3.1 Identify and Explain the Use of Key Cloud Posture Security Elements CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key advantage of agentless scanning over agent-based scanning?

   • AIt works without any cloud provider APIs
   • BIt provides real-time monitoring of every process on the workload
   • CIt is the only method that can scan for malware
   • DIt reduces operational overhead by eliminating the need to install and maintain agents
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What does vulnerability management in cloud posture involve?

   • AOnly scanning for vulnerabilities once a year
   • BInstalling agents on every asset to block all attacks
   • CContinuous scanning, prioritization, and remediation of vulnerabilities across cloud assets
   • DMonitoring user activity for suspicious behavior
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company uses AWS Organizations with multiple accounts. An internal audit reveals that a service account has full administrator access across all accounts, and several IAM users have unused permissions. The security team wants to enforce least privilege and monitor for anomalous behavior, but they also need to avoid breaking existing applications that rely on some of these permissions. What is the best approach?

   • AEnable AWS Config to detect public S3 buckets and enforce encryption on all storage
   • BImmediately revoke all unused permissions and delete the service account with administrator access
   • CUse IAM Access Analyzer to generate least-privilege policies, then gradually apply them while monitoring CloudTrail for access denials
   • DDeploy a KSPM tool to scan EKS clusters for RBAC misconfigurations
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following activities is typical of Data Security Posture Management (DSPM)?

   • ASetting up multi-factor authentication for cloud users
   • BPatching a web server against a known exploit
   • CConfiguring a virtual private network (VPN) for remote employees
   • DIdentifying where personally identifiable information (PII) is stored in cloud databases
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses Azure AD for identity and has a mix of users and service principals accessing resources. The security team wants to enforce least privilege, monitor for anomalous sign-ins, and detect when service principals have excessive permissions. What should they implement?

   • AAzure AD Identity Protection with conditional access policies and regular access reviews for service principals
   • BA CSPM tool that checks for public storage accounts and open security groups
   • CA vulnerability scanner that patches the VMs hosting Azure AD Connect
   • DA KSPM tool that scans AKS clusters for RBAC misconfigurations
   Reveal Solution Discussion Select an answer first