Cloud Security Design Principles and Architecture CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is designing a VPC with a web application that must be accessible from the internet, but the database must not be directly reachable from the internet. Which network architecture should they implement?

   • APlace both web and database servers in the same public subnet with a security group allowing all traffic
   • BPlace the web server in a public subnet and the database in a private subnet, with a security group on the database allowing only traffic from the web server's security group
   • CPlace the database in a public subnet but restrict access with a network ACL that allows only the web server's IP
   • DPlace both servers in a private subnet and use a VPN for all user access
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company uses a cloud provider's IAM service. The security team wants to enforce least privilege for a set of applications that need to access cloud resources. The applications run on virtual machines. Which approach best balances security and operational efficiency?

   • AUse the VM's system-assigned managed identity for all applications running on that VM.
   • BAssign each application a dedicated service principal with a role that grants only the permissions required for that application, and use resource-level scoping.
   • CStore service principal credentials in the application code for simplicity.
   • DCreate a single service principal for all applications and grant it full access to the subscription.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company wants to connect its on-premises data center to a cloud VNet so that resources in the cloud can communicate with on-premises servers as if they were on the same network. The connection must be private and not traverse the public internet. Which connectivity option should be used?

   • AUse a cloud provider's managed VPN gateway with a point-to-site connection for each on-premises server.
   • BEstablish a dedicated private connection between the on-premises data center and the cloud provider's network.
   • CExpose the cloud resources with public IP addresses and allow on-premises servers to connect over the internet.
   • DCreate a site-to-site VPN over the public internet.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which cloud security design principle ensures that users and processes are granted only the permissions necessary to perform their required tasks?

   • AFail secure
   • BSeparation of duties
   • CLeast privilege
   • DDefense in depth
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security architect is threat modeling a multi-tier web application that will run on IaaS. The application uses a public-facing load balancer, a web tier, an application tier, and a database tier. The architect wants to identify the highest-risk attack path that could lead to data exfiltration. Which approach best applies cloud-specific threat modeling?

   • AFocus exclusively on the public load balancer because it is the only component exposed to the internet.
   • BMap the data flow from the load balancer through each tier to the database, then identify where an attacker could intercept or escalate privileges, especially at the application tier's service account.
   • CEnsure the web tier and application tier are in the same subnet so that traffic between them is not inspected by the network security group.
   • DRun a vulnerability scanner on the database and patch any critical CVEs, because data exfiltration always originates from unpatched databases.
   Reveal Solution Discussion Select an answer first