Securing Connected and Cloud-Based Environments GISF Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's cloud environment has a virtual network with multiple subnets. They want to monitor traffic between subnets for suspicious activity. Which control is most effective?

   • ADisable all network security groups to allow full traffic visibility.
   • BRely on the cloud provider's default monitoring without any additional configuration.
   • CEnable flow logs on the virtual network and analyze them with a security monitoring tool.
   • DUse a single subnet for all resources to simplify monitoring.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst suspects a compromised virtual machine in a cloud environment. They need to preserve evidence for forensic analysis. Which step should they take FIRST?

   • AReboot the VM to clear any malware
   • BSnapshot the VM's disk and capture memory before shutting it down
   • CDisconnect the VM from the network but leave it running
   • DImmediately terminate the VM to stop the attack
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security analyst is reviewing the risks introduced by a building's new network-connected HVAC controllers. Which characteristic of these IoT devices most directly increases their attack surface compared to traditional enterprise servers?

   • AThey typically run full-featured operating systems with many open ports.
   • BThey are always connected directly to the internet without any firewall.
   • CThey use proprietary protocols that are inherently insecure.
   • DThey often have limited processing power and lack built-in security features like patch management.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company has a cloud environment with multiple application tiers. They want to limit the impact of a compromise in one tier. Which architecture is MOST effective?

   • APlace all tiers in the same subnet with open security group rules
   • BEnable encryption on all inter-tier traffic
   • CUse separate subnets for each tier and restrict traffic with security groups or network ACLs
   • DUse a single large instance for all tiers
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company experiences a security incident in its cloud environment. The security team needs to collect evidence for forensic analysis. Which action is most appropriate in a cloud context?

   • APower off the affected virtual machines immediately to preserve memory.
   • BRely solely on the cloud provider's incident response team to handle all evidence collection.
   • CTake snapshots of the affected virtual machines and enable detailed logging if not already enabled.
   • DDelete the affected virtual machines to prevent further spread.
   Reveal Solution Discussion Select an answer first