37 free EC-Council 312-40 CCSE v2 practice questions from the CertStash pack of 147, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 37 free here, all 147 in the pack, and each step includes the one before it.
Get all 147 questions (US$39) · Download the first 10 as a PDF
Question 1
Lexie Roth works as a cloud security engineer in an IT company located in Boston, Massachusetts. Her organization generates a huge amount of data. To increase the storage size, speed, and fault tolerance, Lexie would like to configure and create a RAID. Therefore, she created a RAID on Windows Server 2016, which includes block-level striping with a distributed parity. The parity information is distributed among all drives, except one. The data chunks in the RAID are larger than the regular I/O size, but they can be re-sized. To prevent data loss after a drive fails, data are calculated from the distributed parity. The RAID configured by Lexie requires at least three disks, but for robust performance, Lexie used seven disks. Based on the given information, which of the following RAID was configured and created by Lexie?
Show answer and explanation
Correct answer: B. RAID 5
RAID 5 combines block-level striping with parity that is distributed across all member drives instead of being kept on one dedicated disk. It needs a minimum of three disks, and the stripe (chunk) size is configurable. If one drive fails, the missing data is rebuilt by calculating it from the surviving data blocks and the distributed parity, so the array keeps running without data loss. Adding more disks, such as the seven used here, increases usable capacity and read throughput while still tolerating the loss of a single drive.
Why the other options are wrong
- A. RAID 3 stripes at the byte level and stores all parity on one dedicated drive, so its parity is not distributed.
- C. RAID 1 mirrors identical data onto two or more drives and uses neither striping nor parity.
- D. RAID 0 stripes data across drives for speed but stores no parity, so one failed drive destroys the whole array.
Question 2
Cindy Williams has been working as a cloud security engineer in an IT company situated in Austin, Texas. Owing to the robust security and cost-effective features provided by AWS, her organization adopted AWS cloud-based services. Cindy has deployed an application in the Amazon Elastic Compute Cloud (EC2) instance.
Which of the following cloud computing service model does the Amazon EC2 instance represent?
Show answer and explanation
Correct answer: D. IaaS
Amazon EC2 provides virtual servers on rented infrastructure, which is the Infrastructure-as-a-Service (IaaS) model. AWS operates the physical hosts, networking and hypervisor, while the customer chooses the machine image and is responsible for the guest operating system, patching, middleware, the deployed application and its data. Because the customer controls everything above the virtualization layer, EC2 sits at the infrastructure level of the stack rather than at the platform or software level.
Why the other options are wrong
- A. SaaS delivers a finished application that the provider runs entirely, whereas EC2 hands the customer a server to configure and load with software.
- B. DaaS delivers hosted virtual desktops to end users, which is not what launching an EC2 instance for an application provides.
- C. PaaS supplies a managed runtime where the provider handles the operating system and the customer only deploys code, but on EC2 the customer manages the operating system.
Question 3
Billy Pratt works as a cloud security engineer in an MNC. In 2012, his organization transferred all applications and data into an AWS cloud environment. Billy would like to analyze, investigate, and identify the root cause of malicious activities in his organization’s AWS cloud environment.
Which of the following Amazon services automatically collects data from various AWS resources and utilizes machine learning, statistical analysis, and graph theory to provide a unified and interactive view of resources and users that would help Billy in determining the root cause of suspicious activities?
Show answer and explanation
Correct answer: B. Amazon Detective
Amazon Detective is built for security investigation and root cause analysis. It automatically collects log and event data from AWS resources and uses machine learning, statistical analysis and graph theory to build a linked data set that shows how users, resources and activity relate over time. Analysts can pivot from a finding to an interactive visualization and trace how a suspicious event started and what it touched, which is exactly the unified view the scenario describes.
Why the other options are wrong
- A. Amazon Inspector scans workloads such as EC2 instances and container images for software vulnerabilities and unintended network exposure, and it does not trace the cause of malicious activity.
- C. Amazon GuardDuty detects threats and raises findings, but it does not build the linked, graph-based view needed to investigate how an incident unfolded.
- D. Amazon Macie discovers and classifies sensitive data in S3, so it does not correlate user and resource activity to find root causes.
Question 4
The TCK Bank adopts cloud for storing the private data of its customers. The bank usually explains its information sharing practices to its customers and safeguards sensitive data. However, there exist some security loopholes in its information sharing practices. Therefore, hackers could steal the critical data of the bank’s customers. In this situation, under which cloud compliance framework will the bank be penalized?
Show answer and explanation
Correct answer: B. GLBA
The Gramm-Leach-Bliley Act (GLBA) covers financial institutions such as banks. Its Financial Privacy Rule requires them to explain their information sharing practices to customers, and its Safeguards Rule requires them to protect customers' nonpublic personal information. A bank that has weaknesses in how it shares and protects customer data, leading to theft of that data, falls under GLBA and can be penalized by its regulators, including the FTC for covered non-bank institutions.
Why the other options are wrong
- A. ITAR controls the export of defense articles and related technical data, so it has no bearing on a bank's customer data practices.
- C. NIST publishes voluntary frameworks and guidance, not a regulation that fines a bank for weak information sharing practices.
- D. GDPR protects personal data of individuals in the EU and is not the U.S. financial privacy law that addresses a bank's information sharing notices and safeguards.
