Your company decides to deploy the CRM system, which is developed by an in-house integrated product team (IPT) located at a remote branch, to PaaS provisioned by a public cloud services provider. As a security professional, you are reviewing the security plan. Which of the following least contributes to cloud security?
A. Enforce granular access control by implementing XACML.
B. Fulfill Zero Trust authorization by incorporating threat intelligence.
C. Deploy the CRM application to the PaaS from the remote branch by DevOps.
D. Trust the cloud services provider but verify by conducting periodic field audits.

Continue reading →

The complexity of the local and remote infrastructure and cloud services blurred the enterprise perimeter. It resulted in the emergence of the Zero Trust approach to developing a new security model to address the issue. Which of the following statements about Zero Trust is not true?
A. Zero Trust security assumes remote users are less trustworthy than internal users.
B. Zero Trust security controls access to resources in a dynamic and granular fashion.
C. Zero Trust is a set of guiding principles for workflow, system design, and operations.
D. Zero Trust implementations are in favor of a hybrid Zero Trust/perimeter-based mode.

Continue reading →

You are the development team leader and recently found your nightly build failed from time to time. Eve was a disgruntled developer in your team and quit last month. She is responsible for part of the solution and not authorized to integrate the solution. She installed a program running under the local system privilege to delete, on Monday midnights, some source code in the local code repository pushed to the central code repository to be integrated. You decide to conclude that Eve is accountable for the failures of the nightly builds. Which of the following is the least important?
A. Authentication
B. Authorization
C. Auditing
D. Non-repudiation

Continue reading →

A client generates a session key randomly, encrypts it using a server’s public key, and sends it to the server which decrypts the session key using its private key to initiate a secure channel. Which of the following best describes this process?
A. Diffie-Hellman
B. Key agreement
C. Key exchange
D. Authentication

Continue reading →