Data Security CND Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is migrating its customer relationship management (CRM) application to a public cloud IaaS environment. The application stores customer PII in a managed database and also writes log files to a storage bucket. The security team must ensure that data is encrypted both at rest and in transit. Which combination of controls should be implemented?

   • AEnable encryption on the database and storage bucket using cloud-managed keys, and enforce TLS for all application connections.
   • BUse client-side encryption for the database and rely on the cloud provider's default network security groups.
   • CEnable database encryption and rely on the cloud provider's physical security to protect data in transit.
   • DEncrypt the application's configuration files and use a VPN between the application and the database.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying a new application in a virtualized environment. The application stores sensitive customer data on a virtual disk. The security team must ensure that the data is protected from unauthorized access by other virtual machines on the same hypervisor. Which control is most effective?

   • AEncrypt the virtual disk using the hypervisor's built-in encryption feature.
   • BTake regular snapshots of the VM and store them in a secure location.
   • CUse a strong password for the VM's operating system account.
   • DPlace the VM on a separate VLAN and configure firewall rules to restrict traffic.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company uses a cloud storage service to share files with external partners. The files contain confidential business data. The company wants to protect the files both during upload and while stored. Which approach should be used?

   • AUse FTP for uploads and rely on the cloud provider's physical security.
   • BUse HTTPS for uploads and enable server-side encryption on the cloud storage.
   • CUse SFTP for uploads and disable encryption on the storage to reduce complexity.
   • DUse a VPN for uploads and store the files in a public bucket with no additional controls.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a cloud environment, what is the customer's responsibility under the shared responsibility model?

   • ASecuring the underlying hypervisor
   • BPhysical security of the cloud data centers
   • CEnsuring the cloud provider's network is protected from DDoS attacks
   • DManaging access to data and applications they deploy in the cloud
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is using a cloud-based database service. The database contains sensitive data. The company wants to ensure that the data is encrypted at rest and that the encryption keys are managed by the company, not the cloud provider. Which approach should be used?

   • AUse the cloud provider's default encryption with service-managed keys.
   • BEncrypt the data in the application before sending it to the database.
   • CUse customer-managed keys (CMK) with the cloud provider's key management service.
   • DDisable encryption on the database to improve performance.
   Reveal Solution Discussion Select an answer first