CloudSec-Pro Cloud Security Fundamentals And Shared Responsibility Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)

Accepted Answer

Securing data in the cloud. Option C (Securing data in the cloud) is correct because under the AWS Shared Responsibility Model, the customer is always responsible for the security of their data — including encryption, classification, and access control — regardless of which service model (IaaS, PaaS, or SaaS) is used. Option E (Managing IAM users and permissions) is correct because identity and access management, including creating IAM users, roles, policies, and enforcing least privilege, is a customer-side responsibility in AWS. The unmarked options do not belong: A (Physical security of the data center) and B (Server hardware maintenance) are AWS responsibilities under 'security OF the cloud,' and D (Host OS patching for managed services) is handled by AWS for managed services such as RDS or Lambda, not by the customer.

Answer

Physical security of the data center

Answer

Server hardware maintenance

Answer

Host OS patching for managed services

Question 2

Which TWO of the following are primary security benefits of using cloud-native security tools? (Choose two)

Accepted Answer

Automated security policy enforcement. Option D is correct because cloud-native security tools (e.g., AWS Security Hub, Azure Policy, GCP Security Command Center) enforce security policies automatically and continuously across workloads, removing reliance on error-prone manual configuration. Option E is correct because these tools aggregate telemetry from disparate cloud services into a single pane of glass, giving unified visibility across compute, storage, network, and identity assets so misconfigurations and threats can be detected centrally. Option A is wrong because no tool eliminates all security threats; cloud-native tools reduce risk but cannot remove every vulnerability, misconfiguration, or insider threat. Option B is wrong because reducing provider cost is a financial outcome, not a primary security benefit, and cloud-native security tooling often adds licensing or operational cost. Option C is wrong because requiring manual approval for every API call is an operational bottleneck and the opposite of the automation and scalability that cloud-native security tools provide.

Answer

Total elimination of all security threats

Answer

Reduction of provider cost

Answer

Manual approval for every single API call

Question 3

Which THREE of the following are pillars of a Zero Trust approach? (Choose three)

Accepted Answer

Use least privilege access. Option A (Use least privilege access) is correct because Zero Trust requires granting users and workloads only the minimum permissions needed, typically enforced through just-in-time and just-enough-access (JIT/JEA) policies and conditional access. Option C (Assume breach) is correct because Zero Trust assumes no implicit trust and operates as if attackers are already present, driving micro-segmentation, end-to-end encryption, and analytics to minimize blast radius. Option D (Verify explicitly) is correct because every access request must be authenticated and authorized based on all available signals—identity, device health, location, and risk—before granting access. Option B is incorrect because trusting all internal network traffic is the classic perimeter-based model that Zero Trust explicitly rejects. Option E is incorrect because relying solely on physical perimeter firewalls reflects an outdated castle-and-moat strategy rather than the identity-centric, policy-based controls of Zero Trust.

Answer

Trust all internal network traffic

Answer

Deploy only physical perimeter firewalls

Question 4

Which TWO of the following are common risks associated with misconfigured cloud storage buckets? (Choose two)

Accepted Answer

Regulatory compliance violations. Option B (Regulatory compliance violations) is correct because misconfigured buckets that expose or improperly retain regulated data such as PII, PHI, or cardholder data can violate frameworks like GDPR, HIPAA, or PCI DSS, leading to fines and legal liability. Option D (Public data exposure) is correct because a common misconfiguration is setting bucket ACLs or policies to public-read (e.g., an S3 bucket policy with Principal "*" or a GCS object set to allUsers), which exposes sensitive objects to anyone on the internet. The unmarked options do not belong: hardware failure (A) is a provider-side infrastructure concern mitigated by redundancy, not a bucket configuration risk; decreased storage performance (C) is not typically caused by access-control misconfiguration; and increased cloud latency (E) relates to network topology or region placement, not bucket permissions.

