Task 1.1: Describe security and compliance concepts

• ADeciding which accounts can manage the app and which permissions they get

  Incorrect

  Identities and access stay with the customer in every service model.

• BClassifying the app's data and deciding how that data is protected

  Incorrect

  Data, including its classification and protection, always stays with the customer.

• CPatching the operating system and the runtime environment under the app

  Correct

  In PaaS the cloud provider also takes on the operating system and the runtime environment.

• DSecuring the laptops that developers use to publish new versions

  Incorrect

  Endpoints that connect to cloud services are always the customer's to secure.

As you move from on-premises to IaaS, PaaS and SaaS, the provider takes on more of the stack. With PaaS it secures the physical datacenter, network and hosts and also the operating system and runtime. Data, identities and access, endpoints and configuration choices remain the customer's whatever the model.

• ADividing the network into isolated zones so that one compromised zone doesn't expose the rest

  Correct

  Segmentation is a network-layer control that limits how far an attacker can move.

• BDDoS protection and firewalls at the network's outer boundary

  Incorrect

  These protect the boundary from large external attacks, which is the perimeter layer.

• CSecurity checks such as multifactor authentication and Conditional Access before access is granted

  Incorrect

  These authenticate and authorize users, which is the identity and access layer.

• DNetwork security groups that restrict which systems can communicate with which

  Correct

  NSG rules restrict traffic flow between resources, which is the network layer.

• EInput validation that blocks SQL injection and cross-site scripting

  Incorrect

  Input validation is part of the application security layer.

Defense in depth stacks layers: physical, identity and access, perimeter, network, compute, application and data. The network layer controls communication between resources within a network through segmentation into isolated zones and network security groups that restrict traffic. DDoS protection and perimeter firewalls protect the boundary instead.

• ADevices

  Incorrect

  The devices pillar monitors device health and compliance and bases access decisions on it.

• BApplications

  Correct

  This pillar needs visibility into all apps, including unsanctioned shadow IT, and manages the permissions apps request and users grant.

• CInfrastructure

  Incorrect

  The infrastructure pillar assesses servers and cloud resources for version, configuration and unusual behavior.

• DNetworks

  Incorrect

  The networks pillar segments networks and protects and monitors their traffic; it isn't about which apps are in use.

Zero Trust is implemented across seven pillars: identities, devices, applications, data, infrastructure, networks, and visibility, automation and orchestration. Applications are how data is consumed, so the applications pillar calls for visibility into every app in the environment, including shadow IT, and for managing app permissions.

• AHashing, whose challenge is that a hash can't be turned back into the original files

  Incorrect

  Hashing is one-way, so the tool could never restore the files from it.

• BAsymmetric encryption, whose challenge is that the private key can be worked out from the public key

  Incorrect

  The private key can't be derived from the public key, and asymmetric encryption isn't the fast choice for bulk data.

• CSymmetric encryption, whose challenge is sharing the one key securely with whatever decrypts

  Correct

  One key both encrypts and decrypts, which is fast for large data; distributing that key securely is the hard part.

• DDigital signing with a private key, whose challenge is that signing leaves the files readable

  Incorrect

  A signature proves origin and integrity but doesn't make the files unreadable, so it doesn't meet the need.

Symmetric encryption uses the same key to encrypt and decrypt. It's computationally fast and suited to large amounts of data such as files and database records. Its main challenge is key distribution: everyone who decrypts needs the same secret key. Asymmetric encryption solves distribution with a public and private key pair.

• AData sovereignty

  Correct

  Sovereignty is the concept that data is subject to the laws of the country or region where it's collected, held or processed.

• BData residency

  Incorrect

  Residency regulations govern where data may be physically stored and how it may be transferred, not which laws then apply to it.

• CData privacy

  Incorrect

  Data privacy is about handling personal data, not about which laws apply where.

• DRisk transfer

  Incorrect

  Transferring a risk, for example through insurance, is a response in risk management, not a statement about which laws apply.

Data sovereignty means data is subject to the laws and regulations of the country or region where it's physically collected, held or processed, so data handled across several jurisdictions can be subject to the laws of each. Data residency regulations instead govern where data can be stored and how it can be transferred.

• AThe hardware vendor that sold the servers

  Incorrect

  Selling the hardware doesn't make the vendor responsible for securing it in the customer's building.

• BThe cloud provider whose services the company might use later

  Incorrect

  No cloud provider is involved while everything runs on premises.

• CThe company itself, along with the rest of the stack

  Correct

  On premises, the organization is responsible for the entire stack, from the building and physical servers to the data.

• DNobody, because physical security isn't part of the model

  Incorrect

  Physical security is the base of the stack in the shared responsibility model.

Organizations that run only on-premises hardware and software are responsible for the entire technology stack: the building, physical servers, networking, operating systems, applications and data. Moving to cloud services shifts some of those responsibilities to the cloud provider, depending on the service model.

• AIntegrity

  Incorrect

  Integrity is about data staying accurate and unmodified, and nothing was changed.

• BConfidentiality

  Correct

  Confidentiality keeps sensitive information accessible only to authorized people; a data breach violates it.

• CAvailability

  Incorrect

  Availability is about systems and data being accessible when needed, and they kept running.

• DAuthentication

  Incorrect

  Authentication is how identity is proven; it isn't one of the three CIA properties.

The CIA triad names what security protects: confidentiality (only authorized people can read data), integrity (data stays accurate and unmodified except through authorized processes) and availability (data and systems are accessible when needed). A confidentiality breach, commonly called a data breach, occurs when unauthorized parties gain access to protected information.

• AHer own private key

  Incorrect

  Data signed with a private key can be verified by anyone with the public key, so it isn't kept secret.

• BHer own public key

  Incorrect

  Only Alice's private key could decrypt that, so Bob couldn't read it.

• CBob's private key

  Incorrect

  Bob's private key stays with Bob; Alice never has it.

• DBob's public key

  Correct

  Data encrypted with a public key can be decrypted only with the corresponding private key, which only Bob holds.

Asymmetric encryption uses a mathematically related key pair. Data encrypted with the public key can be decrypted only with the matching private key, so anyone can encrypt for Bob with his public key, but only Bob can decrypt.

• AAssess

  Correct

  Assessing evaluates each risk on impact and likelihood, which produces a risk score for prioritizing.

• BIdentify

  Incorrect

  Identifying discovers potential risks through interviews, assessments, audit findings and monitoring.

• CRespond

  Incorrect

  Responding plans what to do about each risk: accept, mitigate, transfer or avoid it.

• DMonitor

  Incorrect

  Monitoring tracks risks and the effectiveness of controls over time.

Risk management identifies, assesses and responds to threats, then keeps monitoring them. Assessment evaluates each risk based on its potential impact and the likelihood of it occurring, producing a risk score that helps prioritize which risks need the most attention.