CSS Cloud Security & Infrastructure Protection 2

Question 1

What is the recommended approach for managing privileged access in cloud environments?

Accepted Answer

Implementing just-in-time (JIT) access with least privilege principles

Answer

Using shared administrator accounts to improve operational efficiency

Answer

Storing privileged credentials directly in application environment variables

Answer

Granting all administrators full access to simplify permissions management

Question 2

What security vulnerability is MOST associated with serverless (Function as a Service) architectures?

Accepted Answer

Event-data injection attacks via malicious data passed through function triggers

Answer

Complete loss of network connectivity due to ephemeral compute nodes

Answer

Unauthorized physical access to the servers running the functions

Answer

Inability to apply encryption to data processed by serverless functions

Question 3

Which control best addresses the risk of a cloud provider outage disrupting business operations?

Accepted Answer

Implementing multi-cloud or hybrid cloud redundancy strategies

Answer

Reducing the total number of cloud services the organization uses

Answer

Storing all disaster recovery backups on the same cloud provider

Answer

Disabling automatic updates in the cloud environment to prevent change-related outages

Question 4

What is Infrastructure as Code (IaC) security scanning?

Accepted Answer

Analyzing IaC templates such as Terraform or CloudFormation for misconfigurations before deployment

Answer

Reviewing the physical configurations of cloud data center servers for vulnerabilities

Answer

Scanning cloud network traffic for malicious executable code

Answer

Encrypting all infrastructure configuration files stored in version control

Question 5

Which encryption protocol version is considered best practice for protecting data in transit within cloud environments?

Accepted Answer

TLS 1.2 or higher for all cloud communications

Answer

SSL 3.0 for maximum compatibility with legacy systems

Answer

MD5-based HMAC for lightweight authentication of cloud API calls

Answer

Symmetric AES-128 with a shared key distributed to all service accounts

Question 6

What is a primary security advantage of immutable infrastructure in cloud environments?

Accepted Answer

It eliminates configuration drift and reduces the attack surface of long-running systems

Answer

It prevents all network-based attacks by blocking inbound connections

Answer

It automatically encrypts all data stored on cloud volumes

Answer

It enforces MFA for all users accessing cloud resources

Question 7

What is the key security benefit of cloud-native security tools compared to third-party alternatives?

Accepted Answer

They offer deeper integration with provider APIs and native telemetry for broader visibility

Answer

They are always less expensive than equivalent third-party solutions

Answer

They require zero configuration or tuning by security teams after deployment

Answer

They completely replace the need for identity and access management controls