75 of 110 questions · Page 1/2 · Clp Security topic · Answers revealed
Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?
NACLs are stateless and require rules for both directions.
Why this answer
Network ACLs (NACLs) are stateless; security groups are stateful.
A cloud administrator needs to audit all API calls made in a GCP project for compliance purposes. Which service should be enabled to log these actions?
Cloud Audit Logs track API calls in GCP.
Why this answer
Cloud Audit Logs in GCP record administrative activities and data access. CloudTrail is AWS-specific, Azure Monitor is for Azure, and Security Command Center is a security dashboard.
An organization is subject to PCI DSS compliance and must demonstrate that it is meeting security requirements. Which cloud service can aggregate compliance findings and provide a dashboard?
Security Hub provides a centralized view of security alerts and compliance status.
Why this answer
AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.
A company uses Google Cloud Platform and wants to enforce that all Compute Engine instances use a specific Customer-Managed Encryption Key (CMEK) for disk encryption. Which GCP service should be used to enforce this policy?
Organization policies can enforce that only CMEK-protected disks are allowed.
Why this answer
Organization Policies (formerly known as 'Constraints') allow administrators to define and enforce guardrails for Google Cloud resources at the hierarchy level. The specific constraint `compute.requireCsekEncryption` (or the newer CMEK-based equivalent) can be applied to a folder or project to mandate that all Compute Engine disks use a Customer-Managed Encryption Key, rejecting any instance creation or disk attachment that does not comply.
Exam trap
The trap here is that candidates often confuse the key management service (Cloud KMS) with the policy enforcement service (Organization Policies), assuming that the service that creates keys also enforces their usage.
How to eliminate wrong answers
Option A is wrong because IAM Conditions control access to resources based on attributes like time or resource tags, but they cannot enforce encryption key requirements on Compute Engine instances. Option C is wrong because Cloud Security Command Center is a security and risk dashboard that provides visibility and threat detection, not a policy enforcement mechanism for resource configuration. Option D is wrong because Cloud Key Management Service is the service that creates, manages, and stores encryption keys, but it does not enforce policies that require their use on Compute Engine disks.
A cloud security analyst is reviewing a compliance report and sees that the organization needs to ensure encryption keys are rotated periodically. Which of the following would best satisfy this requirement?
Customer-managed keys allow custom rotation schedules.
Why this answer
Customer-managed keys (CMK) allow the customer to set rotation policies. AWS managed keys are automatically rotated but the customer cannot control the schedule. Storing keys in the application code violates security best practices.
Disabling rotation does not meet the requirement.
A cloud engineer is configuring a web application that must comply with PCI DSS. The application runs on virtual machines in a public cloud. Which of the following security responsibilities falls under the customer's scope according to the shared responsibility model?
The customer is responsible for guest OS patching.
Why this answer
In the shared responsibility model, the customer is responsible for patching the guest OS, while the cloud provider manages the physical infrastructure and hypervisor.
Which of the following is a best practice for managing secrets in cloud applications?
Secrets managers provide encrypted storage and rotation capabilities.
Why this answer
Secrets should be stored in a dedicated secrets manager and rotated regularly, never hard-coded.
An organization uses AWS and wants to control inbound traffic to its EC2 instances. They need a solution that automatically allows response traffic for any permitted inbound request. Which of the following should they use?
Security groups are stateful and automatically allow return traffic.
Why this answer
Security groups are stateful, meaning if you allow inbound traffic, the response is automatically allowed regardless of outbound rules. Network ACLs are stateless and require explicit rules for both directions.
A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?
Distributes traffic and integrates with Cloud Armor.
Why this answer
Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.
A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?
A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)
WAF can block malicious HTTP requests at the application layer.
Why this answer
A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?
PSS enforces security contexts on pods.
Why this answer
Pod Security Standards (PSS) define security levels (privileged, baseline, restricted) to enforce security policies on pods, such as disallowing root access and restricting host filesystem access.
