712-50 Question 292
Single answerUnderstand and manage network cloud securityA global enterprise is migrating several customer-facing applications from its on-premises data center to a public cloud provider. The CISO learns that development teams are independently creating virtual networks, exposing management ports to the Internet for troubleshooting, and connecting cloud workloads directly to the corporate WAN without a consistent inspection strategy. The board has asked the CISO to reduce the likelihood of a cloud network breach while preserving business agility. Which action should the CISO prioritize FIRST to improve network cloud security governance across the migration program?
- A
Establish a cloud network security architecture standard that mandates segmented virtual networks, centralized ingress/egress control, restricted administrative access paths, and policy-as-code guardrails enforced through the cloud provisioning process
- B
Purchase a larger next-generation firewall appliance for the on-premises perimeter so all cloud traffic can be backhauled for inspection before reaching the Internet
- C
Require each application team to choose its own cloud network controls as long as the teams document the decisions in their project plans
- D
Focus first on encrypting all cloud storage services, because storage encryption will address the primary network security risks created by Internet-exposed management ports and inconsistent cloud connectivity
Show answer and explanation
Correct answer: A
Explanation
This question tests whether the candidate can distinguish between tactical security controls and a CISO-level governance response to cloud network risk. The key issue is not merely a missing technology but the absence of an enterprise cloud network security operating model. When development teams independently create cloud networking patterns, the organization loses visibility, standardization, and control over segmentation, Internet exposure, administrative paths, and hybrid connectivity. A CISO should first establish an architecture baseline and enforce it through provisioning standards, review processes, and automated guardrails. Common best practices include default-deny security group or firewall policies, segmented subnets, centralized ingress and egress, controlled administrative access via bastion or zero trust patterns, and inspection/logging integrated into cloud-native services. This approach is consistent with guidance from NIST, including zero trust principles in SP 800-207, and cloud provider well-architected security frameworks that emphasize secure network foundations, least privilege, and automated governance. The distractors are plausible because organizations often over-rely on traditional perimeter appliances, team-level discretion, or unrelated controls like storage encryption, but those do not address the primary risk drivers in this scenario.
- A. Correct.
Correct. The scenario is fundamentally a governance and architecture problem: decentralized network design, exposed management interfaces, and inconsistent connectivity patterns create systemic risk. The most effective first step for a CISO is to define and enforce a cloud network security architecture standard across the program. In practice, this includes network segmentation using separate virtual networks/VPCs/VNets or subnets, centralized ingress and egress patterns, tightly controlled administrative access through bastion hosts, VPNs, zero trust access, or privileged access workflows, and automated preventive controls through infrastructure-as-code and policy-as-code. This approach aligns with cloud security best practices from major providers and frameworks such as NIST SP 800-207 for zero trust concepts, CIS Controls, and cloud well-architected security guidance.
- B. Incorrect.
Incorrect. Backhauling all cloud traffic to an on-premises perimeter device is a common legacy approach, but it is usually not the best first priority in a cloud migration. It can increase latency, create bottlenecks, reduce resilience, and fail to address the root problem of inconsistent cloud-native network design and Internet-exposed management services. Cloud environments require governance and architecture controls within the cloud itself, not just perimeter expansion in the data center.
- C. Incorrect.
Incorrect. Allowing each application team to independently select controls may preserve short-term agility, but it directly perpetuates the inconsistency and unmanaged risk described in the scenario. Documentation alone does not provide governance, technical enforcement, or a minimum security baseline. This option reflects a common misconception that decentralized decision-making is sufficient if it is recorded, when the real issue is lack of standardization and guardrails.
- D. Incorrect.
Incorrect. Encrypting storage is important for protecting data at rest, but it does not meaningfully mitigate the network cloud security issues described here, such as Internet-exposed management ports, poor segmentation, and uninspected connectivity between cloud workloads and the corporate WAN. This option confuses a valid security control with the wrong control priority for the stated risk.