Learn the key principles of securing cloud network infrastructure for the CCSK certification exam. Discover best practices for implementing cloud firewalls and network security policies.
Table of Contents
Question
What is true of security as it relates to cloud network infrastructure?
A. You should apply cloud firewalls on a per-network basis.
B. You should deploy your cloud firewalls identical to the existing firewalls.
C. You should always open traffic between workloads in the same virtual subnet for better visibility.
D. You should implement a default allow with cloud firewalls and then restrict as necessary.
E. You should implement a default deny with cloud firewalls.
Answer
E. You should implement a default deny with cloud firewalls.
Explanation
When securing cloud network infrastructure, it is crucial to follow the principle of least privilege. This means implementing a default deny policy with cloud firewalls, where all traffic is blocked by default, and only necessary traffic is explicitly allowed based on specific security requirements.
A default deny approach ensures that only authorized and intended network communications are permitted, reducing the attack surface and minimizing the risk of unauthorized access or data breaches. It prevents unintended exposure of resources and helps maintain a secure network environment.
Options A, B, C, and D are not recommended practices for cloud network security:
- Applying firewalls on a per-network basis (A) may lead to inconsistencies and potential security gaps.
- Deploying cloud firewalls identical to existing firewalls (B) may not account for the unique characteristics and requirements of the cloud environment.
- Opening traffic between workloads in the same virtual subnet (C) can increase the attack surface and make it harder to detect and contain security incidents.
- Implementing a default allow policy (D) goes against the principle of least privilege and can expose the network to unnecessary risks.
Therefore, implementing a default deny policy with cloud firewalls (E) is the most secure approach for protecting cloud network infrastructure.
CSA Certificate of Cloud Security Knowledge CCSK certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the CSA Certificate of Cloud Security Knowledge CCSK exam and earn CSA Certificate of Cloud Security Knowledge CCSK certification.