SkillTestPro | CCNP Security 300-740 SSCA Practice Test 2

CCNP Security 300-740 SSCA Practice Test 2 (Hard) - Cloud Provider Security Requirements - AWS, Azure, and GCP

CISCO CCNP Security Exam Logo

1 / 10

Which model describes the division of security responsibilities between a cloud provider (such as AWS, Azure, or GCP) and the customer using that provider's services?

The Shared Responsibility Model

The Service Level Agreement Penalty Model, which addresses uptime credits rather than security responsibility division

The Single Point of Failure Model, which describes infrastructure resilience rather than responsibility division

The Total Cost of Ownership Model, which addresses cost rather than security responsibility division

The Zero Trust Maturity Model, which describes adoption stages rather than provider/customer responsibility division

The MITRE ATT&CK Cloud Matrix, which catalogs adversary techniques rather than responsibility division

2 / 10

Under the Shared Responsibility Model for an IaaS offering, which security responsibility typically remains with the customer rather than the cloud provider?

Maintaining the physical power and cooling infrastructure of the data center

Maintaining the physical network cabling between data center racks

Ensuring the availability of the provider's core global backbone network

Configuring identity and access management, network security groups, and securing the guest operating system and data within their deployed virtual machines

Patching the underlying hypervisor software that hosts customer virtual machines, regardless of the platform version in use, based on standard platform behavior

Physically securing the data center facility housing the provider's hardware

3 / 10

Which native AWS construct would an architect use to enforce fine-grained permissions for a specific user or role accessing cloud resources?

AWS Elastic Beanstalk, which provides application deployment rather than access permissions

AWS Snowball, which provides physical data transfer rather than access permissions

Amazon Route 53, which provides DNS resolution rather than access permissions

Amazon CloudFront, which provides content delivery rather than access permissions

AWS Direct Connect, which provides dedicated network connectivity rather than access permissions

AWS Identity and Access Management (IAM) policies

4 / 10

Which Azure native construct provides a centralized way to enforce organizational compliance and governance rules across subscriptions, such as requiring encryption on storage accounts?

Azure Content Delivery Network, which provides content delivery rather than governance enforcement

Azure Policy

Azure Traffic Manager, which provides DNS-based traffic routing rather than governance enforcement

Azure App Service, which provides application hosting rather than governance enforcement

Azure ExpressRoute, which provides dedicated network connectivity rather than governance enforcement

Azure Data Box, which provides physical data transfer rather than governance enforcement

5 / 10

Which GCP native construct provides organization-wide guardrails that restrict which cloud resource configurations (such as public IP assignment) are allowed within a project hierarchy?

Transfer Appliance, which provides physical data transfer rather than configuration guardrails

App Engine, which provides application hosting rather than configuration guardrails

Cloud CDN, which provides content delivery rather than configuration guardrails

Cloud DNS, which provides DNS resolution rather than configuration guardrails

Organization Policy Service

Cloud Interconnect, which provides dedicated network connectivity rather than configuration guardrails

6 / 10

Which activity is an example of assessing cloud security posture and compliance across AWS, Azure, and GCP resources?

Relying exclusively on the cloud provider's marketing materials to determine compliance status

Disabling all configuration logging to reduce storage costs across cloud accounts

Assuming all default cloud resource configurations are automatically secure with no review needed, though this is not generally recommended, regardless of the platform version in use

Continuously evaluating resource configurations against a defined baseline (such as CIS Benchmarks) to identify misconfigurations like publicly exposed storage buckets

Physically inspecting the cloud provider's data center hardware racks in person

Manually reviewing printed configuration reports mailed once per year with no automated tooling

7 / 10

Which consumption model characteristic distinguishes IaaS from SaaS in terms of the customer's operational security responsibilities?

SaaS customers must patch the underlying operating system themselves while IaaS providers handle patching entirely

Neither IaaS nor SaaS customers have any responsibility for identity and access management under any circumstance

SaaS customers must manage the underlying physical hardware while IaaS customers manage only application-level settings, reversing the actual distinction, in accordance with common design practices

IaaS customers have no security responsibilities at all, with everything managed by the provider

IaaS customers manage more of the stack (OS, middleware, application) themselves, while SaaS customers primarily manage data and user access within a fully provider-managed application

IaaS and SaaS customers have identical operational security responsibilities with no distinction of any kind

8 / 10

Which visibility and monitoring practice would help an organization detect a misconfigured storage resource that has been made publicly accessible across a multi-cloud AWS, Azure, and GCP environment?

Waiting for a customer complaint before ever checking storage resource configurations

Assuming multi-cloud environments cannot have any misconfigurations by design

Relying exclusively on each cloud provider's default configuration with no independent verification, which does not align with best practices, under typical configuration conditions

Disabling cross-account or cross-subscription visibility to simplify the monitoring dashboard

Manually checking each storage resource's configuration once per year via a printed checklist

Deploying a cloud security posture management (CSPM) tool that continuously scans resource configurations across all three providers and alerts on public exposure

9 / 10

Which factor would most influence how an organization designs authentication and access control for workloads spanning AWS, Azure, and GCP simultaneously?

The number of parking spaces available at the organization's headquarters

The font used in the organization's internal newsletter

The color scheme configured for each cloud provider's web console

The specific brand of coffee served in the cloud operations team's office, in accordance with common design practices, in a properly maintained environment

The average outdoor temperature at the organization's headquarters

The need for consistent identity federation and policy enforcement across each provider's native IAM constructs despite their differing implementations

10 / 10

Which combination of practices would provide strong, consistent security posture and compliance across an organization using AWS, Azure, and GCP together?

Ignoring each provider's native governance constructs entirely and relying only on generic, non-provider-specific settings

Applying the Shared Responsibility Model correctly for each provider, using each provider's native governance constructs (IAM policies, Azure Policy, Organization Policy Service), and continuously monitoring posture with a cross-cloud CSPM tool

Relying exclusively on manual, ad hoc reviews with no automated compliance tooling of any kind

Disabling posture monitoring for any provider that has fewer resources deployed, regardless of the sensitivity of those resources

Assuming a single security configuration applied once will remain correct indefinitely across all three providers with no ongoing monitoring, in accordance with common design practices, which is not the standard approach, in most deployment scenarios

Treating all three providers as having identical security responsibility boundaries with no need to verify each one individually

Your score is

The average score is 0%