Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which practice is a key aspect of secure DevOps in cloud environments?

   • APerforming manual security reviews only after deployment
   • BDisabling security tools to speed up deployments
   • CAutomating security checks as part of the deployment pipeline
   • DUsing the same credentials for all environments
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which encryption mechanism protects data while it is being transmitted between a client and a cloud service?

   • AFull disk encryption
   • BTLS/SSL
   • CEncryption at rest
   • DServer-side encryption with customer-managed keys
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A cloud security engineer is deploying a new web application on a cloud platform. The application will be managed by a team of developers who need to deploy code but should not have the ability to modify network security groups or IAM policies. The organization requires that all infrastructure changes be reviewed and approved before they are applied. Which approach best meets these requirements?

   • ACreate a custom role with permissions to deploy resources but not to modify network security groups or IAM policies, and require all changes to go through a CI/CD pipeline with manual approval gates.
   • BProvide developers with read-only access and have them submit change requests to the security team for manual implementation.
   • CGrant developers the Owner role on the resource group and rely on change management procedures.
   • DUse the Contributor role and rely on Azure Policy to deny changes to network security groups and IAM policies.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's security team manages a multi-account cloud environment. They need to allow a new DevOps tool to programmatically create and manage EC2 instances in a specific account, but only from the tool's static public IP address. The team wants to avoid creating long-lived access keys. Which combination of controls should they implement?

   • ACreate an IAM role with a trust policy that includes the tool's public IP as a condition, and have the tool assume the role using its existing identity provider.
   • BCreate an IAM user with an access key and attach a policy that allows EC2 actions only when the request comes from the tool's public IP.
   • CUse a VPC endpoint for EC2 and attach a bucket policy to allow the tool's IP to access the API.
   • DPlace the tool's IP in a security group that allows inbound traffic to the EC2 instances, and use instance profiles for the tool.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team wants to detect and respond to runtime threats on their cloud VMs, such as unauthorized process execution and file modifications. They also want to correlate these findings with network traffic logs. Which solution should they implement?

   • AUse a vulnerability scanner to scan the VMs for known CVEs.
   • BDeploy a cloud workload protection platform (CWPP) that provides runtime visibility and integrates with the cloud provider's logging service.
   • CEnable VPC flow logs and analyze them with a log management tool.
   • DConfigure a firewall to block all outbound traffic from the VMs.
   Reveal Solution Discussion Select an answer first