Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services company uses a cloud-based customer relationship management (CRM) system. The security team wants to ensure that customer data is protected against unauthorized access and that any suspicious activity is quickly identified. They have already implemented encryption for data at rest and in transit. What is the next most important control to add?

   • AImplement a comprehensive identity and access management (IAM) policy with role-based access control and regular access reviews.
   • BEnable multi-factor authentication for all CRM users.
   • CSet up a data loss prevention (DLP) solution that monitors outbound data transfers.
   • DDeploy a network intrusion detection system (IDS) on the CRM's virtual network.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational company uses a public cloud IaaS environment. The security team has identified the following risks: (1) a misconfigured storage bucket that is publicly readable, (2) an API gateway that uses weak authentication, and (3) a lack of centralized logging. The company must remediate these risks while minimizing downtime and cost. Which approach best balances these constraints?

   • ADeploy a full SIEM solution and migrate all applications to a new VPC.
   • BTake the storage bucket offline, disable the API gateway, and review logs after a week.
   • CEnable encryption on the storage bucket and require MFA for API access.
   • DFix the storage bucket policy, implement strong API authentication, and enable centralized logging with a low-cost retention period.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's cloud environment is configured with a virtual private cloud (VPC) that has multiple subnets. The security team discovers that a database subnet is accessible from the internet due to a misconfigured route table. What is the most effective way to remediate this issue?

   • AModify the route table to remove the internet gateway route from the database subnet and ensure that only the application subnet can reach the database.
   • BEnable encryption on the database to protect it from internet access.
   • CAdd a network access control list (ACL) rule to deny all traffic to the database subnet.
   • DMove the database to a different cloud provider.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's cloud environment is under a sophisticated DDoS attack that is also exploiting a vulnerability in the application's API. The attack is causing the auto-scaling group to spin up many instances, increasing costs. The security team must stop the attack, minimize cost, and maintain service availability. Which sequence of actions is most effective?

   • AEnable DDoS protection, apply a WAF rule to block the exploit, and set a hard limit on the auto-scaling group.
   • BIncrease the auto-scaling maximum to handle the load and wait for the attack to end.
   • CTake a snapshot of the affected instances and terminate them all.
   • DBlock all traffic from the attack's source IPs and disable the API endpoint.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company stores customer records in an S3 bucket. An auditor finds that the bucket policy allows 's3:GetObject' to 'Principal: *' but only from a specific VPC endpoint. The auditor flags this as a risk because the policy does not restrict which AWS accounts can access the bucket. What is the most effective way to reduce the risk of unauthorized data exposure while maintaining the required access pattern?

   • AKeep the current policy but enable S3 Block Public Access at the account level.
   • BCreate a new IAM role and attach a resource-based policy to the bucket allowing only that role.
   • CRemove the bucket policy and rely on the default private ACLs.
   • DAdd a condition in the bucket policy that requires the VPC endpoint ID and set the principal to the organization's AWS account ID.
   Reveal Solution Discussion Select an answer first