CloudSec-Pro Practice Test 10 — 10 Questions

Question 1

A startup deploys a serverless API using Azure Functions and stores secrets in Azure Key Vault. The CTO asks which security tasks remain with the startup under the Azure shared responsibility model. Which task is the startup's responsibility?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Managing identity and access policies for the function app and its access to Key Vault. Serverless shifts infrastructure management to Microsoft, but identity, access, and data protection remain with the customer. The startup must configure managed identities and Key Vault access policies so the function retrieves secrets under least privilege. That is a customer-controlled task and the correct answer for what remains the startup's responsibility in this deployment.

Answer

Patching the host operating system that runs the Functions runtime

Answer

Patching the Azure Functions runtime and its language workers

Answer

Securing the physical datacenter where the function app is hosted

Question 2

A multinational corporation uses a multi-cloud strategy with workloads on AWS, Azure, and Google Cloud. The security architect is mapping security responsibilities across providers. The architect notes that each provider has a different shared responsibility model. Which of the following is the most significant challenge when applying the shared responsibility model in a multi-cloud environment?

Accepted Answer

Each provider uses different terminology and service boundaries, making it difficult to consistently map controls. In multi-cloud environments, the primary challenge is that each provider defines its shared responsibility model differently, using unique terminology and service boundaries. This makes it difficult to create a consistent security control mapping. The other options are incorrect because they misrepresent the shared responsibility model as being eliminated, automatically synchronized, or limited to single-cloud. The shared responsibility model always applies, but its implementation varies.

Answer

Providers in a multi-cloud setup automatically synchronize their security controls, so the customer has no responsibility

Answer

Multi-cloud environments eliminate the need for a shared responsibility model because the customer is always responsible for everything

Answer

The shared responsibility model is only applicable to single-cloud deployments and does not extend to multi-cloud

Question 3

A security engineer is deploying an application on a Kubernetes cluster. The application is containerised and managed by a Deployment resource. The engineer wants to ensure that the container's root filesystem is read-only at runtime to prevent tampering. Which Kubernetes security context setting should be configured in the Pod specification to achieve this?

Accepted Answer

Set `securityContext.readOnlyRootFilesystem` to true in the container's security context.. The correct setting is `securityContext.readOnlyRootFilesystem: true` because it directly mounts the container's root filesystem as read-only, preventing any write operations. This is a native Kubernetes feature that enhances workload protection by making the container's filesystem immutable at runtime. Other security context settings control different aspects such as privilege escalation or user identity, but none achieve filesystem read-only status.

Answer

Set `securityContext.allowPrivilegeEscalation` to false in the container's security context.

Answer

Set `securityContext.runAsUser` to a non-root user in the container's security context.

Answer

Set `securityContext.privileged` to false in the container's security context.

Question 4

A security architect is designing a multi-cloud strategy and needs to understand how the shared responsibility model differs between IaaS and PaaS. Which statement accurately reflects the division of responsibilities?

Accepted Answer

In PaaS, the provider manages the runtime and middleware, while the customer manages the application and data.. The shared responsibility model varies by service model. In PaaS, the provider manages the platform, including the OS, runtime, and middleware, while the customer secures the application and data. In IaaS, the customer manages the guest OS and above, while the provider secures the virtualization layer and physical infrastructure. This distinction is vital for multi-cloud security planning.

Answer

In IaaS, the provider manages the virtualization layer and the guest OS, while the customer manages the application.

Answer

In IaaS, the provider manages the application and data, while in PaaS the customer does.

Answer

In PaaS, the customer is responsible for patching the guest operating system, while in IaaS the provider does it.

Question 5

A CloudSec-Pro incident responder is investigating a suspected data exfiltration from an AWS S3 bucket. The bucket has server access logging enabled and AWS CloudTrail data events enabled. Which two log sources should be correlated to determine the identity and the specific objects accessed? (Choose two.)

Accepted Answer

AWS CloudTrail data events for S3, which record the identity and the API call made to the bucket.. Correlating S3 server access logs with CloudTrail data events provides both the object-level access details and the authenticated identity. Server access logs show the object key and requester, while CloudTrail data events map the request to an IAM principal and API call. Management events, VPC Flow Logs, and AWS Config do not capture object-level reads with identity context.

