Managing Cloud Security GSLC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company is evaluating two cloud providers for a new application. Provider A offers a lower price but has limited security certifications. Provider B is more expensive but has comprehensive security certifications and a strong audit trail. The company's compliance team requires that the provider have ISO 27001 certification. Which provider should the company choose?

   • AChoose a hybrid approach using both providers.
   • BProvider B, because it meets the compliance requirement and provides a stronger security posture.
   • CProvider A, and accept the risk of lacking ISO 27001.
   • DProvider A, because the lower cost is more important than certifications.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is selecting a cloud provider for a new project. The security team has identified that the provider's data centers are located in a country with different privacy laws than the company's home country. Which contractual clause is most important to include in the agreement?

   • AA data processing agreement that specifies the legal basis for data transfers and the applicable privacy safeguards.
   • BA clause that requires the provider to store all data in the company's home country.
   • CA non-disclosure agreement (NDA) that prevents the provider from discussing the company's data.
   • DA service level agreement (SLA) that guarantees 99.99% uptime.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is designing a hybrid cloud architecture. The company has a legacy application that must remain on-premises due to latency requirements, but it wants to extend its compute capacity to the cloud for burst workloads. The security architect must ensure that the cloud resources can securely communicate with the on-premises network. The company is concerned about exposing the on-premises network to the cloud. What should the architect implement?

   • AA direct internet connection between the cloud and on-premises resources using public IPs
   • BA site-to-site VPN with strong encryption and strict firewall rules between the cloud VPC and on-premises network
   • CA cloud-based proxy that forwards all traffic between the environments
   • DA dedicated private connection such as AWS Direct Connect or Azure ExpressRoute without additional security controls
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company's cloud environment has been compromised. The incident response team has identified that the attacker used a compromised administrative account. The team needs to contain the incident while preserving evidence. Which action should the team take first?

   • AChange the passwords of all user accounts.
   • BRevoke the compromised account's credentials and disable the account.
   • CShut down all affected virtual machines.
   • DDelete the compromised account and all its associated data.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is moving its customer relationship management (CRM) system to a cloud-based software-as-a-service (SaaS) offering. The company's security team must understand which security controls are the provider's responsibility. Which control is typically the provider's responsibility in a SaaS model?

   • AEnsuring that the company's employees use strong passwords
   • BPatching the underlying infrastructure and application platform
   • CManaging user access and permissions within the CRM application
   • DConfiguring data retention and backup policies for the CRM data
   Reveal Solution Discussion Select an answer first