Identifying Cloud Security Risks CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company stores financial reports, marketing materials, and employee HR records in a cloud storage service. The security team must classify these assets to prioritize risk assessment. Which classification is most appropriate?

   • AMarketing materials as high sensitivity because they are public
   • BAll assets as high sensitivity to ensure maximum protection
   • CFinancial reports as low sensitivity because they are internal
   • DHR records as high sensitivity, financial reports as medium sensitivity, marketing materials as low sensitivity
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a cloud environment, which security risk is most directly associated with the shared responsibility model?

   • AThe provider's physical security controls being weaker than the customer's on-premises controls
   • BThe customer having no control over any security aspects of the cloud service
   • CThe provider being responsible for all data security in all service models
   • DMisunderstanding which security controls are managed by the cloud provider versus the customer
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company has a mix of cloud assets: a public marketing website, a customer database with PII, and internal project documentation. The security team must prioritize risk assessment efforts. Which approach best aligns with asset and data classification?

   • AClassify the marketing website as high sensitivity because it is publicly accessible
   • BOnly assess the internal project documentation because it is not public
   • CClassify the customer database as high sensitivity and the marketing website as low sensitivity, then focus assessment on the database
   • DTreat all assets equally and perform the same level of assessment on each
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is identifying risks for a cloud migration. They are concerned about risks from employees who have access to sensitive data and from a third-party cloud consultant who will have temporary access. Which risk sources should they include in their assessment?

   • AOnly the third-party consultant
   • BBoth internal employees and the third-party consultant
   • CNeither, because the cloud provider is responsible for all security
   • DOnly the internal employees
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is performing a vulnerability assessment of a cloud environment that includes virtual machines, a managed Kubernetes cluster, and serverless functions. The analyst wants to identify misconfigurations and known vulnerabilities across all these components. Which approach is most appropriate?

   • AOnly scan the virtual machines because they are the most likely to have vulnerabilities
   • BRun a traditional network vulnerability scanner against the public IP addresses of all resources
   • CUse the cloud provider's native security tools to scan configurations and integrate with a vulnerability scanner for the VMs
   • DManually review all configuration files and code repositories for known vulnerabilities
   Reveal Solution Discussion Select an answer first