3.3 Explain the Creation and Configuration of Cloud Security Rules and Policies (e.g., Attack Path, Configuration, Data, Identity, Network Exposure, AI) CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a network exposure rule?

   • AA rule that requires all users to use strong passwords
   • BA rule that flags any security group allowing inbound traffic on port 22 from 0.0.0.0/0
   • CA rule that enables versioning on all storage accounts
   • DA rule that disables public access to all storage accounts
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A machine learning team is deploying a model that processes sensitive customer data. The security team needs to create a policy that ensures the model's training data is not publicly accessible and that the model endpoint is only accessible from a specific virtual network. Which policy configuration should be used?

   • AAn identity security rule that requires all users to have multi-factor authentication enabled.
   • BAn attack path rule that identifies potential pivots from the model endpoint to other resources.
   • CAn AI security rule that checks the data storage for public access and a network exposure rule that restricts the endpoint to the specified virtual network.
   • DA configuration rule that ensures the model is using the latest version of the AI framework.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A data security policy must be created to protect sensitive customer data stored in an object storage service. The policy should ensure that data is encrypted at rest and that only a specific set of service principals can access the data. Which combination of policy elements should be configured?

   • AAn attack path rule that identifies potential pivots from the storage service to other resources.
   • BA network exposure rule that blocks all public access to the storage service.
   • CA data classification tag for 'Confidential' and an encryption requirement, plus an identity-based access rule that restricts access to the specified service principals.
   • DA configuration rule that ensures the storage service is using the latest API version.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A data security policy must be created to protect a database that contains personally identifiable information (PII). The policy must ensure that only a specific set of applications can access the database, and that all data is encrypted in transit. The security team is considering using a combination of identity-based and data classification rules. Which configuration best meets the requirements?

   • ACreate an attack path rule that alerts when the database is accessible from a virtual machine.
   • BCreate a configuration rule that ensures the database is using the latest version.
   • CCreate an identity security rule that restricts access to the database to the specified applications, and a data security rule that requires 'Enforce SSL connection' to be enabled.
   • DCreate a network exposure rule that blocks all public access to the database.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is configuring attack path rules for a web application. The analyst has identified a path where a compromised web application can access a database via a service principal, and the database has a public endpoint. The analyst needs to create a rule that alerts on this specific path. Which rule configuration should be used?

   • ACreate an identity security rule that alerts on any service principal with access to a database.
   • BCreate a configuration rule that checks if the web application is using the latest version.
   • CCreate an attack path rule that matches the sequence: web application → database, with a condition that the database has a public endpoint.
   • DCreate a network exposure rule that alerts on any database with a public endpoint.
   Reveal Solution Discussion Select an answer first