Managing Cloud Security GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which identity management practice is considered a foundational security control in cloud architecture?

   • ADisabling account lockout policies
   • BSharing administrative credentials among team members
   • CEnabling multi-factor authentication (MFA) for all user accounts
   • DUsing the same password for all cloud services
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which technical control is most directly used to protect data stored in cloud object storage from unauthorized access?

   • AIdentity and access management (IAM) policies
   • BWeb application firewall (WAF)
   • CNetwork intrusion detection system (NIDS)
   • DData loss prevention (DLP) software
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is considering moving a legacy application to a public cloud. The application has a known vulnerability that cannot be patched because the vendor is out of business. Which risk mitigation strategy is most appropriate?

   • ARequire the cloud provider to patch the application.
   • BMove the application to the cloud as-is and accept the risk.
   • CDisable the application's network access entirely.
   • DImplement compensating controls such as a web application firewall and strict network segmentation.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is selecting a cloud provider for a new project. The project involves processing sensitive customer data. The company's security team has identified a potential risk: the provider's subcontractors may have access to the data. The company wants to ensure that subcontractors are held to the same security standards as the provider. What should the company do?

   • ARequire the provider to include subcontractor security requirements in the contract and provide audit rights
   • BAccept the risk because subcontractors are not under the company's control
   • CRely on the provider's public security certifications to ensure subcontractor compliance
   • DAsk the provider to disable all subcontractor access to the data
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing company is moving its on-premises ERP system to a cloud provider. The ERP vendor will manage the application, runtime, and middleware, while the company will manage its own data and user access. The security team must identify which security controls remain the company's responsibility under the shared responsibility model. Which control should the company plan to implement?

   • APatching the underlying operating system of the ERP servers
   • BConfiguring multi-factor authentication for user access to the ERP application
   • CManaging the physical security of the data center hosting the ERP
   • DUpdating the ERP application code and runtime environment
   Reveal Solution Discussion Select an answer first