Securing Cloud Networks GCLD Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which statement best describes the shared responsibility model for securing cloud networks?

   • AThe cloud provider secures the physical network infrastructure, while the customer secures the virtual network configuration and workloads.
   • BThe cloud provider is responsible for securing everything inside the virtual network, including customer workloads.
   • CThe customer is responsible for all network security, and the provider has no security obligations.
   • DThe customer is responsible for securing the physical data center and network hardware.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is troubleshooting a connectivity issue between two instances in the same VPC. The instances are in different subnets. The security group on the target instance allows inbound traffic from the source instance's security group, but the traffic is still being blocked. Which of the following could be the cause?

   • AThe target instance is in a different VPC.
   • BThe security group on the source instance is blocking outbound traffic.
   • CThe route table on the target subnet does not have a route to the source subnet.
   • DThe network ACL on the target subnet is blocking the traffic.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of dividing a cloud virtual network into multiple subnets?

   • ATo isolate traffic and apply different security policies to different tiers
   • BTo reduce the latency between resources in the same region
   • CTo increase the available public IP address space
   • DTo enable direct connection to the internet for all resources
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a recommended best practice for hardening a cloud network?

   • AUsing default security group rules without review
   • BAllowing inbound SSH from any IP address for administrative convenience
   • CSegmenting the network into tiers and restricting traffic between them
   • DPlacing all resources in a single public subnet for simplicity
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is migrating a legacy application to the cloud. The application uses a proprietary protocol that does not support TLS. The security team requires that all data be encrypted in transit. Which approach should they take?

   • AUse a cloud provider's key management service to encrypt the application's configuration files.
   • BUse a cloud load balancer with TLS termination and forward traffic to the application over HTTP.
   • CUse a site-to-site VPN between the on-premises data center and the cloud VPC to encrypt all traffic.
   • DUse a network ACL to restrict access to the application to trusted IPs only.
   Reveal Solution Discussion Select an answer first