1.10 Compare Security Operations Considerations of Cloud Platforms Such as IaaS, PaaS 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security operations team is designing an incident response plan for a workload that spans IaaS and PaaS. The team needs to ensure that security events from both the VM's OS and the PaaS application are collected in a central location. Which approach should the team implement?

   • AInstall a logging agent on the IaaS VM and enable application-level logging on the PaaS platform, then send both to a central SIEM
   • BEnable network-level logging on the IaaS VM and rely on the provider's PaaS logs
   • CRely on the provider's logging for both the IaaS VM and the PaaS application
   • DUse only the PaaS platform's built-in monitoring and ignore the IaaS VM logs
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A development team uses a PaaS database service. The security team wants to ensure that only authorized applications can access the database. Which control is the customer responsible for configuring?

   • APatching the database operating system
   • BDatabase-level authentication and authorization rules
   • CConfiguring the network firewall on the database host
   • DPhysical security of the database servers
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security engineer is troubleshooting a network connectivity issue on an IaaS VM. The VM has a public IP and is in a subnet with an NSG that allows only HTTPS traffic. The engineer cannot connect to the VM via SSH from the corporate network. Which change is most likely to resolve the issue?

   • AAdd an NSG rule to allow SSH from the corporate network IP range
   • BEnable Azure Bastion and keep the current NSG
   • CChange the NSG rule to allow all traffic
   • DRemove the public IP from the VM
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is migrating from IaaS to PaaS for a web application. The security team is updating its incident response plan. Which change in responsibility should the plan reflect?

   • AThe customer no longer needs to monitor application logs
   • BThe provider now handles patching of the runtime and middleware, so the customer's incident response focuses on the application and data
   • CThe provider is now responsible for securing the application code
   • DThe customer is now responsible for patching the guest OS
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has a compliance requirement to retain security logs for 12 months. They use a mix of IaaS VMs and PaaS services. The security team is designing a log retention strategy. Which consideration is most important?

   • AStore logs only for IaaS VMs, as PaaS logs are not required for compliance
   • BRely on the provider's default log retention for all services
   • CDisable logging for PaaS services to reduce storage costs
   • DEnsure that logs from both IaaS and PaaS are exported to a central storage that supports the retention period
   Reveal Solution Discussion Select an answer first