Managing Cloud Security GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is designing a cloud environment for a new application. The security team requires that all data be encrypted at rest and in transit, and that access to the encryption keys be restricted to a small group of administrators. Which approach should be used?

   • AUse provider-managed keys and rely on the provider's default encryption.
   • BEncrypt data with a static key stored in the application configuration.
   • CUse a cloud key management service (KMS) with customer-managed keys and strict IAM policies.
   • DUse a hardware security module (HSM) but allow all developers to access it.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is designing a cloud architecture for a new application that will handle financial transactions. The security architect must ensure that the application can scale during peak demand while maintaining strong security controls. The architect is considering using a serverless compute service. What should the architect implement to secure the serverless functions?

   • APlace all functions in the same VPC and allow full network access between them
   • BDisable logging for functions to reduce storage costs
   • CGrant each function the least privilege permissions it needs to access only its required resources
   • DUse the same service account for all functions to simplify management
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is using a cloud object storage service to store sensitive documents. The security team wants to protect the data at rest and control access. The provider offers server-side encryption with customer-managed keys and bucket policies. What should the security team implement?

   • AEnable server-side encryption with customer-managed keys and configure bucket policies to restrict access
   • BUse client-side encryption only and leave bucket policies at default
   • CRely on the provider's default encryption and make the bucket public for easy access
   • DDisable encryption to improve performance and use a complex bucket name for security
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During a cloud risk assessment, what is the primary purpose of identifying the data classification and sensitivity of workloads?

   • ATo determine the appropriate security controls and risk treatment priorities
   • BTo satisfy the cloud provider's compliance requirements
   • CTo determine the exact cost of cloud services
   • DTo eliminate all security risks associated with the cloud
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is negotiating a cloud contract with a provider that offers a shared responsibility model. The company's legal team requires that the provider be liable for security breaches caused by the provider's negligence. The provider's standard contract limits liability to the amount paid by the customer. The company wants to ensure that the provider is accountable for its own negligence. What should the company do?

   • AAccept the liability limitation because it is standard in the industry
   • BRely on the provider's cyber insurance to cover any losses
   • CNegotiate a contractual clause that excludes provider negligence from the liability limitation
   • DRequire the provider to sign a business associate agreement (BAA) to increase liability
   Reveal Solution Discussion Select an answer first