Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is a key component of runtime security for cloud workloads?

   • AWriting application code
   • BConfiguring load balancers
   • CDesigning the network architecture
   • DMonitoring and detecting anomalous behavior in running workloads
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational company must comply with GDPR, which requires that personal data of EU citizens be protected. They are using a public cloud provider. Which of the following is the most appropriate way to meet GDPR data residency requirements?

   • AEncrypt all personal data at rest and in transit, regardless of the region.
   • BStore all EU personal data in a cloud region located within the EU and ensure that any data transfer outside the EU uses appropriate safeguards.
   • CUse a private cloud model to ensure that data never leaves the company's premises.
   • DUse a cloud provider that offers dedicated physical servers for the company's data.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security engineer is setting up monitoring for a cloud environment. The team needs to be alerted when an unauthorized network port is opened on a virtual machine. Which combination of actions should be taken?

   • AEnable flow logs for the subnet and create a metric alert on the number of rejected connections.
   • BEnable Azure Defender for Servers and rely on its built-in alerts.
   • CEnable network security group (NSG) flow logs and create a log alert that triggers when a rule allowing a new port is created.
   • DUse a third-party vulnerability scanner to periodically scan for open ports.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization is migrating to a cloud environment and must comply with a regulation that requires separation of duties for financial transactions. The compliance team wants to ensure that no single user can both create a payment batch and approve it. What is the most effective way to enforce this requirement?

   • AUse a shared service account for all financial operations and monitor its usage.
   • BCreate two IAM roles, one for creating batches and one for approving them, and assign users to only one role.
   • CGrant all users the same role and implement a manual approval process outside the cloud.
   • DUse a single role with both permissions and rely on audit logs to detect violations.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which security consideration is most directly associated with cloud storage services?

   • AManaging DNS records
   • BConfiguring load balancer health checks
   • CSetting up auto-scaling policies
   • DEnabling encryption for data at rest
   Reveal Solution Discussion Select an answer first