3.3 Explain the Creation and Configuration of Cloud Security Rules and Policies (e.g., Attack Path, Configuration, Data, Identity, Network Exposure, AI) CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the scope of cloud security rules and policies in a posture security solution?

   • AThey apply only to compute resources such as virtual machines and containers
   • BThey only apply to resources that are publicly accessible from the internet
   • CThey cover a broad range of cloud resources, including compute, storage, identity, network, and data services
   • DThey are limited to network-level controls such as security groups and firewall rules
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of cloud security rules and policies in the context of posture security?

   • ATo replace the need for traditional network firewalls and security groups in the cloud
   • BTo provide a compliance report that is accepted by all major regulatory frameworks
   • CTo automatically remediate all security misconfigurations without requiring human intervention
   • DTo define and enforce the desired security state of cloud resources and detect deviations from that state
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the main goal of an attack path rule or policy in cloud security?

   • ATo automatically patch all vulnerabilities in cloud workloads
   • BTo monitor user activity and detect insider threats
   • CTo identify the sequence of misconfigurations and permissions that an attacker could exploit to reach a critical asset
   • DTo block all inbound traffic from the internet to any cloud resource
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of an identity security rule?

   • AA rule that enables encryption for all databases
   • BA rule that blocks all inbound traffic on port 22 (SSH)
   • CA rule that requires multi-factor authentication (MFA) for all administrative users
   • DA rule that sets the retention period for audit logs
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization wants to enforce a policy that prevents any user from creating a new role assignment with 'Owner' permissions in the production subscription. The policy should be proactive, blocking the action at creation time. Which type of policy should be configured?

   • AAn identity security policy that denies the 'Microsoft.Authorization/roleAssignments/write' action when the role definition is 'Owner'.
   • BA configuration policy that audits all existing role assignments and reports those with 'Owner' permissions.
   • CAn attack path rule that alerts when a user with 'Owner' permissions is found.
   • DA network exposure rule that restricts access to the subscription management endpoints.
   Reveal Solution Discussion Select an answer first