Frameworks for Built-In Security GCLD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is moving its on-premises customer database to a cloud provider. The security team must demonstrate compliance with a framework that provides a common baseline of security controls. They want to use the framework to map which controls are the provider's responsibility and which are the customer's. Which framework is best suited for this purpose?

   • ACSA Cloud Controls Matrix (CCM)
   • BISO/IEC 27001
   • CNIST Cybersecurity Framework (CSF)
   • DCIS Critical Security Controls
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization is using a cloud provider's managed database service and needs to implement a control to protect sensitive data. They are using the CSA Cloud Controls Matrix as a guide. Which control should they implement to meet the CCM's data security requirements?

   • AEnable encryption at rest and in transit for the database
   • BImplement network access control lists (ACLs) on the database subnet
   • CEnable audit logging for the database
   • DUse a VPN to connect to the database
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is using a cloud provider's PaaS service to host a web application. They are required to implement a control to protect against SQL injection attacks. According to the shared responsibility model, which control should the customer implement?

   • AEncrypt the database at rest
   • BConfigure the web application firewall (WAF) provided by the cloud provider
   • CImplement network segmentation
   • DPatch the underlying operating system
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is using the NIST Cybersecurity Framework to improve their cloud security posture. They have identified a gap in their ability to detect anomalous behavior in their cloud environment. They have budget constraints and need to implement a control that provides the most immediate improvement. Which control should they prioritize?

   • AEnable cloud provider's native logging and monitoring services
   • BDeploy a third-party SIEM solution
   • CImplement multi-factor authentication
   • DConduct a penetration test
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is using the CSA Cloud Controls Matrix to assess a new cloud deployment. They need to verify that the provider's data encryption controls meet the organization's requirements. Which document should they review to understand the provider's responsibilities and the controls they implement?

   • AThe provider's shared responsibility model and compliance documentation
   • BThe provider's marketing materials
   • CThe CSA CCM controls list alone
   • DThe organization's own security policies only
   Reveal Solution Discussion Select an answer first