A cloud architect is designing a security group for a web server in AWS. The server must receive HTTPS traffic from the internet. What is the most secure inbound rule?
This allows all inbound HTTPS traffic, which is standard for public web servers.
Why this answer
Security groups are stateful; specifying source IP range 0.0.0.0/0 for HTTPS is typical for public web servers.
A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?
SAML is widely used for SSO federation.
Why this answer
SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Azure AD. OAuth is for authorization, not authentication.
LDAP is a directory protocol. Kerberos is for on-premises.
A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?
Shield Standard is included automatically and protects against common DDoS attacks.
Why this answer
AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.
A security engineer is reviewing IAM policies and notices a policy that allows all actions on all resources for a user. Which principle of security is being violated?
A policy with full access violates least privilege by granting excessive permissions.
Why this answer
The principle of least privilege states that users should be granted only the permissions necessary to perform their job functions.
A cloud architect is designing identity and access management (IAM) for a multi-cloud environment. The architect wants to enforce least privilege and support federation with an on-premises Active Directory. Which TWO of the following should be implemented? (Select TWO).
Service accounts provide dedicated identities with minimal permissions for apps.
Why this answer
Federation with SAML allows SSO from on-prem AD, and service accounts provide non-human identities for applications, both supporting least privilege by granting only necessary permissions.
A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?
Anomaly detection services analyze logs for unusual patterns.
Why this answer
Anomaly detection tools like GuardDuty or Azure Sentinel use machine learning to identify unusual API activity.
During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?
Scanning identifies vulnerabilities early in the pipeline.
Why this answer
Regular container image scanning in the CI/CD pipeline detects vulnerabilities before deployment.
A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?
Correctly describes the division of security responsibilities.
Why this answer
The shared responsibility model delineates security obligations between the cloud provider (physical infrastructure, hypervisor) and the customer (OS, applications, IAM).
A company has deployed a containerized application on a Kubernetes cluster. The security team wants to ensure that containers cannot run as the root user and that the container's root filesystem is read-only. Which Kubernetes security mechanism should be used?
PSS includes the restricted profile that enforces these requirements.
Why this answer
Pod Security Standards (PSS) provide predefined security profiles (privileged, baseline, restricted) that enforce policies like running as non-root and read-only root filesystem.
A security administrator is deploying a web application firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from a specific geographic region that is not part of the target customer base. Which WAF feature would best reduce the attack surface without impacting legitimate users?
Geo-blocking blocks or allows traffic based on geographic location.
Why this answer
Geo-blocking allows the administrator to block traffic from specific regions, reducing the attack surface by eliminating traffic from non-target areas.
A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?
Security Hub centralizes security findings and compliance checks.
Why this answer
AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, including automated checks against standards like PCI DSS.
An organization is subject to PCI DSS compliance and must ensure that all data transmitted between its cloud application and users is encrypted. Which encryption method should be enforced?
TLS 1.2+ provides secure encryption in transit and is required by PCI DSS.
Why this answer
TLS (Transport Layer Security) is the standard protocol for encrypting data in transit over networks, such as between a web browser and a server. PCI DSS requires strong encryption for cardholder data in transit.
A cloud customer needs to ensure that data stored in an S3 bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?
SSE-C allows the customer to provide their own encryption keys, which AWS uses and then discards.
Why this answer
SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the customer to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key as part of the PUT request, and AWS uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.
Exam trap
Cisco often tests the distinction between server-side and client-side encryption, where candidates mistakenly choose client-side encryption because they think 'managing keys' means encrypting on the client, but the question explicitly requires encryption at rest in S3, which is server-side.
How to eliminate wrong answers
Option A (SSE-S3) is wrong because AWS manages the encryption keys entirely, not the customer. Option C (SSE-KMS) is wrong because while it allows customer control over key policies and rotation, the keys themselves are managed by AWS KMS, not directly by the customer. Option D (Client-side encryption) is wrong because the customer encrypts data before sending it to S3, meaning encryption happens on the client side, not at rest on the server, and the customer manages the keys entirely, but this does not meet the 'encrypted at rest in S3' requirement as the encryption is performed client-side.
