CloudSec-Pro Cloud Security Fundamentals And Shared Responsibility Practice Test 2 — 15 Questions

Question 1

In the context of AWS, which tool provides visibility into compliance and configuration drift?

Accepted Answer

AWS Config. AWS Config continuously records resource configurations, evaluates them against rules, and tracks changes over time, making it the primary service for detecting configuration drift and assessing compliance. It provides a timeline of configuration changes and can trigger remediation via SSM Automation.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

Amazon Inspector

Question 2

When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?

Accepted Answer

Microsoft. While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.

Answer

The Azure Tenant Administrator

Answer

The Customer

Answer

The Security Auditor

Question 3

Which cloud security concept allows for the rapid restoration of services after a security incident?

Accepted Answer

Infrastructure as Code. Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.

Answer

Manual provisioning

Answer

Security through obscurity

Answer

Local backup storage

Question 4

Which of the following is a critical step when performing a 'Cloud-Native' threat model?

Accepted Answer

Identifying trust boundaries between microservices. Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.

Answer

Reviewing physical datacenter floor plans

Answer

Updating local workstation antivirus

Answer

Ordering new network hardware

Question 5

What is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

To detect and remediate configuration drift. CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.

Answer

To manage employee identity lifecycle

Answer

To perform deep packet inspection of encrypted traffic

Answer

To block DDoS attacks

Question 6

In GCP, what is the primary purpose of 'Organization Policy Service'?

Accepted Answer

To enforce centralized configuration guardrails. Organization Policy Service lets administrators define constraints (such as restricting resource locations, disabling service account key creation, or limiting allowed APIs) that are enforced across the entire resource hierarchy. It provides centralized, preventive guardrails rather than detective monitoring or identity management. This is why it is the correct answer for enforcing configuration guardrails.

Answer

To manage user credentials

Answer

To monitor network traffic

Answer

To patch virtual machine kernels

Question 7

When securing a containerized application, where should you place the primary focus for security?

Accepted Answer

The container image and runtime. For containerized applications, the primary security focus should be on the container image and its runtime, because that is where the application code, dependencies, and execution environment live. Vulnerabilities in base images, misconfigurations, and runtime threats directly affect the workload. Other options are either irrelevant or outside the container security scope.

Answer

The office network firewall

Answer

The physical server power supply

Answer

The datacenter cooling system

Question 8

You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?

Accepted Answer

Varying shared responsibility boundaries. The Shared Responsibility Model defines which security controls are the cloud provider's responsibility and which belong to the customer, and these boundaries vary significantly across providers (AWS, Azure, GCP) and across service models (IaaS, PaaS, SaaS). In a multi-cloud environment, the lack of a uniform boundary means the security team must map and reconcile different responsibility splits for each provider and service, which is the most significant challenge. This ambiguity is a leading cause of misconfigurations and coverage gaps.

Answer

The lack of API documentation

Answer

Too many cloud-native services

Answer

Consistent provider pricing

Question 9

Which of the following is a benefit of using 'Identity and Access Management' (IAM) groups?

Accepted Answer

To simplify permission management for multiple users. IAM groups allow for the efficient management of permissions for a collection of users with similar job functions.

Answer

To encrypt user passwords

Answer

To provide physical access to the cloud

Answer

To prevent unauthorized login attempts

Question 10

In the context of 'Shared Responsibility', what does the customer typically manage in a SaaS (Software as a Service) offering?

Accepted Answer

User access and data. In a SaaS model, the cloud provider manages the application, runtime, middleware, OS, virtualization, servers, storage, and networking. The customer is responsible for managing user access (identity and access management) and their data (including classification, protection, and compliance). This is the essence of the shared responsibility model for SaaS: security 'of' the cloud is the provider's, security 'in' the cloud (data and access) is the customer's.

Answer

The application code

Answer

The physical network cables

Answer

The underlying operating system

Question 11

When configuring 'VPC Service Controls' in GCP, what is the main security benefit?

Accepted Answer

To prevent data exfiltration by defining service perimeters. VPC Service Controls let you define a service perimeter around GCP resources such as Cloud Storage and BigQuery, so that data cannot be copied or accessed from outside the perimeter even by users with valid IAM permissions. This directly mitigates data exfiltration risks by enforcing context-aware access boundaries at the API level. The main security benefit is therefore preventing data exfiltration through service perimeters.

Answer

To automate disk backups

Answer

To manage virtual machine CPU allocation

Answer

To provide high-speed network routing

Question 12

In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?

Accepted Answer

Using an IAM Role with a trust policy. Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.

Answer

Creating an IAM user with long-term keys

Answer

Giving them your root password

Answer

Configuring a site-to-site VPN

Question 13

When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?

Accepted Answer

The templates may include hardcoded secrets or misconfigurations. Publicly shared IaC templates often contain hardcoded credentials or overly permissive security group rules that can lead to immediate compromise.

Answer

Public templates are automatically deleted

Answer

The templates will not compile

Answer

The templates will incur higher costs

Question 14

Which service should you use to monitor for potential unauthorized API calls in your AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across the AWS account, capturing the identity of the caller, the time of the call, the source IP, and the request parameters. This makes it the authoritative service for detecting and investigating potential unauthorized API calls. CloudTrail event history and trails feed into CloudWatch, EventBridge, and GuardDuty for alerting on suspicious activity.

Answer

AWS WAF

Answer

AWS Lambda

Answer

AWS Direct Connect

Question 15

What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?

Accepted Answer

To provide an additional layer of identity verification. MFA strengthens authentication by requiring a second factor beyond the password — something the user has (a hardware token, phone app) or is (biometric) — in addition to something they know. This means a stolen or guessed password alone is insufficient to authenticate, directly reducing the risk of credential-based account takeover in cloud environments.

Answer

To speed up the login process

Answer

To automatically lock accounts after three attempts

Answer

To encrypt cloud data