Identifying Cloud Security Risks CSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of classifying a cloud asset by criticality?

   • ALabeling a payment processing system as 'mission-critical'
   • BLabeling a customer database as 'confidential'
   • CLabeling a public website as 'public'
   • DLabeling a backup server as 'non-essential'
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is conducting a vulnerability assessment of a cloud environment that uses a managed database service and a set of virtual machines. The team wants to identify misconfigurations in the database service. Which tool is most appropriate for this task?

   • AA web application scanner that tests for SQL injection
   • BThe cloud provider's security configuration assessment tool
   • CA network vulnerability scanner that scans the database's public IP
   • DA penetration testing tool that exploits known database vulnerabilities
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is data classification important in cloud risk assessment?

   • AIt is only required for compliance with GDPR
   • BIt eliminates the need for encryption of all data
   • CIt automatically prevents data breaches
   • DIt helps prioritize security controls based on the sensitivity and criticality of data
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is performing a cloud risk assessment and wants to identify risks related to third-party services. The security team has limited time and budget. Which method is most efficient for gathering this information?

   • AConduct in-depth interviews with each provider's security team
   • BPerform a penetration test on each provider's infrastructure
   • CSend a security questionnaire to each third-party provider
   • DReview the provider's financial statements
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is identifying risks for a new cloud service. The analyst needs to understand how the service handles data encryption and incident response. Which risk identification method would provide this information most directly?

   • AReview the company's own security policies
   • BRun a vulnerability scanner against the service
   • CSend a questionnaire to the cloud provider
   • DInterview the cloud provider's security team
   Reveal Solution Discussion Select an answer first