Secure Compute Deployment GCLD Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security engineer is reviewing the access controls for a VM that runs a critical application. The engineer notices that the VM's security group allows SSH from the entire internet (0.0.0.0/0). The application does not require SSH access from the internet. What is the most appropriate action?

   • ALeave the security group as is because SSH is encrypted.
   • BChange the SSH port to a non-standard port to avoid automated attacks.
   • CRestrict the security group to allow SSH only from the company's VPN IP range.
   • DRemove SSH access entirely and rely on the cloud provider's console access.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A cloud administrator needs to provide a contractor with temporary access to a single VM for troubleshooting. The contractor does not have a corporate account. The administrator wants to avoid creating a permanent IAM user and wants the access to be auditable. Which approach is the most appropriate?

   • ACreate a temporary IAM role that the contractor can assume using a one-time password, and attach a policy that allows only the required actions on the VM.
   • BUse a pre-shared SSH key and provide it to the contractor, then delete the key after the task.
   • CCreate a new IAM user with a console password and add the user to the VM's local administrators group.
   • DShare the root credentials of the cloud account with the contractor for the duration of the task.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A developer is configuring a cloud VM to run a batch job that needs to access a database. The developer is tempted to put the database password in the VM's user-data script for convenience. What is the most secure way to provide the database credentials to the application?

   • APut the password in an environment variable in the application's deployment configuration.
   • BUse the same password for all VMs in the environment to simplify management.
   • CStore the password in a secrets manager and grant the VM's IAM role permission to retrieve it at runtime.
   • DEmbed the password in the user-data script and restrict access to the VM's metadata service.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team needs to detect a potential data exfiltration from a VM. They have enabled cloud provider audit logs and VM-level audit logs, but they are not sure if they are capturing all relevant events. Which additional logging or monitoring control would most directly help detect data exfiltration?

   • AEnable DNS logging to see which domains are resolved by the VM.
   • BEnable network flow logs for the VM's network interface to capture outbound traffic patterns.
   • CEnable file integrity monitoring on the VM's critical files.
   • DEnable detailed billing reports to track cost anomalies.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small company is deploying its first cloud VM for a public-facing web application. The security team has limited experience and wants a simple yet secure baseline. Which combination of measures provides the strongest defense in depth?

   • AUse a secure base image, apply the latest patches, restrict inbound traffic to ports 80/443, and enable audit logging.
   • BDisable all inbound traffic and only allow outbound traffic to the internet.
   • CUse a default image and rely on the cloud provider's firewall to block all traffic.
   • DEnable audit logging but do not restrict inbound traffic to simplify access.
   Reveal Solution Discussion Select an answer first