An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?
Secrets Manager stores secrets and supports automatic rotation.
Why this answer
AWS Secrets Manager manages secrets lifecycle, including automatic rotation.
A cloud architect is designing network security for a VPC. The architect needs to implement both stateful and stateless firewalls. Which TWO of the following correctly describe these firewall types?
Correct characteristic of security groups.
Why this answer
Security groups are stateful (allow outbound automatically if inbound allowed), while NACLs are stateless (explicit rules needed for both directions).
A cloud administrator notices that an AWS IAM user has more permissions than necessary. Which principle should be applied to correct this?
Least privilege ensures users have minimal necessary permissions.
Why this answer
Least privilege means granting only the permissions required to perform a job function.
A cloud architect is designing a secrets management solution for a microservices application. The solution must avoid hardcoding secrets in code and support automatic rotation. Which THREE of the following are best practices? (Select THREE.)
Centralized vault for secrets.
Why this answer
Best practices include using a dedicated vault, injecting secrets at runtime, and enabling rotation. Storing secrets in environment variables is not recommended. Using IAM roles avoids storing credentials.
A cloud administrator is configuring network ACLs (NACLs) for a VPC subnet. The subnet hosts a web server that must accept HTTP (port 80) and HTTPS (port 443) from the internet, and the server needs to respond to clients. Which TWO rules are required?
Allows return traffic on ephemeral ports.
Why this answer
NACLs are stateless, so both inbound and outbound rules must be explicitly allowed. Inbound allows HTTP/HTTPS, outbound allows ephemeral ports for return traffic.
A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?
Pod Security Standards enforce security context constraints.
Why this answer
Pod Security Standards (or Pod Security Policies) define security contexts and can restrict container capabilities.
A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?
A condition like 'aws:MultiFactorAuthPresent' can enforce MFA.
Why this answer
Option B is correct because a condition in an IAM policy can require the `aws:MultiFactorAuthPresent` key to be `true`, which enforces MFA for all API calls made to the cloud management console. This is the standard AWS mechanism to mandate MFA at the IAM policy level, ensuring that users must authenticate with a second factor before accessing the console.
Exam trap
Cisco often tests the misconception that a password policy can enforce MFA, but password policies only control password attributes, not the second authentication factor required by MFA.
How to eliminate wrong answers
Option A is wrong because an IAM role is used to delegate permissions to entities (like EC2 instances or federated users) and does not inherently enforce MFA; it can be assumed without MFA unless a condition is added. Option C is wrong because a resource-based policy (e.g., an S3 bucket policy) controls access to specific resources, not the cloud management console itself, and cannot enforce MFA for console login. Option D is wrong because a password policy only governs password complexity and rotation rules, not multi-factor authentication; MFA enforcement requires a separate IAM policy condition.
A company's cloud environment uses Azure Active Directory for identity management. They want to allow employees to sign in using their existing on-premises Active Directory credentials without synchronizing passwords to the cloud. Which federation protocol should they use?
SAML 2.0 is commonly used for federated identity with Azure AD, enabling single sign-on without password sync.
Why this answer
Federation allows identity federation without password synchronization. AD FS can be configured to use SAML 2.0 or OIDC to authenticate against on-premises AD and issue tokens to access cloud resources.
A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?
Security groups are stateful and can restrict inbound SSH to the specific IP range.
A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?
This is the principle of least privilege.
Why this answer
Least privilege means granting only the permissions required to perform a job function, minimizing potential damage from compromised accounts.
A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?
The customer decides how to classify and encrypt data.
Why this answer
Option C is correct because in a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.
Exam trap
Cisco often tests the misconception that the customer manages the runtime environment in PaaS, but the trap here is that PaaS abstracts the runtime, so the provider handles it, while the customer's responsibilities are limited to data, application code, and access control.
A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)
Runtime security detects threats during container execution.