Question 5
Gabriel Bateman has been working as a cloud security engineer in an IT company for the past 5 years. Owing to the recent onset of the COVID-19 pandemic, his organization has given the provision to work from home to all employees. Gabriel’s organization uses Microsoft Office 365 that allows all employees access files, emails, and other Office programs securely from various locations on multiple devices.
Who among the following is responsible for patch management in Microsoft Office 365?
Show answer and explanation
Correct answer: D. Microsoft is entirely responsible for patch management
Microsoft Office 365 is a Software-as-a-Service offering, so Microsoft operates the application, the underlying servers, the operating systems and the network, and it applies all patches and updates to them. The customer organization keeps responsibility for its own data, user accounts and access, and the endpoint devices employees use, but it does not patch the service itself. Patch management for the Office 365 service therefore rests entirely with Microsoft.
Why the other options are wrong
- A. Responsibility is not split for patching the service, because the customer has no access to the servers and application code that need patches.
- B. There is nothing to outsource, since the provider already patches the service and the customer cannot patch it anyway.
- C. The customer cannot patch Microsoft's hosted application or infrastructure, so it cannot carry this responsibility.
Question 6
Kelsey Lewis has been working as a cloud security engineer in a BPO company that provides 24 × 7 customer service. Owing to the cost-effective storage and security features provided by cloud computing, her organization adopted the cloud environment 4 years ago. Kelsey implemented the TLS protocol to provide security to e-mail communications, voice over IP (VoIP) communication, web traffic, messaging clients, file transfers, and internet services (Domain Name Service (DNS) and Network Time Protocol (NTP)).
Which certificate is used by TLS for communication authentication and encryption between hosts?
Show answer and explanation
Correct answer: D. X.509 certificates issued by the Certificate Authority
TLS relies on X.509 certificates, the ITU-T standard format for public key certificates. A certificate authority issues and signs each certificate, which binds a public key to an identity such as a host name. During the handshake the peers use the certificate to authenticate each other and to establish the keys that encrypt the session. This is why X.509 underpins HTTPS and the other TLS-protected services listed in the scenario.
Why the other options are wrong
- A. X.507 is not the certificate format TLS uses, since TLS certificates follow the X.509 standard.
- B. X.508 is not the certificate format TLS uses, since TLS certificates follow the X.509 standard.
- C. X.506 is not the certificate format TLS uses, since TLS certificates follow the X.509 standard.
Question 7
Tom Holland works as a cloud security engineer in an IT company located in Lansing, Michigan. His organization has adopted cloud-based services wherein user access, application, and data security are the responsibilities of the organization, and the OS, hypervisor, physical, infrastructure, and network security are the responsibilities of the cloud service provider. Based on the aforementioned cloud security shared responsibilities, which of the following cloud computing service models is enforced in Tom’s organization?
Show answer and explanation
Correct answer: D. Platform-as-a-Service
In Platform-as-a-Service the provider manages the operating system, hypervisor, physical infrastructure and network, along with the runtime and middleware. The customer is left with the applications it deploys, the data they handle and user access to them. This split matches the scenario, where the organization secures user access, application and data while the provider secures everything from the operating system down.
Why the other options are wrong
- A. In SaaS the provider also runs the application itself, so the customer would not be responsible for application security as the scenario states.
- B. On-premises means the organization secures every layer, including the physical facility and hypervisor, so no provider takes over those layers.
- C. In IaaS the customer manages the guest operating system, so the scenario's assignment of the OS to the provider does not fit.
Question 8
An organization, PARADIGM PlayStation, moved its infrastructure to a cloud as a security practice. It established an incident response team to monitor the hosted websites for security issues. While examining network access logs using SIEM, the incident response team came across some incidents that suggested that one of their websites was targeted by attackers and they successfully performed an SQL injection attack.
Subsequently, the incident response team made the website and database server offline. In which of the following steps of the incident response lifecycle, the incident team determined to make that decision?
Show answer and explanation
Correct answer: A. Containment
Containment is the incident response phase in which responders limit the spread and impact of an incident before the threat can be removed. Taking the website and its database server offline stops the attacker from continuing the SQL injection attack and from reaching more data, which is a classic containment decision. The team had already identified the attack from the SIEM logs, so the step taken here is about stopping damage, not about further investigation.
Why the other options are wrong
- B. Analysis is where the team examines logs and evidence to confirm and understand the attack, and the scenario's decision to disable the systems is a protective action, not an examination.
- C. Coordination and information sharing is the exchange of incident details with stakeholders and outside parties, and it does not itself stop an attacker.
- D. Post-mortem takes place after the incident is handled to review lessons learned, so it cannot be the stage at which systems are taken offline mid-attack.
Question 9
Global CloudEnv is a cloud service provider that provides various cloud-based services to cloud consumers. The cloud service provider adheres to the framework that can be used as a tool to systematically assess cloud implementation by providing guidance on the security controls that should be implemented by specific actors within the cloud supply chain. It is used as the standard to assess the security posture of organizations on the Security, Trust, Assurance, and Risk (STAR) registry. Based on the given information, which of the following cybersecurity control frameworks does Global CloudEnv adhere to?
