Free CompTIA Cloud+ Cloud Security Controls Questions and Answers — Questions and Answers
Question 1: A cloud administrator is tasked with implementing a security solution to discover and control the use of unapproved SaaS applications by employees, a phenomenon known as 'Shadow IT'. The solution must provide visibility into cloud application usage, enforce data security policies, and protect against cloud-based threats. Which of the following cloud security controls is BEST suited for this purpose?
- Cloud Workload Protection Platform (CWPP)
- Security Information and Event Management (SIEM)
- Cloud Access Security Broker (CASB) (Correct answer)
- Data Loss Prevention (DLP)
Correct answer: Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) is specifically designed to address the challenges of Shadow IT. It acts as an intermediary between cloud service users and cloud applications to enforce security policies, provide visibility into usage, and protect data. CASBs can identify unauthorized cloud services, assess their risk, and apply controls to prevent data exfiltration or malware introduction.
Question 2: A security team is concerned about misconfigurations in their public cloud environment, such as publicly exposed storage buckets and overly permissive IAM policies. They need a tool that continuously scans the cloud infrastructure to identify and remediate these types of policy violations and security risks. Which security tool would be MOST effective for this requirement?
- Cloud Workload Protection Platform (CWPP)
- Cloud Security Posture Management (CSPM) (Correct answer)
- Cloud Access Security Broker (CASB)
- Intrusion Detection System (IDS)
Correct answer: Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) tools are designed to identify misconfiguration issues and compliance risks in cloud environments. They continuously monitor the cloud infrastructure against a defined set of security best practices and policies, providing automated remediation for issues like publicly accessible storage or improper IAM settings.
Question 3: An organization wants to centralize the collection and analysis of log data from various cloud resources, including virtual machines, databases, and network components. The goal is to enable real-time threat detection, security incident investigation, and compliance reporting. Which of the following security controls should be implemented?
- Network Access Control (NAC)
- Security Information and Event Management (SIEM) (Correct answer)
- Web Application Firewall (WAF)
- Cloud Workload Protection Platform (CWPP)
Correct answer: Security Information and Event Management (SIEM)
A Security Information and Event Management (SIEM) system is the most appropriate solution. SIEMs specialize in aggregating, correlating, and analyzing log and event data from a wide variety of sources across an IT environment. This centralized analysis allows security teams to detect potential threats, investigate incidents, and generate reports for compliance purposes.
Question 4: A company is developing a cloud-native application using containers and serverless functions. They need a security solution that focuses specifically on protecting these ephemeral workloads during runtime. The solution should provide vulnerability scanning, malware detection, and integrity monitoring for the workloads themselves. Which of the following is the BEST choice?
- Cloud Access Security Broker (CASB)
- Data Loss Prevention (DLP)
- Cloud Security Posture Management (CSPM)
- Cloud Workload Protection Platform (CWPP) (Correct answer)
Correct answer: Cloud Workload Protection Platform (CWPP)
A Cloud Workload Protection Platform (CWPP) is designed to secure cloud workloads, such as virtual machines, containers, and serverless functions, throughout their lifecycle. It provides runtime protection, including threat detection, vulnerability management, and integrity monitoring, specifically for the applications and services running in the cloud, which is distinct from securing the cloud infrastructure itself (the focus of CSPM).
Question 5: A financial services company needs to prevent sensitive customer data, such as credit card numbers and social security numbers, from being exfiltrated from their cloud environment via email or unauthorized file-sharing applications. They require a control that can identify and block the transmission of this specific data based on content analysis and predefined policies. Which security control directly addresses this need?
- Data Loss Prevention (DLP) (Correct answer)
- Web Application Firewall (WAF)
- Identity and Access Management (IAM)
- Security Information and Event Management (SIEM)
Correct answer: Data Loss Prevention (DLP)
Data Loss Prevention (DLP) solutions are specifically designed to detect and prevent the unauthorized transmission or leakage of sensitive data. They use techniques like pattern matching and data classification to identify sensitive information within data streams (data in motion) or storage (data at rest) and enforce policies to block or encrypt it.
Question 6: A cloud administrator is implementing security for a new virtual private cloud (VPC). To enforce the principle of least privilege, they need to define granular access rules for users and groups, specifying exactly which cloud resources they can access and what actions they can perform. Which of the following is the foundational security control for managing these permissions?
- Encryption
- Multi-Factor Authentication (MFA)
- Identity and Access Management (IAM) (Correct answer)
- Network Segmentation
Correct answer: Identity and Access Management (IAM)
Identity and Access Management (IAM) is the foundational framework that controls who (users, groups, roles) can access what (resources) and how (permissions) within a cloud environment. It is the primary tool for enforcing the principle of least privilege by creating granular policies that grant only the necessary permissions for a user or service to perform its function.
Free CompTIA Cloud+ Cloud Security Controls Questions and Answers
A cloud administrator is tasked with implementing a security solution to discover and control the use of unapproved SaaS applications by employees, a phenomenon known as 'Shadow IT'.
The solution must provide visibility into cloud application usage, enforce data security policies, and protect against cloud-based threats.
Which of the following cloud security controls is BEST suited for this purpose?