- Welcome to lesson two, deep dive quiz.
Now, lesson two was all about summarizing
fundamental security concepts.
Some that are old, tried and true,
some that are really new or emerging.
So in two, one, we talked about
security and privacy principles, confidentiality,
integrity and availability, as well as privacy.
2.2, we talked about zero trust,
really important emerging area.
In 2.3, we took a look at physical security
and the importance of it.
2.4, we looked at a whole array
of environmental conditions and their impact.
And then in 2.5,
we focused in on deception and disruption technologies.
So now we're gonna do a quiz,
and this is the way we're gonna work it.
Just like the last one, we'll get to a question,
if you know the answer right away, go ahead and choose it.
But absolutely feel comfortable putting me
on pause thinking about the answer, right?
Make your choice,
in some cases it's not just gonna be multiple choice, right?
It might be fill in the blank like we saw last time,
or might be matching.
So don't hesitate just to stop the video,
you know, take a piece of paper, write down your answers.
I want this to be as interactive as we possibly can make it.
All right, let's start our quiz.
We have 10 questions this time
'cause this was a much longer lesson.
Question one,
you're helping to prepare a cybersecurity budget briefing
for the board of directors,
which statement would most likely explain
why management is recommending prioritizing
the principle of availability,
to contribute to profitability,
to align with organizational strategic objectives,
in response to customer demands,
or to meet regulatory requirements?
Wow, those all sound like good answers, don't they?
So when you get a question that the answers all seem like
they'd be great answers, I think they're all legit.
I want you to think about that question
as a hierarchical question.
Meaning that there's one answer that probably
encompasses the other answers, right?
So if you see multiple answers that you think are right
look at 'em and say, could all of these, right?
Could all of these filter up to one of these answers?
So which state would most likely explain
why management is recommended prioritizing the principle
of availability to contribute to profitability,
to align with organizational strategic objectives
in response to customer demands
to meet regulatory requirements.
What are you gonna choose?
I'm gonna choose our second one.
To align with organizational strategic objectives.
Profitability is probably a strategic objective.
Responding to customer demands
is probably a strategic objective,
and to meet regulatory requirements is most
definitely going to be a strategic objective.
So all of those answers roll up to
align with organizational strategic objectives.
Let's see how we did, and it is correct.
All right, this one, we have to choose our location.
This is known as a hotspot question.
We're given a couple of pictures here,
and we're said choose the location,
which is designated by the red lines
that's best suited for a data center.
So we've got three choices here
'cause we've got three red squares.
Looks like our first one over to the left
is right on the first floor,
and looks like there's some windows that it has,
the middle picture looks
like it's in the middle of the building, right?
It's not on the first floor,
it's not on the top and I don't see any windows there.
And then I get to the third picture,
the one all the way over to the right,
right up towards the top.
So the top floor can't really tell
if there's windows there or not, but it's up on top.
I want you to tell me
which of these is best suited for a data center?
I take a look at them
and if you get a hotspot question like this
what you'll do is you'll will bring your mouse
and click on the particular hotspot,
the area that you wanna choose.
So I'm gonna choose the one right here in the middle, right?
I like being in the middle,
I'm not up in the, you know,
on the top floor where I have access from the roof,
I'm not in the basement, I'm not on the first floor,
I'm centered in the building
and I don't have any doesn't appear
to have any windows for access.
Where our choice over here on the left
first floor access windows
our one on the right, looks like it's up on the top floor.
Again, issue for access, or maybe storm damage,
or you know, rain and leaks.
So I'm gonna choose that middle one.
What about you?
Do you like that one?
All right, let's see how it is.
And that is correct.
Good work, all right, question three.
We need to match the power condition and the description.
We have a spike, a brownout, a sag, a surge, or a blackout,
on the right hand side, we have the subscriptions
prolonged period without power,
prolonged period of high voltage,
prolonged period of low voltage,
a moment of low voltage or a moment of high voltage.
This is a good one to put me
on pause for while you match these up.
All right, well let's start with this first one,
prolonged period without power,
well, we all know what that one is, right?
That's a blackout so let's bring that one down.