Show answer and explanation
Correct answer: C. CSA CCM
The Cloud Security Alliance Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing. It can be used as a tool to systematically assess a cloud implementation, and it gives guidance on which security controls should be implemented by which actor within the cloud supply chain. The CCM is also the standard against which organizations are assessed for the CSA Security, Trust, Assurance and Risk (STAR) registry, which matches every detail in the scenario.
Why the other options are wrong
- A. CDMI is the SNIA Cloud Data Management Interface, a standard for managing and accessing cloud stored data, not a security control framework.
- B. The CAIQ is a questionnaire of yes or no questions derived from the CCM that providers answer to document their controls, so it is not the framework that assigns control responsibility.
- D. ITU-T X.1601 is a security framework for cloud computing from the ITU, but it is not the control framework used to assess organizations for the STAR registry.
Question 10
Global SoftTechSol is a multinational company that provides customized software solutions and services to various clients located in different countries. It uses a public cloud to host its applications and services. Global SoftTechSol uses Cloud Debugger to inspect the current state of a running application in real-time, find bugs, and understand the behavior of the code in production.
Identify the service provider that provides the Cloud Debugger feature to Global SoftTechSol?
Show answer and explanation
Correct answer: A. Google
Cloud Debugger was a Google Cloud feature that let developers inspect the state of a running application in production without stopping it or slowing it down. By capturing snapshots of variables and the call stack at chosen code locations, developers could find bugs and understand code behavior in real time. The service name belongs to Google Cloud, which is why the provider in the scenario is Google.
Why the other options are wrong
- B. IBM Cloud does not offer a service named Cloud Debugger, since that name belongs to Google Cloud.
- C. Azure's comparable capability is the Snapshot Debugger in Application Insights, which is a differently named service and not Cloud Debugger.
- D. AWS does not offer a service named Cloud Debugger, and its nearest tool for tracing application behavior is AWS X-Ray.
What people say about the full 312-40 pack 4.5 from 2
I was worried I’d need a some months to prepare for this exam but thanks to these dumps I was done in just a few weeks. It’s like they gave me a shortcut to success.
Question 11
Richard Branson works as a senior cloud security engineer in a multinational company. Richard wants to see the actions performed on AWS resources, the services accessed, users who made requests, and the users or services that performed an action on an AWS service.
Which of the following AWS services will provide a log of all system and user actions that affect AWS resources within Richard’s organizational AWS account?
Show answer and explanation
Correct answer: C. Amazon CloudTrail Security
AWS CloudTrail records account activity across an AWS account as events, covering actions taken through the console, the AWS CLI, SDKs and APIs, whether made by a user, a role or an AWS service. Each event identifies who made the request, which service and action were involved, the resources affected, and when and from where the request was made. That gives Richard a log of all system and user actions that affect AWS resources in the account, which supports governance, compliance, operational auditing and security investigations.
Why the other options are wrong
- A. Route 53 is a DNS and domain registration service, and it does not log the actions users and services perform on AWS resources.
- B. CloudFront is a content delivery network, and its logs describe viewer requests for content rather than actions on AWS resources in the account.
- D. CloudWatch collects metrics, logs and alarms for monitoring resource performance, and it does not record which user or service made API calls against AWS resources.
Question 12
SecureSoft Solutions Pvt. Ltd. is an IT company that develops mobile-based applications. Owing to the secure and cost-effective cloud-based services provided by Google, the organization migrated its applications and data from on-premises environment to Google cloud. Sienna Miller, a cloud security engineer, selected the Coldline Storage class for storing data in the Google cloud storage bucket.
What is the minimum storage duration for Coldline Storage?
Show answer and explanation
Correct answer: D. 90 days
The Coldline storage class in Google Cloud Storage has a minimum storage duration of 90 days. Objects deleted, replaced or moved before 90 days are still charged as though they had been stored for the full period. Coldline is intended for data read or modified about once a quarter at most, such as backups and disaster recovery data. Other classes use different minimums, so the figure must be matched to the class named in the question.
Why the other options are wrong
- A. No Cloud Storage class has a 60 day minimum storage duration.
- B. No Cloud Storage class has a 120 day minimum storage duration.
- C. 30 days is the minimum for Nearline storage, not Coldline, which requires 90 days.
Question 13
InternSoft Solution Pvt. Ltd. is an IT company located in Boston, Massachusetts. The IT and InfoSec teams of the organization use CASP to customize access rules and automate compliance policies. Using CASP solutions, they could access the account activities in the cloud, which makes it easy for them to achieve compliance, data security, and threat protection.
What is CASP?
Show answer and explanation
Correct answer: D. It is a CASB that uses APIs
A cloud access security broker sits between an organization and its cloud services to enforce security policy, and the API-based type connects directly to the cloud provider's APIs. That lets the IT and InfoSec teams see account activities, customize access rules, automate compliance policies and detect threats without routing user traffic through an inline proxy. Because it works out of band through the provider's own interfaces, it can cover activity from any device or network, which fits a team that wants to review account activity in the cloud and meet compliance and data security goals.
Why the other options are wrong
- A. A proxy-based CASB sits inline and intercepts user traffic, which is not the API-integrated model the scenario describes for reviewing account activities.
- B. A WAF filters HTTP traffic to protect web applications from attacks such as injection and cross-site scripting, and it does not manage cloud account activity or compliance.
