Securing Cloud Application Service Platforms GPCS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team needs to detect a potential brute-force attack against a cloud application service's login endpoint. They have access to the application's authentication logs. Which analysis should they perform?

   • ALook for failed login attempts from multiple IP addresses, each trying a different username.
   • BLook for successful logins from multiple IP addresses over a long period.
   • CLook for a high number of failed login attempts from a single IP address within a short time window.
   • DLook for a single failed login attempt from a known IP address.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization runs a critical application service and needs to detect unauthorized access attempts and configuration changes. The security operations team wants to receive alerts when someone tries to access the application service without valid credentials and when the application service's configuration is modified. What should the organization enable?

   • AEnable application service's built-in backup and restore features.
   • BEnable diagnostic logs for the application service and send them to a central log analytics workspace, then create alerts for failed authentication events and configuration changes.
   • CSet up a virtual network and network security group to restrict access to the application service.
   • DConfigure the application service to use a custom domain and SSL certificate.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company in a regulated industry wants to use a public cloud application service platform. The compliance team is concerned about the shared responsibility model and wants to ensure that the company meets its obligations. Which approach should they take?

   • AAvoid using the public cloud and build a private cloud to have full control.
   • BReview the cloud provider's shared responsibility model and implement the controls that are the customer's responsibility.
   • CSign a contract that transfers all security responsibility to the cloud provider.
   • DRely on the cloud provider's compliance certifications to cover all requirements.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A startup is building a new application on a cloud application service platform. They have limited security expertise and want to ensure they are not responsible for securing the underlying infrastructure. They also need to comply with a customer requirement to encrypt all data. Which platform choice and configuration should they make?

   • AUse a platform-as-a-service (PaaS) offering and enable encryption at rest and in transit.
   • BUse infrastructure-as-a-service (IaaS) to have full control over security.
   • CUse a function-as-a-service (FaaS) and rely on the provider to encrypt all data automatically.
   • DUse a software-as-a-service (SaaS) application and assume the provider handles all security.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company exposes a public API on a cloud application service. They want to protect the API from unauthorized access and monitor for suspicious activity. Which combination of controls should they implement?

   • AAllow anonymous access and rely on network security groups to restrict access.
   • BRequire API keys but do not enable logging to reduce overhead.
   • CRequire API keys for all requests and enable logging of all API calls.
   • DUse client certificates for authentication and disable logging.
   Reveal Solution Discussion Select an answer first