Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is using a cloud provider's managed Kubernetes service. The security team is determining who is responsible for securing the worker nodes' operating system. According to the shared responsibility model, who is responsible?

   • AThe provider, only if the customer uses a specific node pool.
   • BThe provider, because it is a managed service.
   • CThe customer, because they deploy the workloads.
   • DThe customer, because they have access to the worker nodes.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating a critical application to the cloud and must choose between IaaS and PaaS. The security team is concerned about the effort required to patch the operating system and middleware. The compliance team requires the ability to install a custom security agent on the host. Which service model best balances these requirements?

   • APaaS, because the provider patches the OS and middleware, reducing effort.
   • BIaaS, because the customer can patch the OS and install the custom agent.
   • CServerless, because it eliminates patching entirely.
   • DSaaS, because the provider manages everything.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is using a cloud provider's SaaS collaboration platform. The security team is concerned about data leakage through external sharing. The provider offers a data loss prevention (DLP) feature, but it requires additional configuration. The team has limited resources and must decide whether to configure the DLP feature or rely on user training. Which approach is more effective in reducing data leakage risk?

   • ADisable external sharing entirely in the platform.
   • BRely on user training to teach employees not to share sensitive data externally.
   • CConfigure the provider's DLP feature to block external sharing of sensitive data.
   • DMonitor external sharing through manual audits of sharing logs.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is using a cloud provider's IaaS to host a web server. The provider offers a managed web application firewall (WAF) that can be deployed in front of the server. The security team wants to reduce the risk of web application attacks but is concerned about the cost and management overhead. Which approach best balances security and cost?

   • ADeploy an open-source WAF on a separate virtual machine and manage it manually.
   • BDeploy a network firewall that blocks all inbound traffic except on port 80 and 443.
   • CDeploy the provider's managed WAF and configure it with the provider's recommended rule set.
   • DRely on the web server's built-in security features and do not deploy a WAF.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is using threat intelligence to design a detection strategy. The intelligence indicates that an adversary group uses cloud API calls to enumerate resources and identify misconfigurations. Which control is most directly informed by this threat pattern?

   • ADisabling all cloud APIs.
   • BUsing a VPN for all API access.
   • CEnabling cloud API logging and monitoring for unusual enumeration patterns.
   • DEncrypting all API traffic.
   Reveal Solution Discussion Select an answer first