Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A healthcare company uses a cloud-based system to store patient data. The system is accessed by doctors, nurses, and administrative staff. The company must comply with data protection regulations that require strict access controls and audit trails. The current system uses a single shared account for all staff. The security team is tasked with improving security without disrupting daily operations. Which approach is most effective?

   • AImplement a single sign-on (SSO) solution that maps staff to the shared account.
   • BCreate individual accounts for each staff member with role-based access control and enable detailed audit logging.
   • CKeep the shared account but require MFA and change the password monthly.
   • DEnable encryption on the patient database and restrict access to the database administrator.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is moving its applications to the cloud and wants to ensure that its security team can monitor for suspicious activity. The team has limited experience with cloud security. Which approach is most effective for building monitoring capabilities?

   • AEnable the cloud provider's native monitoring services and configure alerts for key security events, such as failed logins and API calls from unusual locations.
   • BPurchase a third-party monitoring tool and install it on every virtual machine.
   • CWait until the security team receives formal training before implementing any monitoring.
   • DRely on the cloud provider's default security alerts without customization.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is migrating its customer database to a cloud provider. The database contains personally identifiable information (PII). The security team is asked to ensure that data is protected both at rest and in transit. Which set of controls should be implemented?

   • AStore the database in a private subnet and use a jump host for access.
   • BApply database-level access controls and enable audit logging.
   • CUse a VPN tunnel for all administrative access and rely on the provider's physical security.
   • DEnable encryption at rest using the provider's key management service and enforce TLS for all client connections.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An attacker exploits a vulnerability in a cloud provider's management interface to gain unauthorized access to a customer's virtual machines. Which cloud security risk is being exploited?

   • AInsecure APIs
   • BMisconfiguration
   • CData breach
   • DAccount hijacking
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A developer creates a cloud storage bucket to share project files with a contractor. The developer sets the bucket to 'public read' so the contractor can download files without a login. After the project ends, the developer forgets to remove the public access. What is the most effective way to prevent this type of misconfiguration in the future?

   • ATrain developers to check bucket permissions before sharing files.
   • BImplement a policy that blocks the creation of public buckets and requires the use of pre-signed URLs for external sharing.
   • CStore all files in a database instead of a storage bucket.
   • DUse a different cloud provider that does not allow public buckets.
   Reveal Solution Discussion Select an answer first