Security+ Exam Chapter 10

Front 1

Cloud Computing

Back 1

Cloud service providers deliver computing services to their customers over the internet. The big 3 are AWS, Microsoft Azure, and Google Cloud Platform

Front 2

Oversubscription

Back 2

A shared pool of resources that may be configured for different purposed by different users. Not everyone will use all their resources at the same time and it achieves economies of scale.

Front 3

Multitenancy

Back 3

Many different users share resources in the same cloud infrastructure. The same physical hardware might support the workloads and storage needs of many different customers, all whom operate without any knowledge of or interaction with their fellow customers.

Front 4

On Demand Self Service Computing

Back 4

Benefit of the cloud, cloud resources are available when and where you need them.

Front 5

Scalability

Back 5

Customers can manually or automatically increase the capacity of their operations.

Front 6

Vertical scaling

Back 6

Increases the capacity of existing servers. Just like opening up a server and adding physical hardware in an on-premise situation

Front 7

Horizontal Scaling

Back 7

Adds more servers to a pool of clusters servers. This can be done very quick and easy and can replicate existing servers

Front 8

Elasticity

Back 8

Capacity should expand and contract as needs change to optimize costs.

Front 9

Measured Service

Back 9

Everything you do in the cloud is measured by the service provider. All the information about your usage allows the provider to bill you for exactly what you used.

Front 10

Agility and Flexibility

Back 10

The speed to provision cloud resources and the ability to use them for short periods of time lends tremendous agility and flexibility

Front 11

Cloud Service Providers

Back 11

Are the firms that offer cloud computing services to their customers

Front 12

Cloud Consumers

Back 12

The organizations and individuals who purchase cloud services from cloud service providers

Front 13

Cloud Partners/Brokers

Back 13

Organizations that offer companion products or services that support or integrate with the offerings of a cloud service provider

Front 14

Cloud Auditors

Back 14

Independent organizations that provide third party assessments of cloud services and operations. They provide a general assessment of a cloud environment or focus on security controls

Front 15

Cloud Carriers

Back 15

Serve as the intermediaries that provide the connectivity that allows the delivery of cloud services from providers to consumers

Front 16

IaaS

Back 16

Infrastructure as a Service. Allow customers to purchase and interact with the basic building blocks of a technology infrastructure. These include computing, storage, and networks. Customers can customize the components of hardware to meet their needs

Front 17

SaaS

Back 17

Software as a Service provide customers with access to a fully managed application running in the cloud. The provider is responsible for everything from the operation of the physical data centers to the performance management of the application itself. The customer is only responsible for the limited configuration of the application and the application provided access controls

Front 18

PaaS

Back 18

Platform as a Service, is the middle ground of IaaS and SaaS. The service provider offers a platform where customers may run applications that they have developed themselves.

Front 19

FaaS

Back 19

Function as a Service, falls under PaaS and allows customers to upload their own code functions to the provider and then the provider will execute those functions on a scheduled basis, in response to events, and/or on demand

Front 20

Serverless Computing

Back 20

Do not expose customers to the actual server instances executing their code. It is a misnomer because servers are being used but in a manner that is transparent to the customer

Front 21

MSP

Back 21

Managed service provider are services organizations that provide information technology as a service to their customers. They may handle an organization’s IT needs completely, or offer focused services

Front 22

MSSP

Back 22

Managed security service provider which are services offered to include security monitoring, vulnerability management, incident response, and firewall management

Front 23

Public Cloud

Back 23

Public cloud service providers deploy infrastructure and then make it accessible to any customers who wish to take advantage of it in a multi tenant model. This is AWS, Azure, GCP

Front 24

Private Cloud

Back 24

Describes any cloud infrastructure that is provisioned for use by a single customer. These tend to have excess unused capacity to support peak demand and are not as cost effective as public clouds

Front 25

Community Cloud

Back 25

A service that shares characteristics of both the public and private models. Run in a multi tenant environment, but the tenants are limited to members of a specifically designed community. Membership is normally defined based on shared mission, similar security and compliance requirements, or other commonalities

Front 26

Hybrid Cloud

Back 26

A catch-all term used to describe cloud deployments that blend public, private, and/or community cloud services together. It requires technology that unifies the different cloud offerings into a single coherent platform

Front 27

Shared Responsibility Model

Back 27

Cloud customers must divide responsibilities between one or more service providers and the customers’ own cybersecurity teams.

