CCSE Cloud Security Architecture & Design 3

Question 1

Which security architecture approach treats every network request as potentially hostile, regardless of source location?

Accepted Answer

Zero trust architecture

Answer

Zero trust architecture assumes no implicit trust based on network location, requiring verification for every access request.

Question 2

A cloud security engineer is designing a system to detect misconfigured S3 buckets across 200 accounts. Which tool category is MOST appropriate?

Accepted Answer

Cloud Security Posture Management (CSPM)

Answer

CSPM tools continuously assess cloud configurations against security best practices and compliance frameworks across multiple accounts.

Question 3

What is the PRIMARY security benefit of deploying applications using containers compared to traditional VMs?

Accepted Answer

Smaller attack surface due to minimal OS dependencies

Answer

Containers package only the application and its dependencies, resulting in a smaller attack surface compared to full OS virtual machines.

Question 4

Which cloud design pattern uses multiple redundant security controls so that failure of one does not compromise overall security?

Accepted Answer

Defense in depth

Answer

Defense in depth layers multiple security controls so that bypassing one layer does not grant full system access.

Question 5

In cloud security architecture, what is the purpose of a 'security landing zone'?

Accepted Answer

A pre-configured baseline environment with security guardrails for new accounts

Answer

A security landing zone provides a standardized, pre-hardened multi-account environment with centralized logging, IAM policies, and guardrails.

(CCSE) Certified Cloud Security Engineer Practice Test