Shared Cloud Security Responsibility CSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is using a cloud provider's IaaS offering. They have deployed a virtual machine and installed a custom application. Which security responsibility belongs to the cloud provider?

   • ASecuring the hypervisor that runs the virtual machines.
   • BPatching the operating system of the virtual machine.
   • CConfiguring the application's authentication settings.
   • DManaging the firewall rules within the virtual machine.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is using a cloud provider's IaaS offering to host a legacy application. The application has known vulnerabilities, and the company cannot easily patch it. The security team is evaluating risk mitigation options. Which approach aligns with the shared responsibility model?

   • AThe company should implement compensating controls, such as network segmentation and WAF, because they are responsible for the application's security.
   • BThe company should accept the risk because the provider is responsible for application security.
   • CThe company should ask the provider to patch the application.
   • DThe company should move to SaaS to eliminate all application security responsibilities.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is using a cloud provider's Infrastructure as a Service (IaaS) offering. They have deployed virtual machines and are responsible for securing the operating system. Which of the following is the cloud provider's responsibility?

   • AConfiguring the firewall rules within the virtual machines.
   • BPhysical security of the data center.
   • CManaging user access to the virtual machines.
   • DPatching the guest operating system of the virtual machines.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   How does the shared responsibility model affect risk assessment in cloud computing?

   • AThe customer can ignore risks related to the provider's infrastructure because the provider handles them.
   • BThe customer must assess risks associated with both the provider's infrastructure and their own configurations.
   • CRisk assessment is only required for on-premises systems, not cloud services.
   • DRisk assessment is the provider's responsibility because they own the infrastructure.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which statement best describes the shared responsibility model in cloud computing?

   • ASecurity is a joint effort where the provider secures the underlying infrastructure and the customer secures their data and configurations.
   • BThe customer is responsible for all security controls, including physical security of the data center.
   • CThe cloud provider is responsible for all security controls, including customer data and access policies.
   • DSecurity is solely the responsibility of third-party auditors who assess the cloud environment.
   Reveal Solution Discussion Select an answer first