NSA Guidance and Secure Cloud Computing ISE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In secure cloud architecture, what is the purpose of using a hub-and-spoke network topology as recommended by NSA guidance?

   • ATo allow all workloads to communicate directly without restrictions
   • BTo simplify the deployment of workloads by removing all network controls
   • CTo centralize security controls and monitoring in a central hub
   • DTo eliminate the need for network segmentation
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security architect is designing network security for a cloud environment that hosts a critical application. The NSA guidance recommends defense-in-depth. The architect must balance security with operational complexity. Which approach best achieves this balance?

   • AUse a single firewall appliance and no other controls.
   • BUse only security groups and rely on the cloud provider's default security.
   • CImplement multiple layers of security controls, including network ACLs, security groups, and host-based firewalls.
   • DImplement every possible security control, even if it significantly increases operational overhead.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security architect is evaluating NSA guidance for a multi-cloud environment. The organization uses both AWS and Azure and needs a consistent security posture. The architect must decide how to apply the guidance. What is the most effective approach?

   • AApply the NSA principles as a framework and map them to each provider's native security services.
   • BRely on each provider's default security settings and assume they align with NSA guidance.
   • CImplement identical security configurations in both clouds, ignoring provider-specific capabilities.
   • DUse only one cloud provider to simplify compliance with NSA guidance.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A multinational company uses a cloud identity provider for all employees. The security team wants to enforce NSA-recommended identity controls, including multi-factor authentication (MFA) and least-privilege access. Which configuration should they implement?

   • ADisable MFA to reduce login friction and rely on network location to control access.
   • BEnable MFA only for administrators and give all users full access to simplify operations.
   • CUse single-factor authentication with strong passwords and assign permissions individually to each user.
   • DEnable MFA for all users and assign permissions based on job roles using role-based access control (RBAC).
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key component of an incident response plan for cloud environments as recommended by NSA guidance?

   • ADisabling logging during an incident to prevent data exposure
   • BRelying solely on the cloud provider to handle all incidents
   • CWaiting for the incident to resolve itself before taking action
   • DDefining roles and responsibilities for incident response team members
   Reveal Solution Discussion Select an answer first