- C. RASP is embedded inside an application to detect and block attacks at runtime, and it does not give visibility into cloud account activities or compliance policies.
Question 14
Kenneth Danziger has been working as a cloud security engineer in a multinational company. His organization uses AWS cloud-based services.
Kenneth would like to review the changes in configuration and the relationships between AWS resources, examine the detailed resource configuration history, and determine the overall compliance of his organization against the configurations specified in internal guidelines.
Which of the following AWS services enables Kenneth to assess, audit, and evaluate the configuration of AWS resources?
Show answer and explanation
Correct answer: A. AWS Config
AWS Config continuously records the configuration of supported AWS resources and the relationships between them, and keeps a configuration history so changes can be reviewed over time. It evaluates those configurations against rules, such as AWS managed rules or custom rules that encode internal guidelines, and reports whether resources are compliant. This covers each need Kenneth lists: reviewing configuration changes and relationships, examining the detailed resource configuration history, and determining overall compliance with internal guidelines.
Why the other options are wrong
- B. CloudFormation provisions resources from templates as infrastructure as code, and it does not audit configuration history or evaluate compliance against guidelines.
- C. Security Hub aggregates security findings and runs standards-based checks, but it does not record a configuration history of resources and their relationships.
- D. CloudTrail records API calls and account activity, which shows who did what, rather than recording resource configuration state or evaluating compliance.
Question 15
Trevor Noah works as a cloud security engineer in an IT company located in Seattle, Washington. Trevor has implemented a disaster recovery approach that runs a scaled-down version of a fully functional environment in the cloud. This method is most suitable for his organization’s core business-critical functions and solutions that require the RTO and RPO to be within minutes. Based on the given information, which of the following disaster recovery approach is implemented by Trevor?
Show answer and explanation
Correct answer: B. Warm Standby
Warm standby is a disaster recovery approach in which a scaled-down but fully functional copy of the production environment is always running in the cloud. Because the standby already runs and receives data, it can be scaled up to full capacity quickly, giving recovery times and recovery points measured in minutes. That makes it suitable for core business-critical functions that need RTO and RPO within minutes.
Why the other options are wrong
- A. A multi-cloud option spreads workloads across providers for resilience, and it does not describe running a scaled-down copy of the environment.
- C. Pilot light keeps only the core components, such as the data replica, with the remaining servers switched off, so recovery takes longer than the minutes required.
- D. Backup and restore keeps no running environment and rebuilds from backups, so recovery takes far longer than minutes.
Question 16
Steven Smith has been working as a cloud security engineer in an MNC for the past 4 years. His organization uses AWS cloud-based services.
Steven handles a complex application on AWS that has several resources and it is difficult for him to manage these resources.
Which of the following AWS services allows Steven to make a set of related AWS resources easily and use or provision them in an orderly manner so that he can spend less time managing resources and more time on the applications that run in the AWS environment?
Show answer and explanation
Correct answer: C. AWS CloudFormation
AWS CloudFormation lets you describe a set of related AWS resources in a template and then create and manage them together as a single unit called a stack. Resources are provisioned in an orderly, repeatable way, with dependencies handled automatically, so engineers spend less time managing individual resources and more time on the application. Updating or deleting the stack applies the change to the whole set of resources.
Why the other options are wrong
- A. AWS Control Tower sets up and governs a multi-account environment with guardrails, and it is not used to provision the resources of one application.
- B. Amazon CloudFront is a content delivery network that caches and delivers content, and it does not provision related resources.
- D. AWS Config records resource configurations and evaluates them against rules, but it does not create or provision resources.
Question 17
For securing data, an AWS customer created a key in the Alabama region to encrypt their data in the California region. Two users were added to the key along with an external AWS account.
When the AWS customer attempted to encrypt an S3 object, they observed that the key is not listed.
What is the reason behind this?
Show answer and explanation
Correct answer: B. Encryption key should be in the same region
AWS KMS keys are regional resources. A customer managed key can encrypt S3 objects only when it is in the same Region as the bucket, so a key created in one Region does not appear in the key list when the object is being encrypted in another. The customer needs to create the key in the same Region as the data to be encrypted. Cross-account access to a key is a separate matter handled through the key policy.
Why the other options are wrong
- A. Newly created KMS keys are available for use almost immediately, so the missing key is not the result of a listing delay.
- C. S3 supports server-side encryption with KMS keys, so integration with KMS is not the problem.
- D. AWS allows a key policy to grant access to external AWS accounts, so the external account is not what hides the key.
Question 18
Jayson Smith works as a cloud security engineer in CloudWorld SecCo Pvt. Ltd. This is a third-party vendor that provides connectivity and transport services between cloud service providers and cloud consumers.
Select the actor that describes CloudWorld SecCo Pvt. Ltd. based on the NIST cloud deployment reference architecture?
Show answer and explanation
Correct answer: C. Cloud Carrier
In the NIST cloud computing reference architecture, the cloud carrier is the intermediary that provides connectivity and transport of cloud services between cloud providers and cloud consumers, typically through network and telecommunication links. CloudWorld SecCo is described as a third-party vendor supplying connectivity and transport, so it is a cloud carrier. It neither delivers the cloud services itself nor assesses or brokers them.
