Cloud X (owned by Cloud Provider X) provides Physical Server A which hosts Virtual
Servers A and B.
Virtual Server B hosts Ready-Made Environments A and B.
Cloud Service Consumer A uses Virtual Server A as part of an IaaS leasing agreement in which
Cloud Consumer A is charged a fixed monthly fee for unlimited access. Cloud Service
Consumers B and C use Ready-Made Environments A and B respectively as part of a
PaaS leasing agreement based on per-minute usage fees. In both cases, access is
monitored via Pay-For-Use Monitor A, which keeps track of log-in and log-out times in
order to calculate the usage charges that are billed to Cloud Consumers B and C.

Physical Server A begins to become unstable. Over the course of a 24 hour period, the
server shuts down three times, taking down Virtual Servers A and B with it. This causes
numerous problems for Cloud Service Consumers A, B and C, which lose connections and
encounter a variety of exceptions.
A subsequent investigation of the log files generated by Pay-For-Use Monitor A reveals
that the three server crashes coincided with the usage periods of Ready-Made Er
n'ronment B b> Cloud Service Consumer B.
De 'elopers at the Cloud Consumer 3 organization confirm they did not actually log in during those periods, which leads Cloud
Provider X to discover that another cloud service consumer has been posing as Cloud
Service Consumer B in order to maliciously access Ready-Made Environment B, Virtual
Server B, and Physical Server B on Cloud X.
The investigation concludes that the malicious cloud service consumer was able to carry out the attack successfully by obtaining
a weak password being used by developers from Cloud Consumer B.
Which of the following statements accurately identifies the type of security threat that
corresponds to the described attack - and -provides a solution that can directly mitigate this
type of security threat within Cloud X?

• A. Ready-Made Environment B.
  Virtual Server B and Physical Server B were subjected to a weak authentication attack that can be mitigated by implementing the encryption and
  digital signature mechanisms.
• B. Ready-Made Environment B.
  Virtual Server B and Physical Server B were subjected to a malicious intermediary attack that can be mitigated by implementing the cloud-based
  security groups and hardened virtual server images mechanisms.
• C. Ready-Made Environments, Virtual Server B and Physical Server B were subjected to
  an attack that succeeded due to overlapping trust boundaries. This type of attack can be
  mitigated by implementing the single sign-on mechanism.
• D. Ready-Made Environment B, Virtual Server B and Physical Server B were subjected to
  a virtualization attack that can be mitigated by implementing the encryption and digital
  signature mechanisms.

Cloud X (owned by Cloud Provider X) provides Physical Server A which hosts Virtual
Servers A and B.
Virtual Server B hosts Ready-Made Environments A and B.
Cloud Service Consumer A uses Virtual Server A as part of an IaaS leasing agreement in which
Cloud Consumer A is charged a fixed monthly fee for unlimited access. Cloud Service
Consumers B and C use Ready-Made Environments A and B respectively as part of a
PaaS leasing agreement based on per-minute usage fees. In both cases, access is
monitored via Pay-For-Use Monitor A, which keeps track of log-in and log-out times in
order to calculate the usage charges that are billed to Cloud Consumers B and C.
Virtual Server A begins generating a series of exceptions. Soon thereafter, Virtual Server B
becomes destabilized, resulting in further exceptions being raised in Ready-Made
Environments A and B.
Cloud Service Consumers B and C receive a series of error
messages until both of their connections are dropped Finally, Physical Server A shuts
down completely. A subsequent investigation reveals that Virtual Server A was the victim of
a security attack performed by a malicious cloud service consumer, the attacker generated
increased loads of external communication requests on Virtual Server A and the underlying
network, causing Physical Server A (along with Virtual Server B) to eventually shut down.

Which of the following statements accurately identifies the type of security threat that
corresponds to the described attack - and -provides a solution that can directly mitigate this
type of security threat within Cloud X?

• A. Virtual Server A was subjected to an insufficient authorization attack that can be
  mitigated by implementing the digital signature and hardened virtual server image
  mechanisms.
• B. Virtual Server A was subjected to an insufficient authorization attack that can be
  mitigated by implementing the single sign-on mechanism.
• C. Virtual Server A was subjected to a denial of service attack that can be mitigated by
  implementing the encryption and digital signature mechanisms.
• D. Virtual Server A was subjected to a denial of service attack that can be mitigated by
  implementing the hardened virtual server image and identity and access management
  mechanisms.

A cloud consumer is interested in leasing cloud-based virtual servers. It compares the
virtual servers offered by Cloud Provider X and Cloud Provider Y.
Cloud X (owned by Cloud Provider X) and Cloud Y (owned by Cloud Provider Y) both provide shared physical
servers that host multiple virtual servers for other cloud consumers.
The virtual servers on Cloud X are accessed directly, whereas the virtual servers on Cloud
Y are accessed via an automated scaling listener. On Cloud X, virtual servers are pre-
configured to support a specific amount of concurrent cloud service consumers. When this
threshold is exceeded, cloud service consumer requests are rejected. Due to the use of the
automated scaling listener, virtual servers on Cloud Y can provide a greater level of
elasticity.
The hourly cost to the cloud consumer to use a virtual server on Cloud X is half that of the
cost to use a virtual server on Cloud Y.
Within a one month period, Cloud Provider X bases its hourly charge on the maximum number of virtual servers used. Within a one month
period, Cloud Provider Y bases its hourly charges on actual virtual server usage. Cloud
Provider Y charges $20 for each hour that a cloud consumer uses a virtual server.

The cloud consumer predicts its monthly usage requirements to be as follows:

The cloud consumer is required choose the cloud provider with the lowest on-going cost
based on its predicted usage. Which of the following statements accurately calculates the
on-going usage costs of Cloud Providers X and Y and correctly states the cloud provider
that the cloud consumer must choose?

• A. The total usage duration is (10 + 20 + 70) x 12 hours = 1.200 hours.
  The actual usage is (10X6) + (20X4) + (70X2) hours = 280 server hours.
  The cost of using virtual servers from Cloud Provider Xis12X100X5X$10 = $60,000.
  The cost of using virtual servers from Cloud Provider Y is 280 X $20 = $5,600.
  The cloud consumer must therefore choose Cloud Provider Y.
• B. The total usage duration is (10 + 20 + 70) hours = 100 hours.
  The actual usage is (10 X 6) + (20 X 4) + (70 X 2) hours = 280 hours.
  The cost of using virtual servers from Cloud Provider X is 100X6X$10 = $6,000.
  The cost of using virtual servers from Cloud Provider Y is 280 X $20 = $5,600.
  The cloud consumer must therefore choose Cloud Provider Y.
• C. The total usage duration is (10 + 20 + 70) hours = 100 hours.
  The actual usage is ((10 X 6) + (20 X 4) + (70 X 2)) x ((2 + 4 + 6) / 3) hours = 1,120 hours
  The cost of using virtual servers from Cloud Provider Xis10QX6X$10 = $6,000.
  The cost of using virtual servers from Cloud Provider Y is 1,120 X $20 = $22,400.
  The cloud consumer must therefore choose Cloud Provider X.
• D. The total usage duration is (10 + 20 + 70) hours = 100 hours.
  The actual usage is ((10 X 6) + (20 X 4) + (70 X 2)) x ((2 + 4 + 6) / 3) hours = 1,120 hours
  The cost of using virtual servers from Cloud Provider X is 6 X 100 X $10 = $6,000.
  The cost of using virtual servers from Cloud Provider Y is 1,120 X $20 = $22,400.
  The cloud consumer must therefore choose Cloud Provider Y.