4.1 Identify and Describe Major Cloud Architectures and Topologies CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is adopting a SaaS email and collaboration suite. They are concerned about data security. Under the shared responsibility model, which security control is the customer responsible for?

   • ASecuring the physical data center where the email servers are hosted
   • BManaging user access and authentication policies
   • CApplying network security patches to the hypervisor
   • DPatching the email server operating system
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In cloud security, what is a trust boundary?

   • AA certificate that establishes trust between two cloud services
   • BA rule that allows all traffic within a virtual network
   • CA physical barrier in the data center that separates different customers' hardware
   • DA point where the level of trust changes, such as between a public-facing web tier and an internal database tier
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security engineer is reviewing a cloud environment where a single VPC contains a web application, a CI/CD pipeline, and a set of development VMs. The engineer wants to reduce the risk of a compromised development VM being used to pivot to the production web application. Which change is most effective?

   • AMove the development VMs and CI/CD pipeline to a separate VPC or subnets with restrictive network ACLs
   • BDisable outbound internet access for the web application
   • CApply a host-based firewall to the production web server only
   • DPlace the development VMs in the same subnet as the web application to monitor traffic more easily
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which cloud networking component acts as a logical boundary that contains resources like virtual machines and subnets, and is typically isolated from other such components unless explicitly connected?

   • ANetwork security group (NSG)
   • BVPN gateway
   • CVirtual network (VNet)
   • DLoad balancer
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does a cloud architecture with many publicly accessible services affect the organization's attack surface?

   • AIt increases the attack surface because more entry points are exposed to potential attackers
   • BIt reduces the attack surface because the cloud provider manages security
   • CIt has no effect on the attack surface because the cloud is inherently secure
   • DIt only affects the attack surface if the services are misconfigured
   Reveal Solution Discussion Select an answer first