CCSE Cloud Security Architecture & Design 5

Question 1

Which cloud architecture pattern is MOST effective for protecting against cloud account takeover through compromised administrative credentials?

Accepted Answer

Privileged Access Workstations (PAW) combined with MFA and just-in-time access

Answer

PAWs with MFA and just-in-time access significantly reduce the attack window and ensure administrative access requires multiple strong controls.

Question 2

In cloud security architecture, what is 'blast radius reduction'?

Accepted Answer

Limiting the scope of damage a single security failure can cause

Answer

Blast radius reduction involves isolating components, applying least privilege, and segmenting networks so that a single failure cannot cascade across the system.

Question 3

Which secure design principle BEST addresses the risk of supply chain attacks targeting cloud-deployed container images?

Accepted Answer

Use only signed, verified images from trusted private registries with vulnerability scanning

Answer

Signed images from private, scanned registries ensure that only verified, untampered software is deployed into production environments.

Question 4

A security architect is reviewing a cloud design where developers have direct production access. Which control BEST mitigates this risk without disrupting velocity?

Accepted Answer

Implement CI/CD pipelines with automated security gates and no direct production access

Answer

CI/CD pipelines with automated security testing enforce consistent checks while removing the need for developers to have direct production access.

Question 5

Which cloud architecture approach BEST ensures that a ransomware attack encrypting primary storage cannot destroy backup data?

Accepted Answer

Maintain immutable, versioned backups in a separate account with write-once-read-many (WORM) policies

Answer

Immutable WORM backups in an isolated account cannot be encrypted or deleted by ransomware even if primary account credentials are compromised.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Security Architecture & Design 5