Cloud Control Strategies CAS-005 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a detective control in a cloud environment?

   • AConfiguring a SIEM to alert on suspicious login patterns
   • BPatching a critical vulnerability in a cloud application
   • CImplementing multi-factor authentication for all users
   • DSetting up a firewall rule to block traffic from a known malicious IP
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization uses Salesforce (SaaS) and needs to integrate it with their on-premises Active Directory. They want to enforce single sign-on (SSO) and multi-factor authentication (MFA) for all Salesforce users. They also want to monitor for suspicious login activity. Which solution should they implement?

   • ACreate a direct VPN connection between the on-premises network and Salesforce.
   • BDeploy a third-party identity provider on-premises and configure Salesforce to use SAML.
   • CUse Azure AD as an identity provider with federation to Salesforce, and enable Azure AD Identity Protection.
   • DUse Salesforce's built-in password policies and enable login IP restrictions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A cloud environment is highly dynamic, with resources being provisioned and deprovisioned frequently. Which authorization approach is best suited to maintain compliance and security in this environment?

   • AContinuous authorization
   • BStatic authorization
   • CManual authorization
   • DOne-time authorization
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a hybrid cloud environment with an ExpressRoute connection to Azure. They want to ensure that only authorized administrators can access the Azure management plane. They also want to monitor for any unauthorized access attempts. Which combination of controls should they implement?

   • AUse Azure AD Privileged Identity Management (PIM) for just-in-time access and Azure AD sign-in logs for monitoring.
   • BUse Azure Firewall to restrict access to the management plane.
   • CUse a VPN to the Azure management plane and rely on the VPN logs.
   • DUse Azure Policy to deny all access to the management plane.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a cloud-based project management tool (SaaS) and a cloud-based identity provider (IdP). They want to integrate the two so that user provisioning and deprovisioning is automated. They also want to ensure that the integration is secure. Which approach should they take?

   • AUse OAuth for API access.
   • BUse SCIM (System for Cross-domain Identity Management) to automate user provisioning.
   • CUse SAML for single sign-on.
   • DUse a manual process to create and delete user accounts.
   Reveal Solution Discussion Select an answer first