CloudSec-Pro Practice Questions 1 — 50 Questions

Question 1

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks

Question 2

What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?

Accepted Answer

To minimize the attack surface by limiting permissions. Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.

Answer

To automate the revocation of keys

Answer

To reduce the number of IAM users

Answer

To increase the complexity of password requirements

Question 3

Which of the following is a benefit of using 'Identity and Access Management' (IAM) groups?

Accepted Answer

To simplify permission management for multiple users. IAM groups allow for the efficient management of permissions for a collection of users with similar job functions.

Answer

To encrypt user passwords

Answer

To provide physical access to the cloud

Answer

To prevent unauthorized login attempts

Question 4

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

Accepted Answer

Database user access control. While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.

Answer

Physical datacenter security

Answer

Host operating system hardening

Answer

Database software patching

Question 5

When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?

Accepted Answer

The templates may include hardcoded secrets or misconfigurations. Publicly shared IaC templates often contain hardcoded credentials or overly permissive security group rules that can lead to immediate compromise.

Answer

Public templates are automatically deleted

Answer

The templates will not compile

Answer

The templates will incur higher costs

Question 6

Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)

Accepted Answer

Identity and Access Management. Governance, Identity, and Detection form the foundation of a robust strategy.

Answer

Relying solely on external audits

Answer

Ignoring container-based workloads

Question 7

You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?

Accepted Answer

Provider responsibility for physical infrastructure. Hardware maintenance, such as physical server upkeep and datacenter security, falls under Microsoft's responsibility in the IaaS model.

Answer

Shared responsibility for data encryption

Answer

Customer responsibility for OS patching

Answer

Customer responsibility for identity management

Question 8

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 9

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 10

Which TWO of the following are common risks associated with misconfigured cloud storage buckets? (Choose two)

Accepted Answer

Regulatory compliance violations. Data breaches and compliance violations are the most significant risks.

Answer

Hardware failure

Answer

Decreased storage performance

Answer

Increased cloud latency

Question 11

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the provider manages almost everything except the user's data and access.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 12

When configuring a Runtime Policy for serverless, which of the following is a capability that you can enforce?

Accepted Answer

Block unauthorized network connections from the function.. Serverless runtime policies focus on function behavior like file access and network requests.

Answer

Rotate the AWS Lambda access keys.

Answer

Enforce Multi-Factor Authentication for the function.

Answer

Limit the CPU usage of the function execution.

Question 13

Which of the following is a core characteristic of cloud-native security?

Accepted Answer

Integrating security into the CI/CD pipeline. Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.

Answer

Relying on manual configuration audits

Answer

Using only on-premises security appliances

Answer

Focusing exclusively on perimeter security

Question 14

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 15

Which TWO of the following are primary security benefits of using cloud-native security tools? (Choose two)

Accepted Answer

Automated security policy enforcement. Automation and unified visibility are key benefits of cloud-native tools.

Answer

Total elimination of all security threats

Answer

Reduction of provider cost

Answer

Manual approval for every single API call

Question 16

Which THREE of the following are pillars of a Zero Trust approach? (Choose three)

Accepted Answer

Use least privilege access. Zero Trust is based on verify explicitly, least privilege access, and assuming breach.

Answer

Trust all internal network traffic

Answer

Deploy only physical perimeter firewalls

Question 17

Which THREE components are involved in the Prisma Cloud serverless security workflow?

Accepted Answer

Serverless wrapper library. The console, the wrapper/layer, and the intelligence feed work together.

Answer

Local developer IDE plugin

Answer

Edge load balancer

Question 18

Which of the following is a primary goal of using Data Loss Prevention (DLP) tools within a cloud-native security platform?

Accepted Answer

To identify and prevent accidental exposure of sensitive information. DLP tools are designed to identify, monitor, and protect sensitive data in motion and at rest to prevent unauthorized exposure.

Answer

To automate network routing

Answer

To increase application performance

Answer

To patch operating system vulnerabilities

Question 19

Which cloud security concept allows for the rapid restoration of services after a security incident?

Accepted Answer

Infrastructure as Code. Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.

Answer

Manual provisioning

Answer

Security through obscurity

Answer

Local backup storage

Question 20

Which THREE of the following are required to maintain a secure cloud-native environment? (Choose three)

Accepted Answer

Automated security guardrails. Visibility, automation, and identity governance are key components.

Answer

Physical access to the server room

Answer

Manual firewall rule entry