Introduction to Cloud Security CCSE Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A financial services firm is designing a cloud-based trading application. The security architect is performing threat modeling and identifies that an attacker could exploit a misconfigured storage bucket to access sensitive customer data. Which security control would directly mitigate this identified threat?

   • AEnabling server-side encryption on the storage bucket
   • BImplementing a web application firewall (WAF) in front of the application
   • CApplying least-privilege access policies and enabling public access blocking on the storage bucket
   • DDeploying a network intrusion detection system (IDS) to monitor traffic to the storage service
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is designing a cloud workload that will process sensitive user data. The security architect wants to identify potential attack vectors and prioritize mitigations. Which approach is most effective for this purpose?

   • AReview the cloud provider's security whitepapers and assume the provider handles all threats.
   • BDeploy a web application firewall (WAF) and rely on its default rules to protect the workload.
   • CPerform a threat modeling exercise using a structured methodology like STRIDE to identify threats and then map them to security controls.
   • DConduct a vulnerability scan after deployment and fix any findings.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of cloud security governance?

   • ATo automatically block all network traffic from public IP addresses
   • BTo define and enforce policies, standards, and processes that align cloud security with business objectives and compliance requirements
   • CTo ensure the cloud provider manages all customer data and access decisions
   • DTo replace the need for technical security controls such as firewalls and encryption
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is using a public cloud IaaS environment. A security administrator notices that a virtual machine has been compromised. According to the shared responsibility model, which of the following is the company's responsibility?

   • AConfiguring the physical network firewall at the data center.
   • BPatching the operating system of the virtual machine.
   • CEnsuring the availability of the underlying physical servers.
   • DSecuring the hypervisor that hosts the virtual machine.
   Reveal Solution Discussion Select an answer first