CCSE Cloud Security Architecture & Design 2

Question 1

Which cloud security architecture pattern uses a dedicated virtual network with no internet gateway to isolate sensitive workloads?

Accepted Answer

Air-gapped VPC

Answer

An air-gapped VPC has no internet gateway, ensuring complete network isolation for highly sensitive workloads.

Question 2

In a multi-cloud security architecture, what is the primary purpose of a Cloud Access Security Broker (CASB)?

Accepted Answer

Provide visibility and control over cloud service usage

Answer

A CASB sits between users and cloud services to provide visibility, compliance enforcement, and threat protection across cloud usage.

Question 3

Which security design principle ensures that a compromised cloud component cannot access resources beyond its specific function?

Accepted Answer

Least privilege

Answer

Least privilege limits each component's access to only what is required for its specific function, containing blast radius.

Question 4

A company needs to enforce consistent security policies across 50 AWS accounts. Which architecture approach is MOST efficient?

Accepted Answer

Use AWS Organizations with Service Control Policies

Answer

AWS Organizations with Service Control Policies (SCPs) enforces guardrails across all member accounts centrally.

Question 5

What is the security advantage of using immutable infrastructure in cloud environments?

Accepted Answer

Eliminates the risk of configuration drift and persistent attacks

Answer

Immutable infrastructure replaces rather than patches components, eliminating configuration drift and removing any persistent attacker footholds.

(CCSE) Certified Cloud Security Engineer Practice Test