A financial services company operates a customer analytics platform in AWS. During an internal audit, the security team discovers that a storage bucket containing customer transaction reports was accidentally configured for public access. The cloud provider confirms that the underlying storage service was functioning correctly, encryption hardware was operational, and no infrastructure vulnerability was involved. The application team argues that the cloud provider should have prevented the exposure because the data was stored on provider-managed infrastructure. Under the cloud shared responsibility model, who is primarily responsible for the incident? *

A healthcare organisation plans to migrate 150 applications to Azure and GCP within six months. Business leaders want teams to begin provisioning resources immediately to meet the deadline. However, there is no approved landing-zone architecture, identity model, data-classification standard, logging requirement, or process for approving public-facing services. Different development teams are already proposing their own naming conventions, network structures, and security controls. What should the organisation do FIRST? *

An online retailer deploys its application servers and primary database in one cloud availability zone. The application is backed up daily to storage in the same zone. Management believes the environment is resilient because the cloud provider operates multiple data centres in the region. During a major availability-zone failure, the application and its backups become temporarily inaccessible, causing several hours of downtime. Which architectural change would BEST improve resilience while maintaining appropriate security? *

A development team wants to deploy a sensitive payment-processing service in containers. To reduce operational work, the team proposes using a public container image, deploying it with privileged access, mounting the host file system, and allowing the container to communicate with every internal service. The team argues that containers are isolated by the cloud provider’s hypervisor and therefore present minimal security risk. Which response is MOST accurate? *

A company is designing a three-tier web application consisting of an internet-facing load balancer, application servers, and a database. The initial design places all components in one public subnet and assigns public IP addresses to every server. Administrators plan to restrict access using host-based firewalls. Security reviewers are concerned that a compromise of one application server could expose the database directly to the internet. Which design BEST addresses the risk? *

A multinational organisation operates separate cloud environments for production, development, security tooling, and shared services. Each environment connects directly to every other environment using individual peering connections. As the number of environments grows, routing becomes difficult to manage, traffic inspection is inconsistent, and administrators frequently add overlapping routes. Which architecture would BEST improve scalability and centralise security control? *

A security team identifies repeated malicious traffic from a known external IP address. The organisation wants to block the source before the traffic reaches application instances. The environment currently uses stateful security groups attached to instances and stateless network ACLs applied at subnet boundaries. Administrators also want to ensure that legitimate return traffic is not accidentally blocked. Which approach is MOST appropriate? *

An organisation hosts 200 microservices in a Kubernetes and virtual-machine environment. The services currently share a large private network, and most workloads can communicate with each other on any port. During a penetration test, the tester compromises a low-risk reporting service and uses it to connect directly to payment and identity systems. Which control would BEST reduce the likelihood of this type of lateral movement? *

A cloud administrator requires permission to create virtual machines, configure networks, and review logs. The administrator is also permanently assigned permissions to disable logging, modify security policies, delete backups, change billing settings, and create new administrators. The account is protected by a password and MFA. Management considers the account secure because MFA is enabled. What is the MOST important improvement? *

A consulting company gives temporary cloud access to contractors working on several projects. Contractors frequently change projects, locations, departments, and contract status. Administrators manually create different roles for each contractor and often forget to revoke access after a contract ends. The organisation wants access decisions to reflect user attributes and wants high-risk administrative actions to require temporary approval. Which combination BEST satisfies these requirements? *

A company connects its on-premises data centre to AWS using Direct Connect. A VPN connection is configured as a backup path. Security monitoring shows that, during a Direct Connect outage, traffic automatically switches to the VPN. However, the VPN uses outdated encryption settings, permits broad network access, and is not included in the central logging platform. What should the organisation do? *

A hybrid organisation uses internal DNS zones for private applications and public DNS zones for customer-facing services. A development team configures its workloads to use an unapproved external DNS resolver because it responds faster. The security team later discovers that DNS requests containing internal hostnames and encoded application data are leaving the cloud environment. Which control would BEST address the issue? *

An e-commerce company experiences a large increase in HTTP requests during a product launch. Some traffic is legitimate, but a significant portion includes SQL injection attempts, automated login attacks, and high-volume requests from distributed sources. The company wants to maintain availability while blocking malicious application-layer requests. Which solution provides the BEST layered protection? *

A cloud workload is allowed to establish outbound connections to any internet address on any port. After the workload is compromised, an attacker downloads additional tools, communicates with a command-and-control server, and transfers sensitive files to external storage. The organisation’s inbound firewall rules were restrictive, but outbound traffic was not monitored. Which security improvement would MOST effectively reduce this risk? *