Why the other options are wrong
- A. A cloud provider owns and delivers the cloud service itself, whereas CloudWorld SecCo only supplies connectivity between parties.
- B. A cloud auditor conducts independent assessments of security, privacy and performance and does not supply transport links.
- D. A cloud broker manages service use and mediates provider and consumer relationships, which is different from supplying network transport.
Question 19
Luke Grimes has recently joined a multinational company as a cloud security engineer. The company has been using the AWS cloud. He would like to reduce the risk of man-in-the-middle attacks in all Redshift clusters.
Which of the following parameters should Grimes enable to reduce the risk of man-in-the-middle attacks in all Redshift clusters?
Show answer and explanation
Correct answer: D. require_ssl
The require_ssl parameter in an Amazon Redshift parameter group forces clients to connect to the cluster using SSL. With it enabled, connections that do not use SSL are rejected, so data in transit is encrypted and the cluster's identity can be validated, which reduces the risk of man-in-the-middle attacks. The setting is applied to the cluster through the parameter group associated with it.
Why the other options are wrong
- A. enable_user_ssl is not a Redshift parameter group setting, so it cannot be enabled to require encrypted connections.
- B. The parameter named fips_ssl is not the setting that requires SSL, and the related use_fips_ssl option only enables FIPS-compliant SSL mode for systems that need it.
- C. wlm_ssl is not a Redshift parameter, and workload management is configured through wlm_json_configuration, which does not control SSL.
Question 20
The organization TechWorld Ltd. used cloud for its business. It operates from an EU country (Poland and Greece). Currently, the organization gathers and processes the data of only EU users. Once, the organization experienced a severe security breach, resulting in loss of critical user data. In such a case, along with its cloud service provider, the organization should be held responsible for non-compliance or breaches. Under which cloud compliance framework will the company and cloud provider be penalized?
Show answer and explanation
Correct answer: C. GDPR
The General Data Protection Regulation applies to organizations that process the personal data of people in the European Union, and it makes both the controller and the processor, which includes a cloud provider, accountable. A breach or non-compliance can bring administrative fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. TechWorld processes only EU user data from Poland and Greece, so GDPR is the framework under which it and its provider face penalties.
Why the other options are wrong
- A. NIST publishes voluntary U.S. standards and guidance, and it does not impose penalties on EU organizations processing EU user data.
- B. ITAR is a U.S. regulation on the export of defense articles and related technical data, and it does not cover personal data protection in the EU.
- D. HIPAA is a U.S. law protecting health information, and it does not govern an EU company handling EU user data.
Question 21
WinSun Computers is a software firm that adopted cloud computing. To keep the cloud environment secure, the organization must ensure that it adheres to the regulations, controls, and rules framed by its management in the cloud environment.
Which of the following represents the adherence to these regulations, controls, and rules framed by the organization in this scenario?
Show answer and explanation
Correct answer: A. Governance
Governance is the set of regulations, controls and rules framed by an organization's management to direct how it operates and to keep its cloud environment secure. It defines the policies and oversight that staff and systems must follow, and adherence to that framework is what the scenario describes. It sets the direction within which risk management and compliance activities are then carried out.
Why the other options are wrong
- B. Risk management identifies, assesses and treats risks, and it does not represent adherence to the rules and controls that management has framed.
- C. Corporate compliance means meeting legal, regulatory and contractual obligations, whereas the question describes the management-defined rules and controls that make up governance.
- D. Regulatory compliance means conforming to laws and regulations set by external authorities, not the rules and controls framed by the organization's own management.
Question 22
An Azure subscription owner, Arial Solutions, gets notified by Microsoft (by default) when a high-severity alert (email notification) is triggered. The cloud security engineer would like to send these security alerts to a specific individual or anyone with particular Azure roles for a subscription, and modify the severity levels for which alerts are sent.
How can the cloud security engineer configure these alerts?
Show answer and explanation
Correct answer: D. By setting ASC security contact
Azure Security Center, now part of Defender for Cloud, sends email notifications for high-severity alerts to subscription owners by default. Configuring the security contact settings lets an engineer direct those notifications to a specific person or to everyone holding certain Azure roles on the subscription, and choose the alert severity level at which emails are sent. This is the configuration that matches the requirement.
Why the other options are wrong
- A. Azure Front Door is a global web application delivery and acceleration service, and it has no role in routing security alert emails.
- B. Exporting alerts sends alert data to a destination such as a workspace or event hub, and it does not set who receives email notifications or at which severity.
- C. Streaming alerts to Azure Sentinel through the data connector feeds them into a SIEM for analysis, and it does not control the email recipients or severity thresholds.
Question 23
The GCP environment of a company named Magnitude IT Solutions encountered a security incident. To respond to the incident, the Google Data Incident Response Team was divided based on the different aspects of the incident.
Which member of the team has an authoritative knowledge of incidents and can be involved in different domains such as security, legal, product, and digital forensics?
Show answer and explanation
Correct answer: C. Subject Matter Experts
Google's data incident response process forms a team around each incident. The Incident Commander coordinates the response and assigns the work, but the deep knowledge of each affected area comes from Subject Matter Experts drawn from the relevant teams, such as security, legal, product engineering and digital forensics. These experts carry the authoritative knowledge of how the incident affects their own domain and are brought in as the incident requires, which is why they are the members who can be involved across those different domains.
