4.1 Explain Cloud Runtime Security Concepts and Capabilities CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How are WAAS policies typically applied to protect web applications and APIs?

   • ABy using only default policies that cannot be customized
   • BBy defining rules that specify allowed and blocked traffic based on application and API characteristics
   • CBy requiring manual approval for every request to the application
   • DBy automatically blocking all traffic that is not from a known IP address
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is adopting a multi-cloud strategy and wants to ensure that all cloud workloads are continuously monitored for security issues. They want a single solution that can discover workloads, assess their security posture, and monitor for threats across AWS, Azure, and GCP. Which capability is most important for this requirement?

   • AA SIEM that ingests logs from all three clouds and provides a single dashboard.
   • BA cloud-native security group that is configured identically in all three clouds.
   • CCloud Workload Protection (CWP) with multi-cloud workload discovery and continuous monitoring.
   • DA vulnerability scanner that runs on-premises and scans cloud workloads over the internet.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is investigating a potential data exfiltration incident. They have identified that a cloud storage bucket was accessed by an IAM role that is not typically used for that bucket. The analyst wants to determine if the role's credentials were compromised and if the access was part of a larger attack. Which CDR capability should they use?

   • ADisable the IAM role to prevent further access.
   • BCheck the IAM role's permissions to see if it has access to the bucket.
   • CCorrelate the IAM role's API activity with other cloud events to identify anomalies and potential compromise.
   • DReview the bucket's access logs to see the source IP addresses of the access.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is prioritizing vulnerabilities across their cloud environment. They have a vulnerability in a development server that has a high CVSS score but is not exposed to the internet. They also have a medium-severity vulnerability in a production database that is internet-facing. Which vulnerability should the team remediate first?

   • AThe high-severity vulnerability in the development server, because the CVSS score is higher.
   • BThe development server vulnerability first, because it is easier to remediate.
   • CThe medium-severity vulnerability in the production database, because the asset is critical and internet-facing.
   • DBoth vulnerabilities at the same time, because they are both important.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key characteristic of agent-based Cloud Workload Protection (CWP) deployment?

   • AIt is only applicable to serverless functions and not to VMs
   • BIt uses only cloud provider APIs to gather telemetry without any software installation
   • CIt requires installing a software component on each workload to be protected
   • DIt provides no visibility into runtime behavior of workloads
   Reveal Solution Discussion Select an answer first