NSA Guidance and Secure Cloud Computing ISE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is developing an incident response plan for its cloud environment. The NSA guidance emphasizes preparation and the ability to respond effectively. Which practice is most aligned with NSA recommendations?

   • ARely on the cloud provider's incident response team for all incidents.
   • BConduct regular tabletop exercises and ensure logs are available for analysis.
   • CCreate an incident response plan but do not test it to avoid disrupting operations.
   • DDocument the incident response plan and store it only in the cloud environment.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is implementing IAM for a cloud environment. The NSA guidance recommends using the principle of least privilege. Which practice best implements this principle?

   • AGrant all users administrative permissions to simplify management.
   • BGrant permissions based on seniority rather than job function.
   • CGrant permissions only when requested and never review them.
   • DGrant users permissions based on their specific job functions.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company stores sensitive data in a cloud object storage service. The security team must implement NSA-recommended data protection, but the data is frequently accessed by multiple applications. The team wants to avoid performance degradation. Which approach should they take?

   • AUse envelope encryption with a customer-managed key, caching decrypted keys in memory to reduce performance overhead.
   • BDisable encryption to maximize performance, relying on access controls.
   • CUse a single static key for all data to simplify key management, accepting the risk of key compromise.
   • DEncrypt data only in transit and leave data at rest unencrypted.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is configuring network security for a cloud environment that hosts a public-facing web application and an internal database. The security team wants to follow NSA recommendations. Which network security configuration should they use?

   • AUse a single security group for all resources and allow all traffic within the group.
   • BDisable security groups and rely on the cloud provider's default network settings.
   • CPlace both the web application and database in the same public subnet for simplicity.
   • DPlace the web application in a public subnet and the database in a private subnet, with security groups allowing only necessary traffic.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is designing a cloud architecture for a new application that will handle sensitive customer data. The security architect wants to follow NSA best practices for secure cloud architecture. Which design principle should be prioritized?

   • AGrant all users administrative access to avoid delays in troubleshooting.
   • BSegment the network into tiers and apply least-privilege access controls between them.
   • CPlace all resources in a single subnet and rely on encryption for security.
   • DUse a flat network to simplify management and reduce the chance of misconfiguration.
   Reveal Solution Discussion Select an answer first