Why the other options are wrong
- A. The Communications Lead manages updates to customers, stakeholders and the response team, and is not the source of domain expertise in security, legal, product or forensics.
- B. The Operations Lead works with the Incident Commander to carry out the response tasks, and is not the specialist holding expert knowledge across those domains.
- D. The Incident Commander coordinates the overall response and delegates work to specialists, rather than being the domain expert in security, legal, product and forensics.
Question 24
Melissa George is a cloud security engineer in an IT company. Her organization has adopted cloud-based services. The integration of cloud services has become significantly complicated to be managed by her organization. Therefore, her organization requires a third-party to consult, mediate, and facilitate the selection of a solution.
Which of the following NIST cloud deployment reference architecture actors manage cloud service usage, performance, and delivery, and maintain the relationship between the CSPs and cloud consumers?
Show answer and explanation
Correct answer: D. Cloud Broker
In the NIST cloud computing reference architecture, the cloud broker is the actor that manages the use, performance and delivery of cloud services and negotiates relationships between cloud providers and cloud consumers. A broker consults, mediates and helps consumers select a solution, which is exactly the third-party role Melissa's organization needs when integration has become too complicated to manage itself. The other NIST actors have different responsibilities: providing the service, auditing it, or carrying it over the network.
Why the other options are wrong
- A. A cloud auditor performs independent assessments of security, privacy and performance and does not mediate between providers and consumers.
- B. A cloud carrier supplies network connectivity and transport between consumers and providers and does not manage service selection or relationships.
- C. A cloud provider makes cloud services available to consumers and is one party of the relationship rather than the intermediary between parties.
Question 25
Rachel McAdams works as a cloud security engineer in an MNC. A DRaaS company has provided a disaster recovery site to her organization. The disaster recovery sites have partially redundant equipment with daily or weekly data synchronization provision; failover occurs within hours or days with minimum data loss. Based on this information, which of the following disaster recovery sites is provided by the DRaaS company to Rachel’s organization?
Show answer and explanation
Correct answer: D. Warm Site
A warm site is a recovery facility that holds partially redundant equipment and receives data from the primary site on a periodic schedule, typically daily or weekly. Because the hardware is only partly in place and the data is not fully current, failover takes hours or days and some recent data may need to be restored. This places it between a hot site, which mirrors the production environment for near-immediate failover, and a cold site, which offers little more than space and power. The partial redundancy, periodic synchronization and hours-to-days failover in the scenario match a warm site.
Why the other options are wrong
- A. A hot site is fully redundant with continuous data synchronization and fails over almost immediately, which is faster than the hours or days described.
- B. A cold site has little or no pre-installed equipment and no regular data synchronization, so recovery takes far longer than the partially prepared site described.
- C. Remote site describes where a facility is located, not a recovery tier that defines equipment readiness or synchronization frequency.
Question 26
Falcon Computers is an IT company that runs its IT infrastructure on the cloud. The organization must implement cloud governance in its corporate cloud environment to align its business vision with the cloud vision.
Which of the following cloud governance components can help the organization to align the cloud vision and business vision?
Show answer and explanation
Correct answer: A. Cloud business office
The cloud business office is the governance component that aligns the cloud vision with the business vision. It acts as the link between business stakeholders and the cloud teams, directing cloud strategy from a business perspective so that cloud adoption supports organizational goals. Without it, technical cloud decisions can drift away from what the business needs, which is the alignment problem Falcon Computers wants to solve.
Why the other options are wrong
- B. Processes for the cloud service lifecycle define how services are planned, delivered and retired, not how the cloud vision is aligned with the business vision.
- C. A cloud center of excellence builds technical expertise and promotes best practices for adoption, but it does not link the business vision to the cloud vision.
- D. Norms, reference architectures, guidelines and policies are artifacts that guide implementation, not the component that aligns the two visions.
Question 27
Curtis Morgan works as a cloud security engineer in an MNC. His organization uses Microsoft Azure for office-site backup of large files, disaster recovery, and business-critical applications that receive significant traffic, etc. Which of the following allows Curtis to establish a fast and secure private connection between multiple on-premises or shared infrastructures with Azure virtual private network?
Show answer and explanation
Correct answer: D. Express Route
Azure ExpressRoute extends on-premises networks into Azure over a private connection supplied by a connectivity provider, and the traffic does not travel over the public internet. It offers more reliability, faster speeds and lower latencies than typical internet connections, which suits large file backup, disaster recovery and busy business-critical applications. It can connect multiple on-premises or shared infrastructure locations to Azure, which is what Curtis needs. VPN options and web delivery services do not provide this private, provider-supplied circuit.
Why the other options are wrong
- A. Front Door is a global web delivery and load balancing service and does not provide private connectivity to on-premises sites.
- B. Point-to-Site VPN connects individual client computers to a virtual network over the internet and does not link whole on-premises infrastructures.
- C. Site-to-Site VPN is encrypted but travels over the public internet, so it is not the private, dedicated connection the question describes.
Question 28
A company is a third-party vendor for several organizations and provides them customized software and products to cater to their needs. It recently moved its infrastructure and applications on cloud. Its applications are not working on the cloud as expected. The developers and testers are experiencing significant difficulty in managing and deploying the code in the cloud.
