Understand Design Principles of Secure Cloud Computing CCSP Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A security architect is designing access controls for a cloud-based application. The architect wants to apply the SANS principle of least privilege. The application has three roles: administrators, managers, and employees. Which access control design best implements least privilege?

   • AGranting each role only the permissions required to perform its job functions.
   • BGranting administrators full access and managers and employees read-only access.
   • CGranting all users the same level of access to simplify management.
   • DGranting users access based on their seniority in the organization.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is migrating its customer relationship management (CRM) system from an on-premises deployment to a SaaS platform. The company's security team requires that the CRM data be portable so the company can switch vendors in the future. The SaaS vendor offers an API for data export but stores data in a proprietary format. The company also requires that the CRM integrate with its existing identity provider using SAML 2.0. Which approach best addresses the company's requirements?

   • AAccept the proprietary format because the API export meets the portability requirement, and configure SAML 2.0 for interoperability.
   • BUse the vendor's proprietary format but negotiate a contract clause that the vendor will convert the data to a standard format upon termination.
   • CStore a copy of all CRM data in the company's own cloud storage using the vendor's API, and use the vendor's built-in identity management.
   • DRequire the vendor to provide export in an open, standard format (e.g., CSV or JSON) and configure SAML 2.0 for identity interoperability.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   What is the primary purpose of the CSA Enterprise Architecture reference model?

   • ATo provide a framework for aligning cloud security with business goals and compliance
   • BTo guarantee compliance with all regulations
   • CTo define a specific cloud provider's API
   • DTo replace the need for risk assessments
   Reveal Solution Discussion Select an answer first