PT0-002 · Question #136
A company obtained permission for a vulnerability scan from its cloud service provider and now wants to test the security of its hosted data. Which of the following should the tester verify FIRST to…
The correct answer is A. Whether sensitive client data is publicly accessible. When assessing the security of hosted cloud data, the most critical initial verification is to determine if any sensitive client data is publicly accessible, as this represents a severe, immediate risk.
Question
A company obtained permission for a vulnerability scan from its cloud service provider and now wants to test the security of its hosted data. Which of the following should the tester verify FIRST to assess this risk?
Options
- AWhether sensitive client data is publicly accessible
- BWhether the connection between the cloud and the client is secure
- CWhether the client's employees are trained properly to use the platform
- DWhether the cloud applications were developed using a secure SDLC
How the community answered
(28 responses)- A79% (22)
- B7% (2)
- C4% (1)
- D11% (3)
Why each option
When assessing the security of hosted cloud data, the most critical initial verification is to determine if any sensitive client data is publicly accessible, as this represents a severe, immediate risk.
When testing the security of hosted data in a cloud environment, the absolute first and most critical step is to verify whether any sensitive client data is publicly accessible. Public data exposure is a high-impact vulnerability that can lead to immediate breaches and must be prioritized over other security considerations.
Ensuring the connection between the cloud and the client is secure is vital for data in transit, but it takes secondary priority to verifying if sensitive data is already exposed at rest and directly accessible.
Proper employee training is an important administrative control, but it is not the initial technical verification step to assess the direct risk of data exposure in the cloud environment.
Assessing the use of a secure SDLC for cloud applications is crucial for long-term security, yet it is a process audit and not the immediate technical check required to identify already exposed sensitive data.
Concept tested: Cloud data security - Public accessibility
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
Topics
Community Discussion
No community discussion yet for this question.