Introduction to Cloud Security CCSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is designing a cloud-based data analytics platform. The threat model identifies that an attacker could intercept data in transit between the application and the database. Which control should the company implement to mitigate this threat?

   • AEncrypting the database at rest
   • BImplementing a database activity monitor
   • CEncrypting the data with TLS
   • DUsing a VPN for all internal traffic
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is adopting a cloud governance framework. The security team must ensure that all cloud resources are tagged with an owner and cost center. The team also needs to enforce that all storage buckets are private. Which governance approach is MOST effective?

   • AUse a third-party cloud security posture management (CSPM) tool to monitor and alert on violations.
   • BCreate a tagging standard and rely on developers to apply tags and set storage to private.
   • CConduct monthly audits to identify untagged resources and public buckets.
   • DUse cloud policy services (e.g., Azure Policy, AWS Organizations SCPs) to enforce tagging and deny public storage buckets.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is adopting a multi-cloud strategy and needs to ensure consistent security across AWS, Azure, and GCP. The security team is developing a governance framework. Which approach is MOST effective?

   • ADefine a common set of security policies and standards that are cloud-agnostic and map to each provider's native controls.
   • BImplement separate security policies for each cloud provider based on their default settings.
   • CRely on each cloud provider's compliance certifications to ensure security.
   • DUse a single cloud provider for all workloads to simplify governance.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing a threat model for a cloud-native application that uses serverless functions, a managed database, and an API gateway. The architect must identify the most critical threats and prioritize mitigations. Which approach is BEST?

   • ARely on the cloud provider's built-in security features for serverless and managed services.
   • BUse a threat modeling methodology that covers the entire application, including the serverless functions, API gateway, and database, and prioritize based on risk.
   • CConduct a penetration test after deployment to identify vulnerabilities.
   • DFocus on the API gateway because it is the entry point for external traffic.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of a preventive security control in a cloud environment?

   • AAn alert that notifies administrators of a potential breach
   • BA backup that allows data restoration after a ransomware attack
   • CA log that records all access attempts
   • DA firewall rule that blocks unauthorized inbound traffic
   Reveal Solution Discussion Select an answer first