Platform and Infrastructure Security in Cloud CCSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of encrypting data at rest in cloud storage?

   • ATo allow public access to the data
   • BTo speed up data retrieval
   • CTo protect data from unauthorized access when it is stored on disk
   • DTo reduce storage costs
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which practice is a core principle of secure configuration management for cloud resources?

   • AApplying the principle of least privilege to IAM roles
   • BDisabling all logging to reduce overhead
   • CUsing default service accounts for all applications
   • DOpening all ports to simplify connectivity
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to have an incident response plan tailored to cloud environments?

   • ABecause cloud incidents are always less severe than on-premises incidents
   • BBecause cloud environments have unique characteristics such as shared responsibility and dynamic resources
   • CBecause cloud providers handle all incident response for customers
   • DBecause cloud environments are immune to security incidents
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team detects a ransomware attack on a cloud VM. The VM's disk is encrypted with a customer-managed key. The team wants to recover the VM from a snapshot taken before the attack. What must they ensure to successfully restore the VM?

   • AThe customer-managed key is available and the IAM role used for the restore has permission to use the key.
   • BThe snapshot is stored in a different region than the original VM.
   • CThe VM's public IP address is the same as before the attack.
   • DThe security group attached to the VM is the same as before the attack.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses a CI/CD pipeline to deploy cloud resources. The security team wants to ensure that no deployment creates a storage bucket with public read access. What is the most effective way to enforce this?

   • AUse a monitoring tool to detect public buckets after deployment and make them private.
   • BUse a policy-as-code tool to scan the deployment template and fail the pipeline if public access is detected.
   • CAdd a manual approval step in the pipeline for every deployment.
   • DConduct a security review of the code before it is merged into the main branch.
   Reveal Solution Discussion Select an answer first