Shared Cloud Security Responsibility CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is using a cloud provider's SaaS offering for customer relationship management. The company's security team wants to ensure that only authorized employees can access the system. Which action is the customer's responsibility?

   • APatching the application's code.
   • BSecuring the application's underlying database.
   • CEnsuring the physical security of the data center.
   • DSetting up role-based access control (RBAC) for employees.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the shared responsibility model, which of the following is a key principle?

   • ASecurity responsibilities are determined by the cloud provider's compliance certifications alone.
   • BEach party is responsible for the security of the components they control.
   • CThe customer is responsible for everything, including the physical security of the data center.
   • DThe provider is responsible for everything, so the customer does not need to implement any security controls.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is using a cloud provider's managed Kubernetes service. The company deploys a containerized application that has a known vulnerability in its application code. Who is responsible for patching the application code?

   • AThe company, because they are responsible for the application code
   • BBoth the provider and the company, because it is a shared vulnerability
   • CThe cloud provider, because they manage the Kubernetes service
   • DNeither, because the Kubernetes service is fully managed
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses a cloud provider's managed database service. The database contains sensitive customer data. The company wants to ensure that data is encrypted in transit between the application and the database. Which responsibility does the company retain?

   • APatching the database engine's software
   • BManaging the physical security of the database servers
   • CEnsuring the database service is available
   • DConfiguring the database service to require encrypted connections
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup is choosing between IaaS, PaaS, and SaaS for a new application. The team wants to minimize its own security management overhead while retaining control over application-level security settings. Which service model best meets this requirement?

   • APaaS, because the provider manages the runtime and the customer controls the application
   • BIaaS, because the customer controls the operating system and can harden it
   • CAny model, because the shared responsibility model is identical across all service models
   • DSaaS, because the provider manages everything including application settings
   Reveal Solution Discussion Select an answer first