Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a virtual private cloud (VPC) in a public cloud environment?

   • ATo encrypt all data stored in the cloud
   • BTo automatically patch all virtual machines
   • CTo provide a backup of all cloud resources
   • DTo provide a logically isolated section of the cloud where resources can be launched
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A company is migrating a legacy application to the cloud. The application runs on a VM and needs to access a cloud storage service. The security team wants to avoid storing long-term credentials in the application's configuration files. Which approach should be used to grant the application access to the storage service?

   • AUse a shared access key that is embedded in the application's code.
   • BUse a service account or workload identity that is associated with the VM and grants permissions to the storage service.
   • CCreate a user account with a long-lived access key and store it in the application's configuration file.
   • DUse a federated identity that requires the application to authenticate with a user's credentials.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has deployed a multi-tier web application in a cloud VPC. The web tier must be accessible from the internet, but the application tier must only be reachable from the web tier. The database tier must be reachable only from the application tier. Which set of network controls should be implemented?

   • APlace all tiers in the same subnet and use host-based firewalls on each instance to restrict traffic.
   • BPlace all tiers in the same subnet and use a network ACL to allow all traffic, relying on the application's authentication.
   • CUse a single subnet for all tiers and rely on the cloud provider's default security group to block traffic.
   • DCreate separate subnets for each tier and use network security groups or security lists to allow only the required traffic between them.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is designing a secure data transfer process between two cloud applications. The data is sensitive and must be protected from unauthorized access during transmission. The company also needs to ensure that the data has not been tampered with during transit. Which combination of controls should be used?

   • AUse only encryption with a symmetric key to protect the data.
   • BUse TLS for encryption in transit and a digital signature to provide integrity and authenticity.
   • CUse a digital signature only, without encryption.
   • DUse only a hash function to verify the data's integrity.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of configuration management in cloud security?

   • ATo ensure that systems are configured consistently and securely
   • BTo encrypt all data in transit
   • CTo manage user passwords
   • DTo monitor network traffic for intrusions
   Reveal Solution Discussion Select an answer first