CAP Cloud Security Architecture 2

Question 1

Which cloud deployment model places infrastructure on-premises but uses cloud management tools and APIs?

Accepted Answer

Private cloud

Answer

Private cloud hosts infrastructure on-premises (or dedicated facilities) while leveraging cloud-like management tools and APIs.

Question 2

In a shared responsibility model, who is responsible for patching the hypervisor in an IaaS environment?

Accepted Answer

The cloud service provider

Answer

In IaaS, the cloud service provider owns and patches the hypervisor layer; the customer manages OS and above.

Question 3

What is the primary purpose of a Cloud Access Security Broker (CASB)?

Accepted Answer

Enforce security policies between users and cloud services

Answer

A CASB acts as an intermediary to enforce security policies, visibility, and compliance between enterprise users and cloud services.

Question 4

Which encryption key management approach gives an organization the most control over its keys in a cloud environment?

Accepted Answer

Customer-managed keys (CMK)

Answer

Customer-managed keys (CMK) allow the organization to generate, store, rotate, and revoke keys independently of the cloud provider.

Question 5

A virtual private cloud (VPC) peering connection allows two VPCs to communicate — what is a key security consideration?

Accepted Answer

Overly permissive security groups can expose resources across both VPCs

Answer

VPC peering routes traffic privately, but misconfigured security groups or NACLs can unintentionally expose resources in both VPCs.

(CAP) Certified Authorization Professional Practice Test