A financial services firm is moving to a public cloud and must comply with a regulation that requires customer data to reside within the country's borders. Which of the following is the most appropriate architectural decision?

Use a private cloud hosted in a neighboring country with a direct connection

Use a global cloud service and rely on encryption to protect data anywhere

Use a cloud region located in the required country for all customer data storage

Use a SaaS application that stores data in multiple regions for redundancy

A company is deploying a new application in the cloud. The security team wants to ensure that each application component has only the permissions it needs to function, and that no component can access resources outside its intended scope. Which set of controls should be applied?

Use a single shared service principal for all components to simplify management.

Assign each component a dedicated service principal with a role that grants only the required permissions, and use resource-level scoping to limit access.

Rely on the provider's default permissions for all components because they are designed to be secure.

Grant each component full contributor access to the entire subscription to avoid permission errors.

An organization uses a cloud provider's IAM service. They want to grant a developer the ability to list only their own project's virtual machines, without the ability to modify or delete them. Which IAM strategy should they use?

Create a custom role with only 'compute.instances.list' permission and assign it to the developer

Use a service account key shared with the developer

Give the developer the 'Editor' role

Assign the developer the 'Owner' role on the project

EC-CouncilCloud Security Essentials

Domain 1Objective 5

Cloud Security Design Principles and Architecture CSE Practice Questions (Page 4)

Part of the Cloud Computing and Security Fundamentals domain, which makes up ~12% of our current practice bank.

48questions here

10free pages

9concepts

9 Concepts in This Objective

Cloud Security Design Principles
Cloud Architecture Security
Shared Responsibility Model
Threat Modeling for Cloud
Identity and Access Management (IAM) in Cloud
Data Protection in Cloud
Network Security in Cloud
Compliance and Governance in Cloud
Incident Response in Cloud

Questions 16–20

16foundation · easy
Which threat modeling framework categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?
Select an answer first
17application · medium
A financial services firm is moving to a public cloud and must comply with a regulation that requires customer data to reside within the country's borders. Which of the following is the most appropriate architectural decision?
Select an answer first
18foundation · easy
Which compliance framework is specifically designed for organizations that handle credit card data?
Select an answer first
19application · medium
A company is deploying a new application in the cloud. The security team wants to ensure that each application component has only the permissions it needs to function, and that no component can access resources outside its intended scope. Which set of controls should be applied?
Select an answer first
20application · medium
An organization uses a cloud provider's IAM service. They want to grant a developer the ability to list only their own project's virtual machines, without the ability to modify or delete them. Which IAM strategy should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Cloud Security Design Principles and Architecture CSE Practice Questions (Page 4)

Questions 16–20

Which threat modeling framework categorizes threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

A financial services firm is moving to a public cloud and must comply with a regulation that requires customer data to reside within the country's borders. Which of the following is the most appropriate architectural decision?

Which compliance framework is specifically designed for organizations that handle credit card data?

A company is deploying a new application in the cloud. The security team wants to ensure that each application component has only the permissions it needs to function, and that no component can access resources outside its intended scope. Which set of controls should be applied?

An organization uses a cloud provider's IAM service. They want to grant a developer the ability to list only their own project's virtual machines, without the ability to modify or delete them. Which IAM strategy should they use?

Keep studying — Cloud Computing and Security Fundamentals