Cloud Security Design Principles and Architecture CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During threat modeling for a cloud application, the team identifies that a compromised administrative account could access both the application's database and its backup storage. Which design change would most directly reduce the blast radius of such a compromise?

   • AEnable multi-factor authentication on the administrative account
   • BPlace the database and backup storage on the same subnet to simplify monitoring
   • CSeparate the database and backup storage into different AWS accounts with distinct IAM roles
   • DEncrypt the database and backup storage with the same customer-managed key
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In the shared responsibility model for IaaS, which security responsibility typically remains with the cloud customer?

   • APhysical security of data centers
   • BHypervisor security
   • CNetwork infrastructure security
   • DPatching the guest operating system
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A threat modeling exercise for a cloud application reveals that a compromised API gateway could allow an attacker to access backend services. The team wants to mitigate this risk with minimal impact on performance. Which control is most effective?

   • AUse network ACLs to block all traffic to backend services
   • BImplement mutual TLS between the API gateway and backend services
   • CLog all API gateway traffic for later analysis
   • DAdd a second API gateway for redundancy
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is subject to a regulation that requires all access to sensitive data to be logged and reviewed. The company uses a cloud provider's IAM service to control access. The security team wants to ensure that the logs are tamper-evident and cannot be altered by an attacker who compromises an administrator account. Which approach best meets this requirement?

   • AEnable logging but do not set any retention policy, so logs are automatically deleted after 30 days.
   • BUse the provider's default logging and rely on the provider's promise to preserve logs for compliance.
   • CStore the IAM logs in the same storage account as the sensitive data and rely on the IAM permissions to protect them.
   • DStream the IAM logs to a separate logging account or service that uses write-once-read-many (WORM) storage and requires multi-party approval for any deletion.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A multinational company must comply with GDPR, which restricts transferring personal data outside the EU. They are using a cloud provider with regions in the EU and the US. Which architecture ensures compliance?

   • AStore personal data in the US region because the provider is certified
   • BUse a private cloud in the US to avoid GDPR
   • CEncrypt personal data and store it in any region
   • DStore all personal data in an EU region and ensure that any data transfer outside the EU has appropriate safeguards
   Reveal Solution Discussion Select an answer first