Securing Cloud Networks GCLD Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which statement correctly describes the difference between security groups and network ACLs?

   • ASecurity groups are applied at the subnet boundary, while network ACLs are applied to individual VMs
   • BSecurity groups operate at the instance level, while network ACLs operate at the subnet level
   • CSecurity groups are stateless, while network ACLs are stateful
   • DSecurity groups support allow and deny rules, while network ACLs only support allow rules
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A system administrator needs to securely manage a Linux instance located in a private subnet of a cloud VPC. The company's security policy requires that administrative access be logged and that the administrator's identity be authenticated using the corporate identity provider. Which solution should the administrator use?

   • AUse AWS Systems Manager Session Manager or Azure Bastion with Microsoft Entra ID authentication to connect to the instance without exposing a public IP.
   • BSet up a VPN connection to the VPC and allow SSH from the VPN's IP range, using local user accounts on the instance.
   • CUse a bastion host in a public subnet that forwards SSH connections to the private instance, and authenticate using SSH keys.
   • DAttach an Elastic IP to the private instance and configure a security group to allow SSH from the administrator's IP address.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a cloud virtual network?

   • AVPN
   • BNAT gateway
   • CDNS resolver
   • DLoad balancer
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that a web server in a public subnet is receiving inbound traffic on port 22 (SSH) from a wide range of IP addresses, even though the security group only allows SSH from the corporate VPN CIDR. The analyst suspects the traffic is being blocked by the security group but wants to verify. Which action should the analyst take to confirm whether the security group is actually blocking the traffic?

   • ATemporarily remove the security group rule and observe if the traffic increases.
   • BReview the security group's inbound rules and check the VPC flow logs for denied traffic from the suspicious IPs.
   • CUse a packet capture tool on the web server to see if the SSH packets are arriving at the operating system.
   • DCheck the network ACL rules for the subnet to see if they allow SSH from the suspicious IPs.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of VPC flow logs?

   • ATo capture information about IP traffic going to and from network interfaces
   • BTo block malicious traffic in real time
   • CTo provide a backup of the network configuration
   • DTo encrypt traffic between subnets
   Reveal Solution Discussion Select an answer first