Cloud Computing Threats and Countermeasures ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying a new application in a public cloud and needs to ensure that only specific IP addresses can access the application's administrative console. The application is behind a load balancer. Which configuration should be used?

   • AConfigure the application itself to check the source IP address and reject others.
   • BConfigure a security group on the load balancer to allow only the specified IP addresses on the administrative port.
   • CConfigure a network ACL on the load balancer's subnet to allow only the specified IP addresses on the administrative port.
   • DUse a VPN to allow any IP address that is part of the corporate network.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses a hybrid cloud model with a public cloud VPC and an on-premises data center connected via VPN. They want to ensure that only the on-premises network can access a management interface on a cloud VM. Which configuration should they implement?

   • APlace the VM in a private subnet with no public IP and use a network security group that allows traffic only from the VPN gateway's internal IP range.
   • BEnable Azure Bastion or AWS Systems Manager Session Manager for management access.
   • CCreate a separate VPC for management and peer it with the production VPC.
   • DAssign the VM a public IP address and configure a network security group to allow traffic only from the on-premises public IP.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst at a company using a public IaaS provider discovers that a developer accidentally left a storage bucket publicly readable. The bucket contains configuration files with database credentials. The analyst needs to remediate the immediate exposure and reduce the risk of similar incidents. Which two actions should the analyst take first?

   • ARotate the exposed credentials and change the bucket ACLs to private.
   • BChange the bucket ACLs to private and enable server-side encryption on the bucket.
   • CDelete the bucket and all its contents immediately.
   • DEnable CloudTrail logging and create a new bucket for future use.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is using a public cloud IaaS environment and has deployed a web server in a public subnet. The security team wants to protect the server from common attacks such as SQL injection and cross-site scripting. Which control is most effective?

   • AUse a security group to allow traffic only from the company's IP range.
   • BConfigure a network ACL to block all inbound traffic except on port 80 and 443.
   • CUse a web application firewall (WAF) in front of the web server.
   • DEnable encryption on the web server's disk.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is required to comply with ISO 27001 and wants to use a public cloud provider. Which of the following is the MOST important step?

   • AImplement encryption for all data at rest and in transit.
   • BRequire the provider to use a private cloud deployment model.
   • CEnsure the cloud provider has ISO 27001 certification and review their compliance reports.
   • DConduct a penetration test of the provider's infrastructure.
   Reveal Solution Discussion Select an answer first