Sec+ CH.5 Pre-Assessment

Network administrators are considering adding an HSM to a server in

your network. What functions will this add to the server?

• Provide full drive encryption

• Reduce the risk of employees emailing confidential information

  outside the organization

• Provide webmail to clients

• Generate and store keys used with servers

Answer explanation

D is correct. A hardware security module (HSM) is a removable device

that can generate and store RSA keys used with servers. The keys can be

used to encrypt data sent to and from the server, but they wouldn’t be used

for full drive encryption. A Trusted Platform Module (TPM) provides full

drive encryption and is included in many laptops. A data loss prevention

(DLP) device is a device that can reduce the risk of employees emailing

confidential information outside the organization. Software as a Service

(SaaS) provides software or applications, such as webmail, via the cloud.

See Chapter 5.

Bart needs to send an email to his supervisor with an attachment that

includes sensitive information. He wants to maintain the confidentiality of

this information. Which of the following choices is the BEST choice to

meet his needs?

• Digital signature

• Encryption

• Data masking

• Hashing

Answer explanation

B is correct. Encryption is the best choice to provide confidentiality of

any type of information, including sensitive information. A digital signature

provides integrity, non-repudiation, and authentication. Data masking

modifies the original data, producing data that looks valid but is not

authentic. Hashing provides integrity. See Chapter 5.

The Springfield school system stores some data in the cloud using its

own resources. The Shelbyville Nuclear Power Plant also stores some data

in the cloud using its own resources. Later, the two organizations decide to

share some data in both clouds for educational purposes. Which of the

following BEST describes the cloud created by these two organizations?

• Community

• Private

• Public

• XaaS

Answer explanation

A is correct. They created a community cloud. In the scenario, the two

organizations have a common goal of sharing educational materials. The

individual clouds created by each organization are private clouds, but the

shared community cloud resources are not private. A public cloud would be

available to anyone, but the scenario wants to restrict access to just two

organizations. Anything as a Service (XaaS) refers to cloud services beyond

IaaS, PaaS, and SaaS. See Chapter 5.

Your organization is planning to implement a CYOD deployment

model. You’re asked to provide input for the new policy. Which of the

following concepts are appropriate for this policy?

• SCADA access

• Storage segmentation

• Database security

• Embedded RTOS

Answer explanation

B is correct. Storage segmentation creates separate storage areas in

mobile devices and can be used with a choose your own device (CYOD)

mobile device deployment model where users own their devices. None of

the other answers are directly related to mobile devices. A supervisory

control and data acquisition (SCADA) system controls industrial control

systems (ICSs), such as those used in nuclear power plants or water

treatment facilities, and SCADA systems should be isolated. Database

security includes the use of permissions and encryption to protect data in a

database but is unrelated to mobile device deployment. Some embedded

systems use a real-time operating system (RTOS) when the system must

react within a specific time. See Chapter 5.

Your organization plans to implement desktops via the cloud. Each

desktop will include an operating system and a core group of applications

needed by employees, and the cloud provider will manage the desktops.

Employees with Internet access will be able to access these desktops from

anywhere and almost any device. Which of the following BEST identifies

this service?

• IaaS

• CASB

• SaaS

• XaaS

Answer explanation

D is correct. Anything as a Service (XaaS) refers to cloud services

beyond IaaS, PaaS, and SaaS. It would include desktops as a service.

Infrastructure as a Service (IaaS) is a cloud computing option where the

vendor provides access to a computer. Still, customers must install the

operating system and maintain the system. A cloud access security broker

(CASB) is a software tool used to provide additional security for cloud

resources, but it provides the underlying cloud services. Software as a

Service (SaaS) provides access to specific applications such as an email

application, but not entire desktops. See Chapter 5.

A small business owner has asked you for advice. She wants to improve

the company’s security posture, but she doesn’t have any security staff.

Which of the following is the BEST solution to meet her needs?

• SOAR

• MSSP

• SaaS

• XaaS

Answer explanation

B is correct. A managed security service provider (MSSP) is a third-

party vendor that provides security services for an organization, and it is the

best solution for this scenario. A Security Orchestration, Automation, and

Response (SOAR) solution automates incident response for some events,

but it will augment services already provided by security staff within an

organization. SOAR would not work here because the small business

doesn’t have any security staff. Software as a Service (SaaS) includes any

software or application provided to users over a network such as the

Internet. Anything as a Service (XaaS) refers to cloud services beyond

SaaS, IaaS, and PaaS. See Chapter 5.

Management at the Goody New Shoes retail chain decided to allow

employees to connect to the internal network using their personal mobile

devices. However, the organization is having problems with these devices,

including the following:

1) Employees do not keep their devices updated.

2) There is no standardization among the devices.

3) The organization doesn’t have adequate control over the

devices.

Management wants to implement a mobile device deployment model to

overcome these problems while still allowing employees to use their own

devices. Which of the following is the BEST choice?

• BYOD

• COPE

• CYOD

• IaaS

Answer explanation

C is correct. A choose your own device (CYOD) mobile device

deployment model includes a list of acceptable devices that employees can

purchase and connect to the network. IT management can then implement a

mobile device management (MDM) system to provide standardized

management for these devices. The current policy is a bring your own

device (BYOD) policy, but because of the lack of standardization, it’s

difficult for IT departments to adequately manage the devices and ensure

they don’t introduce vulnerabilities to the network. A corporate-owned

personally enabled (COPE) policy indicates the organization owns the

devices, not the employees. Infrastructure as a Service (IaaS) is a cloud

computing option where the vendor provides access to a computer, but

customers must install the operating system and maintain the system. See

Chapter 5.