IaaS: ISP is responsible for Datacenter and hardware. Customer is responsible for Operating System, Application and Data

PaaS: ISP is responsible for Datacenter, hardware, and Operating System. Shared responsibility of the Application and the Customer has sole responsibility of Data

SaaS: ISP is responsible for everything except a shared responsibility for the Data

Front 28

CSA

Back 28

Cloud Security Alliance is an industry organization focused on developing and promoting best practices in cloud security.

Front 29

CCM

Back 29

Cloud Controls matrix is a reference document designed to help organizations understand the appropriate use of cloud security controls and map this controls to various regulatory standards

Front 30

Edge Computing

Back 30

Addresses the issue of sensors sending data to the cloud for complete processing. Instead it places some processing power on the remote sensors allowing them to preprocess data before shipping it back to the cloud

Front 31

Edge Computing

Back 31

Addresses the issue of sensors sending data to the cloud for complete processing. Instead it places some processing power on the remote sensors allowing them to preprocess data before shipping it back to the cloud

Front 32

Virtualization

Back 32

Technology that allows multiple guest systems to share the same underlying hardware

Front 33

Edge Computing

Back 33

Addresses the issue of sensors sending data to the cloud for complete processing. Instead it places some processing power on the remote sensors allowing them to preprocess data before shipping it back to the cloud

Front 34

Virtualization

Back 34

Technology that allows multiple guest systems to share the same underlying hardware

Front 35

Hypervisor

Back 35

Primary responsibility is to isolate virtual machines. This ensures that virtual machines do not interfere with each other’s operations as well as not be able to access or alter information or resources assigned to another virtual machine

Front 36

Type 1 Hypervisor

Back 36

Also known as a bare metal hypervisor, operates directly on top of the underlying hardware. Most commonly used in datacenter virtualization because it is highly efficient.

Front 37

Type 1 Hypervisor

Back 37

Also known as a bare metal hypervisor, operates directly on top of the underlying hardware. Most commonly used in datacenter virtualization because it is highly efficient.

Front 38

Type 2 Hypervisor

Back 38

Runs as an application on top of an existing operating system. The operating system supports the Hypervisor y and the hypervisor requests resources for each guest operating system from the host operating system. This is most commonly used on personal computers and is less efficient due to the consumption of more resources

Front 39

Type 1 Hypervisor

Back 39

Also known as a bare metal hypervisor, operates directly on top of the underlying hardware. Most commonly used in datacenter virtualization because it is highly efficient.

Front 40

Type 2 Hypervisor

Back 40

Runs as an application on top of an existing operating system. The operating system supports the Hypervisor y and the hypervisor requests resources for each guest operating system from the host operating system. This is most commonly used on personal computers and is less efficient due to the consumption of more resources

Front 41

Virtualized Servers

Back 41

Virtual machines are the basic building block of compute capacity in the cloud. Organizations provision servers running most common OS’s with the specific number of CPU cores, amount of RAM, and storage capacity in order to meet business requirements. Organizations are charged on an hourly rate based on the resources acquired. You can interact with it the same as a physical server by SSH with Linux or RDP for Windows

Front 42

Containers

Back 42

Provide application level virtualization. Instead of creating complex virtual machines that require their own OS’s, containers package applications and allow them to be treated as units of virtualization that become portable across operating systems and hardware platforms

Front 43

Block Storage

Back 43

Allocates large volumes of storage for use by virtual server instances. These volumes are then formatted as virtual disks by the OS on those server instances and used as they would a physical drive

Front 44

Block Storage

Back 44

Allocates large volumes of storage for use by virtual server instances. These volumes are then formatted as virtual disks by the OS on those server instances and used as they would a physical drive

Front 45

Object Storage

Back 45

Provides customers with the ability to place files in buckets and treat each file as an independent entity that may be accessed over the web or through the provider’s API. It hides the storage details from the user. More cost effective

Front 46

SDN

Back 46

Software Defined Networking allows engineers to interact with and modify cloud resources through API’s

Front 47

SDN

Back 47

Software Defined Networking allows engineers to interact with and modify cloud resources through API’s

Front 48

SDV

Back 48

Software Defined Visibility offers insight into the traffic on virtual networks

Front 49

Security Groups

Back 49

Providers meet the need for firewalls by defining permissible network traffic. They consist of a set of rules for network traffic that are substantially the same as a firewall rule set

Front 50

VPC

Back 50

Virtual Private Cloud are similar to a physical VLAN to achieve segmentation. It allows you to group systems into subnets and designate those subnets as public or private depending on whether access to them is permitted from the internet

Front 51

VPC

Back 51

Virtual Private Cloud are similar to a physical VLAN to achieve segmentation. It allows you to group systems into subnets and designate those subnets as public or private depending on whether access to them is permitted from the internet

