CCSE Cloud Security Architecture & Design 4

Question 1

Which cloud network architecture pattern BEST prevents east-west lateral movement between application tiers?

Accepted Answer

Micro-segmentation with security groups per workload

Answer

Micro-segmentation applies granular security group policies per workload tier, blocking lateral movement even within the same VPC.

Question 2

What is the security purpose of a Cloud Workload Protection Platform (CWPP)?

Accepted Answer

Protect workloads at runtime from threats like malware and privilege escalation

Answer

CWPP solutions provide runtime protection for cloud workloads by monitoring process behavior, detecting anomalies, and blocking threats.

Question 3

When designing a multi-region cloud architecture for compliance, which data security concern is MOST critical?

Accepted Answer

Data residency and sovereignty requirements

Answer

Data residency requirements mandate that certain data must remain within specific geographic boundaries, which must be enforced in multi-region designs.

Question 4

Which approach BEST reduces the risk of credential compromise in cloud-native applications?

Accepted Answer

Use instance/pod identity with short-lived tokens from a secrets manager

Answer

Instance or pod identity with dynamic, short-lived tokens eliminates long-lived credentials that can be stolen and reused.

Question 5

In a cloud security reference architecture, what role does a Security Operations Center (SOC) play in the 'detect' function?

Accepted Answer

Monitors alerts from SIEM and cloud-native tools to identify security incidents

Answer

The SOC analyzes telemetry from SIEM, CSPM, and cloud-native security services to detect active threats and anomalies.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Security Architecture & Design 4