Securing Cloud Application Service Platforms GPCS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of network segmentation for a cloud application service?

   • ATo simplify the application's codebase
   • BTo eliminate the need for encryption
   • CTo increase the application's processing speed
   • DTo isolate the application from other resources to limit the impact of a compromise
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of using a federated identity provider (IdP) with a cloud application service?

   • ATo automatically encrypt all data stored by the application
   • BTo monitor network traffic for malicious activity
   • CTo provide a backup of the application's database
   • DTo allow users to authenticate using credentials from an external identity system
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a customer-facing web application on a cloud application service platform. The security team wants to allow the development team to deploy new versions of the application, but the developers must not be able to change the network security group rules or the application's managed identity. What should the security team configure?

   • AGive the developers the Owner role on the application service, and instruct them not to modify network or identity settings.
   • BAssign the developers the built-in Contributor role on the application service resource group, and rely on Azure Policy to prevent changes to network security groups and managed identities.
   • CCreate a management group that includes the application service, network security group, and managed identity, and assign the developers a read-only role on the management group.
   • DAssign the developers a custom role that includes only the permissions to create and update the application service, and deny them write access to the network security group and identity resources.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has deployed a web application on a cloud application service platform. The security team wants to ensure that the application service is not accessible directly from the internet, but only through a reverse proxy that performs SSL termination and web application firewall (WAF) inspection. What should the security team configure?

   • AEnable the application service's built-in authentication and authorization features.
   • BConfigure the application service's access restrictions to allow only the public IP address of the company's headquarters.
   • CPlace the application service in a virtual network with access restrictions that allow only the reverse proxy's IP address, and configure the reverse proxy to forward traffic to the application service.
   • DSet the application service's TLS version to 1.2 and require client certificates.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company deploys a web application to a cloud application service platform. The application has an admin panel that should only be accessible to a small group of administrators. The security team wants to ensure that the admin panel is not exposed to the internet. Which combination of controls should they implement?

   • AAllow all network access but require a strong password for admin accounts.
   • BRestrict the admin panel's network access to a specific IP range and require multi-factor authentication for admin accounts.
   • CDisable the admin panel entirely and manage the application through the cloud provider's CLI.
   • DHide the admin panel by using a non-standard URL and rely on security through obscurity.
   Reveal Solution Discussion Select an answer first