A company operates internal APIs that transfer customer records between cloud services. Developers use HTTPS, but certificate validation is disabled in several applications because certificate errors previously caused outages. Some services accept TLS 1.0, certificates are manually copied between servers, and private keys are stored in shared folders. Which action BEST improves encryption-in-transit security? *

A payment company must protect cryptographic keys used to sign high-value transactions. Regulatory requirements state that private signing keys must be non-exportable and generated within validated cryptographic hardware. The application team currently stores the private keys in encrypted configuration files on virtual machines. Which solution BEST meets the requirement? *

A newly deployed cloud virtual machine is created from a general-purpose operating-system image. It contains unused services, default local accounts, outdated packages, open management ports, and an agent that runs with excessive privileges. The development team plans to expose the server to the internet for testing and harden it later. What should happen BEFORE the workload is exposed? *

A Kubernetes cluster permits developers to deploy any container image. During a security review, an engineer deploys an image containing critical vulnerabilities, runs it as root, mounts a sensitive host directory, and creates a service that can communicate with every namespace. Which control set would BEST prevent similar deployments? *

A cloud incident-response team investigates suspicious activity on an application server. The team has operating-system logs, but network flow logs were never enabled, DNS logs are stored for only one day, load-balancer logs are kept in a separate account, and cloud control-plane logs are not integrated with the SIEM. Investigators cannot determine how the attacker entered the environment or what systems were contacted. Which architecture would BEST improve future investigations? *

During an overnight monitoring period, one workload performs sequential connection attempts against internal ports, sends ICMP requests across an adjacent subnet, queries a newly registered domain, generates long encoded DNS subdomains, transfers an unusually large amount of outbound data, and then connects to internal servers over SSH for the first time. Which detection approach would BEST represent the likely attack progression while minimising false positives? *

A security operations centre receives alerts from AWS GuardDuty, Microsoft Defender for Cloud, firewall logs, identity logs, and endpoint detection tools. Analysts treat each alert as an isolated event. An attacker uses stolen credentials, creates a new access key, disables a logging control, scans internal resources, and transfers data to an external destination. No individual alert is considered critical enough to trigger an incident. What should the SOC implement? *

A company creates an automated response workflow that immediately terminates any virtual machine generating suspicious outbound traffic. During testing, the workflow terminates a critical financial-processing server because of a legitimate but unusually large data transfer. The organisation wants rapid containment without causing unnecessary business disruption. Which improvement is MOST appropriate? *

An attacker compromises a cloud application server. The incident-response team wants to stop further communication, but investigators must also preserve evidence. One administrator proposes shutting down and deleting the virtual machine immediately. Another proposes leaving it connected to the production network until the investigation is complete. What is the BEST response? *

Following a cloud breach, investigators export control-plane logs, network flow logs, DNS records, and disk snapshots. The files are copied to a shared folder where multiple administrators can modify or delete them. No cryptographic hashes are calculated, timestamps are not documented, and investigators do not record who collected each item. Which action is MOST important for preserving evidential value? *

An organisation must comply with ISO 27001, NIST-based internal requirements, CIS benchmarks, and sector-specific regulations. Each audit team currently maintains a separate spreadsheet containing similar but differently worded controls. Technical teams repeatedly provide the same evidence to different auditors, creating significant audit fatigue. What is the BEST governance improvement? *

A board receives a monthly cloud security report showing the total number of firewall rules, alerts, virtual machines, and user accounts. The report does not identify control failures, risk severity, affected business services, remediation owners, overdue actions, or trends. Executives cannot determine whether cloud risk is improving. Which reporting approach would be MOST useful? *

A development team uses Terraform to deploy cloud networks. A proposed change creates a security group allowing inbound SSH from 0.0.0.0/0, disables flow logging, and deploys a database in a public subnet. The changes pass syntax validation and are scheduled for automatic production deployment. What control would BEST prevent the insecure deployment? *

An organisation deploys cloud resources through approved Infrastructure as Code templates. Several months later, an administrator manually changes a firewall rule in the cloud console to allow public database access. Because the change was not made in the template repository, the security team does not notice it during code review. Which capability would BEST detect and correct this issue? *

A multinational organisation operates applications across AWS, Azure, GCP, remote offices, and software-as-a-service platforms. Users connect from corporate devices, personal devices, and third-party networks. The organisation currently trusts traffic based mainly on whether it originates from an internal IP address. Attackers who compromise a VPN account can access numerous internal services. Which architecture BEST addresses this weakness? *

A company operates hundreds of cloud accounts and subscriptions across multiple providers. Security teams use separate tools for vulnerability scanning, configuration assessment, workload protection, container security, entitlement analysis, and compliance reporting. Findings are duplicated, ownership is unclear, and teams struggle to understand which risks could combine into exploitable attack paths. Which approach would BEST improve visibility and risk prioritisation? *