CloudSec-Pro Cloud Security Fundamentals And Shared Responsibility — 20 Questions

Question 1

Which type of encryption should be used to protect data at rest in a cloud storage bucket?

Accepted Answer

Server-side encryption. Server-side encryption (SSE) is the standard mechanism for protecting data at rest in cloud storage buckets because the cloud provider encrypts objects before writing them to disk and decrypts them on retrieval, using provider-managed or customer-managed keys. It protects data at rest transparently without requiring the application to change how it reads or writes objects. This is why SSE (e.g., SSE-S3, SSE-KMS, SSE-C) is the correct answer for data-at-rest protection in a bucket.

Answer

Network-level encryption

Answer

Client-side encryption only

Answer

Physical security locks

Question 2

Which THREE of the following represent responsibilities typically shared between the customer and cloud provider? (Choose three)

Accepted Answer

Patching operating systems. Patching, encryption, and configuration management are often shared responsibilities.

Answer

Design of the global network backbone

Answer

Physical security of the facility

Question 3

A security administrator is evaluating the shared responsibility model for an AWS deployment. Which task remains the sole responsibility of the customer when using Amazon RDS?

Accepted Answer

Configuring database user authentication and access control. In managed services like Amazon RDS, AWS manages the underlying OS and patching, but the customer retains responsibility for data encryption and access management.

Answer

Physical maintenance of the underlying server hardware

Answer

Patching the underlying database engine operating system

Answer

Managing network isolation of the RDS instances

Question 4

A security architect is designing a multi-cloud strategy on GCP. Which component must the customer configure to ensure data protection within the shared responsibility model for Google Cloud Storage?

Accepted Answer

Configuration of IAM bucket-level permissions. While Google secures the infrastructure, the customer must define access policies (IAM) and enable encryption settings to protect data stored in buckets.

Answer

Implementation of physical disk encryption at rest

Answer

Redundancy of the data across physical regions

Answer

Management of the underlying storage hardware lifecycle

Question 5

Which TWO of the following are considered shared responsibilities between the customer and the cloud provider in IaaS?

Accepted Answer

Identity and access management policy definition. Identity management and network firewall configuration are shared because the provider supplies the tools, but the customer must configure them correctly.

Answer

Management of the host hardware lifecycle

Answer

Physical server maintenance

Answer

Data center facility security

Question 6

A multinational corporation uses Google Cloud Platform (GCP) for its big data analytics. The security architect is mapping responsibilities for a Compute Engine deployment. Which of the following is a Google responsibility under the shared responsibility model?

Accepted Answer

Securing the physical infrastructure of Google's data centers. Google is responsible for the physical security of its data centers, which is a provider duty across all service models. On Compute Engine, the customer handles guest OS patching, firewall configuration, and data encryption key management. The shared responsibility model clearly delineates that physical security remains with the cloud provider, while the customer secures their workloads and data.

Answer

Configuring firewall rules to restrict traffic to the Compute Engine instances

Answer

Managing the guest operating system updates on the Compute Engine instances

Answer

Encrypting data at rest in the customer's Cloud Storage buckets

Question 7

A retail company runs an e-commerce web application on AWS. The application runs on EC2 instances behind an Application Load Balancer, with customer data stored in an RDS for MySQL database. Under the AWS shared responsibility model, which security control is the customer's responsibility to implement and manage?

Accepted Answer

Patch the Linux operating system running on the EC2 instances.. In the AWS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes patching the guest operating system on EC2 instances. AWS is responsible for security 'of' the cloud, such as physical security and managed service maintenance. Patching the Linux OS on EC2 is a customer task because the customer has full control over the instance's operating system and applications.

Answer

Maintain the physical security of the data center that houses the RDS database.

Answer

Apply security patches to the underlying host operating system that runs the RDS database.

Answer

Configure the network ACLs and security groups for the Application Load Balancer.

Question 8

A media company uses Google Cloud Platform (GCP) for its content processing pipeline. They store sensitive media assets in Cloud Storage and process them using Compute Engine instances. The security team is reviewing the shared responsibility model. Which of the following is the customer's responsibility?

Accepted Answer

Managing access controls and encryption keys for data stored in Cloud Storage. In GCP, the customer is responsible for securing their data, including managing access controls and encryption keys for Cloud Storage. Google handles the physical infrastructure, network, and hypervisor. Therefore, managing access controls and encryption keys is the customer's responsibility.

Answer

Managing the hypervisor that isolates Compute Engine instances

Answer

Patching the operating system of the Compute Engine instances

Answer

Securing the physical infrastructure of the GCP region where the data is stored

Question 9

What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?

Accepted Answer

To minimize the attack surface by limiting permissions. Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.

Answer

To automate the revocation of keys

Answer

To reduce the number of IAM users

Answer

To increase the complexity of password requirements

Question 10

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 11

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

Accepted Answer

Database user access control. While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.

Answer

Physical datacenter security

Answer

Host operating system hardening

Answer

Database software patching

Question 12

Which of the following is a core characteristic of cloud-native security?

Accepted Answer

Integrating security into the CI/CD pipeline. Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.

Answer

Relying on manual configuration audits

Answer

Using only on-premises security appliances

Answer

Focusing exclusively on perimeter security

Question 13

You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?

Accepted Answer

Provider responsibility for physical infrastructure. Hardware maintenance, such as physical server upkeep and datacenter security, falls under Microsoft's responsibility in the IaaS model.

Answer

Shared responsibility for data encryption

Answer

Customer responsibility for OS patching

Answer

Customer responsibility for identity management

Question 14

When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?

Accepted Answer

Identity-based access policies. Zero Trust is built on the principle 'never trust, always verify' — every request must be authenticated and authorized based on identity and context, regardless of network location. Identity-based access policies are therefore the most critical component, as they evaluate the user's identity, device posture, and contextual signals before granting access to a resource.

Answer

Static IP allow-lists

Answer

Default open network ports

Answer

Physical firewalls

Question 15

You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?

Accepted Answer

The Customer. Under the AWS Shared Responsibility Model, the customer is responsible for configuring S3 bucket policies and access controls, including restricting public read access. AWS is responsible for the security of the cloud (infrastructure), while the customer is responsible for security in the cloud (data, configurations, access management). Therefore, the developer's mistake of creating a public bucket is the customer's responsibility to fix.

Answer

The AWS Support Team

Answer

AWS

Answer

The Cloud Service Provider (CSP) Shared Responsibility Framework

Question 16

In the context of AWS, which tool provides visibility into compliance and configuration drift?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations, evaluates them against rules, and tracks changes over time, making it the primary service for detecting configuration drift and assessing compliance. It provides a timeline of configuration changes and can trigger remediation via SSM Automation.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

Amazon Inspector

Question 17

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 18

Which cloud security concept allows for the rapid restoration of services after a security incident?

Accepted Answer

Infrastructure as Code. Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.

Answer

Manual provisioning

Answer

Security through obscurity

Answer

Local backup storage

Question 19

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 20

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks