Understanding Shared Responsibility and Threat Informed Defense GCLD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is moving a legacy application to an infrastructure-as-a-service (IaaS) environment. The security team is performing a risk assessment and must determine who is responsible for patching the guest operating system of the virtual machines. Which statement accurately reflects the shared responsibility model for IaaS?

   • AThe customer patches both the guest OS and the hypervisor.
   • BThe customer is responsible for patching the guest OS, while the provider patches the hypervisor.
   • CThe provider patches the guest OS only if the customer uses a managed service offering.
   • DThe provider patches the guest OS because it runs on provider infrastructure.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is using a serverless compute service (Function-as-a-Service) to run event-driven code. The security team is documenting responsibilities for securing the runtime environment. According to the shared responsibility model, which responsibility remains with the customer?

   • APatching the underlying operating system of the function runtime.
   • BSecuring the physical servers that host the functions.
   • CManaging the function code and its dependencies.
   • DConfiguring the hypervisor for the function environment.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is using threat intelligence to prioritize cloud security investments. The intelligence shows that adversaries are exploiting weak identity and access management (IAM) policies to escalate privileges. The team has a limited budget and must choose between implementing a cloud access security broker (CASB) or conducting a thorough IAM policy review and cleanup. Which choice is more aligned with threat-informed defense?

   • AImplement both, but prioritize the CASB because it provides immediate visibility.
   • BImplement a CASB because it provides visibility into cloud usage and can block risky activities.
   • CConduct the IAM policy review and cleanup because it directly addresses the misconfigurations that adversaries exploit.
   • DImplement neither and rely on the provider's default IAM settings.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is using threat intelligence to prioritize cloud security investments. The intelligence shows that the most common attack vector is exposed management interfaces with weak passwords. The team has a limited budget and must choose one control. Which control is most aligned with threat-informed defense?

   • AEnforcing strong password policies and multi-factor authentication for management interfaces.
   • BPurchasing additional threat intelligence feeds.
   • CEncrypting all data at rest.
   • DDeploying a web application firewall (WAF) for all public-facing applications.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is reviewing threat intelligence that shows adversaries are using exposed cloud storage keys to access sensitive data. Which control would be most effective in preventing this attack?

   • ADeploy a network firewall to block external access to the storage service.
   • BUse a secrets management service to store and rotate access keys.
   • CEnable versioning on the storage buckets.
   • DEncrypt all data in the storage buckets using server-side encryption.
   Reveal Solution Discussion Select an answer first