D320 Managing Cloud Security - Set 4 - Part 1

Correct Answer: Homomorphic Encryption

Homomorphic Encryption allows data to be processed while encrypted, protecting it in use. Data Masking, Tokenization, and Disk Encryption focus on protecting data at rest or in transit.

Correct Answer: HIPAA

HIPAA is designed to protect the privacy and security of healthcare data. PCI DSS governs payment card data, GDPR protects personal data within the EU, and SOX focuses on corporate governance.

Correct Answer: Problem Management

Problem Management aims to identify and resolve issues before they cause incidents. Incident Management deals with incidents after they occur, while Change Management and Service Level Management focus on other aspects.

Correct Answer: Risk Avoidance

Risk Avoidance involves discontinuing activities that introduce risk, while Risk Mitigation reduces risks, Risk Transference shifts risks to another party, and Risk Acceptance involves tolerating the risk.

Correct Answer: FERPA

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student educational records. HIPAA focuses on healthcare data, SOX governs corporate governance, and GLBA deals with financial information.

Correct Answer: Centralizing and analyzing security logs

SIEM systems centralize security logs and analyze them to detect and respond to potential threats. Managing access, configuring firewalls, and encryption are separate controls.

Correct Answer: Service Level Management

Service Level Management ensures that cloud services meet or exceed the expectations set out in the SLa) Other processes manage specific aspects of cloud operations but do not ensure SLA compliance.

Correct Answer: Quantitative Risk Analysis

Quantitative Risk Analysis calculates financial loss using numerical values, while Qualitative Risk Analysis ranks risks subjectively. Risk Mitigation and Transference are strategies for managing risks.

Correct Answer: PCI DSS

PCI DSS is a standard designed to protect payment card data. HIPAA governs healthcare data, ISO/IEC 27001 is a general information security standard, and GDPR focuses on personal data protection within the EU.

Correct Answer: Load Testing

Load Testing evaluates how well cloud services can handle increased demand. Functional Testing checks if the service works as expected, Penetration Testing assesses security vulnerabilities, and Compliance Testing ensures adherence to regulations.

Correct Answer: SOC 2

SOC 2 reports provide assurance about security, availability, and confidentiality controls. SOC 1 focuses on financial controls, while ISO/IEC 27001 certification and HIPAA reports cover other compliance requirements.

Correct Answer: Risk Acceptance

Risk Acceptance involves choosing to accept the risk and its potential impact, while Risk Mitigation reduces risks, Risk Avoidance eliminates them, and Risk Transference shifts them to another party.

Correct Answer: SSL/TLS

SSL/TLS encrypts data in transit to protect it from interception. Disk Encryption protects data at rest, while Data Masking and Homomorphic Encryption serve other purposes.

Correct Answer: Risk Transference

Risk Transference involves sharing the risk with another party, such as through insurance. Risk Acceptance involves taking no action, Risk Mitigation reduces risks, and Risk Avoidance eliminates them.

Correct Answer: Homomorphic Encryption

Homomorphic Encryption allows data to be processed while encrypted. Tokenization and Data Masking serve different purposes, while Symmetric Encryption does not allow for encrypted processing.

Correct Answer: Collecting only necessary data

Data Minimization requires organizations to collect only the data necessary for specific purposes. Accuracy, breach notification, and encryption are other GDPR requirements but fall under different principles.

Correct Answer: SSL/TLS

SSL/TLS is used to secure communication between web browsers and servers. Symmetric and Asymmetric Encryption are general encryption methods, while Homomorphic Encryption is used for processing encrypted data.

Correct Answer: GDPR

GDPR focuses on the privacy and protection of personal data in the EU. HIPAA governs healthcare data, PCI DSS is for payment card data, and SOX focuses on corporate governance.

Correct Answer: Adjusting resources to meet demand

Capacity Management ensures that cloud resources are available to meet demand efficiently. Centralizing logs is the role of SIEM systems, while access control and incident recovery are handled by other processes.

Correct Answer: PCI DSS

PCI DSS is a standard for securing credit card data. HIPAA governs healthcare data, ISO/IEC 27001 is a general security framework, and GDPR protects personal data in the EU.