Cloud Security Controls CEH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is using a SaaS application and wants to implement a control to prevent data exfiltration by users. The provider offers a data loss prevention (DLP) feature. Who is responsible for configuring and managing this DLP control?

   • ABoth parties, because DLP requires shared responsibility
   • BThe provider, because they manage the application
   • CA third-party security vendor
   • DThe customer, through the SaaS application's administrative settings
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A cloud security team wants to ensure that their security controls are effective over time. They plan to review logs, conduct periodic vulnerability scans, and perform penetration tests. Which type of control activity are they performing?

   • ACorrective action planning
   • BDeterrent control deployment
   • CPreventive control implementation
   • DMonitoring and auditing
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses a SaaS email service. The security team wants to implement a control that prevents phishing emails from reaching users. Which control is most appropriate in this SaaS model?

   • AConfigure a host-based firewall on each user's workstation
   • BImplement a VPN for all email traffic
   • CEnable the email service's built-in spam and phishing filter
   • DDeploy a network-based intrusion prevention system (IPS) in the customer's data center
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A government agency uses a community cloud to share data with partner agencies. The agency must implement a control that prevents unauthorized physical access to the cloud data center and also provides a tamper-evident record of any physical access. Which control combination best meets these requirements?

   • ARole-based access control and audit logging
   • BSecurity guards and a visitor log
   • CEncryption of data at rest and in transit
   • DBiometric access control and CCTV surveillance with video retention
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is using a cloud provider's IaaS offering to host a web server. They want to ensure that only HTTPS traffic reaches the server. Which control should they configure at the cloud provider level?

   • AA network security group (NSG) rule that allows only port 443
   • BA data encryption at rest policy
   • CAn application-level authentication mechanism
   • DA guest OS firewall rule that blocks port 80
   Reveal Solution Discussion Select an answer first