Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security operations team is setting up monitoring for a cloud environment. They want to detect potential brute-force attacks on their cloud VMs and also identify unusual API calls that might indicate compromised credentials. They have limited budget and need to prioritize the most effective controls. Which combination should they implement?

   • AEnable cloud provider's security monitoring service that analyzes API calls and integrates with OS-level agents for brute-force detection.
   • BEnable VPC flow logs and set up alerts for high volumes of failed SSH attempts.
   • CUse a third-party vulnerability scanner to identify open ports and potential brute-force vectors.
   • DConfigure a firewall to block repeated failed SSH attempts from the same IP.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is designing a multi-tier application in the cloud. The web tier must be publicly accessible, while the application tier and database tier must be private. They also need to encrypt traffic between tiers. Which architecture should they implement?

   • APlace all tiers in a private subnet and use a VPN for public access.
   • BPlace all tiers in a public subnet and use security groups to restrict access.
   • CPlace the web tier in a public subnet, the application and database tiers in private subnets, and use security groups to allow traffic only between tiers, with TLS for inter-tier communication.
   • DUse a single subnet for all tiers and rely on encryption to protect data.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which cloud service is typically used to collect and store logs from various cloud resources for security analysis?

   • ACentralized logging service (e.g., CloudTrail, Azure Monitor)
   • BContent delivery network (CDN)
   • CLoad balancer
   • DObject storage bucket
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is a key security consideration for serverless functions?

   • ASecuring the function code and its dependencies
   • BPatching the container runtime
   • CConfiguring the virtual network firewall
   • DManaging the underlying operating system patches
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company uses a CI/CD pipeline to deploy containerized applications to a managed Kubernetes cluster. They want to ensure that only approved container images are deployed and that the pipeline automatically scans for vulnerabilities. They also need to enforce that the Kubernetes cluster rejects any image that is not from their private registry. Which approach should they take?

   • AUse an admission controller that validates image signatures and enforces that images come from the private registry.
   • BRely on the CI/CD pipeline to scan images and manually approve each deployment.
   • CUse a network policy to block traffic from pods running unapproved images.
   • DConfigure the Kubernetes cluster to pull images only from the private registry and rely on the pipeline to scan.
   Reveal Solution Discussion Select an answer first