Secure Software Development Lifecycle (SDLC) in the Cloud CSE Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard

   A company is designing a multi-tier cloud application with a public-facing web tier, an application tier in a private subnet, and a database tier. During threat modeling, the team identifies that a compromised web server could be used to access the application tier directly. Which design change most effectively mitigates this threat while maintaining functionality?

   • APlace the application tier in the same subnet as the web tier to simplify network security group rules.
   • BRemove the application tier and integrate its functionality directly into the web tier.
   • CConfigure network security groups to allow traffic from the web tier to the application tier only on the required application port.
   • DAllow all traffic from the web tier to the application tier to ensure seamless communication.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which activity is a key characteristic of the cloud-adapted SDLC that differs from traditional SDLC?

   • AConducting all testing manually to ensure thoroughness
   • BPerforming a single, comprehensive security review after deployment
   • CFreezing requirements at the start to avoid scope changes
   • DUsing infrastructure as code to provision and manage environments
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   A security operations team is monitoring a cloud application. They notice unusual API calls from a service account that should only have read access to a specific bucket. The team suspects the account is compromised. What is the FIRST action they should take to minimize damage while preserving evidence?

   • AImmediately revoke the service account's keys and rotate them.
   • BReview the service account's activity logs to understand the scope before taking any action.
   • CDisable the service account and review its recent activity logs.
   • DTake a snapshot of the bucket and then revoke the service account's permissions.
   Reveal Solution Discussion Select an answer first