Front 52

Segmentation

Back 52

One of the core concepts of network security. It offers engineers to place systems of differing security levels and functions on different network subnets

Front 53

VPC Endpoints

Back 53

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 54

VPC Endpoints

Back 54

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 55

Cloud Transit Gateways

Back 55

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 56

VPC Endpoints

Back 56

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 57

Cloud Transit Gateways

Back 57

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 58

DevOps

Back 58

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 59

VPC Endpoints

Back 59

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 60

Cloud Transit Gateways

Back 60

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 61

DevOps

Back 61

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 62

IaC

Back 62

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 63

VPC Endpoints

Back 63

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 64

Cloud Transit Gateways

Back 64

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 65

DevOps

Back 65

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 66

IaC

Back 66

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 67

Data Sovereignty

Back 67

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 68

VPC Endpoints

Back 68

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 69

Cloud Transit Gateways

Back 69

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 70

DevOps

Back 70

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 71

IaC

Back 71

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 72

Data Sovereignty

Back 72

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 73

Virtual Machine Escape Attack

Back 73

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 74

VPC Endpoints

Back 74

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 75

Cloud Transit Gateways

Back 75

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 76

DevOps

Back 76

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 77

IaC

Back 77

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 78

Data Sovereignty

Back 78

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 79

Virtual Machine Escape Attack

Back 79

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 80

Virtual Machine Sprawl

Back 80

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 81

VPC Endpoints

Back 81

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 82

Cloud Transit Gateways

Back 82

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 83

DevOps

Back 83

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 84

IaC

Back 84

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 85

Data Sovereignty

Back 85

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 86

Virtual Machine Escape Attack

Back 86

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 87

Virtual Machine Sprawl

Back 87

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 88

SWG

Back 88

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 89

VPC Endpoints

Back 89

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 90

Cloud Transit Gateways

Back 90

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 91

DevOps

Back 91

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 92

IaC

Back 92

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 93

Data Sovereignty

Back 93

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 94

Virtual Machine Escape Attack

Back 94

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 95

Virtual Machine Sprawl

Back 95

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 96

SWG

Back 96

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 97

Auditability

Back 97

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 98

VPC Endpoints

Back 98

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 99

Cloud Transit Gateways

Back 99

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 100

DevOps

Back 100

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 101

IaC

Back 101

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 102

Data Sovereignty

Back 102

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 103

Virtual Machine Escape Attack

Back 103

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 104

Virtual Machine Sprawl

Back 104

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 105

SWG

Back 105

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 106

Auditability

Back 106

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 107

CASB

Back 107

Cloud Access Security Broker is a software tool that serve as intermediaries between cloud service user and cloud service providers. This positioning allows them to monitor user activity and enforce policy requirements.

Front 108

VPC Endpoints

Back 108

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 109

Inline CASB

Back 109

Physically or logically reside in the connection path between the user and the service. This is done through a hardware appliance or an endpoint agent that routes request through the CASB. It provides the advantage of seeing a request before they are sent to the cloud service, allowing the CASB to block requests that violate policies

Front 110

Cloud Transit Gateways

Back 110

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 111

DevOps

Back 111

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 112

IaC

Back 112

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 113

Data Sovereignty

Back 113

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 114

Virtual Machine Escape Attack

Back 114

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 115

Virtual Machine Sprawl

Back 115

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 116

SWG

Back 116

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 117

Auditability

Back 117

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 118

CASB

Back 118

Cloud Access Security Broker is a software tool that serve as intermediaries between cloud service user and cloud service providers. This positioning allows them to monitor user activity and enforce policy requirements.

Front 119

VPC Endpoints

Back 119

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 120

Inline CASB

Back 120

Physically or logically reside in the connection path between the user and the service. This is done through a hardware appliance or an endpoint agent that routes request through the CASB. It provides the advantage of seeing a request before they are sent to the cloud service, allowing the CASB to block requests that violate policies

Front 121

API-based CASB

Back 121

A solution that does not interact directly with the user but rather interact directly with the cloud provider through the provider’s API. This approach provides direct access to the cloud service and does not require user device configuration. It doesn’t allow the CASB to block requests that violate policy it is limited to monitoring activity and reporting policy violations

Front 122

Cloud Transit Gateways

Back 122

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 123

DevOps

Back 123

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 124

IaC

Back 124

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 125

Data Sovereignty

Back 125

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 126

Virtual Machine Escape Attack

Back 126

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 127

Virtual Machine Sprawl

Back 127

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 128

SWG

Back 128

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 129

Auditability

Back 129

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 130

CASB

Back 130

Cloud Access Security Broker is a software tool that serve as intermediaries between cloud service user and cloud service providers. This positioning allows them to monitor user activity and enforce policy requirements.