Answer

AWS Config configuration history for the S3 bucket, which records changes to bucket properties over time.

Answer

AWS CloudTrail management events, which record bucket-level configuration changes such as policy updates.

Answer

Amazon VPC Flow Logs for the subnet containing the S3 endpoint, which record IP-level traffic metadata.

Question 6

A healthcare provider runs workloads on Google Kubernetes Engine (GKE) Standard. A compliance reviewer asks the security team to identify which controls the provider must implement rather than relying on Google. Which control is the provider's responsibility?

Accepted Answer

Configuring Kubernetes RBAC, network policies, and pod security settings for the workloads. With GKE Standard, Google secures the control plane, node OS images, and physical infrastructure, while the customer secures what runs inside the cluster. Kubernetes RBAC, network policies, and pod security settings are customer-managed controls that protect the healthcare workloads. Assigning those to the provider reflects the correct division of responsibility for this managed Kubernetes service.

Answer

Securing the physical hosts and the GKE control plane components managed by Google

Answer

Patching the GKE control plane and the etcd datastore

Answer

Maintaining the Container-Optimized OS images used by the node pools

Question 7

A company is using a cloud provider's function-as-a-service (FaaS) offering. The security team must identify which security tasks are the customer's responsibility under the shared responsibility model. (Choose two.)

Accepted Answer

Configuring the function's IAM role and permissions. In a FaaS environment, the provider manages the infrastructure, including the host OS, container runtime, and physical security. The customer is responsible for the function's code, its dependencies, and the IAM role that defines its permissions. Securing the code prevents vulnerabilities, while proper IAM configuration enforces least privilege and limits unauthorized access.

Answer

Managing the physical security of the data center hosting the function

Answer

Patching the operating system of the host that runs the function

Answer

Managing the underlying container runtime and orchestration

Question 8

A company is using a hybrid cloud model with on-premises and AWS resources. The security team is clarifying responsibilities under the shared responsibility model. Which TWO of the following are always the customer's responsibility, regardless of the service model? (Choose two.)

Accepted Answer

Managing identity and access for users and applications. Data classification and protection, along with identity and access management, are always customer responsibilities in the shared responsibility model, regardless of the service model. The customer owns the data and must control access to it. The other tasks—hypervisor patching, physical security, and network fabric management—are provider responsibilities in the cloud. Even in a hybrid model, these remain with AWS for cloud resources.

Answer

Maintaining the physical security of the cloud data centers

Answer

Configuring the underlying network fabric between Availability Zones

Answer

Patching the hypervisor that runs the virtual machines

Question 9

A CloudSec-Pro auditor is evaluating a cloud service provider's data protection controls. The auditor needs to verify that the provider implements appropriate measures for data remanence and secure disposal in a multi-tenant environment. Which TWO of the following are essential controls to validate? (Choose two.)

Accepted Answer

Logical separation of tenant data with access controls that prevent cross-tenant data leakage.. Cryptographic erasure and logical separation are essential controls for data remanence and secure disposal in multi-tenant cloud environments. Cryptographic erasure ensures data is unrecoverable by destroying keys, while logical separation prevents cross-tenant data leakage. Physical destruction and transit encryption do not directly address these concerns.

Answer

Physical destruction of all storage media upon tenant offboarding, with certificates of destruction.

Answer

Encryption of data in transit using TLS 1.2 or higher for all tenant communications.

Answer

Regular third-party audits of the provider's data center physical security.

Question 10

A CloudSec-Pro security engineer is investigating a potential data exfiltration incident in an AWS environment. The engineer suspects that an IAM role was used to copy sensitive data from an S3 bucket to an external account. Which AWS service should the engineer use to identify the API calls made by that IAM role and the source IP addresses?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that logs all API activity in an AWS account, including the identity, timestamp, source IP, and request details. To investigate which API calls an IAM role made and from which IP addresses, the engineer should analyze CloudTrail logs. GuardDuty provides threat findings but not raw API logs. AWS Config tracks resource configurations, and Macie focuses on sensitive data discovery, not API auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Macie