3.1 Identify and Explain the Use of Key Cloud Posture Security Elements CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses a third-party ML API for fraud detection. The security team wants to ensure that the training data used by the vendor is not exposed, that the model's outputs are consistent, and that the API is not being abused. They also need to verify that the vendor's infrastructure is configured securely. What is the most comprehensive approach?

   • AUse a DSPM solution to classify the data sent to the API and restrict access
   • BUse an AI-SPM solution that monitors the ML API's behavior, checks for data exposure, and validates model integrity
   • CUse a CSPM tool to scan the vendor's cloud infrastructure for misconfigurations
   • DUse a vulnerability scanner to patch the vendor's servers
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which principle is central to identity security?

   • ALeast privilege, granting only the permissions necessary for a task
   • BSingle sign-on for all users without monitoring
   • CUsing shared accounts for simplicity
   • DMaximum access to ensure productivity
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a multi-tenant Kubernetes cluster where different teams deploy workloads. The security team wants to ensure that no pod runs as root, that RBAC roles are least-privilege, and that the cluster's compliance with CIS benchmarks is continuously monitored. They also want to avoid installing agents on nodes. What should they implement?

   • AA CSPM tool that checks for public S3 buckets in the AWS account
   • BA vulnerability scanner that patches the underlying host OS of each node
   • CA KSPM tool that scans the cluster API for pod security contexts, RBAC roles, and CIS benchmark compliance
   • DA manual review of all YAML manifests before deployment
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is migrating to Azure and wants to ensure its cloud posture is continuously assessed. They have a mix of IaaS, PaaS, and SaaS resources. The security team wants to detect misconfigurations, enforce compliance with internal policies, and receive alerts when risky changes occur. However, they are concerned about alert fatigue and want to focus on the most critical issues. What should they configure?

   • AAzure Sentinel to collect all logs and generate alerts for every event
   • BMicrosoft Defender for Cloud with regulatory compliance standards and custom policies, using severity-based alerts
   • CAzure Policy alone to enforce tagging on all resources
   • DAzure AD Privileged Identity Management to manage admin roles only
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has thousands of EC2 instances and Azure VMs that were provisioned by different teams. The security team wants to assess them for misconfigurations and vulnerabilities, but they are concerned about the operational overhead of installing and maintaining agents on every instance. They also want to avoid any impact on application performance. Which approach best meets these requirements?

   • AEnable AWS Config and Azure Policy to check for misconfigurations only, ignoring vulnerabilities
   • BInstall a lightweight agent on each VM that reports to a central vulnerability management console
   • CDeploy a network-based scanner that performs authenticated scans over the network using admin credentials
   • DUse agentless scanning that snapshots the VM disks and analyzes them without installing software on the instances
   Reveal Solution Discussion Select an answer first