Securing Cloud Networks GCLD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of encrypting data at rest in a cloud storage service?

   • ATo speed up data retrieval from storage
   • BTo protect data from unauthorized access when stored on disk
   • CTo encrypt data while it is being transmitted over the network
   • DTo reduce the storage cost of the data
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which protocol is commonly used to encrypt data in transit between a client and a cloud-hosted web application?

   • AIPsec
   • BSSH
   • CHTTPS
   • DTLS
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company is moving a legacy application to the cloud. The application transmits sensitive customer data between an on-premises data center and a cloud VPC over the public internet. The compliance team requires that all data in transit be encrypted and that the connection be authenticated. The company already has an existing VPN gateway on-premises. Which solution should the cloud architect recommend?

   • APlace the application in a public subnet and use a network ACL to restrict source IP addresses to the on-premises public IP.
   • BEstablish an IPsec VPN tunnel between the on-premises VPN gateway and a cloud VPN gateway, and route the application traffic through the tunnel.
   • CUse AWS Direct Connect or Azure ExpressRoute to establish a private dedicated connection, and rely on the physical isolation for security.
   • DConfigure the application to use TLS with a self-signed certificate and send traffic directly over the internet.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a hybrid cloud architecture with an on-premises data center connected to a cloud VPC via a site-to-site VPN. The security team wants to ensure that all traffic between the two environments is encrypted, but they are concerned about the performance impact of VPN encryption. Which solution should they use?

   • AUse a dedicated connection (e.g., AWS Direct Connect or Azure ExpressRoute) with MACsec encryption.
   • BUse a network ACL to allow only encrypted traffic from the on-premises network.
   • CUse a cloud load balancer with TLS termination to encrypt traffic between on-premises and the cloud.
   • DUse a site-to-site VPN with a higher encryption algorithm (e.g., AES-256) to ensure security.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying a three-tier web application in a cloud VPC. The web tier must be reachable from the internet on port 443, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier. The security team wants to minimize the number of rules and ensure that return traffic is automatically allowed. Which approach should the architect implement?

   • AUse network ACLs on each subnet with explicit allow rules for inbound and outbound traffic, including ephemeral ports for return traffic.
   • BPlace all tiers in the same subnet and use a single network ACL that allows all traffic between instances, relying on host-based firewalls for isolation.
   • CUse security groups on each tier's instances, with inbound rules that reference the source security group of the preceding tier, and allow inbound 443 from 0.0.0.0/0 on the web tier.
   • DUse a bastion host in the public subnet and route all tier-to-tier traffic through it, with security groups allowing only the bastion's IP.
   Reveal Solution Discussion Select an answer first