6.4 Compare Cloud, Docker and Kubernetes Configurations to the Latest Industry Benchmarks to Determine Compliance CCCS Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When comparing a cloud service configuration to an industry benchmark, what is the primary purpose of the comparison?

   • ATo replace the cloud provider's default security controls
   • BTo determine if the configuration meets the benchmark's security requirements
   • CTo verify the cloud provider's compliance with legal regulations
   • DTo guarantee the cloud service is free from all vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services company is preparing for a regulatory audit. The security team has been asked to verify that all Azure virtual machines are configured according to the Center for Internet Security (CIS) Azure Foundations Benchmark. The team has exported the VM configuration data and needs to compare it against the benchmark. Which approach best ensures an accurate compliance assessment?

   • AReview the VM settings manually and rely on the security team's experience to determine compliance.
   • BUse the latest published CIS benchmark version and map each VM setting to the corresponding benchmark control, documenting any deviations.
   • CCompare VM settings against the benchmark version that was current when the VMs were first deployed.
   • DRun a generic vulnerability scanner and treat any findings as benchmark non-compliance.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A cloud administrator is checking an AWS account against the CIS AWS Foundations Benchmark. The administrator finds that CloudTrail is not enabled in all regions. What is the compliance status for this control?

   • ANon-compliant, because the benchmark requires CloudTrail to be enabled in all regions.
   • BCompliant, because CloudTrail is an optional service.
   • CCompliant, because CloudTrail is enabled in the primary region.
   • DNon-compliant, because CloudTrail must be enabled in at least two regions.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which industry benchmark provides security configuration guidelines specifically for Kubernetes clusters?

   • AGDPR
   • BCIS Kubernetes Benchmark
   • CISO 27017
   • DSOC 2
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Kubernetes administrator is reviewing the cluster's configuration against the CIS Kubernetes Benchmark. The administrator notices that the kubelet is configured with the '--read-only-port=0' flag. What is the compliance status for this setting?

   • ANon-compliant, because the flag should be set to a specific port number.
   • BCompliant, because disabling the read-only port is a recommended control.
   • CCompliant, because the flag is not relevant to the benchmark.
   • DNon-compliant, because the read-only port must be enabled for monitoring.
   Reveal Solution Discussion Select an answer first