Now, the good thing about starting
with the things you really know best
is now you've got sort of the process
of elimination working for you.
A moment of high voltage,
well that's when the power whoosh spikes right up.
So that's gonna be a spike.
Our next one, prolonged period of high voltage,
what do you like?
I like surge.
A moment of low voltage, that's a sag,
and a prolonged period of low voltage
that's gonna be a brownout.
So a spike, a moment of high voltage,
a brownout a prolonged period of low voltage,
a sag, like a drop off,
a moment of low voltage,
a surge a prolonged period of high voltage,
and a blackout a prolonged period without power.
Do you like them?
Do you agree?
Okay, we'll check it out, and those are correct.
Question four,
you are recommending this fire suppression agent
because it doesn't damage electronic equipment.
FM-200 pressurized water, purple K or foam.
So which one of these are you going to choose?
Which fire suppression agent
because it doesn't damage electronic equipment.
So this would be, you know, applicable for a data center
FM-200, pressurized water, purple K, or foam.
Go ahead and make that choice I'm gonna choose FM-200.
I could have chosen Novak if that was a choice
or innu gases, but FM-200 is the best choice.
So the ones that I'm given, do you agree?
All right, let's check it out, and that is correct.
Question five, you are designing a honey net
with the goal of learning more
about potential attackers and their techniques.
Which type of trap is used to identify an attacker?
Now the key word here is identifying attacker or identify.
So we're not just saying we wanna know
about how we might be attacked,
we wanna know who might be attacking us.
Is this a honey token, a honey pot,
a honey file, or a DNS sinkhole?
And so we've got a honey net, right?
We wanna learn more about potential attackers
and their techniques,
but we wanna have a particular type
of trap that will help us to identify who the attacker is.
Honey token, honey pot honey file or a DNS sinkhole.
I'm gonna choose a honey token, do you agree?
All right, and that's correct, right?
Question six, we're gonna drag and drop some words here.
The cybersecurity and building security teams
are discussing emergency control options.
Blank means that in an emergency
controls will default to open.
Blank means that an emergency controls will default
to locked, and blank means that there
are resilient systems in place, and we have four choices.
Fail soft, fail safe, fail, secure, or fail over.
Now sometimes in your exam
and whether you're taking a prep exam
or a regular, the actual exam,
you might see terms that you've never seen before.
Now that might be for one of two reasons,
it might be because it hasn't yet been included
in your studying or you know what?
It just might be a made up term,
and sometimes you're gonna see that.
So don't panic, if you get to a question
and you see some of the answer options, you're like,
hey I've never even seen that,
I don't know what that means.
Just go with it.
You know, it could very well be a made up answer.
All right, you ready to do this?
Blank means that an emergency controls will default to open.
I'm going with fail safe.
And the way I remember fail safe to me is everything's open,
everybody's safe, they can get outta there.
Fail-secure, I'm gonna say means in an emergency
controls will default to lock.
I think about locking as being secure,
I'm secure in this room.
If I have an intruder and the door's been locked,
the intruder can't get in.
And then blank means
that there are resilient systems in place,
and we haven't discussed this yet,
but I bet you all knew that failover means
there are resilient systems in place.
So fail safe means an emergency
controls will default to open,
fail secure means that an emergency controls will default
to locked,
and failover means that there
are resilient systems in place.
You like it, you agree?
All right, let's check, and those are correct.
We're doing great, all right.
Number seven, we're gonna click
on the section of the image
above or below the line that represent
the zero trust control plane.
Remember, above and below the line
we have two different planes,
we have a control plane and a data plane.
So we're either gonna click above that dotted line
or below the dotted line.
Tell me which part and section of that image
represents the zero trust control plane.
I am going to choose a here where it says policy
administrator and policy engine
which is the policy decision point, right?
That's the control plane,
and below the line is the data plane.
Remember, this picture came right from a NIST publication,
so you can read all about it
and get lots of great information.
You agree?
All right, let's submit, and that is correct,
good work.
All right, question number eight, we have another matching.
This time we're gonna match a physical security
IDS or figure physical security sensor type and description.
