Securing Cloud Application Service Platforms GPCS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is migrating a legacy application to a cloud application service platform. The security team is concerned about the shared responsibility model and wants to ensure that the company's security controls are not overlooked. Which security control is the company responsible for even when using a fully managed application service platform?

   • ASecuring the physical network infrastructure of the cloud provider.
   • BManaging the application's code and its dependencies.
   • CPatching the host operating system of the application service.
   • DConfiguring the cloud provider's hypervisor.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A company's security operations team is overwhelmed by alerts from its application service platform. Many alerts are false positives, and the team is missing critical security incidents. The company wants to improve the signal-to-noise ratio while ensuring that important events are not missed. Which approach is most effective?

   • AUse a centralized log analytics workspace and create alert rules with specific conditions and thresholds, and suppress alerts for known benign events.
   • BDisable all alerts and rely on manual log review.
   • CIncrease the severity of all alerts to ensure they are noticed.
   • DSend all logs to a third-party SIEM and create alerts for every event.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company runs a multi-tier application on a cloud application service platform. The front-end web tier must be accessible from the internet, while the back-end API tier should only be reachable from the front-end tier. They want to avoid exposing the back-end to the internet. Which network design should they implement?

   • APlace the front-end in a public subnet and the back-end in a private subnet, with a network security group allowing only the front-end to reach the back-end.
   • BPlace both tiers in a private subnet and use a load balancer to expose the back-end to the internet.
   • CPlace both tiers in the same subnet and rely on application-level authentication to protect the back-end.
   • DPlace both tiers in the same subnet and use a network security group to restrict inbound traffic to the back-end from the front-end's IP addresses.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of applying a secure configuration baseline to a cloud application service?

   • ATo automatically patch all underlying infrastructure
   • BTo establish a known secure state for the service configuration
   • CTo eliminate the need for monitoring and logging
   • DTo increase the number of features enabled by default
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which key management practice is recommended for protecting data at rest in a cloud application service?

   • AUse customer-managed keys stored in a cloud key management service
   • BDisable encryption to improve performance
   • CUse the same key for all customers in the cloud provider
   • DStore encryption keys in the same database as the encrypted data
   Reveal Solution Discussion Select an answer first