Identifying Cloud Security Risks CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which cloud-specific risk is most directly caused by multi-tenancy?

   • AInadequate isolation between different customers' workloads on shared infrastructure
   • BThe cloud provider being able to access customer data without authorization
   • CThe customer's inability to choose the geographic location of their data
   • DThe customer having to manage the underlying physical servers
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A threat modeling session for a cloud application reveals that an attacker could exploit a misconfigured storage bucket to access sensitive data. The team wants to systematically identify other similar attack vectors. Which technique should they use next?

   • AAsk the cloud provider to fix the bucket
   • BConduct a penetration test on the entire cloud environment
   • CReview the application's data flow diagram to identify trust boundaries
   • DImmediately patch the storage bucket configuration
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is adopting a cloud service where the provider manages the operating system and application runtime, but the customer is responsible for its own data and user access. The security team is identifying risks. Which risk is most directly associated with the customer's responsibilities in this shared responsibility model?

   • AInsecure APIs exposed by the provider
   • BPhysical security of the data center
   • CMisconfigured identity and access management policies
   • DHypervisor vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company stores a mix of data in the cloud: public marketing brochures, internal project plans, and customer personal data. The security team is planning a risk assessment. How should they classify these assets to prioritize their efforts?

   • AClassify all data as high sensitivity to ensure maximum protection
   • BClassify only the customer personal data and ignore the rest
   • CClassify customer personal data as high sensitivity, internal plans as medium, and brochures as low
   • DClassify based on the cloud provider's default labels
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security architect is threat modeling a new cloud application that will process sensitive financial data. The application consists of a web front end, an API layer, and a database, all deployed in a public cloud. The architect wants to systematically identify attack vectors. Which approach best aligns with threat modeling principles for this cloud architecture?

   • ARun a vulnerability scanner against the public IP addresses of all components
   • BReview the cloud provider's compliance certifications
   • CInterview developers about their coding practices
   • DMap data flows and trust boundaries across the front end, API, and database
   Reveal Solution Discussion Select an answer first