence and avoid an irreversible technical action based on guesswork.
Κάρτα 315
Ερώτηση
What protects an internal auditor's independence?
Απάντηση
Authority to assess outside the operation being audited, objective reporting, and freedom from designing or owning the control under review. Internal employment does not prevent independence if governance is sound.
Κάρτα 316
Ερώτηση
What does a privacy officer oversee?
Απάντηση
Privacy governance, impact assessment, rights, transparency, lawful processing, transfers, incidents, and regulator engagement. The exact statutory role varies by jurisdiction.
Κάρτα 317
Ερώτηση
What do SOC, SSAE, and ISAE labels tell an assurance-report reader?
Απάντηση
SOC identifies a service-organization report family, while SSAE and ISAE identify attestation standards used for defined engagements. The exact report type, criteria, period, scope, exceptions, and subservices determine its value.
Κάρτα 318
Ερώτηση
What must an audit plan define before cloud audit fieldwork starts?
Απάντηση
The objective, criteria, scope, responsibilities, schedule, methods, evidence access, and reporting path. The plan should also name constraints and follow-up ownership.
Κάρτα 319
Ερώτηση
How do risk appetite and risk tolerance differ?
Απάντηση
Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain; tolerance sets acceptable variation around objectives. Both guide escalation and treatment.
Κάρτα 320
Ερώτηση
What does an enterprise risk owner decide?
Απάντηση
Whether to avoid, mitigate, transfer or share, or accept a documented risk within authority. The owner tracks residual exposure and review triggers.
Κάρτα 321
Ερώτηση
How should risk metrics be designed?
Απάντηση
Tie each metric to a decision, owner, threshold, reliable source, trend, and response. Separate leading indicators from lagging outcomes and guard against easy gaming.
Κάρτα 322
Ερώτηση
What is gap analysis?
Απάντηση
Comparison of current control state with a required or target state. Each gap needs impact, owner, treatment, evidence, and due date.
Κάρτα 323
Ερώτηση
What makes cloud audit evidence reliable?
Απάντηση
Clear criteria, complete scope, trustworthy source, protected integrity, accurate time, repeatable collection, and accountable ownership. Screenshots without context are weak evidence.
Κάρτα 324
Ερώτηση
Why does a distributed cloud model complicate audit scope?
Απάντηση
Controls, evidence, people, providers, and data span locations and jurisdictions with different access and retention limits. Define boundaries and shared responsibilities before fieldwork.
Κάρτα 325
Ερώτηση
Can a clean SOC report prove compliance with a customer's specialized regulation?
Απάντηση
No. Map the report's criteria, period, scope, exceptions, subservices, and customer controls to the specific requirement. NERC CIP, HIPAA, HITECH, PCI, or another regime may need additional evidence.
Κάρτα 326
Ερώτηση
What should a customer assess in a cloud provider's risk-management program?
Απάντηση
Whether its policies, methods, controls, risk profile, and appetite fit the customer's requirements and exposure. Review evidence before selection and when material risk changes.
Κάρτα 327
Ερώτηση
What is a data owner's enterprise-risk role?
Απάντηση
Set business value, classification, allowed use, access, retention, and acceptable risk for the data. Custodians implement the resulting controls.
Κάρτα 328
Ερώτηση
What AI evidence supports accountability and explainability without promising perfect interpretation?
Απάντηση
Document intended use, data and model versions, decision roles, testing, limitations, human oversight, outputs, changes, and incident history. Match explanation depth to affected people and legal duties.
Κάρτα 329
Ερώτηση
What does a data steward add to governance?
Απάντηση
Consistent definitions, quality rules, metadata, lineage, and policy application across business use. The steward connects business meaning to operational handling.
Κάρτα 330
Ερώτηση
What is procurement's security role in cloud outsourcing?
Απάντηση
Make required risk, assurance, pricing, ownership, exit, and supplier terms part of selection and negotiation. Security requirements lose force if added after commercial commitment.
Κάρτα 331
Ερώτηση
When should an organization avoid a cloud risk rather than mitigate it?
Απάντηση
When stopping the activity is feasible and residual exposure would remain outside appetite or legal authority. Compare the business consequence of avoidance with other treatments.
Κάρτα 332
Ερώτηση
What is an external auditor responsible for?
Απάντηση
Perform the agreed independent engagement against stated criteria and report within its scope. The auditor does not own management's controls or risk decisions.
Κάρτα 333
Ερώτηση
How do an MSA, SOW, and SLA differ?
Απάντηση
The MSA sets the general legal relationship, the SOW defines specific work and deliverables, and the SLA sets measurable service commitments. Read them together for the full obligation.
Κάρτα 334
Ερώτηση
What should a cloud risk register contain?
Απάντηση
Scenario, assets, cause, consequence, owner, likelihood, impact, controls, treatment, residual risk, due dates, and review triggers. Link evidence and dependencies where useful.
Κάρτα 335
Ερώτηση
Who should own a cloud contract after signature?
Απάντηση
A named contract or vendor manager with business, legal, security, privacy, and service stakeholders. Ownership includes obligations, evidence, changes, renewals, disputes, and exit.
Κάρτα 336
Ερώτηση
Which contract controls support a safe cloud exit?
Απάντηση
Data and configuration export, assistance, timing, format, cost, continued access, verified deletion, transition support, and survival of needed duties. Exercise the exit path before a crisis.
Κάρτα 337
Ερώτηση
What makes a contractual right to audit usable?
Απάντηση
Defined scope, notice, frequency, methods, evidence access, confidentiality, cost, remediation, and alternatives when direct testing is unsafe. A vague right may be impossible to exercise.
Κάρτα 338
Ερώτηση
When does source-code escrow reduce cloud vendor viability risk?
Απάντηση
When usable code plus dependencies, documentation, rights, updates, and release triggers can support continuity. Escrow adds little if the customer cannot operate the service.
Κάρτα 339
Ερώτηση
What should a cloud incident-notification clause define?
Απάντηση
Trigger, timing, recipient, secure channel, minimum facts, updates, cooperation, evidence, regulator support, and subcontractor flow-down. Avoid waiting for the provider's final root cause before notice.
Κάρτα 340
Ερώτηση
What should happen to customer data when a cloud contract ends?
Απάντηση
Return or export it in a usable form, preserve only what is lawfully required, revoke access, and verify deletion across in-scope copies under the contract. Data ownership and transition duties should be settled before purchase.

Abstract cloud infrastructure with layered security boundaries, connected control nodes, and an AI model graph.

340 κάρτες