Section: Protection of Information Assets
Explanation/Reference:
Salami slicing or Salami attack refers to a series of many small actions, often performed by clandestine
means, that as an accumulated whole produces a much larger action or result that would be difficult or
unlawful to perform all at once. The term is typically used pejoratively. Although salami slicing is often used
to carry out illegal activities, it is only a strategy for gaining an advantage over time by accumulating it in
small increments, so it can be used in perfectly legal ways as well.
An example of salami slicing, also known as penny shaving, is the fraudulent practice of stealing money
repeatedly in extremely small quantities, usually by taking advantage of rounding to the nearest cent (or
other monetary unit) in financial transactions. It would be done by always rounding down, and putting the
fractions of a cent into another account. The idea is to make the change small enough that any single
transaction will go undetected.
In information security, a salami attack is a series of minor attacks that together results in a larger attack.
Computers are ideally suited to automating this type of attack.
The following answers are incorrect:
Eavesdropping - is the act of secretly listening to the private conversation of others without their consent,
as defined by Black's Law Dictionary. This is commonly thought to be unethical and there is an old adage
that "eavesdroppers seldom hear anything good of themselves...eavesdroppers always try to listen to
matters that concern them."
Traffic analysis - is the process of intercepting and examining messages in order to deduce information
from patterns in communication. It can be performed even when the messages are encrypted and cannot
be decrypted. In general, the greater the number of messages observed, or even intercepted and stored,
the more can be inferred from the traffic. Traffic analysis can be performed in the context of military
intelligence, counter-intelligence, or pattern-of-life analysis, and is a concern in computer security.
Masquerading - A masquerade attack is an attack that uses a fake identity, such as a network identity, to
gain unauthorized access to personal computer information through legitimate access identification. If an
authorization process is not fully protected, it can become extremely vulnerable to a masquerade attack.
Masquerade attacks can be perpetrated using stolen passwords and logons, by locating gaps in programs,
or by finding a way around the authentication process. The attack can be triggered either by someone
within the organization or by an outsider if the organization is connected to a public network. The amount of
access masquerade attackers get depends on the level of authorization they've managed to attain. As
such, masquerade attackers can have a full smorgasbord of cybercrime opportunities if they've gained the
highest access authority to a business organization. Personal attacks, although less common, can also be
harmful.
The following reference(s) were/was used to create this question:
http://searchfinancialsecurity.techtarget.com/definition/eavesdropping
http://en.wikipedia.org/wiki/Salami_slicing
http://en.wikipedia.org/wiki/Eavesdropping
http://en.wikipedia.org/wiki/Traffic_analysis
http://www.techopedia.com/definition/4020/masquerade-attack

Section: Governance and Management of IT
Explanation:
In Community cloud, the cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
For your exam you should know below information about Cloud Computing deployment models:
Private cloud
The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
Private Cloud

Community Cloud
The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
Community Cloud

Public Cloud
The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.
Public Cloud

Hybrid cloud
The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds) hybrid cloud

The following answers are incorrect:
Private cloud - The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
Public cloud - The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.
Hybrid cloud - The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds) Reference:
CISA review manual 2014 page number 102
Official ISC2 guide to CISSP 3rd edition Page number 689 and 690

A directory server makes other users' certificates available to applications. Encrypting the information transmitted over the network and storing certificate revocation lists (CRLs) are roles performed by a security server. Facilitating the implementation of a password policy is not relevant to public key infrastructure ( PKl ).