Cloud Provider and Infrastructure Security KCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the shared responsibility model for cloud computing, which statement correctly describes the division of security responsibilities for an IaaS (Infrastructure as a Service) offering?

   • AThe provider secures everything from physical infrastructure up to the application layer, leaving only data encryption to the customer.
   • BSecurity responsibilities are entirely transferred to the provider, so the customer has no security obligations.
   • CThe provider secures the physical hosts and network, while the customer secures the guest OS, applications, and data.
   • DThe customer is responsible for physical security of the data center, while the provider secures all virtual resources.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company must comply with a regulation that requires audit logs of all access to sensitive data stored in a cloud object storage service. Which action should the company take to meet this requirement?

   • AMove the data to a different region
   • BEncrypt the storage service with customer-managed keys
   • CRely on the cloud provider's compliance certifications
   • DEnable cloud provider logging and audit trails for the storage service
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company runs a multi-tenant Kubernetes cluster on a cloud provider. They need to ensure that tenants cannot access each other's resources, while also meeting compliance requirements for logging. Which set of controls should they implement?

   • AEncryption at rest and in transit
   • BPod security policies and image scanning
   • CResource quotas and limit ranges
   • DNetwork policies, RBAC, and audit logging
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company runs a production Kubernetes cluster on a cloud provider. They want to minimize the risk of a compromised node affecting other nodes. Which best practice should they implement?

   • AUse network policies to restrict east-west traffic between pods
   • BEnable encryption for all data at rest
   • CDisable all logging to reduce attack surface
   • DUse a single large node for all workloads
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company runs a production cluster on a cloud provider. They want to detect and respond to suspicious activities, such as unusual API calls or network connections. Which best practice should they implement?

   • AEnable comprehensive logging and monitoring of the cluster and cloud APIs
   • BApply encryption to all data in transit
   • CUse only private IP addresses for all services
   • DRestrict all network traffic to the cluster
   Reveal Solution Discussion Select an answer first