3.3 Explain the Creation and Configuration of Cloud Security Rules and Policies (e.g., Attack Path, Configuration, Data, Identity, Network Exposure, AI) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A data security policy must be created to protect a file share that contains confidential documents. The policy should ensure that the file share is encrypted at rest and that only a specific group of users can access it. Which combination of policy elements should be configured?

   • AA network exposure rule that blocks all public access to the file share.
   • BA data security rule that requires encryption at rest for the file share, and an identity security rule that restricts access to the specified user group.
   • CA configuration rule that ensures the file share is using the latest API version.
   • DAn attack path rule that identifies potential pivots from the file share to other resources.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the main purpose of identity security rules and policies in cloud posture security?

   • ATo manage and enforce identity-based access and permissions across cloud resources
   • BTo encrypt all data stored in the cloud
   • CTo automatically patch vulnerabilities in cloud workloads
   • DTo monitor network traffic for malicious activity
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to create a policy that alerts when any virtual machine has a public IP address and an open management port (e.g., SSH or RDP). The policy should be specific to this condition and not alert on other open ports. Which rule configuration should be used?

   • AA data security rule that checks if the virtual machine has encryption enabled on its disks.
   • BA configuration rule that checks if the virtual machine is using a specific operating system version.
   • CAn identity security rule that checks if the virtual machine's managed identity has 'Contributor' permissions.
   • DA network exposure rule that matches virtual machines with a public IP and a security rule allowing inbound traffic on port 22 or 3389.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of an AI security rule?

   • AA rule that requires all users to change their passwords every 90 days
   • BA rule that ensures all virtual machines have the latest OS patches
   • CA rule that restricts access to a machine learning model registry to authorized users only
   • DA rule that blocks all inbound traffic on port 443
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary goal of network exposure rules and policies in cloud posture security?

   • ATo encrypt all network traffic between cloud resources
   • BTo monitor and control the exposure of cloud resources to the internet and other networks
   • CTo automatically patch network devices
   • DTo manage user permissions to network resources
   Reveal Solution Discussion Select an answer first