6.1 Evaluate Cloud Security Controls and Configurations to Identify Indicators of Misconfiguration (IOMs), Vulnerabilities And/or High-Risk Practices CCCS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is migrating a legacy application to the cloud. The application requires a specific version of a library that has a known vulnerability. The security team has identified this as a finding. The application is critical to business operations and cannot be updated immediately. Which approach best balances risk and operational continuity?

   • AIgnore the vulnerability because the application is critical
   • BMove the application to a separate network segment and do nothing else
   • CImmediately update the library, even if it breaks the application
   • DImplement a compensating control, such as a web application firewall (WAF) or network restriction, to mitigate the vulnerability until the application can be updated
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A cloud administrator is reviewing the configuration of a production database. The database is encrypted at rest, but all applications connect using a single shared service account with administrative privileges. Which high-risk practice is present?

   • ADisabled logging
   • BInadequate network segmentation
   • CExcessive privilege
   • DLack of encryption
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a cloud environment with a web application that uses a managed database service. The database has a configuration that allows public access from any IP address. The application also has a known SQL injection vulnerability. Which finding is more critical?

   • ANeither is critical
   • BBoth are equally critical
   • CThe public database access
   • DThe SQL injection vulnerability
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A security analyst finds that a cloud storage bucket is publicly accessible. How should this finding be classified?

   • AAs a vulnerability in the application code
   • BAs a detective control
   • CAs a high-risk practice
   • DAs an indicator of misconfiguration (IOM)
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is implementing controls to protect a cloud environment. They have configured a web application firewall (WAF) to block common attack patterns. Which type of control is this?

   • ACompensating
   • BCorrective
   • CPreventive
   • DDetective
   Reveal Solution Discussion Select an answer first