Identifying Cloud Security Risks CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses a third-party SaaS application for HR management. The SaaS provider recently suffered a data breach that exposed employee records. The company's security team is reviewing its risk register. Which risk source should be documented as the primary trigger for this incident?

   • AExternal third-party service
   • BInternal misconfiguration
   • CInsider threat
   • DData classification failure
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a cloud-specific vulnerability that should be assessed during a vulnerability assessment?

   • AOpen network security group rules that allow unrestricted access
   • BWeak passwords on a database server
   • CMissing operating system patches on a virtual machine
   • DUnpatched web application framework
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is migrating its applications to the cloud. The security team has identified the following assets: a customer database with credit card numbers, a public marketing website, and internal employee email. The team must prioritize risk assessment efforts. Which asset should be classified as highest sensitivity and criticality?

   • AInternal employee email
   • BCustomer database with credit card numbers
   • CPublic marketing website
   • DAll assets should be treated equally
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key difference between vulnerability assessment in traditional on-premises environments and in cloud environments?

   • ACloud vulnerability assessment only covers the provider's infrastructure
   • BCloud vulnerability assessment cannot be automated
   • CCloud vulnerability assessment must consider the shared responsibility model and provider-managed components
   • DCloud vulnerability assessment does not require authentication to scan resources
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an internal source of cloud security risk?

   • AMisconfiguration of cloud resources by an administrator
   • BA natural disaster affecting the cloud provider's data center
   • CA distributed denial-of-service (DDoS) attack from an external botnet
   • DA vulnerability in a third-party SaaS application
   Reveal Solution Discussion Select an answer first