A company wants to migrate a legacy application to the cloud. The application requires a specific operating system version and has a predictable, steady workload. The company wants to minimize management overhead while retaining control over the OS. Which cloud service model is MOST appropriate?

Infrastructure as a Service (IaaS)

A healthcare organization in the EU plans to use a public cloud SaaS application to store patient health records. The organization must comply with GDPR and HIPAA. Which action is MOST important before migrating data?

Implement multi-factor authentication for all users of the SaaS application.

Ensure the SaaS provider offers data residency in the EU and signs a Data Processing Agreement (DPA).

Verify that the SaaS provider has ISO 27001 certification.

Require the SaaS provider to use a private cloud deployment model.

A company uses a multi-tenant public cloud SaaS application for customer relationship management. The security team is concerned about the risk of cross-tenant attacks. Which control is most effective in mitigating this risk?

Encrypt all data at rest using the provider's default encryption.

Use a private cloud deployment model instead of a public cloud.

Implement strong authentication and authorization policies, including multi-factor authentication and least privilege.

Regularly back up data to an external location.

Which cloud security countermeasure is primarily used to control inbound and outbound traffic to cloud resources at the network layer?

Identity and access management (IAM)

Which of the following is a key forensic consideration when responding to a security incident in a cloud environment?

The requirement to immediately delete all virtual machines to prevent further damage

The ability to ignore the cloud provider's terms of service during an investigation

The need to rely on the cloud provider's logging and snapshot capabilities for evidence collection

The ability to physically seize the server hardware

EC-CouncilCertified Security Specialist

Domain 4Objective 5

Cloud Computing Threats and Countermeasures ECSS Practice Questions (Page 3)

Part of the Ethical Hacking Advanced Attacks and Penetration Testing domain, which makes up ~17% of our current practice bank.

43questions here

9free pages

6concepts

Questions 11–15

11application · easy
A company wants to migrate a legacy application to the cloud. The application requires a specific operating system version and has a predictable, steady workload. The company wants to minimize management overhead while retaining control over the OS. Which cloud service model is MOST appropriate?
Select an answer first
12application · medium
A healthcare organization in the EU plans to use a public cloud SaaS application to store patient health records. The organization must comply with GDPR and HIPAA. Which action is MOST important before migrating data?
Select an answer first
13application · medium
A company uses a multi-tenant public cloud SaaS application for customer relationship management. The security team is concerned about the risk of cross-tenant attacks. Which control is most effective in mitigating this risk?
Select an answer first
14foundation · easy
Which cloud security countermeasure is primarily used to control inbound and outbound traffic to cloud resources at the network layer?
Select an answer first
15foundation · easy
Which of the following is a key forensic consideration when responding to a security incident in a cloud environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.