Cloud Security Design Principles and Architecture CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is moving a database to a PaaS cloud service. The database contains sensitive customer information. The security team wants to protect the data both at rest and in transit. Which combination of controls should be implemented?

   • AEnable database auditing and rely on the provider's default encryption settings.
   • BEnable transparent data encryption (TDE) for the database and enforce TLS for all client connections.
   • CEnable TLS for client connections only and rely on the provider's physical security for data at rest.
   • DUse client-side encryption for all data before storing it in the database, and do not enable TLS.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is migrating its customer-facing web application to a cloud provider using IaaS. The security team is defining the shared responsibility boundaries. Which of the following tasks remains the customer's responsibility?

   • AManaging the physical access controls to the data center
   • BConfiguring the network security groups for the application tier
   • CReplacing failed physical disks in the storage arrays
   • DPatching the hypervisor that hosts the virtual machines
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is using a SaaS email service and a PaaS database. They are subject to a regulation that requires them to control encryption keys for data at rest. Which of the following is the most appropriate way to meet this requirement?

   • AMove all data to on-premises to ensure key control
   • BUse the PaaS provider's customer-managed key option for the database, and for the SaaS email, use a provider that supports customer-managed keys or a third-party key management service
   • CRely on the SaaS provider's default encryption
   • DAccept the risk because SaaS does not allow key control
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which data protection technique replaces sensitive data with a non-sensitive placeholder that has no exploitable value, but can be mapped back to the original value by authorized systems?

   • ATokenization
   • BMasking
   • CEncryption
   • DHashing
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which security design principle is best described by placing multiple layers of security controls so that if one layer fails, another layer provides protection?

   • ADefense in depth
   • BLeast privilege
   • CSeparation of duties
   • DShared responsibility
   Reveal Solution Discussion Select an answer first