Unit 3: Secure Cloud Network Architecture, Resiliency and Vulnerability Management - Practice Quiz

1 In cloud computing, what does IaaS stand for?

2 Which cloud deployment model is used exclusively by a single organization?

3 Under the cloud shared responsibility model, who is typically responsible for securing the physical data center?

4 What is the core principle of Zero Trust Architecture?

5 Which of the following is a common example of an embedded system?

6 In Zero Trust, what access principle grants users only the permissions they need?

7 What is the primary purpose of an asset inventory in security?

8 What term describes retiring and securely disposing of hardware at end of life?

9 What does high availability aim to minimize?

10 Which RAID level provides data redundancy through mirroring?

11 A backup power source that keeps systems running during an outage is called a:

12 Which of the following is a physical security control?

13 What is the main purpose of a mantrap (access control vestibule)?

14 What is the best general practice to fix known operating system vulnerabilities?

15 A vulnerability unknown to the vendor and without a patch is called a:

16 Which attack injects malicious SQL commands into an application's input fields?

17 In cloud environments, what is a common cause of accidental data exposure?

18 What tool automatically scans systems to detect known vulnerabilities?

19 Which activity simulates a real attack to find exploitable weaknesses?

20 Which scoring system rates the severity of vulnerabilities on a scale from to ?

21 A company deploys its application servers across multiple Availability Zones within a single cloud region. What is the primary benefit of this design choice?

22 Under the shared responsibility model for Infrastructure as a Service (IaaS), which task remains the customer's responsibility?

23 In a Zero Trust Architecture, a user who successfully authenticated an hour ago now requests access to a sensitive database. What does Zero Trust require before granting this access?

24 Embedded systems in industrial controllers often run for years without updates. Which characteristic makes securing them particularly challenging?

25 A security team discovers servers running production workloads that are not listed in the official inventory. What are these assets best described as?

26 Why is maintaining an accurate asset inventory considered a foundational control for vulnerability management?

27 A system is configured in a RAID 1 array. What protection does this configuration primarily provide?

28 An organization wants a disaster recovery site that can take over operations within minutes of a primary site failure. Which site type best meets this requirement?

29 A data center uses a mantrap at its entrance. What security objective does this control primarily address?

30 Which physical security control is classified as a detective control rather than a preventive one?

31 A legacy workstation runs an operating system that no longer receives security updates. What is the most significant risk this creates?

32 A server was configured with default administrator credentials that were never changed. Which vulnerability category does this best represent?

33 A web application concatenates user input directly into a database query string. Which vulnerability is most likely present?

34 A cloud storage bucket is accidentally set to allow public read access. What is the primary consequence of this misconfiguration?

35 In a cloud environment, an attacker exploits overly permissive IAM policies to escalate from a low-privilege account to administrator rights. This attack is best described as:

36 A security tester performs a credentialed scan instead of a non-credentialed scan. What advantage does this provide?

37 During a vulnerability scan, a tool reports a critical flaw that, upon manual verification, does not actually exist on the system. This result is called a:

38 An organization wants to find vulnerabilities by having ethical hackers actively attempt to exploit its systems under defined rules. Which method is this?

39 A vulnerability has a CVSS base score of 9.8. According to standard severity ratings, how should it be classified?

40 A critical vulnerability exists on a production system, but no patch is yet available from the vendor. Which action is the most appropriate compensating control?

41 An organization runs a multi-tenant SaaS platform on a public cloud using a shared responsibility model. A tenant's data was exposed because an object storage bucket was left publicly readable. Under the shared responsibility model for IaaS/PaaS, who bears responsibility, and why?

42 A Zero Trust Architecture (ZTA) deployment uses a Policy Decision Point (PDP) and Policy Enforcement Point (PEP). During an outage, the PDP becomes unreachable. Which design choice best preserves Zero Trust principles while maintaining availability?

43 A system has two independent components each with reliability . What is the overall reliability if they are configured in a parallel (redundant) arrangement?

44 An enterprise discovers unmanaged IoT devices on its network during an audit. Which combination of asset management practices most directly prevents recurrence of such 'shadow' assets?

45 A vulnerability has a CVSS base score of 9.8 but exists only on an internal host with no network path from untrusted zones and no sensitive data. Which prioritization approach best reflects risk-based vulnerability management?

46 A web application allows users to supply a URL that the server fetches to retrieve a profile image. An attacker supplies http://169.254.169.254/latest/meta-data/. What vulnerability class is this, and what is the primary risk?

47 A patch for a kernel-level privilege escalation flaw is available, but applying it requires a reboot that disrupts a 24/7 service. Which mitigation most reduces risk while deferring the reboot, assuming compatible tooling exists?

48 A security team must assess a legacy application with no source code access, running in production, where crashing the service is unacceptable. Which identification method is most appropriate?

49 A data center uses mantraps, badge readers, and biometric scanners. An auditor notes that tailgating still occurs. Which control most directly addresses tailgating as a residual risk?

50 An architecture requires an availability of at least . A single data center provides availability. If two independent data centers are deployed in active-active parallel, what is the approximate combined availability?

51 A company migrates workloads to a cloud using Infrastructure as Code (IaC). A reviewer finds that a security group rule allowing 0.0.0.0/0 on port 22 was committed. What practice most effectively prevents such misconfigurations from reaching production?

52 Embedded medical devices on a hospital network cannot run modern authentication agents required for full Zero Trust microsegmentation. Which approach best extends Zero Trust principles to these constrained devices?

53 A containerized microservice runs as root and mounts the host Docker socket for convenience. An attacker achieves remote code execution inside the container. What is the most severe realistic consequence?

54 A critical vulnerability cannot be patched for 90 days due to vendor dependency. The organization must document this decision. Which risk treatment and artifact combination is most appropriate?

55 A fleet of OS images is built from a golden image. A zero-day affecting a preinstalled library is announced. Which remediation strategy most efficiently eliminates the vulnerability across the fleet while preventing reintroduction?

56 A scanner reports a service as vulnerable to CVE-X, but manual testing shows the exploit fails because a backported fix was applied without changing the version banner. How should this finding be classified and handled?

57 An organization wants vulnerability remediation to be prioritized by business impact, not just technical severity. Which asset management enrichment most directly enables this?

58 A high-security facility must protect against both unauthorized access and environmental threats to equipment. Which pairing correctly matches a threat to its most appropriate physical control?

59 A cloud deployment uses a single NAT gateway in one availability zone for all outbound traffic from private subnets across three zones. From a resiliency standpoint, what is the primary weakness?

60 A serverless function has an over-permissive IAM role granting s3:* on all buckets, though it only needs to read one bucket. If the function is compromised via a dependency vulnerability, what principle was violated and what is the main consequence?