CloudSec-Pro Cloud Security Fundamentals And Shared Responsibility Practice Test 1 — 15 Questions

Question 1

Which THREE of the following represent responsibilities typically shared between the customer and cloud provider? (Choose three)

Accepted Answer

Patching operating systems. Patching, encryption, and configuration management are often shared responsibilities.

Answer

Design of the global network backbone

Answer

Physical security of the facility

Question 2

Which TWO of the following are considered shared responsibilities between the customer and the cloud provider in IaaS?

Accepted Answer

Identity and access management policy definition. Identity management and network firewall configuration are shared because the provider supplies the tools, but the customer must configure them correctly.

Answer

Management of the host hardware lifecycle

Answer

Physical server maintenance

Answer

Data center facility security

Question 3

What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?

Accepted Answer

To minimize the attack surface by limiting permissions. Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.

Answer

To automate the revocation of keys

Answer

To reduce the number of IAM users

Answer

To increase the complexity of password requirements

Question 4

You are configuring a security group in AWS. What is the default behavior for inbound traffic?

Accepted Answer

Deny all traffic by default. AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.

Answer

Allow all traffic by default

Answer

Allow only SSH and RDP traffic

Answer

Allow traffic from the VPC CIDR

Question 5

In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?

Accepted Answer

Database user access control. While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.

Answer

Physical datacenter security

Answer

Host operating system hardening

Answer

Database software patching

Question 6

Which of the following is a core characteristic of cloud-native security?

Accepted Answer

Integrating security into the CI/CD pipeline. Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.

Answer

Relying on manual configuration audits

Answer

Using only on-premises security appliances

Answer

Focusing exclusively on perimeter security

Question 7

You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?

Accepted Answer

Provider responsibility for physical infrastructure. Hardware maintenance, such as physical server upkeep and datacenter security, falls under Microsoft's responsibility in the IaaS model.

Answer

Shared responsibility for data encryption

Answer

Customer responsibility for OS patching

Answer

Customer responsibility for identity management

Question 8

When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?

Accepted Answer

Identity-based access policies. Zero Trust requires continuous verification of every request, which is typically handled by an Identity and Access Management (IAM) system integrated with context-aware policies.

Answer

Static IP allow-lists

Answer

Default open network ports

Answer

Physical firewalls

Question 9

You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?

Accepted Answer

The Customer. The customer is responsible for the security of data in the cloud, including the configuration of S3 bucket policies.

Answer

The AWS Support Team

Answer

AWS

Answer

The Cloud Service Provider (CSP) Shared Responsibility Framework

Question 10

In the context of AWS, which tool provides visibility into compliance and configuration drift?

Accepted Answer

AWS Config. AWS Config is the service designed to track resource configuration changes and evaluate them against compliance rules.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

Amazon Inspector

Question 11

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 12

Which cloud security concept allows for the rapid restoration of services after a security incident?

Accepted Answer

Infrastructure as Code. Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.

Answer

Manual provisioning

Answer

Security through obscurity

Answer

Local backup storage

Question 13

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 14

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks

Question 15

In GCP, what is the primary purpose of 'Organization Policy Service'?

Accepted Answer

To enforce centralized configuration guardrails. The Organization Policy Service allows administrators to set guardrails and restrictions on resources across the entire organization to ensure compliance.

Answer

To manage user credentials

Answer

To monitor network traffic

Answer

To patch virtual machine kernels