Why this answer
Image scanning detects vulnerabilities in container images, and runtime security monitors containers for anomalous behavior. Network ACLs are not container-specific. Using the latest base image reduces vulnerabilities.
Disabling security controls is wrong.
A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)
WAF can maintain state for session tracking.
Why this answer
Security groups are stateful, automatically allowing return traffic. WAF can be stateful in some implementations (e.g., tracking sessions). Network ACLs are stateless.
DDoS protection is not stateful in this context. Route tables are stateless.
A company stores sensitive customer data in an S3 bucket and must encrypt the data at rest using a key managed by the company (not AWS). Which encryption option should the company use?
SSE-C uses customer-provided keys; the customer manages the keys outside of AWS.
Why this answer
SSE-C allows customers to provide their own encryption keys; AWS performs encryption/decryption but does not store the keys.
A company is implementing a secrets management solution. The security team wants to ensure that secrets are protected and rotated regularly. Which THREE of the following are best practices for secrets management?
Auditing helps identify and respond to potential breaches.
Why this answer
Best practices include using a dedicated vault, rotating secrets, avoiding hard-coded secrets, and auditing access.
A company uses AWS and needs to enforce that all S3 buckets are encrypted at rest with customer-managed keys stored in AWS KMS. Which IAM policy condition would ensure this?
This condition allows requiring a specific KMS key ARN for encryption.
Why this answer
The 'aws:RequestTag' condition (or similar) can enforce that resources are created with specific tags, but to enforce encryption key usage, the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' is used.
An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?
Encryption at rest secures data stored on persistent media.
Why this answer
Encryption at rest protects data stored on disk, typically using AES-256.
A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?
The customer manages the guest OS and must apply patches.
Why this answer
In IaaS, the customer is responsible for securing the operating system, applications, and data, including patching the guest OS.
A company running a critical web application on AWS wants to protect against SQL injection and cross-site scripting attacks. The application is behind an Application Load Balancer. Which service should be deployed to provide this protection?
WAF provides rule-based filtering for OWASP Top 10 threats.
Why this answer
AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting (XSS). It integrates directly with Application Load Balancers (ALB) to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.
Exam trap
The trap here is that candidates often confuse AWS WAF with AWS Shield Advanced, thinking Shield provides application-layer attack protection, but Shield focuses on DDoS mitigation while WAF handles web-specific exploits like SQL injection and XSS.
How to eliminate wrong answers
Option A is wrong because AWS Network Firewall is a stateful managed firewall for VPC network traffic, operating at layers 3-4 and 7 for network protocols, but it does not provide application-layer inspection for SQL injection or XSS payloads in HTTP requests. Option B is wrong because AWS Shield Advanced provides DDoS protection against volumetric and state-exhaustion attacks, not against application-layer threats like SQL injection or XSS. Option C is wrong because AWS GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events for malicious activity, but it does not actively block or filter web application attacks like SQL injection or XSS.
A company uses a SaaS application for customer relationship management (CRM). The security team wants to monitor user activities and enforce data loss prevention (DLP) policies. Which type of security tool should be deployed?
CASB is designed for SaaS security and governance.
Why this answer
A Cloud Access Security Broker (CASB) provides visibility into SaaS usage, monitors user activities, and can enforce DLP policies across cloud applications.
A company is implementing multi-factor authentication (MFA) for cloud console access. Which TWO of the following are valid MFA methods? (Select TWO.)
Combines something you know (password) with something you have (token).
Why this answer
A hardware TOTP token generates a time-based one-time password (RFC 6238) that changes every 30 or 60 seconds, providing a second factor independent of the user's password. Combining this with a password satisfies the MFA requirement of using two different authentication factors (something you know and something you have).
Exam trap
Cisco often tests the distinction between multi-step authentication (e.g., password then security question) and true multi-factor authentication, where candidates mistakenly believe any two sequential credentials count as MFA.
A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)
PCI DSS mandates encryption of cardholder data.
Why this answer
PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.
A security analyst is reviewing logs and finds that an unauthorized user accessed a storage blob in Azure. The analyst needs to determine which permissions allowed the access. Which Azure feature provides a detailed view of effective permissions for a user?
RBAC provides tools like 'Check access' to view effective permissions.
Why this answer
Azure RBAC (Role-Based Access Control) provides the 'Check access' feature (formerly 'Effective permissions') that allows an administrator to evaluate the cumulative permissions assigned to a specific user, group, or service principal for a given scope (e.g., storage blob container). This feature calculates the net effect of all role assignments, including inherited permissions from management groups, subscriptions, and resource groups, enabling the analyst to pinpoint exactly which role granted the unauthorized access.
Exam trap
The trap here is that candidates often confuse Azure RBAC's 'effective permissions' feature with Azure AD PIM, assuming PIM shows current permissions, when in fact PIM only manages role activation and does not compute the cumulative effective permissions across multiple role assignments.
How to eliminate wrong answers
Option A is wrong because Azure AD Privileged Identity Management (PIM) manages just-in-time activation and oversight of privileged roles, but it does not provide a detailed view of effective permissions for a specific user on a resource. Option C is wrong because Azure Blueprints is used for defining and deploying repeatable sets of Azure resources and policies (like compliance templates), not for evaluating effective user permissions. Option D is wrong because Azure Policy enforces rules and effects (e.g., deny, audit) on resource configurations, but it does not evaluate or display the effective RBAC permissions assigned to a user.
A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?
Secrets Manager manages secrets and supports automatic rotation.
Why this answer
AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys.
IAM roles are for AWS service permissions.
An organization uses multiple SaaS applications and wants to enforce data loss prevention policies and gain visibility into user activity. Which technology should they implement?
CASBs provide visibility and control over SaaS applications.
A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?
CASB sits between users and SaaS to monitor and enforce policies.
Why this answer
A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.
A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)
Runtime security detects suspicious container behavior.
Why this answer
A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.
Exam trap
Cisco often tests the misconception that ConfigMaps are a secure place for secrets, but ConfigMaps lack encryption and access control features, making them unsuitable for sensitive data.
A security team discovers that a container image used in production contains a known vulnerability in one of its base image layers. Which action should be taken to remediate this issue?
Rebuilding with a patched base image resolves the vulnerability at the image level.
Why this answer
The vulnerability is in the base image, so rebuilding the image using an updated base image that includes the security fix is the correct remediation. Additionally, scanning images in a CI/CD pipeline can catch vulnerabilities before deployment.
A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?
Vault provides secure, audited access to secrets and integrates well with Kubernetes.
Why this answer
Storing secrets in a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager is recommended. Kubernetes Secrets should be avoided if possible, and secrets should never be hardcoded or stored in environment variables directly.
A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?
Security groups can reference other security groups as sources, providing fine-grained control.
Why this answer
Option A is correct because it uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier.
This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.
Exam trap
Cisco often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates may choose network ACLs (Option D) thinking they provide similar control, without realizing that security groups support logical references to other security groups, which is essential for dynamic tier-to-tier access in a three-tier architecture.
How to eliminate wrong answers
Option B is wrong because assigning the same security group to all tiers with a single inbound rule would allow all tiers to communicate with each other without restriction, violating the principle of least privilege and potentially exposing the database tier to the web tier or the internet. Option C is wrong because placing all tiers in the same subnet and using a network ACL to permit all traffic eliminates subnet-level segmentation, allowing any instance in the subnet to reach any other instance, and network ACLs are stateless, requiring explicit return rules, which adds complexity and risk. Option D is wrong because while network ACLs can provide subnet-level filtering, they are stateless and do not support security group references as sources; they require manual IP address management and cannot dynamically reference the web tier's security group, making them less precise and harder to maintain for tier-to-tier access control.
