Securing Cloud Application Service Platforms GPCS Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A financial services company must comply with PCI DSS and GDPR. The company uses a cloud application service platform that stores personal data of EU citizens. The compliance team requires that data be encrypted at rest and that access to the data be logged. The company also needs to demonstrate compliance to auditors. Which approach best meets these requirements?

   • AEnable audit logging only for the production environment and rely on manual configuration for other environments.
   • BEncrypt data at rest and store the encryption keys in the application's configuration file.
   • CEnable encryption at rest, enable audit logging for data access, and use cloud policy to enforce these settings across all application services.
   • DUse a platform-managed key for encryption and rely on the provider's compliance certifications.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A multinational company uses a cloud application service platform with multiple business units. Each business unit has its own application services and data. The security team wants to enforce least privilege while allowing each business unit to manage its own resources. The company also needs to meet regulatory requirements that require separation of duties. Which approach best satisfies these requirements?

   • ACreate a separate cloud account for each business unit and assign the root user to each business unit's administrator.
   • BUse a single management group for all business units and assign users the Owner role on their respective application services.
   • CAssign all users the Contributor role on the subscription and rely on the application service's built-in access control.
   • DCreate a management group for each business unit and assign custom RBAC roles that limit access to the respective management group.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's application service processes sensitive customer data. The security team wants to ensure that data is encrypted in transit between the application service and the database, and that the database connection string is not stored in the application's configuration file. What should the security team implement?

   • AUse a network security group to restrict database access to the application service's IP address.
   • BStore the connection string in the application's source code and use a code review process.
   • CUse TLS for the database connection and store the connection string in a cloud key vault, referencing it from the application service's configuration.
   • DEnable the database's built-in encryption at rest.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security operations team is investigating a potential data breach in a cloud application service. They have access to the platform's logs, but the logs are incomplete for the time period of the suspected breach. They need to determine what happened. Which action should they take first?

   • ACheck whether the logging configuration was changed during the suspected breach period.
   • BRestore the application from the last known good backup.
   • CImmediately notify all users of a potential breach.
   • DAssume the breach did not occur because logs are incomplete.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company runs a microservices-based application on a cloud application service platform. Each microservice needs to communicate with others, but the security team wants to minimize the attack surface by restricting communication to only necessary services. They also need to detect any anomalous traffic between services. Which approach should they implement?

   • AUse a single shared secret for all services and disable logging to reduce overhead.
   • BUse network security groups to allow all traffic between services in the same subnet.
   • CUse API keys for inter-service communication and rely on the platform's default logging.
   • DUse a service mesh with mutual TLS and fine-grained access policies, and enable traffic logging.
   Reveal Solution Discussion Select an answer first