4.1 Explain Cloud Runtime Security Concepts and Capabilities CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is part of the 'scanning' phase in cloud vulnerability management?

   • AAssigning risk scores to vulnerabilities based on exploitability
   • BIdentifying known vulnerabilities in workloads and container images
   • CDeleting unused cloud accounts
   • DApplying security patches to affected systems
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a web application that is protected by a WAAS solution. The security team has noticed that the WAAS is blocking legitimate traffic from a specific user group. They suspect that the WAAS is misidentifying the traffic as malicious. The team wants to ensure that legitimate users are not affected while maintaining protection against OWASP Top 10 threats. Which action should they take?

   • ADisable the WAAS policy that is blocking the traffic.
   • BIncrease the severity threshold for blocking to reduce false positives.
   • CSwitch to out-of-band deployment to avoid blocking legitimate traffic.
   • DReview the WAAS logs to identify the pattern that is being blocked and create an exception for legitimate traffic.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has a web application that is deployed across multiple cloud regions. The application uses a content delivery network (CDN) to serve static content, and the origin server is behind a load balancer. The security team wants to protect the application from OWASP Top 10 threats without introducing additional latency for users. Which WAAS deployment mode should they choose?

   • ADeploy WAAS out-of-band and analyze traffic asynchronously.
   • BDeploy WAAS inline at the load balancer to inspect traffic before it reaches the origin.
   • CUse the CDN's built-in security features and rely on them for OWASP Top 10 protection.
   • DDeploy WAAS only in the region where the origin server is located.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is migrating a legacy application to AWS. The application runs on EC2 instances that are managed by an autoscaling group, and the security team needs continuous visibility into workload vulnerabilities and compliance. The team wants to avoid installing agents on every instance because the AMI is tightly controlled and changes require a lengthy approval process. Which approach should the security team take?

   • AEnable AWS Config rules to monitor instance configuration and rely on those rules for vulnerability detection.
   • BDeploy a network-based scanner in the VPC that scans all instances on a schedule using the AWS Systems Manager agent.
   • CUse agentless scanning that snapshots the EC2 volumes and analyzes them without installing software on the instances.
   • DInstall the CWP agent on each instance during the AMI build process and update the AMI whenever the agent needs a new version.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) uses a SIEM platform to monitor on-premises infrastructure. The company is moving to the cloud and wants to extend visibility into cloud workloads and identities. They want to automate response actions, such as isolating a compromised instance, but they also want to keep the existing SIEM as the central console. Which integration should they implement?

   • AUse the cloud provider's native monitoring service and manually review alerts in the cloud console.
   • BExport cloud audit logs to the SIEM but continue to handle response actions manually.
   • CDeploy a separate cloud security monitoring tool and have the SOC switch to that tool for cloud alerts.
   • DIntegrate CDR with the SIEM and SOAR platforms to send alerts and enable automated response actions.
   Reveal Solution Discussion Select an answer first