A cloud security analyst is investigating a potential container security incident. The analyst notices that a container is sending outbound traffic to a known malicious IP address. The container was deployed from an image that passed a vulnerability scan. Which TWO of the following should the analyst implement to detect and prevent such behavior in the future? (Select TWO).
Runtime security detects behavioral anomalies such as unexpected outbound connections.
Why this answer
Runtime security tools monitor container behavior for anomalies like outbound connections to malicious IPs, and scanning base image layers helps catch vulnerabilities that might allow such behavior.
A cloud engineer is deploying a new application and needs to securely store database credentials. The credentials must be automatically rotated every 90 days. Which service should be used?
Secrets Manager supports automatic rotation of secrets.
Why this answer
AWS Secrets Manager allows secure storage and automatic rotation of secrets such as database credentials, with configurable rotation intervals.
A cloud administrator is implementing network security for a VPC. The administrator needs to create a stateless firewall that filters traffic based on source and destination IP, port, and protocol. Which TWO of the following are characteristics of this type of firewall? (Select TWO.)
Stateless firewalls like NACLs evaluate rules in order.
Why this answer
Network ACLs are stateless, meaning they do not track connection state and require explicit rules for both inbound and outbound traffic. They evaluate rules in order by rule number.
A company needs to meet PCI DSS compliance requirements for storing credit card data in the cloud. Which compliance certification should they verify their cloud provider has?
PCI DSS Level 1 is required for entities handling large volumes of cardholder data.
Why this answer
PCI DSS Level 1 is the highest level for handling cardholder data.
A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?
Stateless means each direction must be explicitly allowed.
Why this answer
Option D is correct because network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.
Exam trap
The trap here is confusing stateful security groups with stateless network ACLs, leading candidates to incorrectly think security groups can deny specific IPs or that network ACLs are evaluated first, when in fact security groups are evaluated at the instance level before network ACLs at the subnet boundary.
A security team is implementing encryption for a cloud-based database. The compliance requirements mandate that encryption keys be managed by the customer and rotated every 90 days. Which THREE of the following should the team use? (Select THREE).
Customer-managed keys give the customer control over key rotation.
A cloud architect is designing a multi-tier application. The application tier needs to access a database, but the database should not be reachable from the internet. Which network security control should be used?
Private subnets have no internet gateway, and security groups can restrict access to only the application tier.
Why this answer
Placing the database in a private subnet with no direct internet route ensures it is not reachable from the internet. Security groups can then allow inbound traffic only from the application tier's security group.
An organization wants to ensure that only authenticated users from their corporate Active Directory can access cloud resources. Which federation protocol is most commonly used for this purpose?
SAML enables browser-based SSO with corporate IdPs.
Why this answer
SAML is widely used for federation between corporate identity providers (e.g., Active Directory) and cloud services.
In the shared responsibility model, which of the following is the cloud customer responsible for?
Customers manage guest OS patching.
Why this answer
The shared responsibility model states that customers are responsible for OS patching, application code, IAM, data encryption, and network security groups.
A company is deploying a cloud-native application that uses containers orchestrated by Kubernetes. The security team wants to enforce the principle of least privilege at the Kubernetes level. Which THREE measures should be implemented? (Choose three.)
Pod Security Standards enforce security contexts that limit pod capabilities.
Why this answer
Pod Security Standards (PSS) define security contexts for pods, with the 'restricted' policy enforcing the principle of least privilege by disallowing privileged containers, host network access, and other high-risk capabilities. This directly prevents pods from running with unnecessary permissions, aligning with the security team's goal at the pod level.
Exam trap
Cisco often tests the distinction between network-level controls (network policies) and identity/privilege controls (RBAC, Pod Security Standards), leading candidates to mistakenly select network policies as a least-privilege measure when they only restrict traffic, not permissions.
An organization's compliance policy requires that all access to cloud resources be logged and that logs be immutable. Which service should be used to meet these requirements?
CloudTrail records API calls and can store logs immutably.
