Introduction to Cloud Security CCSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization is adopting a multi-cloud strategy and must align its security controls with HIPAA. The security team is defining a governance framework. What should be the FIRST step in establishing effective cloud security governance?

   • ASelect a single cloud provider that offers the most HIPAA-compliant services to minimize governance overhead.
   • BDefine security policies and standards that map to HIPAA requirements and apply consistently across all cloud providers.
   • CImplement technical controls first, then document them in a governance policy.
   • DCreate a compliance checklist for each cloud provider and review it annually.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating its on-premises data center to a public cloud. The security team is evaluating the shared responsibility model and wants to ensure that the company's security controls are effective. Which combination of controls is most appropriate for the company to implement?

   • AImplementing identity and access management, encryption, and network security controls
   • BRelying on the cloud provider's security certifications and compliance reports
   • CDeploying a cloud access security broker (CASB) to monitor all traffic
   • DUsing a single sign-on (SSO) solution for all cloud applications
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services company is migrating a customer-facing application to a public cloud IaaS environment. The security team must ensure that the application's data remains confidential and that the system is available during a regional outage. The compliance team requires that the company retain the ability to audit who accessed the data. Which combination of actions best addresses these requirements while respecting the shared responsibility model?

   • AUse a single region with daily backups to a different region and rely on the provider's access logs.
   • BMove the application to a private cloud to ensure physical security and avoid shared responsibility.
   • CEncrypt data at rest and in transit, enable multi-region replication, and enable cloud provider audit logging for the customer data.
   • DRely on the cloud provider's default encryption and availability guarantees, and request the provider's compliance reports for auditing.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is implementing a cloud governance framework and wants to ensure that security policies are enforced consistently across all cloud resources. The security team is considering using infrastructure as code (IaC) to deploy resources. Which benefit of IaC is most directly related to governance?

   • AIaC enables automated compliance checks and policy enforcement
   • BIaC eliminates the need for manual security reviews
   • CIaC reduces the time required to deploy resources
   • DIaC provides a graphical interface for managing resources
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is evaluating the risk of a new cloud service that will store customer data. The team has identified that the service has a high likelihood of a data breach and a high impact on the business. What is the MOST appropriate risk response?

   • AAccept the risk because the cloud provider has strong security measures.
   • BAvoid the risk by not using the cloud service at all.
   • CTransfer the risk by purchasing cyber insurance.
   • DMitigate the risk by implementing additional security controls, such as encryption and access controls.
   Reveal Solution Discussion Select an answer first