Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company uses a cloud-based CRM with an API that integrates with its billing system. The API key is stored in a configuration file on a developer's laptop. The developer's laptop is compromised, and the attacker uses the API key to exfiltrate customer records. The company wants to prevent recurrence while minimizing operational disruption. Which combination of actions is most effective?

   • ARevoke the API key and require all integrations to use a new key shared via email.
   • BRotate the API key, move it to a secrets management service, and enable conditional access policies that restrict API usage to trusted devices and locations.
   • CKeep the current API key but add an IP allowlist for the billing system's IP address.
   • DDisable the API and require all data transfers to be done manually through the CRM interface.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses a cloud-based file-sharing service to collaborate with external partners. The security team is concerned about the risk of data leakage through shared links. Which control is most effective in reducing this risk?

   • ARely on the file-sharing service's default sharing settings.
   • BDisable all external sharing and require partners to use a VPN.
   • CConfigure shared links to expire after a set period and require authentication for access.
   • DUse a longer, more complex link URL to make it harder to guess.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's cloud environment uses a shared storage account for all departments. The security team discovers that a misconfigured access policy allowed a contractor to read sensitive files from another department. The company wants to prevent this from happening again. What is the most effective control to implement?

   • ARequire all users to use multi-factor authentication.
   • BImplement a data classification scheme and apply access policies based on data sensitivity.
   • CSet up a monitoring alert for any access to sensitive files.
   • DEnable encryption on the storage account.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A cloud-based application allows users to upload profile pictures. The application stores the images in a cloud storage bucket and serves them back to users. A security researcher reports that the application is vulnerable to malware injection because it does not validate the content of uploaded files. What is the most effective way to mitigate this risk?

   • AEnable server-side encryption on the storage bucket.
   • BRestrict the file extension to .jpg, .png, and .gif.
   • CStore the files in a private bucket and serve them through a signed URL.
   • DUse a cloud-based malware scanning service to scan all uploaded files before they are stored.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company operates a multi-tenant cloud environment where multiple customers share the same infrastructure. A security researcher discovers a vulnerability that could allow one customer to access another customer's data. The company must respond quickly. Which action should be taken first?

   • ANotify all customers about the vulnerability immediately.
   • BIgnore the vulnerability because it is only theoretical.
   • CShut down the entire cloud service until the vulnerability is fixed.
   • DIsolate the affected tenants and apply a virtual patch or workaround while a permanent fix is developed.
   Reveal Solution Discussion Select an answer first