Cloud Vulnerability Analysis GCTD Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is scanning a multi-cloud environment (AWS, Azure, GCP) for vulnerabilities. They want to use a single tool that can scan across all three providers and provide a unified view of vulnerabilities. Which tool is most appropriate?

   • AGoogle Cloud Security Command Center
   • BAWS Inspector
   • CQualys Cloud Platform
   • DAzure Defender
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team has identified two vulnerabilities: (1) a critical vulnerability in a public-facing web application that is not currently being exploited, and (2) a high-severity vulnerability in an internal system that is being actively exploited. The web application is critical to business operations and cannot be taken offline. What is the best course of action?

   • APrioritize the critical web application first because it is critical and has higher severity.
   • BIgnore the internal system because it is internal and focus only on the web application.
   • CPrioritize the actively exploited internal system first because it is being exploited, but apply temporary mitigations to the web application.
   • DTake the web application offline to remediate it immediately.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team has identified a critical vulnerability in a cloud application and applied a patch. What is the next step in the vulnerability lifecycle to ensure the remediation was effective?

   • AUpdate the vulnerability database with the patch details.
   • BClose the vulnerability ticket immediately after applying the patch.
   • CMove on to the next vulnerability without further action.
   • DRe-scan the affected resource to verify the vulnerability is no longer present.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which vulnerability should be remediated first according to common prioritization frameworks?

   • AA high-severity vulnerability that is actively exploited in the wild
   • BA low-severity vulnerability affecting a non-critical system
   • CA medium-severity vulnerability that requires local access
   • DA low-severity vulnerability with no known exploit
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security engineer discovers that an AWS S3 bucket used for customer uploads has a bucket policy that grants 's3:GetObject' to 'Principal': '*'. The bucket does not contain sensitive data, but the company's compliance team is concerned about data exposure. The engineer needs to reduce the risk while maintaining the bucket's function as a public content repository for a marketing website. Which action best addresses the vulnerability?

   • AEnable S3 Block Public Access on the bucket and keep the bucket policy unchanged.
   • BRemove the bucket policy and rely on the bucket ACL to grant public read access.
   • CMove the bucket to a different AWS region with stricter default settings.
   • DReplace the wildcard principal with the specific IAM role used by the marketing website.
   Reveal Solution Discussion Select an answer first