Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital uses a cloud-based electronic health record (EHR) system. The compliance officer requires that all protected health information (PHI) be encrypted both in transit and at rest, and that access to PHI be logged and auditable. The system currently uses TLS for data in transit and server-side encryption for data at rest. What additional control is most directly required to meet the auditability requirement?

   • AImplement multi-factor authentication for all EHR users.
   • BEnable detailed audit logging on the EHR application and the underlying cloud storage, capturing who accessed which record and when.
   • CUse a customer-managed key for server-side encryption.
   • DApply a data loss prevention policy that blocks PHI from being emailed externally.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is adopting a cloud-first strategy and wants to ensure that its security team can respond to incidents effectively. The team currently has no formal incident response plan. Which first step should the company take?

   • APurchase advanced security tools before creating a plan.
   • BOutsource all incident response to the cloud provider.
   • CDevelop an incident response plan that defines roles, communication channels, and procedures for detecting, containing, and recovering from incidents.
   • DWait for a real incident to occur and learn from it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A cloud-based web application is suddenly overwhelmed by a flood of HTTPS requests from thousands of distinct IP addresses. The requests appear to come from legitimate browsers and are all hitting the same login endpoint. The application's auto-scaling group is adding instances, but the attackers are adapting their request patterns to bypass the current rate-limiting rules. Which combination of actions would most effectively mitigate this attack while minimizing impact on legitimate users?

   • AEnable a web application firewall with bot management and rate limiting based on client IP and session behavior.
   • BDisable the login endpoint temporarily to stop the attack.
   • CBlock all traffic from the top 100 source IP addresses at the network firewall.
   • DIncrease the auto-scaling maximum to handle the load and wait for the attack to stop.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A cloud service provider's employee with legitimate access to customer data copies sensitive information and sells it to a competitor. Which type of cloud attack is this?

   • AInsider threat
   • BDistributed Denial of Service (DDoS)
   • CAccount hijacking
   • DMalware injection
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization's cloud-based web application suddenly becomes unresponsive. The security team observes a massive spike in inbound traffic from thousands of distinct IP addresses, all targeting a single API endpoint with malformed requests. The application is behind a cloud load balancer. Which combination of actions should the team take first to mitigate the attack while minimizing impact on legitimate users?

   • ABlock all traffic from the identified IP addresses at the network firewall.
   • BShut down the API endpoint until the attack subsides.
   • CEnable rate limiting on the API endpoint and activate the cloud provider's DDoS protection service.
   • DIncrease the load balancer's capacity to handle the extra traffic.
   Reveal Solution Discussion Select an answer first