Securing the Cloud

A security team notices employees are uploading corporate files to numerous unsanctioned SaaS applications discovered from firewall and proxy logs. Leadership wants a solution that can automatically discover all cloud apps in use, assess their risk, enforce granular data-sharing policies within sanctioned apps like Office 365, and detect anomalous user behavior indicating account compromise. Which cloud security solution best meets all of these requirements?

A DevSecOps team stores database passwords, API keys, and TLS private keys directly as plaintext variables inside their Jenkins pipeline configuration files, which are committed to a shared Git repository. A security review flags this practice. Which approach best remediates the risk while supporting the CI/CD pipeline's need to authenticate to downstream services at build time?

A financial services company migrated its file-sharing workloads to a sanctioned SaaS platform. Compliance requires that employees be prevented from uploading documents containing customer social security numbers or credit card data to any cloud storage location. Security wants a solution that inspects content in real time and blocks the transfer based on the sensitive data patterns detected, regardless of the file name. Which capability should be implemented?

A company is deploying a three-tier application (web, app, database) in a public cloud IaaS environment. Security requires that the database tier only accept inbound traffic from the app tier, and the app tier only from the web tier, regardless of IP address changes as instances autoscale. The team wants a policy model that references logical workload groupings rather than static IPs. Which approach best meets these requirements?

A financial services company is migrating a sensitive customer database to an IaaS provider's managed storage service. Regulatory requirements state that the organization must retain full control over the encryption keys used to protect the data at rest, including the ability to revoke access and rotate keys independently of the cloud provider. Which approach best satisfies this data security requirement?

A security engineer at a company using a public cloud IaaS provider must investigate who deleted a virtual machine and from which source IP the API call originated. The team already collects VPC/network flow logs but cannot determine the identity or management action responsible for the deletion. Which cloud logging capability should the engineer enable to capture this information?

A security engineer at a retail company must continuously detect when engineers modify AWS security group rules or S3 bucket ACLs away from the approved baseline, and automatically flag those changes as non-compliant. The team already collects VPC flow logs and API activity separately. Which native cloud capability should the engineer implement to satisfy this specific requirement?

A security team has migrated a multi-tier application into a hybrid environment consisting of on-premises bare-metal servers and public cloud instances. They need a solution that provides deep visibility into east-west process-level and network flow behavior across every workload, automatically generates whitelist microsegmentation policies based on observed application dependencies, and enforces those policies consistently regardless of where the workload runs. Which Cisco solution best meets these requirements?

A security architect must protect a sanctioned Microsoft 365 tenant. The requirement is to scan data already stored in SharePoint Online and OneDrive for sensitive files and malware, apply remediation to historical content, and do so without redirecting user traffic through a proxy or requiring endpoint agents. Which cloud security deployment approach meets these requirements?

A company migrates several application servers to an IaaS cloud provider. During a security review, the team debates which risks are now the cloud provider's responsibility versus their own. In this IaaS deployment model, which threat remains primarily the customer's responsibility to mitigate?

A retail company hosts its customer-facing web application on public-cloud virtual machines. Security wants to inspect inbound HTTP/HTTPS traffic for SQL injection and cross-site scripting, apply OWASP Top 10 rule sets, and enable virtual patching without redesigning the application or forcing all traffic through the on-premises data center. Which cloud security capability and deployment approach best meets these requirements?

A security team is deploying workload protection across a fleet of production virtual machines in a public cloud IaaS environment. Many of these VMs are ephemeral and are frequently terminated and recreated by an autoscaling group. The team needs continuous vulnerability and configuration visibility but cannot tolerate performance overhead on the running instances or a lengthy onboarding process for each new VM. Which workload security approach best fits these constraints?

A security engineer is hardening a fleet of production Linux VMs running a well-defined set of applications in a public cloud IaaS environment. The workloads are static — the same processes run continuously and no new software is expected to be installed at runtime. The team wants to prevent any unauthorized or unknown executable, script, or process from launching on these workloads, even if an attacker gains a foothold. Which workload security control best meets this requirement?

A DevSecOps team builds Docker images that are pushed to a private registry before deployment into a Kubernetes cluster. Recently, a production workload was found running an image containing a critical CVE in a bundled OS library. The security architect wants to prevent vulnerable images from ever reaching the cluster while keeping the CI/CD pipeline automated. Which control best addresses this requirement?

A DevSecOps team runs a microservices application on a Kubernetes cluster. By default, all pods can communicate freely with each other across namespaces. Security wants to enforce that only the frontend pods may initiate connections to the payment-service pods, while blocking all other lateral pod-to-pod traffic to that service. Which Kubernetes-native mechanism should the team implement to achieve this least-privilege pod communication?

A DevSecOps team runs a microservices application on a Kubernetes cluster. Security wants to detect and block anomalous runtime behavior inside running containers—such as a process spawning an unexpected shell or making unauthorized outbound connections—without modifying application code. Which capability best meets this requirement?

A security team is responsible for a rapidly growing multi-cloud deployment spanning AWS and Azure. Developers frequently spin up new storage buckets, databases, and virtual machines using infrastructure-as-code templates. The team keeps discovering publicly exposed storage buckets and security groups that allow 0.0.0.0/0 inbound access only after an incident occurs. They need a solution that continuously assesses their cloud resource configurations against compliance benchmarks and best-practice policies, and alerts on drift across both providers. Which cloud security capability best meets this requirement?

A DevSecOps team already runs SAST during the code-commit stage and scans container images in the registry before deployment. During a security review, an auditor notes that authentication-bypass and session-handling flaws only appear when the application is actually running and processing requests. The team wants to add automated testing to the CI/CD pipeline that detects these runtime vulnerabilities against a deployed staging instance. Which testing approach should they add?

A DevSecOps team deploys cloud infrastructure using Terraform templates through their CI/CD pipeline. During a recent audit, several production storage buckets were found configured with public read access, and a security group was discovered allowing SSH (TCP 22) from 0.0.0.0/0. The team wants to catch these misconfigurations automatically before resources are ever provisioned, without waiting for a running-environment posture scan. Which practice should they add to the pipeline?

A development team runs a CI/CD pipeline that builds container images, deploys them to a Kubernetes cluster, and exposes a web application. The security team wants to adopt a 'shift-left' DevSecOps practice that catches vulnerabilities in the application's own source code as early as possible—before any artifact is built. Which control should be integrated into the pipeline to meet this requirement?