Correct answer:

Jurisdiction is correct. When a security professional is considering cloud solutions for BCDR, a top concern is the jurisdiction where the cloud systems are hosted. If the jurisdiction is different from where the production systems are hosted, these systems may be subjected to different regulations and controls, which would make a seamless BCDR solution far more difficult.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Aggregation is correct. Because a SIEM solution aggregates logs together from across the enterprise, an organization could implement log retention at the point of the SIEM solution and have a single source to retain and back up, versus each device or system having its own log retention strategies.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Envelope is correct. SOAP encapsulates its information in what is known as a SOAP envelope and then leverages common communications protocols for transmission.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Inter-cloud provider is correct. The inter-cloud provider is responsible for peering with other cloud services and providers as well as for overseeing and managing federations and federated services.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Cross-site request forgery is correct. A cross-site request forgery (CSRF) attack forces a client that a user has used to authenticate to an application to send forged requests under the user’s own credentials to execute commands and requests that the application thinks are coming from a trusted client and user. Although this type of attack cannot be used by the attacker to steal data directly, because they have no way to see the results of the commands, it does open other ways to compromise an application.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Remote key management service is correct. A remote key management service (KMS) is maintained and controlled by the customer at their own location. This offers the highest degree of security for the customer because it is contained under the customer’s sole control, outside the boundaries of the cloud provider.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Lack of international authority is correct. With international operations, systems ultimately cross many jurisdictional boundaries, and many times, they conflict with each other. The major hurdle to overcome for an organization is the lack of an ultimate international authority to mediate such conflicts, with a likely result of legal efforts in each jurisdiction.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

They can directly communicate is correct. A major aspect of a virtual environment is that servers are not physical cabled into switches and routers. As such, if two hosts are on the same hypervisor, they can directly communicate with each other, without the need to route traffic through physical devices. This limits the use of physical security measures such as intrusion detection and prevention systems, though most major vendors have begun to offer virtualized appliances to mitigate this problem.

Incorrect answers:

All other answers choices are incorrect.

Correct answer:

Reproducibility is correct. Reproducibility is the measure of how easy it is to reproduce and successfully use an exploit. Scoring within the DREAD model ranges from 0, signifying a nearly impossible exploit, up to 10, which signifies something that anyone using a simple function call could exploit, such as a URL.

Incorrect answers:

All other answers choices are incorrect.

Correct answer;

Tampering with data is correct. Any application that sends data to the user will face the potential that the user could manipulate or alter the data, whether it resides in cookies, GET or POST commands, or headers or manipulates client-side validations. If the user receives data from the application, it is crucial that the application validate and verify any data received back from the user.

Incorrect answers:

All other answers choices are incorrect.