NSA Guidance and Secure Cloud Computing ISE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A healthcare startup is migrating patient records to a public cloud. The compliance officer requires that all protected health information be encrypted both at rest and in transit, and that access be restricted to specific clinical staff. The cloud provider offers default encryption for storage and TLS for data in transit. What additional measure should the startup implement to align with NSA cloud security principles?

   • ADisable encryption to avoid performance overhead and use network ACLs to restrict access.
   • BEnable customer-managed keys for encryption and enforce least-privilege IAM roles for clinical staff.
   • CStore patient records on-premises only, because public cloud cannot meet healthcare compliance.
   • DRely on the provider's default encryption and TLS, and grant all users full access to simplify administration.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following best describes the scope of NSA guidance for secure cloud computing?

   • AIt applies exclusively to classified data and national security systems
   • BIt provides security recommendations for cloud adoption, including architecture, data protection, and identity management
   • CIt is limited to public cloud environments and does not apply to private or hybrid clouds
   • DIt covers only infrastructure-as-a-service (IaaS) deployments
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company must demonstrate compliance with a regulatory framework that requires audit logging. The NSA guidance recommends continuous monitoring. Which action best supports this requirement?

   • ADisable audit logging to reduce storage costs.
   • BRely on the cloud provider's audit logs without additional configuration.
   • CEnable audit logging for all critical resources and integrate with a centralized monitoring system.
   • DEnable audit logging only for the database and store logs locally.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team is developing an incident response playbook for a cloud environment. The NSA guidance emphasizes the importance of preparation. Which activity is most important to include?

   • ARely on the cloud provider's incident response documentation.
   • BCreate a playbook but do not test it to avoid resource consumption.
   • CConduct regular incident response drills and update the playbook based on lessons learned.
   • DFocus only on detection and not on response actions.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company is designing a multi-tier application in the cloud. The web tier must be publicly accessible, while the database tier must only be reachable from the web tier. The security team wants to follow NSA architectural best practices. Which network architecture should they implement?

   • AUse a single subnet for all tiers and rely on encryption to protect the database.
   • BPlace both tiers in the same public subnet and rely on host-based firewalls on the database server.
   • CPlace the database in a private subnet but allow all internal traffic from any subnet for flexibility.
   • DPlace the web tier in a public subnet and the database tier in a private subnet, with security groups allowing database traffic only from the web tier.
   Reveal Solution Discussion Select an answer first