Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise uses a cloud provider with multiple accounts. They want to implement a centralized IAM policy that allows developers to create and manage resources only in their designated project accounts, but they also need to enforce that all resources are tagged with a cost center. The security team wants to minimize administrative overhead. Which approach should they take?

   • AUse a single IAM user for all developers and attach a policy that allows access to all accounts.
   • BCreate a separate IAM role for each developer with permissions to all accounts and rely on resource tags for cost tracking.
   • CUse AWS Organizations with service control policies (SCPs) to restrict access to specific accounts and enforce tagging requirements.
   • DCreate a single IAM policy that grants full access to all accounts and requires tagging via a separate policy.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of a cloud workload protection platform (CWPP)?

   • ATo replace the need for identity and access management
   • BTo provide a user interface for cloud resource provisioning
   • CTo provide security controls for workloads across various cloud environments
   • DTo manage cloud billing and cost optimization
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is evaluating a cloud workload protection platform (CWPP) for their environment. They need to detect known vulnerabilities in container images, monitor runtime behavior of containers, and integrate with their SIEM for alerting. Which capability is most important to verify in the CWPP?

   • AThe ability to scan container images for known vulnerabilities.
   • BThe ability to integrate with the organization's SIEM for centralized alerting.
   • CThe ability to perform all three: image scanning, runtime monitoring, and SIEM integration.
   • DThe ability to monitor runtime behavior and detect anomalies.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of using infrastructure-as-code (IaC) templates for cloud resource configuration?

   • ATo enable version-controlled, repeatable, and consistent deployments
   • BTo bypass security scanning of cloud resources
   • CTo increase the risk of configuration drift
   • DTo manually configure each resource through the console
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational company must ensure that personal data of EU citizens is stored only in EU regions. The company uses a cloud provider with regions worldwide. What is the most effective way to enforce this requirement?

   • AUse a monitoring tool to detect resources created outside the EU and delete them.
   • BUse an organization policy that restricts resource creation to EU regions.
   • CCreate a custom IAM role that only allows resource creation in EU regions.
   • DTrain all employees to manually select EU regions when creating resources.
   Reveal Solution Discussion Select an answer first