Introduction to Cloud Security CCSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare startup is migrating a patient-facing application to a public cloud. The compliance officer requires that all protected health information (PHI) be encrypted at rest and in transit, and that the organization maintain visibility into who accesses the data. The cloud provider offers encryption by default for storage and network traffic, but the startup must also ensure that its own administrators cannot bypass logging. Which responsibility does the startup retain under the shared responsibility model?

   • APatching the hypervisor that hosts the virtual machines
   • BEnforcing access control policies and auditing administrative actions
   • CConfiguring and managing the physical security of the data center
   • DEnsuring that the cloud provider's network is protected from distributed denial-of-service attacks
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security architect is designing a defense-in-depth strategy for a cloud application. The application is exposed to the internet and handles sensitive data. Which set of controls BEST implements defense-in-depth?

   • AEncryption of data at rest and in transit only.
   • BA single, comprehensive security appliance that provides all security functions.
   • CA strong password policy and multi-factor authentication for all users.
   • DNetwork security groups, a web application firewall, encryption of data at rest and in transit, and application-level authentication.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A software company uses a serverless architecture for its application. The security team is concerned about the security of the underlying runtime environment. According to the shared responsibility model, which security aspect is the cloud provider responsible for?

   • APatching and securing the underlying server infrastructure
   • BManaging user access to the application's data
   • CSecuring the application code and its dependencies
   • DConfiguring network security groups for the application
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is migrating its customer relationship management (CRM) system to the cloud. The risk assessment identifies that a misconfigured identity provider could allow unauthorized access. The company decides to implement multi-factor authentication (MFA) for all users and conduct regular access reviews. Which risk management strategy is the company applying?

   • ARisk acceptance
   • BRisk mitigation
   • CRisk transfer
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In cloud security, what is the primary purpose of threat modeling?

   • ATo encrypt all data stored in the cloud
   • BTo automatically patch all virtual machines in the cloud environment
   • CTo identify potential threats, vulnerabilities, and attack vectors so that security controls can be prioritized
   • DTo monitor network traffic for malicious activity in real time
   Reveal Solution Discussion Select an answer first