A healthcare organization uses a multi-tenant SaaS application to manage patient records. The SaaS provider recently suffered a data breach that exposed tenant data. The organization's contract states the provider is responsible for application security, but the organization is required to notify patients under data protection regulations. Which threat is the organization primarily facing?

Service outage causing data unavailability

Insider threat from the SaaS provider's employees

Vendor lock-in preventing migration to another provider

Data breach due to shared responsibility gaps

A company uses a cloud-based CRM that stores customer data. They want to mitigate the risk of data loss due to accidental deletion by employees. Which control is most effective?

Implement strict password complexity policies

Deploy a Web Application Firewall (WAF) in front of the CRM

Enable versioning on the storage service

Use a single administrative account for all employees

Which cloud-specific threat involves the unauthorized access to or disclosure of sensitive data stored in the cloud?

Insufficient identity management

A company's cloud environment experienced a data breach traced to a compromised developer account. The account had broad administrative privileges and no multi-factor authentication (MFA). The security team wants to reduce the risk of similar incidents. Which combination of actions is most effective?

Enforce MFA for all users and review IAM roles to apply least-privilege permissions.

Increase logging and alerting on all administrative actions.

Move all resources to a private cloud to reduce the attack surface.

Rotate access keys monthly and disable unused accounts.

EC-CouncilCertified Ethical Hacker

Domain 8Objective 2

Cloud Computing Threats CEH Practice Questions (Page 3)

Part of the Cloud Computing domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

6concepts

Questions 11–15

11application · medium
A healthcare organization uses a multi-tenant SaaS application to manage patient records. The SaaS provider recently suffered a data breach that exposed tenant data. The organization's contract states the provider is responsible for application security, but the organization is required to notify patients under data protection regulations. Which threat is the organization primarily facing?
Select an answer first
12application · medium
A company uses a cloud-based CRM that stores customer data. They want to mitigate the risk of data loss due to accidental deletion by employees. Which control is most effective?
Select an answer first
13foundation · easy
Which cloud-specific threat involves the unauthorized access to or disclosure of sensitive data stored in the cloud?
Select an answer first
14application · medium
A company's cloud environment experienced a data breach traced to a compromised developer account. The account had broad administrative privileges and no multi-factor authentication (MFA). The security team wants to reduce the risk of similar incidents. Which combination of actions is most effective?
Select an answer first
15application · medium
A company uses a public cloud IaaS environment. They are responsible for securing their virtual machines, but the provider is responsible for the physical hosts. A vulnerability in the hypervisor is discovered. Which party is responsible for patching the hypervisor?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Cloud Computing Threats CEH Practice Questions (Page 3)

Questions 11–15

A company uses a cloud-based CRM that stores customer data. They want to mitigate the risk of data loss due to accidental deletion by employees. Which control is most effective?

Which cloud-specific threat involves the unauthorized access to or disclosure of sensitive data stored in the cloud?

A company uses a public cloud IaaS environment. They are responsible for securing their virtual machines, but the provider is responsible for the physical hosts. A vulnerability in the hypervisor is discovered. Which party is responsible for patching the hypervisor?

Keep studying — Cloud Computing