Securing Cloud Networks GCLD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a bastion host in a cloud network?

   • ATo cache frequently accessed data to reduce latency
   • BTo load balance traffic across multiple application servers
   • CTo monitor network traffic for intrusion detection
   • DTo provide a secure entry point for administrative access to resources in a private subnet
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst notices unusual outbound traffic from a cloud VPC to an unknown external IP address. The analyst needs to determine which instances are communicating with that IP, the volume of traffic, and whether any security group rules were recently changed. Which combination of cloud-native tools should the analyst use?

   • ACheck the instance's metadata service for the external IP and review the security group rules from the instance console.
   • BUse a packet sniffer on the hypervisor to capture all traffic, and review the instance's local firewall logs.
   • CReview the network ACL rules to see which rules allow outbound traffic to the external IP, and check the instance's route table.
   • DEnable VPC flow logs on the subnets and query the logs for the external IP, then review the CloudTrail or activity log for security group changes.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst has VPC flow logs enabled, but the logs show that traffic to a suspicious external IP was allowed. The analyst also notices that a security group rule was changed to allow outbound traffic to that IP just before the traffic occurred. The analyst needs to determine who made the change and when. Which source of information should the analyst use?

   • AReview the cloud provider's API activity logs (e.g., CloudTrail) for the security group modification event.
   • BCheck the instance's system logs for any commands that modified the security group.
   • CUse a packet capture on the instance to see the outbound traffic and correlate it with the security group change.
   • DReview the VPC flow logs for the specific traffic to the external IP.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which cloud networking component acts as a stateless firewall at the subnet boundary?

   • ARoute table
   • BNetwork ACL
   • CSecurity group
   • DInternet gateway
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is hardening its cloud network. The security team wants to ensure that only necessary ports are open and that all other traffic is denied. They also want to ensure that changes to network configurations are reviewed and approved. Which combination of practices should they implement?

   • APlace all instances in a single subnet and use a single security group with broad rules to simplify management.
   • BRely on the cloud provider's default security groups, which automatically close all ports after 90 days.
   • CUse network ACLs with a default-allow policy and add deny rules for unused ports.
   • DUse security groups with a default-deny inbound policy, and implement a change management process for all security group and network ACL modifications.
   Reveal Solution Discussion Select an answer first