On the left hand side we have contacts,
passive infrared, photometric, ultrasonic and motion.
On the right hand side we have a proximity center
that measures distance or detects breaks
in electrical circuit or changes,
detects changes in movement or changes in light
or changes in heat signature.
So let's start with contact.
We look through that, what would you choose for contact?
Well, now you could put me on pause
and get these all done, right?
Or you can work through them with me.
Contact, how about a break in an electrical circuit?
What about passive infrared?
Passive infrared?
Hmm, infrared is probably gonna be a heat signature,
so detects changes in a heat signature photometric,
no photo would be our light,
so that's gonna detect changes in light.
Oh, maybe I can't remember exactly what ultrasonic is,
but I only have two left.
So I, again, using that process of elimination,
if I went to motion, I say,
well, motion I know detects changes in movement,
that means ultrasonic must be a proximity sensor
that measures distance.
So contact detects a brachi in a electrical circuit,
passive infrared detects changes in heat signatures,
photometric detects changes in light,
ultrasonic proximity sensor that measures
distance and motion detects changes in movement,
is that what you had?
Do you agree?
Let's check it out.
And that is correct, all right, two more to go.
Number nine, devices in the data center
are failing more often than should be expected
based on the MTBF specifications.
MTBF is meantime between failures.
Which explanation below is the most plausible?
The fiber optic cable is not shielded.
Temperature is set for 72 degrees Fahrenheit,
the data center racks are all facing the same way
or relative humidity is between 45 and 60%.
Okay, so we've got these devices in our data center,
they're failing just a lot more frequently
than we expect they should be.
What's the most plausible explanation?
What are you gonna choose?
Cable isn't shielded,
the temperature is 72 degrees Fahrenheit.
The data center racks are all facing the same way,
or the relative humidity use between 45 and 60%.
Well, I'm gonna choose the third one that the data
center racks are all facing the same way.
Fiber optic cable does not need to be shielded,
although as I mentioned, you may wanna shield it
if it's out in the ground,
so critters don't eat it.
Temperature set for 72 degrees Fahrenheit.
That's a lovely temperature for our equipment
and for us as people,
relative humidity between 45 and 60%,
that's awesome, right?
Not too damp, not too dry, that's perfect.
All of those are good data center racks facing the same way.
Remember we talked about the problem there
of you take the data center devices take
in air from the front and they exhaust
out the back and the the air that they exhaust
is hot or warmer than what they took in.
And we keep going all the way down the line till
you know, three, four, or five rows down.
You know, the devices are taking in really, really hot air
and that's really enough to have them fail.
Let's double check, see if it's right,
that is correct.
Good work.
And we've, so far, we've gotten 90 out of a hundred points,
can we get a hundred out of a hundred?
One more matching and this is a tough one.
We're gonna match the zero trust components
with their description.
We've got a policy engine,
the policy enforcement point,
and the policy administrator.
One makes the decision to grant access,
one creates a session specific authentication
or the authentication token,
and one monitors and terminates the connections.
Two are in the control plane
and one is down in the data plane.
And see if you can visualize that picture
that we've been using of the control
and data planes in the zero trust architecture environment.
So the decision to grant access,
where are we gonna choose that one?
I think we put that
with the policy engine,
actually does the work of generating that
session specific authentication or the authentication token?
Yeah, our administrator's gonna do the work,
and then that policy enforcement point, right?
That's the point that it monitors
and ultimately terminates the connection, right?
And so that's gonna be down in the data plane, right?
Because it knows what's going on,
I am gonna put that right there
in the policy enforcement point, the PEP.
So policy engine PE makes a decision to
grant access the policy enforcement point
monitors and terminates those connections,
and the policy administrator generates a session
specific authentication.
And if this is confusing memory
you've got that whole publication to look at.
Or if you don't wanna go that far
just being able to look at that illustration.
All right, let's try it,
see if we get a hundred out of a hundred points.
Ah, awesome, and we're correct.
Great job, you guys did really, really excellent.
Up next is gonna be lesson three,
we're gonna explain the importance
of change management processes and the impact to security.
So I'll see you there.