Which of the following will help them with automated integration, development, testing, and deployment in the cloud?
Show answer and explanation
Correct answer: B. DevOps
DevOps combines development and operations practices with tooling such as continuous integration and continuous delivery pipelines. These pipelines automatically build, test and deploy code every time a change is committed, which removes manual handoffs and reduces deployment errors. For a vendor whose developers and testers struggle to manage and deploy code on cloud infrastructure, adopting DevOps gives a repeatable, automated path from integration through testing to deployment, and it lets security checks be built into the same pipeline.
Why the other options are wrong
- A. A dashboard only displays metrics and status information, and it has no ability to build, test or deploy code.
- C. A vulnerability assessment tool scans systems and applications for weaknesses and reports them, but it does not integrate, test or deploy code.
- D. A SIEM collects and correlates log data to detect security events, and it plays no part in building or releasing software.
Question 29
A BPO company would like to expand its business and provide 24 × 7 customer service. Therefore, the organization wants to migrate to a fully functional cloud environment that provides all features with minimum maintenance and administration.
Which cloud service model should it consider?
Show answer and explanation
Correct answer: C. SaaS
Software as a Service delivers a complete, ready-to-use application over the internet, and the provider manages the underlying infrastructure, platform, application code, updates and availability. The customer only configures and uses the application. A BPO company that wants a fully functional environment with all features and minimum maintenance and administration, so it can run 24 x 7 customer service, needs exactly this model, because nearly every layer of the stack is handled by the provider.
Why the other options are wrong
- A. IaaS provides only virtual infrastructure, leaving the customer to install, patch and administer operating systems, middleware and applications, which is the opposite of minimal maintenance.
- B. PaaS gives a platform for building and running applications, so the customer still develops and maintains its own application code and is not getting a fully functional product.
- D. RaaS is not one of the standard cloud service models, and it usually refers to recovery or ransomware as a service.
Question 30
SecureSoft IT Pvt. Ltd. is an IT company located in Charlotte, North Carolina, that develops software for the healthcare industry. The organization generates a tremendous amount of unorganized data such as video and audio files. Kurt recently joined SecureSoft IT Pvt. Ltd. as a cloud security engineer. He manages the organizational data using NoSQL databases. Based on the given information, which of the following data are being generated by Kurt’s organization?
Show answer and explanation
Correct answer: B. Unstructured Data
Unstructured data has no predefined data model or schema, so it cannot be stored neatly in rows and columns. Video and audio files are typical examples, along with images, free text and documents. Because this data is large, varied and unorganized, NoSQL databases are commonly used to store and manage it. SecureSoft IT generates a tremendous amount of unorganized video and audio content, which is exactly the kind of data this category describes.
Why the other options are wrong
- A. Metadata is data that describes other data, such as file size or creation date, and does not describe the video and audio content itself.
- C. Semi-structured data, such as JSON or XML, carries tags or markers that give it some organization, which raw video and audio files lack.
- D. Structured data follows a fixed schema of rows and columns, as in a relational table, which does not fit unorganized media files.
Question 31
Jordon Bridges has been working as a senior cloud security engineer in a multinational company. His organization uses Google cloud-based services. Jordon stored his organizational data in the bucket and named the bucket in the Google cloud storage following the guidelines for bucket naming.
Which of the following is a valid bucket name given by Jordon?
Show answer and explanation
Correct answer: B. company-storage-data
Google Cloud Storage bucket names may contain only lowercase letters, numbers, dashes, underscores and dots, and they must start and end with a letter or number. The name company-storage-data uses only lowercase letters and dashes, so it meets every rule. Spaces and uppercase characters are not allowed, which rules out the other names.
Why the other options are wrong
- A. The name contains spaces, which are not permitted in a bucket name.
- C. The name contains uppercase letters, and bucket names must be entirely lowercase.
- D. The name begins with an uppercase letter, and bucket names must be entirely lowercase.
Question 32
FinTech Inc. is an IT company that utilizes a cloud platform to run its IT infrastructure. Employees belonging to various departments do not implement the rules and regulations framed by the IT department, which leads to fragmented control and breaches that affect the efficiency of cloud services.
How can the organization effectively overcome shadow IT and unwarranted usage of cloud resources in this scenario?
Show answer and explanation
Correct answer: A. By implementing cloud governance
Cloud governance is the set of policies, roles, processes and controls that define how an organization adopts and uses cloud services. When departments ignore the rules set by the IT department and adopt their own cloud resources, a governance framework restores centralized control by defining who may provision services, what approvals are required, and how usage is monitored and enforced. This is the way to overcome shadow IT and unwarranted resource usage, because it addresses the missing control directly.
Why the other options are wrong
- B. Cloud risk management identifies and treats risks but does not itself set and enforce who may provision and use cloud resources.
- C. Corporate compliance concerns meeting the organization's own obligations and codes of conduct and is not the framework that controls how cloud resources are acquired and used.
- D. Regulatory compliance means meeting external laws and regulations and does not give the IT department control over unsanctioned cloud usage.
Question 33
GlobalCloud is a cloud service provider that offers various cloud-based secure and cost-effective services to cloud consumers. The customer base of this organization increased within a short period; thus, external auditing was performed on GlobalCloud. The auditor used spreadsheets, databases, and data analyzing software to analyze a large volume of data. Based on the given information, which cloud-based audit method was used by the auditor to collect the objective evidence?
