Cloud Security Risks, Attacks, and Best Practices NDE Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A company's cloud environment is being attacked by an insider who has legitimate access to the cloud console. The insider is exfiltrating data by copying it to a personal cloud storage account. The security team wants to detect and stop this activity without blocking legitimate data transfers. Which control is most effective?

   • ARevoke the insider's access to the cloud console immediately.
   • BImplement a data loss prevention (DLP) policy that monitors and blocks transfers to unauthorized external destinations.
   • CSet up a network firewall rule to block access to personal cloud storage domains.
   • DEnable encryption on all data in the cloud environment.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A startup uses a cloud provider's object storage to host static website assets. The storage bucket is configured with a public-read policy. A developer accidentally uploads a file containing internal API keys to the bucket. The file is publicly accessible for 24 hours before the mistake is noticed. Which combination of controls would have most effectively prevented this exposure?

   • AEnable object versioning and configure a lifecycle rule to delete old versions after 30 days.
   • BUse a bucket policy that denies public access to any object containing the string 'API_KEY' and enable server-side encryption.
   • CEnable access logging and set up an alert for any object named 'key' or 'secret'.
   • DRemove the public-read policy and use a signed URL for the website assets, plus implement a data classification policy that flags sensitive files before upload.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A software company uses a cloud-based API gateway to expose internal services to partners. The gateway uses API keys for authentication, but the keys are stored in plaintext in the application's configuration files. A developer accidentally commits the configuration file to a public repository. What is the most immediate and effective action to mitigate the risk?

   • ARotate all API keys immediately and move them to a secure secrets manager.
   • BChange the API gateway to use OAuth 2.0 instead of API keys.
   • CRemove the file from the public repository and force-push to overwrite history.
   • DAdd a rate limit to the API gateway to reduce the impact of unauthorized use.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company's cloud environment has a mix of production and development resources. The security team wants to implement a monitoring and incident response plan. The company has a limited budget and cannot afford a full SIEM solution. Which approach provides the most effective monitoring and response capability within the constraint?

   • AUse a spreadsheet to track security events and review it monthly.
   • BRely on the cloud provider's default security monitoring and do not create any custom alerts.
   • CEnable native cloud logging and alerts for critical events, and define a manual incident response runbook.
   • DPurchase a commercial SIEM and hire a dedicated security analyst to monitor it 24/7.
   Reveal Solution Discussion Select an answer first