NSA Guidance and Secure Cloud Computing ISE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the recommended first step in responding to a security incident in a cloud environment according to NSA guidance?

   • ANotify the media immediately
   • BReboot all affected systems without preserving evidence
   • CDelete all logs to remove evidence of the incident
   • DContain the incident to prevent further damage
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A government contractor must ensure its cloud deployment meets FedRAMP requirements. The security team needs to implement continuous monitoring and auditing. Which practice should they adopt?

   • ARely on the cloud provider's compliance certifications without implementing internal monitoring.
   • BPerform a one-time security assessment and then disable logging to reduce storage costs.
   • CEnable detailed logging for all cloud resources and integrate logs with a centralized SIEM for continuous review.
   • DStore logs only on-premises to ensure compliance, without cloud-based monitoring.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A large enterprise uses a cloud identity provider and has thousands of employees. The security team wants to enforce NSA-recommended IAM controls, but the help desk is overwhelmed with access requests. Which strategy best reduces the burden while maintaining security?

   • ADisable access reviews to reduce administrative overhead.
   • BGrant all employees the same access level to reduce help desk requests.
   • CImplement role-based access control (RBAC) with automated provisioning and periodic access reviews.
   • DUse individual permissions for each employee to ensure precise access, even if it increases help desk load.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is deploying a web application in the cloud. The security team wants to follow NSA guidance for network security by implementing defense-in-depth. Which set of controls should they implement?

   • ADisable all network filtering to avoid misconfiguration and rely on host-based security.
   • BUse only a network ACL to filter all traffic, since it provides a single layer of control.
   • CRely solely on the cloud provider's default security settings without additional configuration.
   • DUse a web application firewall (WAF), network ACLs, and security groups to filter traffic at multiple layers.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial firm stores customer transaction data in a cloud object storage bucket. The compliance team requires that data be encrypted at rest and that encryption keys be rotated every 90 days. The firm wants to maintain control over the key lifecycle. Which approach should they choose?

   • ADisable encryption and rely on the bucket's access control list to protect the data.
   • BUse a customer-managed key stored in the cloud provider's key management service and configure automatic rotation every 90 days.
   • CEncrypt data with a static key stored in the application code for simplicity.
   • DUse provider-managed keys and rely on the provider's default rotation schedule.
   Reveal Solution Discussion Select an answer first