Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of integrating security scanning into a CI/CD pipeline?

   • ATo automatically detect vulnerabilities in code and infrastructure before deployment
   • BTo slow down the deployment process for manual review
   • CTo replace the need for penetration testing
   • DTo ensure that only the latest version of software is deployed
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary function of a network firewall in a cloud environment?

   • ATo balance traffic across multiple servers
   • BTo encrypt data stored on disk
   • CTo filter traffic based on rules and block unauthorized access
   • DTo translate domain names to IP addresses
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An organization uses a cloud provider with a large number of resources. The security team wants to ensure that all resources have mandatory tags (e.g., owner, cost center) and that no resource is created without these tags. They also want to prevent any user from creating resources outside a specific region. What is the most efficient way to enforce these requirements?

   • AUse a combination of organization policies and IAM roles to enforce tagging and region restrictions.
   • BUse organization policies to require tags and restrict regions, and also use policy-as-code in the CI/CD pipeline.
   • CUse a policy-as-code tool in the CI/CD pipeline to validate tags and region before deployment.
   • DUse a monitoring tool to detect resources without tags or in the wrong region and remediate them.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A financial services company must comply with a regulation that requires all access to customer data to be logged and reviewed. The company uses a cloud object storage service for customer data. The security team wants to ensure that every access to the data is logged and that logs are immutable. What should be implemented?

   • AEnable access logging on the storage service and store logs in a separate storage account with write-once-read-many (WORM) policy.
   • BUse a third-party monitoring tool to capture access logs, but do not enable native logging.
   • CEnable access logging and store logs in the same storage account as the data.
   • DEnable access logging and set a lifecycle policy to delete logs after 90 days.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A development team uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to ensure that all resources are deployed with encryption enabled and that no public IP addresses are assigned to databases. What is the most efficient way to enforce these requirements?

   • AConduct periodic security audits of deployed resources and fix any issues found.
   • BUse policy-as-code tools to scan IaC templates before deployment and fail the pipeline if violations are found.
   • CProvide developers with a checklist of security requirements to follow when writing IaC.
   • DAdd manual review steps to the CI/CD pipeline for every deployment.
   Reveal Solution Discussion Select an answer first