Type 1 (native or bare metal). Runs directly on the host computer's hardware
Type 2 (hosted). Runs within an operating system environment
Question 2
What is the recommended method for collecting security logs from multiple endpoints?
Answer : C
A SIEM (Security Information and Event Management) is a system that collects, analyzes, and correlates security logs from multiple sources, such as endpoints, firewalls, servers, etc. A SIEM can provide a centralized and comprehensive view of the security posture of an organization, as well as detect and respond to threats. Configuring endpoints to forward logs to a SIEM is the recommended method for collecting security logs from multiple endpoints, as it reduces the network bandwidth and storage requirements, simplifies the log management process, and enables faster and more effective security analysis. Leveraging an EDR (Endpoint Detection and Response) solution to request the logs from endpoints is not recommended, as it may cause performance issues on the endpoints, increase the network traffic, and create a dependency on the EDR solution. Connecting to the endpoints remotely and downloading the logs is not recommended, as it is a manual and time-consuming process, prone to errors and inconsistencies, and may expose the endpoints to unauthorized access. Building a script that pulls down the logs from all endpoints is not recommended, as it requires technical skills and maintenance, may not be compatible with different endpoint platforms, and may introduce security risks if the script is compromised or misconfigured.Reference:
Which option describes the ''selective network security virtualization'' phase of incrementally transforming data centers?
Answer : A
Selective network security virtualization: Intra-host communications and live migrations are architected at this phase. All intra-host communication paths are strictly controlled to ensure that traffic between VMs at different trust levels is intermediated either by an on-box, virtual security appliance or by an off-box, physical security appliance.
Question 4
How does Prisma SaaS provide protection for Sanctioned SaaS applications?
Answer : D
Prisma SaaS connects directly to the applications themselves, therefore providing continuous silent monitoring of the risks within the sanctioned SaaS applications, with detailed visibility that is not possible with traditional security solutions.
Question 5
On which security principle does virtualization have positive effects?
Answer : C
Virtualization improves the availability of IT systems and resources by enabling features such as12:
Resource optimization: Virtualization allows multiple virtual instances to share the same physical infrastructure, reducing hardware costs and increasing resource utilization.
Scalability: Virtualization enables rapid provisioning and deprovisioning of virtual instances, allowing organizations to scale up or down their IT capacity according to demand.
Disaster recovery: Virtualization facilitates backup and replication of virtual instances, allowing organizations to restore their IT systems and data in the event of a disaster or outage.
Fault tolerance: Virtualization supports high availability and load balancing of virtual instances, ensuring that IT systems and services remain operational even if one or more virtual instances fail.Reference:Virtualization Benefits: How Virtualization Improves Efficiency and Security | VMware,Virtualization Security - A Complete Guide - CyberExperts.com
Question 6
A user is provided access over the internet to an application running on a cloud infrastructure. The servers, databases, and code of that application are hosted and maintained by the vendor.
Which NIST cloud service model is this?
Answer : B
According to the NIST definition of cloud computing1, there are three service models for cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). In the SaaS model, the cloud provider delivers the software applications over the internet, and the users access them from various devices through a web browser or a program interface. The cloud provider manages the underlying infrastructure, including the servers, databases, and code of the applications. The users do not need to install, update, or maintain the software, and they only pay for the service they use. The scenario described in the question is an example of the SaaS model, as the user is provided access over the internet to an application running on a cloud infrastructure, and the vendor hosts and maintains the servers, databases, and code of that application.Reference:
SP 800-145, The NIST Definition of Cloud Computing | CSRC
Final Version of NIST Cloud Computing Definition Published
NIST Cloud Computing Program - NCCP | NIST
SaaS - User responsible for only the data, vendor responsible for rest
Question 7
Which three services are part of Prisma SaaS? (Choose three.)
Answer : A, D, E
Prisma SaaS is a cloud access security broker (CASB) solution that helps secure and manage SaaS applications.It provides advanced capabilities in risk discovery, data loss prevention, compliance assurance, data governance, user behavior monitoring, and advanced threat prevention12. The three services that are part of Prisma SaaS are:
Data Loss Prevention: This service helps prevent the leakage or exposure of sensitive data stored in SaaS applications.It allows you to define data patterns, policies, and actions to protect your data from unauthorized access or sharing3.
Data Exposure Control: This service helps identify and remediate data exposure risks in SaaS applications. It scans your data at rest and classifies it based on its sensitivity and exposure level.It also provides recommendations and remediation actions to reduce the risk of data breaches4.
Threat Prevention: This service helps detect and block malicious activities and threats in SaaS applications. It leverages the WildFire and AutoFocus threat intelligence services to analyze user and file activity and identify indicators of compromise.It also provides alerts and response actions to mitigate the impact of threats5.
All Official Question Types