Managing Cloud Security GSLC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is using a SaaS application for customer relationship management (CRM). The security team wants to ensure that only authorized users can access the application and that their access is logged. Which controls should the team implement?

   • AEnable single sign-on (SSO) with multi-factor authentication (MFA) and configure audit logging.
   • BEncrypt the data stored in the SaaS application.
   • CUse a VPN for all users and disable external access.
   • DRely on the SaaS provider's default security settings.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a key difference between incident response in the cloud and in traditional on-premises environments?

   • ACloud incidents do not involve any legal or regulatory considerations
   • BCloud incidents often require coordination with the cloud provider for forensic data acquisition
   • CCloud incidents are always less severe than on-premises incidents
   • DCloud incidents never require a formal response plan
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A hospital is moving patient records to a cloud provider. The provider offers a shared infrastructure environment. The hospital's compliance officer requires that the provider be contractually obligated to protect the confidentiality of patient data. Which type of agreement is most appropriate?

   • AA non-disclosure agreement (NDA) that prevents the provider from sharing the data.
   • BA data processing agreement (DPA) that is GDPR-specific.
   • CA standard service level agreement (SLA) that guarantees uptime.
   • DA business associate agreement (BAA) that includes HIPAA privacy and security requirements.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is designing a cloud architecture for a three-tier application (web, application, database). The security team requires that the web tier be accessible from the internet, the application tier only from the web tier, and the database tier only from the application tier. Which network segmentation approach should be used?

   • ADeploy each tier in a separate virtual network with no peering.
   • BUse a single subnet and restrict traffic with application-level authentication.
   • CPlace each tier in a separate subnet with network security groups that allow only the required traffic flows.
   • DPlace all tiers in the same subnet and rely on host-based firewalls.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A healthcare organization is evaluating a cloud-based email service. The provider stores data in multiple regions worldwide. The organization must ensure that protected health information (PHI) remains within the United States. The provider offers a data residency option that restricts data storage to a U.S. region. What should the organization do to address this requirement?

   • AConfigure the data residency option to store data only in the U.S. region
   • BEncrypt all email content with a customer-managed key to ensure compliance
   • CRequire the provider to sign a business associate agreement (BAA) and rely on that for compliance
   • DAccept the provider's default data storage locations to avoid configuration complexity
   Reveal Solution Discussion Select an answer first