4.1 Explain Cloud Runtime Security Concepts and Capabilities CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is implementing a vulnerability management program for their cloud environment. They have a large number of vulnerabilities to remediate, but limited resources. They want to prioritize vulnerabilities based on the actual risk to the organization. They have access to vulnerability scans, asset inventories, and threat intelligence feeds. Which approach should they use to prioritize remediation?

   • ACombine vulnerability severity, exploitability, and asset criticality to calculate a risk score for each vulnerability.
   • BPrioritize vulnerabilities based on the age of the vulnerability, because older vulnerabilities are more likely to be exploited.
   • CPrioritize vulnerabilities based on the number of affected assets, because that indicates the blast radius.
   • DPrioritize vulnerabilities based on CVSS score alone, because it is the industry standard.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is managing vulnerability remediation for a portfolio of cloud workloads. They have identified a critical vulnerability in a container image that is used by a production application. The vulnerability has a known exploit, but the application is not internet-facing and is protected by strict network controls. Which factor should the team consider when prioritizing this vulnerability?

   • AThe asset criticality and the exploitability of the vulnerability, even if the application is not internet-facing.
   • BThe number of other workloads using the same container image, because that indicates the blast radius.
   • CThe vulnerability's CVSS score alone, because it is the standard measure of severity.
   • DThe age of the vulnerability, because older vulnerabilities are more likely to be exploited.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a critical web application that cannot tolerate any additional latency. They are considering deploying WAAS to protect against OWASP Top 10 threats. The security team is debating between inline and out-of-band deployment. They also want to ensure that the WAAS solution can block attacks in real time. Which deployment mode should they choose, and what trade-off should they accept?

   • AInline deployment, accepting a small increase in latency to gain real-time blocking.
   • BOut-of-band deployment, accepting that attacks may not be blocked in real time.
   • COut-of-band deployment, but with automated response to block attacks after detection.
   • DInline deployment, but only for API traffic, to minimize latency impact.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which factor is commonly considered when prioritizing vulnerability remediation in cloud environments?

   • AThe color of the cloud provider's logo
   • BThe number of characters in the vulnerability description
   • CThe age of the vulnerability scanner used
   • DThe criticality of the asset affected by the vulnerability
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does Cloud Detection and Response (CDR) typically leverage cloud-native telemetry?

   • ABy ingesting audit logs and API activity from cloud providers for threat detection
   • BBy replacing the cloud provider's native logging with proprietary agents
   • CBy requiring all telemetry to be sent to an on-premises SIEM before analysis
   • DBy ignoring API activity and focusing only on network traffic
   Reveal Solution Discussion Select an answer first