Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a cloud-based application that exposes a REST API for third-party integrations. The security team is concerned about insecure APIs. Which practice is most effective in securing the API?

   • APublish the API documentation publicly to encourage security researchers to find vulnerabilities.
   • BRely on the API's built-in security features without additional configuration.
   • CUse API keys for authentication and validate all input to prevent injection attacks.
   • DLimit the API to internal use only and do not allow third-party integrations.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's cloud-based application is experiencing intermittent performance issues. The security team discovers that a malicious actor has been sending a high volume of requests to the application's login endpoint, causing the authentication service to become overloaded. The requests appear to come from a botnet. Which control is most effective in mitigating this attack?

   • ADisable the login endpoint temporarily.
   • BChange the login URL to a less predictable path.
   • CIncrease the number of application instances to handle the extra load.
   • DImplement a web application firewall (WAF) with rate limiting and bot detection rules.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A cloud-based application is experiencing a distributed denial-of-service (DDoS) attack targeting its public-facing load balancer. The attack is generating a high volume of UDP traffic. The security team wants to mitigate the attack while maintaining availability for legitimate users. Which action is the most effective first step?

   • AIncrease the load balancer's capacity to handle the traffic.
   • BEnable DDoS protection on the load balancer and configure rate-based rules to drop excessive UDP traffic.
   • CBlock all UDP traffic at the network firewall.
   • DChange the load balancer's public IP address.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A cloud-based web application is overwhelmed with a flood of traffic, making it unavailable to legitimate users. Which type of attack is being performed?

   • AAccount hijacking
   • BDenial of Service (DoS)
   • CMalware injection
   • DInsider threat
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is migrating its on-premises applications to the cloud. The compliance team requires that all data be encrypted at rest and that access to encryption keys be logged and audited. The company wants to minimize the risk of key compromise while maintaining the ability to decrypt data in an emergency. Which key management strategy best meets these requirements?

   • ALet each application manage its own keys independently without central oversight.
   • BUse a single static key for all data and keep it in a configuration file on the application server.
   • CUse a cloud provider's managed key management service (KMS) with automatic key rotation and enable audit logging on all key usage.
   • DStore encryption keys in the same database as the encrypted data for easy access.
   Reveal Solution Discussion Select an answer first