Show answer and explanation
Correct answer: A. CAAT
Computer-assisted audit techniques (CAAT) use software such as spreadsheets, databases and data analysis tools to test large volumes of data. Auditors apply them to select samples, search for anomalies and recalculate figures far faster than manual review, and the results serve as objective evidence. Using spreadsheets, databases and analysis software on a large data set, as the auditor did here, is the definition of CAAT.
Why the other options are wrong
- B. Re-performance means the auditor independently carries out a procedure or control again to confirm it produces the same result, which is not bulk data analysis with software.
- C. Striping is a way of spreading data across disks, as in RAID, and is not an audit technique.
- D. Gap analysis compares current practices against a required standard to find shortfalls, and it does not by itself mean analyzing large data sets with software.
Question 34
A multinational company decided to shift its organizational infrastructure and data to the cloud. Their team finalized the service provider.
Which of the following is a contract that can define the security standards agreed upon by the service provider to maintain the security of the organizational data and infrastructure and define organizational data compliance?
Show answer and explanation
Correct answer: A. Service Level Agreement
A Service Level Agreement is the contract between a cloud provider and its customer that sets out the level of service the provider commits to deliver. In cloud security it records the security standards the provider will maintain, along with measures such as availability, and it addresses data compliance obligations and the remedies if commitments are not met. This is the document an organization relies on to define the protection of its data and infrastructure after choosing a provider.
Why the other options are wrong
- B. Compliance Agreement is not the standard term for the contract that defines a provider's service and security commitments.
- C. Service Level Contract is not the recognized name for this document, which is called a Service Level Agreement.
- D. A general service agreement covers the commercial terms of use and does not specifically define measurable security standards and compliance commitments.
Question 35
Frances Fisher has been working as a cloud security engineer in a multinational company. Her organization uses Microsoft Azure cloud-based services.
Frances created a resource group (devResourceGroup); then, she created a virtual machine (devVM) in that resource group.
Next, Frances created a Bastion host for the virtual machine (devVM) and she connected the virtual machine using Bastion from the Azure portal.
Which of the following protocols is used by Azure Bastion to provide secure connectivity to Frances’ virtual machine (devVM) from the Azure portal?
Show answer and explanation
Correct answer: A. TLS
Azure Bastion is a managed service that lets users reach virtual machines over RDP or SSH directly from the Azure portal, with no public IP address on the VM and no RDP or SSH ports exposed to the internet. The session between the browser and the Bastion host runs over TLS on port 443, so the connection is encrypted end to end between the portal and Bastion, and Bastion then reaches the VM over its private IP address. This is why Frances can connect to devVM securely from the portal.
Why the other options are wrong
- B. Plain HTTP carries traffic unencrypted, whereas the portal session to Bastion is protected by TLS on port 443.
- C. Telnet is a clear-text remote access protocol, and Bastion uses RDP or SSH to the VM wrapped in a TLS session to the browser.
- D. TCP is only the transport layer and provides no encryption of its own, so it is not the protocol that secures the browser session to Bastion.
Question 36
Simon recently joined a multinational company as a cloud security engineer. Due to robust security services and products provided by AWS, his organization has been using AWS cloud-based services. Simon has launched an Amazon EC2 Linux instance to deploy an application. He would like to secure Linux AMI.
Which of the following command should Simon run in the EC2 instance to disable user account passwords?
Show answer and explanation
Correct answer: A. passwd -d < USERNAME >
The passwd -d option deletes a user's password, leaving the account with no password set. On an EC2 Linux instance, where users sign in with SSH key pairs, removing the password this way takes password authentication off the account, which is the step the question names for securing the AMI. The command runs as root against each user name, for example passwd -d followed by the account name, and it changes only the stored password, not the account's files or its SSH keys.
Why the other options are wrong
- B. The -D option is not a passwd option for removing a password, so it does not act on the user's password.
- C. The passwd command has no -I option, so this command does not remove the user's password.
- D. The -L option is not a passwd option for removing a password, so it does not act on the user's password.
Question 37
Daffod is an American cloud service provider that provides cloud-based services to customers worldwide. Several customers are adopting the cloud services provided by Daffod because they are secure and cost-effective. Daffod complies with the cloud computing law enacted in the US to realize the importance of information security in the economic and national security interests of the US. Based on the given information, which law order does Daffod adhere to?
Show answer and explanation
Correct answer: B. FISMA
The Federal Information Security Management Act (FISMA) is the US law that opens by recognizing the importance of information security to the economic and national security interests of the United States. It requires federal agencies to develop, document and implement an information security program, and the requirement extends to cloud providers that serve those agencies, typically demonstrated through FedRAMP. That wording matches the law Daffod follows in the scenario.
Why the other options are wrong
- A. FERPA protects the privacy of student education records and is unrelated to information security for cloud services.
- C. ECPA limits the interception of and government access to electronic communications, and it does not set information security requirements for cloud providers.
- D. The CLOUD Act addresses law enforcement access to data held by US providers, including data stored overseas, and does not create the information security program requirements described.
That was 37 of 147.
The full EC-Council 312-40 CCSE v2 pack has all 147 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 73 free as one PDF by email. Get the Half Pack →