Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company runs a containerized application on a managed Kubernetes service. They need to ensure that container images are scanned for vulnerabilities before deployment and that running containers are restricted from privilege escalation. Which set of controls should they implement?

   • AUse a service mesh with mutual TLS and encrypt traffic between pods.
   • BManually review container images before deployment and rely on the container runtime's default security settings.
   • CEnable audit logging on the Kubernetes cluster and use network policies to restrict pod-to-pod communication.
   • DIntegrate image scanning into the CI/CD pipeline and enforce a pod security policy that disallows privileged containers.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company runs a serverless application using a function-as-a-service platform. They need to ensure that the function's environment variables, which contain database credentials, are encrypted at rest and that the function can only be invoked from a specific VPC. Which configuration should they implement?

   • AEncrypt the environment variables using the platform's default encryption and rely on IAM policies to restrict invocation.
   • BStore the credentials in a secrets management service and configure the function to retrieve them at runtime, and set the function's VPC configuration to the specific VPC.
   • CUse a dedicated serverless database that does not require credentials and allow public invocation.
   • DHardcode the credentials in the function code and use a VPC endpoint to restrict invocation.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes the shared responsibility model in cloud computing?

   • AThe customer is responsible for physical security, while the provider handles logical access controls.
   • BThe customer is responsible for securing the underlying infrastructure in all cloud service models.
   • CThe cloud provider is responsible for all security aspects, including customer data and access policies.
   • DSecurity responsibilities are split between the provider and customer depending on the service model and the specific asset.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a multi-tier application in a cloud VPC. The web tier must be accessible from the internet, while the application and database tiers should only be reachable from the web tier. The security team requires that all traffic between tiers be encrypted. Which configuration should the engineer implement?

   • APlace all tiers in the same subnet and use security group rules to restrict traffic between instances.
   • BPut the web and application tiers in the same subnet and the database in a separate subnet, using security groups to allow database access only from the application tier.
   • CUse a single subnet but enable encryption at the storage layer for all instances.
   • DCreate separate subnets for each tier, use network ACLs to allow only required traffic, and enable TLS for inter-tier communication.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the first step in an incident response process for a cloud security incident?

   • ARecovery
   • BEradication
   • CContainment
   • DPreparation
   Reveal Solution Discussion Select an answer first