A vulnerability assessment of a cloud environment is being planned. The team wants to minimize disruption to production systems. Which scanning approach is most appropriate?

Run an authenticated scan during a maintenance window

Run a full port scan on all production servers without prior notification

Skip scanning production and only scan development

Run an unauthenticated scan during peak business hours

A startup uses a cloud storage bucket to host static website assets. After a security review, they discover the bucket is publicly readable. Which cloud-specific threat does this scenario exemplify, and what is the most appropriate immediate remediation?

Denial of service; enable bucket logging

Misconfigured storage; change the bucket ACL to private and use a CDN for public content

Shared responsibility gap; move the bucket to a different region

Insecure API; enable server-side encryption

A company is adopting a multi-cloud strategy. The security team wants to identify potential threats before they are exploited. Which approach best aligns with the purpose of threat modeling?

Relying solely on the cloud provider's security certifications

Waiting until after a security incident to analyze what happened

Purchasing a vulnerability scanner and running it monthly

Conducting a threat modeling exercise during the design phase of each cloud workload

EC-CouncilCloud Security Essentials

Domain 7Objective 3

Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 7)

Part of the Cloud Security Risk Assessment and Management domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

6concepts

Questions 31–35

31foundation · easy
Which of the following is a cloud-specific threat that often results from human error?
Select an answer first
32application · medium
A vulnerability assessment of a cloud environment is being planned. The team wants to minimize disruption to production systems. Which scanning approach is most appropriate?
Select an answer first
33application · medium
A startup uses a cloud storage bucket to host static website assets. After a security review, they discover the bucket is publicly readable. Which cloud-specific threat does this scenario exemplify, and what is the most appropriate immediate remediation?
Select an answer first
34foundation · easy
Which threat modeling approach focuses on simulating attacks against a system to identify potential attack paths?
Select an answer first
35application · medium
A company is adopting a multi-cloud strategy. The security team wants to identify potential threats before they are exploited. Which approach best aligns with the purpose of threat modeling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Threat Modeling and Vulnerability Assessment CSE Practice Questions (Page 7)

Questions 31–35

Which of the following is a cloud-specific threat that often results from human error?

A vulnerability assessment of a cloud environment is being planned. The team wants to minimize disruption to production systems. Which scanning approach is most appropriate?

A startup uses a cloud storage bucket to host static website assets. After a security review, they discover the bucket is publicly readable. Which cloud-specific threat does this scenario exemplify, and what is the most appropriate immediate remediation?

Which threat modeling approach focuses on simulating attacks against a system to identify potential attack paths?

A company is adopting a multi-cloud strategy. The security team wants to identify potential threats before they are exploited. Which approach best aligns with the purpose of threat modeling?

Keep studying — Cloud Security Risk Assessment and Management