Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A startup is deploying a containerized web application on a cloud provider's managed Kubernetes service. The security team wants to ensure that the underlying worker nodes are patched and that the container images are scanned for vulnerabilities. Which responsibility division aligns with the shared responsibility model for this deployment?

   • AThe customer patches the worker node operating system; the provider scans container images for vulnerabilities.
   • BThe provider is responsible for both node patching and container image scanning.
   • CThe customer is responsible for both node patching and container image scanning.
   • DThe provider patches the worker node operating system; the customer is responsible for scanning and updating container images.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is developing a threat-informed defense strategy. Threat intelligence indicates that an adversary group uses legitimate cloud management tools to create new user accounts and assign them high-privilege roles. The team must choose a control that balances security with operational efficiency. Which control is most effective?

   • AImplementing a process that requires approval for new high-privilege accounts and monitors for unusual account creation.
   • BDisabling the ability to create new user accounts entirely.
   • CRelying solely on the cloud provider's default security controls.
   • DUsing a single shared administrative account to simplify management.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is using a software-as-a-service (SaaS) email platform. The security team is defining who is responsible for applying security patches to the email application itself. According to the shared responsibility model, who is responsible?

   • AThe provider, only if the customer subscribes to a premium support plan.
   • BThe customer, because they are responsible for all security controls in the cloud.
   • CThe customer, because they use the application and must secure their data.
   • DThe provider, because the application is fully managed by the provider in SaaS.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A cloud security team is reviewing threat intelligence that shows adversaries are exploiting misconfigured cloud storage buckets to exfiltrate data. Which defensive strategy would be most effective in reducing the risk of this tactic?

   • ARequire multi-factor authentication for all storage API calls.
   • BImplement automated checks to detect and alert on public bucket access.
   • CDeploy a network intrusion detection system inside the virtual network.
   • DEncrypt all data in transit using TLS.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing threat intelligence that indicates adversaries are using stolen credentials to access cloud management consoles and then creating new administrative users. Which control would most directly address this adversary tactic?

   • AEnforce multi-factor authentication for all console users.
   • BRestrict console access to a specific IP range.
   • CDeploy a web application firewall in front of the console.
   • DEnable detailed logging of API calls.
   Reveal Solution Discussion Select an answer first