Securely Accessing Cloud Services GPCS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is deploying a cloud application that must be accessed by remote employees over the internet. The security team wants to ensure that all traffic between employees and the application is encrypted and that the application's identity is verified. Which control is essential?

   • AUse TLS with a valid certificate from a trusted CA for the application endpoint.
   • BUse HTTP and rely on the cloud provider's network security.
   • CUse a custom encryption protocol developed in-house.
   • DRequire users to connect through a VPN without TLS.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A cloud administrator is designing a permission model for a large organization. The organization has a requirement that no single user should have the ability to both create a virtual machine and delete a virtual machine. This is to prevent accidental or malicious destruction of resources. Which IAM design best meets this requirement?

   • ACreate a group with create permissions and another group with delete permissions, and add all users to both groups.
   • BCreate a single role with create permissions and use a separate approval process for deletions.
   • CCreate a single role with both create and delete permissions and assign it to all users.
   • DCreate two roles: one with create permissions and one with delete permissions, and assign them to different users.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is implementing a zero-trust security model. The security team wants to ensure that every access request to cloud resources is authenticated and authorized, regardless of the user's location. The company currently uses a VPN for remote access. Which change is most aligned with zero-trust principles?

   • ADisable all remote access and require users to be on-site.
   • BKeep the VPN but add MFA for all VPN connections.
   • CUse a more secure VPN protocol that encrypts all traffic.
   • DReplace the VPN with identity-based access controls and continuous verification of every request.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is deploying a new application that needs to access a cloud database. The application runs on a virtual machine in the same cloud environment. The security team wants to ensure that the database connection is encrypted and that the application does not use hard-coded credentials. Which solution should the team implement?

   • AStore the database password in an environment variable and enable SSL on the database.
   • BUse a service principal with a long-lived secret and configure the database to allow only the virtual machine's IP.
   • CUse a connection string with the password embedded and rely on the virtual network for security.
   • DUse a managed identity for the virtual machine and configure the database to require TLS connections.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In cloud IAM, what is the primary purpose of an IAM group?

   • ATo represent a specific application or service that needs access to resources
   • BTo provide a temporary set of credentials for a specific session
   • CTo define a set of permissions that can be attached to multiple users
   • DTo log all actions performed by a user within the cloud environment
   Reveal Solution Discussion Select an answer first