Introduction to Cloud Security CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In the context of cloud security, which statement best describes the shared responsibility model?

   • AThe customer is responsible for securing the physical infrastructure and hypervisor in all cloud service models.
   • BThe cloud provider is responsible for securing everything, including customer data and access management.
   • CThe customer is responsible for all security controls, while the provider only ensures service availability.
   • DSecurity responsibilities are divided between the provider and customer, with the exact split depending on the service model (IaaS, PaaS, SaaS).
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is deploying a new cloud application and wants to ensure that security is integrated throughout the development lifecycle. The security team plans to conduct threat modeling during the design phase and implement security controls as part of the CI/CD pipeline. Which approach does this represent?

   • ASecurity as a reactive measure to incidents
   • BSecurity as a separate phase after development
   • CSecurity as a continuous and automated process
   • DSecurity as a shared responsibility between development and operations
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A multinational corporation is adopting a multi-cloud strategy and must align its security controls with the ISO 27001 framework. The security team wants to ensure that all cloud deployments, regardless of provider, enforce consistent identity and access management (IAM) policies. Which governance approach best achieves this objective?

   • ADelegating all IAM decisions to each business unit to accommodate local regulatory differences
   • BImplementing a cloud access security broker (CASB) to monitor user activity across all providers
   • CDeveloping a centralized governance policy that defines baseline IAM requirements and using infrastructure as code to deploy them
   • DCreating provider-specific IAM policies and mapping them to ISO 27001 controls after deployment
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security architect is performing threat modeling for a cloud-based application that processes credit card payments. The architect identifies a threat where an attacker could exploit a vulnerability in a third-party library to gain remote code execution. Which control is most effective in mitigating this threat?

   • AUsing a network intrusion detection system (IDS) to monitor for suspicious activity
   • BImplementing a web application firewall (WAF) to filter malicious requests
   • CRegularly updating and patching the third-party library
   • DEncrypting all data in transit and at rest
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is performing a risk assessment for a new cloud application. The application will store customer payment card data. The analyst identifies that the data is not encrypted at rest. What is the MOST appropriate next step in the risk management process?

   • ATransfer the risk to the cloud provider by signing a contract that holds them liable for data breaches.
   • BImplement encryption at rest for the data storage to mitigate the identified risk.
   • CDocument the risk and accept it because the cloud provider is responsible for data security.
   • DConduct a vulnerability scan to confirm the risk before taking action.
   Reveal Solution Discussion Select an answer first