Securing Cloud Networks GCLD Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which practice is a key method for reducing the attack surface of a cloud network?

   • AApplying the principle of least privilege to firewall rules
   • BDisabling logging to reduce storage costs
   • CUsing the same security group for all resources to simplify management
   • DOpening all ports to the internet for ease of access
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has a cloud environment with multiple VPCs and wants to reduce the attack surface by ensuring that only necessary ports are open. They have a web application that requires HTTPS (443) and a management interface that should only be accessible from a specific admin CIDR. Which hardening measure should they implement?

   • AUse a single security group for all instances that allows both HTTPS and management ports from 0.0.0.0/0.
   • BPlace all instances in a single subnet and rely on network ACLs to restrict management traffic.
   • CCreate a security group for the web servers that allows inbound HTTPS from 0.0.0.0/0 and a separate security group for the management interface that allows inbound RDP/SSH from the admin CIDR only.
   • DDisable the management interface entirely and use a bastion host for all administrative tasks.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key characteristic of a stateful security group compared to a stateless firewall rule?

   • AIt only filters traffic based on source IP addresses
   • BIt requires separate rules for inbound and outbound return traffic
   • CIt automatically allows return traffic for permitted outbound connections
   • DIt evaluates each packet independently without considering connection state
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A small company is moving its on-premises infrastructure to the cloud. The security team is concerned about the shared responsibility model. They want to ensure that they understand which security controls they are responsible for implementing. Which of the following is the customer's responsibility in a cloud IaaS environment?

   • AConfiguring the cloud provider's global network backbone and edge locations.
   • BSecuring the physical data center and the network infrastructure that connects to the cloud.
   • CPatching the operating system of virtual machines and configuring the guest firewall.
   • DManaging the hypervisor and ensuring it is patched against vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company stores sensitive customer data in a cloud object storage bucket. The data is accessed by applications running in a VPC. The security team wants to ensure that the data is encrypted both in transit and at rest. Which configuration should they implement?

   • AUse a network ACL to restrict access to the storage bucket to the VPC CIDR only.
   • BUse a VPC endpoint for the storage service and rely on the private network for security.
   • CEnable server-side encryption on the bucket and use HTTPS for all API calls to the storage service.
   • DUse a client-side encryption library to encrypt data before uploading, and do not use HTTPS.
   Reveal Solution Discussion Select an answer first