Cloud Security Design Principles and Architecture CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational company must store personal data of EU citizens in a cloud region located in the EU. The company also wants to use a cloud provider's AI service that only runs in a US region. The data protection officer (DPO) says the data cannot leave the EU. Which option satisfies the data residency requirement?

   • AUse the AI service in the US region and rely on the provider's encryption in transit to protect the data during transfer.
   • BMove the personal data to the US region because the provider's AI service is more powerful and the provider guarantees GDPR compliance.
   • CStore the data in the EU region but allow the AI service to access it remotely from the US region without copying the data.
   • DKeep the personal data in the EU region and use the AI service only on anonymized or non-personal data that can be sent to the US region.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the shared responsibility model for SaaS, which security responsibility is typically handled by the cloud provider?

   • AIntegrating with corporate identity providers
   • BManaging user access to the application
   • CSecuring the application code and infrastructure
   • DConfiguring data retention policies
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which IAM strategy allows users to use their existing corporate credentials to access cloud resources without creating a separate cloud account?

   • APrivileged access management
   • BRole-based access control
   • CMulti-factor authentication
   • DFederation
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company uses a cloud provider's identity federation to allow employees to access cloud resources using their corporate credentials. They want to ensure that only employees with a valid corporate account can access the cloud. Which configuration is required?

   • AUse API keys for each employee
   • BSet up a SAML trust between the corporate identity provider and the cloud provider, and configure the cloud to trust only the corporate identity provider
   • CCreate local cloud accounts for each employee and sync passwords
   • DAllow any identity provider to federate
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company stores sensitive data in a cloud database. The compliance team requires that the data be encrypted at rest using keys that are rotated every 90 days. Which key management approach should be used?

   • AUse a cloud key management service with automatic key rotation enabled for a 90-day rotation period.
   • BUse a single static key and manually rotate it every year.
   • CUse the provider's default encryption and do not manage keys.
   • DUse client-side encryption and store the keys in the same database as the data.
   Reveal Solution Discussion Select an answer first