Identifying Cloud Security Risks CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A vulnerability assessment of a cloud environment found that a development team has left a storage bucket publicly accessible. The team wants to identify other similar misconfigurations across their cloud accounts. Which method is most efficient?

   • AUse automated cloud security posture management tools
   • BWait for the next external penetration test
   • CAsk the cloud provider to monitor for misconfigurations
   • DManually review each cloud resource's permissions
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's cloud environment was compromised because an employee's credentials were phished. The security team is updating the risk register. Which risk source should be documented as the primary trigger?

   • AExternal attacker using social engineering
   • BNatural disaster affecting the data center
   • CThird-party service provider failure
   • DInternal misconfiguration of the cloud environment
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A healthcare startup is migrating its patient records to a public cloud. The compliance officer is concerned about data exposure due to multi-tenancy. The security team has been asked to identify the most significant cloud-specific risk that could lead to unauthorized access to patient data. Which risk should the team prioritize?

   • AMisconfigured storage buckets that allow public read access
   • BLack of encryption for data in transit
   • CInadequate physical security at the cloud provider's data center
   • DInsider threat from a disgruntled employee with legitimate access
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A risk analyst has identified multiple cloud risks, including a high-impact risk with low likelihood and a medium-impact risk with high likelihood. The analyst must document these risks for stakeholders who have limited time. Which documentation approach is most effective?

   • ACreate a summary report highlighting the high-impact risk and the high-likelihood risk
   • BDocument only the high-impact risk
   • CDocument both risks in a detailed risk register with full analysis
   • DProvide raw data from the risk assessment tools
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a common threat modeling technique used to systematically identify threats in cloud architectures?

   • ASTRIDE
   • BOSSTMM
   • CCIS Controls
   • DISO 27001
   Reveal Solution Discussion Select an answer first