Why this answer
AWS CloudTrail is the correct service because it records all API calls made to AWS resources, providing a detailed audit log of who made the request, from which IP address, and when. CloudTrail logs can be stored in an S3 bucket with S3 Object Lock enabled, which enforces a write-once-read-many (WORM) model to make logs immutable, meeting the compliance requirement for both logging and immutability.
Exam trap
Cisco often tests the distinction between logging API calls (CloudTrail) and monitoring resource configurations (Config) or operational logs (CloudWatch Logs), leading candidates to confuse CloudWatch Logs as the logging service without considering immutability requirements.
How to eliminate wrong answers
Option A is wrong because AWS CloudWatch Logs is a monitoring service for collecting log data from various sources, but it does not natively provide immutability features; logs can be deleted or overwritten without additional configuration. Option C is wrong because AWS Trusted Advisor is an advisory tool that inspects your AWS environment for best practices in cost, performance, security, and fault tolerance, but it does not log API calls or provide immutable logs. Option D is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, but it does not capture API activity logs or offer immutability; it records configuration changes, not access logs.
A security administrator needs to store database credentials and API keys securely in AWS. The credentials must be automatically rotated every 90 days. Which service should the administrator use?
Secrets Manager stores secrets and supports automatic rotation.
Why this answer
AWS Secrets Manager is designed to store secrets and provides built-in rotation capabilities.
A security administrator is configuring a Web Application Firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from certain geographic regions that are not serving customers. Which WAF feature should be used to block this traffic?
Geo-blocking restricts traffic by country or region.
Why this answer
Geo-blocking allows the WAF to block or allow traffic based on geographic location, reducing unwanted traffic and potential attacks.
A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?
Role assignment at subscription scope applies to all resources in that subscription.
Why this answer
RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).
A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?
IAM policies define permissions for AWS resources.
Why this answer
IAM policies are JSON documents that define permissions for AWS resources like S3 buckets.
A company uses Azure and wants to enforce multi-factor authentication (MFA) for all administrative users. The solution must be centrally managed and apply to all Azure subscriptions. Which approach should be used?
Conditional Access policies can enforce MFA tenant-wide.
Why this answer
Option A is correct because Conditional Access policies in Azure AD are centrally managed and can enforce MFA for all cloud apps across all Azure subscriptions by targeting the 'Microsoft Azure Management' cloud app. This approach applies to all administrative users regardless of subscription, as Azure AD is the identity provider for Azure resources.
Exam trap
The trap here is confusing Azure Policy (resource compliance) with Azure AD Conditional Access (identity security), leading candidates to select Option D, even though Azure Policy cannot enforce authentication requirements.
How to eliminate wrong answers
Option B is wrong because MFA cannot be configured on individual Azure subscriptions; MFA is an Azure AD feature, not a subscription-level setting. Option C is wrong because assigning MFA per user is not centrally managed and does not scale to apply to all subscriptions automatically; it also lacks the granularity of Conditional Access policies. Option D is wrong because Azure Policy is used for resource compliance (e.g., tagging, encryption) and cannot enforce MFA, which is an identity-level control managed by Azure AD.
A company uses Google Cloud Platform (GCP) and wants to enforce that all service accounts used by applications have only the permissions necessary to perform their tasks. Which IAM concept should the administrator apply?
Least privilege is the principle of granting minimal necessary permissions.
Why this answer
The principle of least privilege dictates granting only the required permissions. In GCP, this is achieved by assigning predefined roles that are narrowly scoped to specific services, and by using conditions to further restrict access.
A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?
Security groups are stateful instance-level firewalls that can allow HTTP/HTTPS inbound traffic.
Why this answer
Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.
A security administrator is configuring a web application firewall (WAF) to protect against SQL injection attacks. Which WAF feature should be enabled?
OWASP rules include SQL injection detection/prevention.
Why this answer
OWASP rules include protections against SQL injection, XSS, and other common web vulnerabilities.
An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?
Vault is cloud-agnostic and supports multiple backends.
Why this answer
HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.
Ready to test yourself?
Try a timed practice session using only Clp Security questions.