Front 131

VPC Endpoints

Back 131

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 132

Inline CASB

Back 132

Physically or logically reside in the connection path between the user and the service. This is done through a hardware appliance or an endpoint agent that routes request through the CASB. It provides the advantage of seeing a request before they are sent to the cloud service, allowing the CASB to block requests that violate policies

Front 133

API-based CASB

Back 133

A solution that does not interact directly with the user but rather interact directly with the cloud provider through the provider’s API. This approach provides direct access to the cloud service and does not require user device configuration. It doesn’t allow the CASB to block requests that violate policy it is limited to monitoring activity and reporting policy violations

Front 134

Resource Policies

Back 134

Cloud providers offer so that customers may use to limit the actions that users of their accounts may take. It is a good security standard to protect against accidental command, a compromised account, or a malicious insider

Front 135

Cloud Transit Gateways

Back 135

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 136

DevOps

Back 136

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 137

IaC

Back 137

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 138

Data Sovereignty

Back 138

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 139

Virtual Machine Escape Attack

Back 139

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 140

Virtual Machine Sprawl

Back 140

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 141

SWG

Back 141

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 142

Auditability

Back 142

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 143

CASB

Back 143

Cloud Access Security Broker is a software tool that serve as intermediaries between cloud service user and cloud service providers. This positioning allows them to monitor user activity and enforce policy requirements.

Front 144

VPC Endpoints

Back 144

Allow the connection of VPCs to each other using the cloud providers secure network backbone

Front 145

Inline CASB

Back 145

Physically or logically reside in the connection path between the user and the service. This is done through a hardware appliance or an endpoint agent that routes request through the CASB. It provides the advantage of seeing a request before they are sent to the cloud service, allowing the CASB to block requests that violate policies

Front 146

API-based CASB

Back 146

A solution that does not interact directly with the user but rather interact directly with the cloud provider through the provider’s API. This approach provides direct access to the cloud service and does not require user device configuration. It doesn’t allow the CASB to block requests that violate policy it is limited to monitoring activity and reporting policy violations

Front 147

Resource Policies

Back 147

Cloud providers offer so that customers may use to limit the actions that users of their accounts may take. It is a good security standard to protect against accidental command, a compromised account, or a malicious insider

Front 148

HSM

Back 148

Hardware Security Modules are computing devices that manage encryption keys and also perform cryptographic operations in a highly efficient manner. They are expensive but offer an extremely high level of security. They can create and manage encryption keys without exposing them to a single human being. Cloud service providers use them use them intentionally for the management of their own encryption keys and offer HSM services to customers

Front 149

Cloud Transit Gateways

Back 149

Extend the VPC endpoints further by allowing the direct interconnection of cloud VPCs with on premises VLANs for hybrid cloud operations

Front 150

DevOps

Back 150

This approach to development brings together development and operations teams in a unified process where they work together in an agile approach to software development.

Front 151

IaC

Back 151

Infrastructure as Code is one of the key enabling technologies behind the DevOps movement and is also a crucial advantage of cloud computing services integration. It is the process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. It is a key feature in all major IaaS environments

Front 152

Data Sovereignty

Back 152

Is a principle that states that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed. Under this principle, a customer might wind up subject to legal requirements of a jurisdiction where they have no involvement other than the fact that one of their cloud providers operates a Datacenter with that jurisdiction

Front 153

Virtual Machine Escape Attack

Back 153

This vulnerability is the most serious issue that can exist in a virtualized environment, particularly when a virtual host runs systems of differing security levels. The attacker has access to a single virtual host and then manages to leverage that access to intrude upon the resources assigned to a different virtual machine

Front 154

Virtual Machine Sprawl

Back 154

Occurs when IaaS users create virtual device instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time.

Front 155

SWG

Back 155

Secure Web Gateways provide a layer of application security for cloud dependent organizations. They monitor web requests made by internal users and evaluate them against the organization’s security policy, blocking requests that run afoul of these requirements. They are commonly used to clock access to potentially malicious content but may also be used to enforce content filtering restrictions

Front 156

Auditability

Back 156

Is an important component of cloud governance. Contracts should include language guaranteeing the right of the customer to audit cloud service providers. This is essential to Provo using customers the assurance that the provider is operating in a secure manner and meeting its contractual data protection obligations

Front 157

CASB

Back 157

Cloud Access Security Broker is a software tool that serve as intermediaries between cloud service user and cloud service providers. This positioning allows them to monitor user activity and enforce policy requirements.