ACA-Sec1 ACA Cloud Security Associate Questions and Answers

After beginning to use cloud service, the cloud service provider will become responsible for all of

the user’s security.

After beginning to use cloud service, the user and the cloud service provider will be jointly

responsible for cloud security, with each responsible for different layers of security.

After beginning to use cloud service, users must still take care of physical and environmental

security.

After beginning to use cloud service, users only need to pay attention to the security of their own

apps and data. All other security will be the responsibility of the cloud service provider.

TCP

UDP

IP

SMTP

Servers in VPC only configured with private network

Any device internet reachable

Government website

Public DNS service

Offline servers

Update cache

turn on protection switch manually

add one protection rule

restart the whole WAF service

755

700

777

766

Attack initiated time

Attack type

Tools attacker used

Attack source IP

Physical location of attacker

fix vulnerability found in open source software using Alibaba self-developed patch

detect any vulnerability before it bursts

release official patches for any exposed vulnerability

stop hacker's vulnerabilities probing

Enterprise sub-account management and permission assignment

Resource operation and authorization management between enterprises

Temporary authorization management for untrusted client apps

Prevention of network attacks on enterprises

Every IP address inside this subnet can be assigned as a HOST IP

The broadcast address of this subnet is 192.168.0.0

The network address of this subnet is 192.168.0.255

IP communication between the hosts inside this subnet will not go through the gateway

IPV6 has bigger route table size

IPV6 address length upper limit is 128 bits

IPV6 has more simplified header

No network switch device is needed when using IPV6 protocol to transfer data

The computer is part of a DDoS attack

The computer is part of a TCP/IP hijacking

The computer is part of a spoofing attack

The computer is part of a man-in-the-middle attack

Ping to the server

Simulate a DDoS attack on that server

Simulate a DoS attack on the server

Check if all the patches and required antivirus software has been loaded o the server

rule setting for security group supports both in and out direction configuration

default security group rule is safe enough, please don't change it too much

by default, ECS in different security group can communicate with each other

one ECS can be in several different security group

hot fix doesn't need to reboot physical host

service will not be available during the hot fix

hot fix means the host need to reach some temperature upper limit to be able to

proceed

hot fix is transparent to end user

Cross-Site Request Forgery(CSRF)

Cross-Site Scripting(XSS)

Unvalidated Redirects and Forwards

Injection

Room temperature

Data encryption

Rain

Sounder

HTTP must use port 80 and HTTPS must use port 443 to provide service

HTTPS is more secure than HTTP regarding the way they transfer data

Data transferred through HTTPs is under encryption

You must buy commercial CA before you setup your own web server with HTTPS service

setup index for this table

use 'group by' to filter information

use 'count(*)' to get total record number before query

use 'limit N' to limit the number of possible returned records

Software development cycle is not formalized

Security system overall solutions are not complete

Administration tools on Cloud Platform may have some flaws

Cloud platform console and API may lack of security hardenning