Cloud Security Design Principles and Architecture CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is threat modeling a serverless application that uses a function to process user-uploaded files. The function writes to a storage bucket and sends a message to a queue. Which threat is most specific to the serverless model and should be prioritized?

   • AThe storage bucket could be misconfigured to allow public read access, exposing uploaded files.
   • BAn attacker could upload a malicious file that exploits a vulnerability in the function's dependencies, leading to code execution in the function's runtime.
   • CThe function's virtual machine could be compromised through an unpatched operating system vulnerability.
   • DThe queue could be overwhelmed with messages, causing a denial of service.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which cloud architecture component is primarily protected by applying security groups, network ACLs, and firewall rules?

   • ANetworking
   • BIdentity
   • CStorage
   • DCompute
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is migrating to a cloud environment and must comply with a regulation that requires segregation of duties for administrative tasks. The security team wants to ensure that no single administrator can both create a user and grant that user access to sensitive resources. Which IAM design best meets this requirement?

   • ARely on the cloud provider's default administrator role, which is designed to meet compliance requirements.
   • BUse a single role that can both create users and grant access, but require a second administrator to approve each action.
   • CCreate two separate roles: one that can create users and another that can grant resource access, and assign these roles to different administrators.
   • DGrant all administrators full access to the identity service and all resources.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which key management practice is essential to protect data encrypted in the cloud?

   • ARotating keys regularly
   • BUsing the same key for all data
   • CStoring keys with the encrypted data
   • DEmbedding keys in application code
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   During threat modeling for a cloud-native application, the team identifies that an attacker who compromises a single microservice could potentially access the entire database due to overly broad IAM roles. The team must reduce the risk without impacting performance. Which approach is most effective?

   • AApply least privilege IAM roles to each microservice, granting only the permissions needed
   • BImplement network segmentation to isolate each microservice
   • CEnable multi-factor authentication for all microservices
   • DUse a single powerful service account for all microservices to simplify management
   Reveal Solution Discussion Select an answer first