A company wants to allow a partner organization to access a specific application hosted in the company's cloud environment. The partner should not have access to any other resources. Which network or identity control should be used?

Give the partner a VPN client certificate that allows access to the entire VNet.

Create a user account for the partner in the company's identity service and grant it contributor access to the subscription.

Expose the application on a public IP address and rely on the application's own authentication.

Create a separate VNet for the partner and peer it with the application's VNet, then use network security groups to restrict traffic to the application's IP address and port.

A company stores sensitive data in a cloud database. They want to protect the data even if the database backups are stolen. Which measure is most effective?

Use transparent data encryption with keys managed by the cloud provider

Use client-side encryption with keys managed by the customer

Encrypt the backups with a key stored in the same database

A company's cloud environment has been compromised. The incident response team needs to contain the incident while preserving evidence. Which action should be taken first?

Delete the compromised resources immediately to prevent further damage.

Power off the affected virtual machines to stop the attack.

Isolate the affected resources by applying network security group rules that block all traffic to and from the compromised resources.

Change all passwords and rotate all keys before isolating the resources.

A network administrator is designing a cloud network for a multi-tier application. They want to minimize the attack surface by ensuring that only the web tier is exposed to the internet. Which architecture should they use?

Place all tiers in the same public subnet

Place all tiers in private subnets and use a VPN for all access

Use a single security group that allows all traffic from the internet

Use a DMZ with the web tier in a public subnet and application/database tiers in private subnets

EC-CouncilCloud Security Essentials

Domain 1Objective 5

Cloud Security Design Principles and Architecture CSE Practice Questions (Page 5)

Part of the Cloud Computing and Security Fundamentals domain, which makes up ~12% of our current practice bank.

48questions here

10free pages

9concepts

9 Concepts in This Objective

Cloud Security Design Principles
Cloud Architecture Security
Shared Responsibility Model
Threat Modeling for Cloud
Identity and Access Management (IAM) in Cloud
Data Protection in Cloud
Network Security in Cloud
Compliance and Governance in Cloud
Incident Response in Cloud

Questions 21–25

21application · medium
A company wants to allow a partner organization to access a specific application hosted in the company's cloud environment. The partner should not have access to any other resources. Which network or identity control should be used?
Select an answer first
22application · medium
A company stores sensitive data in a cloud database. They want to protect the data even if the database backups are stolen. Which measure is most effective?
Select an answer first
23application · medium
A company's cloud environment has been compromised. The incident response team needs to contain the incident while preserving evidence. Which action should be taken first?
Select an answer first
24foundation · easy
Which governance practice helps an organization ensure that its cloud resources are provisioned and configured according to internal policies and regulatory requirements?
Select an answer first
25application · medium
A network administrator is designing a cloud network for a multi-tier application. They want to minimize the attack surface by ensuring that only the web tier is exposed to the internet. Which architecture should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.