01. A cloud governance team must ensure that no team can create resources outside the organization's approved regions. Receiving an alert after such a resource exists is not acceptable.
Which type of governance guardrail meets this requirement?
a) A detective guardrail that flags the noncompliant resource
b) A corrective control that deletes the resource after it is created
c) A preventive guardrail that blocks the noncompliant request
d) A compensating control that records an approved exception
02. A GuardDuty finding reports unusual API calls from an IAM role. The analyst wants to see the role's related activity, IP addresses and resources over time as linked visualizations to find the root cause.
Which AWS service is designed for this investigation?
a) Amazon Detective
b) Amazon Macie
c) AWS Security Hub
d) AWS Config
03. Which forensic process collects evidence from cloud systems, such as disk snapshots and log exports, and preserves it with hashes so it can be analyzed later?
a) Evidence analysis
b) Forensic acquisition
c) Incident containment
d) Centralized log aggregation
04. A cloud administrator configures automated backups of a database to run every hour.
Which recovery metric does this schedule primarily support?
a) Recovery time objective (RTO)
b) Service level agreement (SLA)
c) Mean time to repair (MTTR)
d) Recovery point objective (RPO)
05. A development team needs a copy of a production customer database for testing. Real names and account numbers must be replaced with fictitious but realistic values, and the test copy must not be reversible to the originals.
Which technique meets this requirement?
a) Static data masking
b) Format-preserving encryption
c) Tokenization
d) Hashing
06. Before release, a team wants to test its deployed cloud web application from the outside, as an attacker would see it, by sending crafted HTTP requests to the running application and observing the responses. It will not use the source code or install any agent inside the application.
Which testing method meets this requirement?
a) Static application security testing (SAST)
b) Interactive application security testing (IAST)
c) Software composition analysis (SCA)
d) Dynamic application security testing (DAST)
07. A company must quickly set up a new multi-account AWS environment with a baseline landing zone and preconfigured preventive and detective guardrails applied to every account.
Which AWS service should it use?
a) AWS Service Catalog
b) AWS Control Tower
c) Amazon GuardDuty
d) AWS Security Hub
08. A team hosting a public web application on App Engine wants Google Cloud to crawl the application and report common vulnerabilities such as cross-site scripting, mixed content and outdated libraries.
Which service should the team enable?
a) Binary Authorization
b) Google Cloud Armor
c) Web Security Scanner
d) Sensitive Data Protection
09. A company with several Azure virtual networks wants one centrally managed, stateful service that filters outbound traffic from all of them by fully qualified domain name and logs every allowed and denied connection.
Which Azure service meets this requirement?
a) Azure Firewall
b) Network security groups
c) Azure Bastion
d) Application Gateway WAF
10. In the first technical phase of an authorized test, the team enumerates the client's public DNS names, storage endpoints, and exposed services before probing anything for weaknesses.
Which phase of penetration testing is this?
a) Exploitation
b) Reporting
c) Reconnaissance
d) Post-exploitation
The purpose of this Sample Question Set is to provide you with information about the EC-Council Certified Cloud Security Engineer exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 312-40 certification test. To get familiar with real exam environment, we suggest you try our Sample EC-Council CCSE Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual EC-Council Certified Cloud Security Engineer (CCSE) certification exam.