Answer

Hardware failure

Answer

Decreased storage performance

Answer

Increased cloud latency

Question 5

Which THREE of the following are required to maintain a secure cloud-native environment? (Choose three)

Accepted Answer

Automated security guardrails. Automated security guardrails (B) are required because cloud-native environments are dynamic and API-driven, so policy-as-code controls (e.g., OPA/Gatekeeper, AWS SCPs, Azure Policy) must enforce configuration and compliance continuously without human intervention. Robust identity governance (C) is essential because cloud-native security centers on least-privilege access, so managing identities, roles, entitlements, and access reviews (e.g., RBAC, IAM policies, just-in-time access) prevents credential misuse and privilege creep. Continuous visibility into resources (D) is required because ephemeral workloads, containers, and microservices constantly change, so logging, monitoring, and posture management (e.g., CloudTrail, GuardDuty, CSPM, SIEM) are needed to detect drift, threats, and misconfigurations in real time. Physical access to the server room (A) is not required for cloud-native environments since infrastructure is managed by the cloud provider under the shared responsibility model, and manual firewall rule entry (E) is not required because manual, ticket-driven changes are error-prone and incompatible with the automation and elasticity of cloud-native operations.

Answer

Physical access to the server room

Answer

Manual firewall rule entry

Question 6

Which TWO of the following are effective ways to secure access to your cloud management console? (Choose two)

Accepted Answer

Use strong, unique passwords. Option B is correct because using strong, unique passwords for each administrator account reduces the risk of credential stuffing, brute-force, and password-reuse attacks against the cloud management console. Option C is correct because enabling Multi-Factor Authentication (MFA) adds a second verification factor (such as a TOTP app, hardware key, or push notification) beyond the password, so a stolen or guessed password alone is insufficient to authenticate. Option A is wrong because sharing a single root account password eliminates accountability, violates least-privilege and non-repudiation principles, and exposes the most privileged account to uncontrolled use. Option D is wrong because public Wi-Fi is untrusted and vulnerable to eavesdropping, evil-twin APs, and MITM attacks, making it a poor access channel. Option E is wrong because disabling all logging removes audit trails and detection capability, which is essential for monitoring and investigating unauthorized console access.

Answer

Share one root account password among all admins

Answer

Access the console only from public Wi-Fi

Answer

Disable all logging

Question 7

Which TWO of the following are common cloud-native security practices? (Choose two)

Accepted Answer

Shift-left security testing. Shift-left security testing (A) is a core cloud-native practice because it moves security checks—SAST, DAST, dependency and IaC scanning—into the earliest CI/CD stages, catching flaws before deployment in fast, ephemeral pipelines. Automated vulnerability scanning (C) is equally essential, since container images, registries, and running workloads change constantly and must be continuously scanned (e.g., Trivy, Clair, or native registry scanners) to detect CVEs and misconfigurations at scale. The unmarked options do not belong: static firewall rules only (B) contradict the dynamic, identity- and policy-driven microsegmentation typical of cloud-native environments; manual password rotations (D) are error-prone and inferior to automated secrets management and short-lived credentials; and disabling cloud logging (E) destroys the audit trails and telemetry needed for detection, forensics, and compliance.

Answer

Using static firewall rules only

Answer

Manual password rotations

Answer

Disabling cloud logging

Question 8

Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)

Accepted Answer

Identity and Access Management. Identity and Access Management (A) is a critical component because it enforces authentication, authorization, and least-privilege access to cloud resources through mechanisms such as roles, policies, MFA, and federation, directly reducing the risk of credential compromise and lateral movement. Cloud Governance (B) is essential because it establishes policies, standards, guardrails, and compliance controls (for example, via AWS Organizations SCPs, Azure Policy, or GCP Organization Policies) that keep cloud usage aligned with business, regulatory, and security requirements across accounts and subscriptions. Continuous Security Monitoring (C) is critical because it provides ongoing visibility through logging, metrics, and threat detection services such as AWS CloudTrail/GuardDuty, Azure Monitor/Microsoft Defender for Cloud, or GCP Cloud Logging/Security Command Center, enabling timely detection and response to misconfigurations and attacks. Relying solely on external audits (D) is not a component of a comprehensive strategy because audits are periodic, point-in-time assessments and cannot replace continuous preventive and detective controls. Ignoring container-based workloads (E) is incorrect because containers are a major cloud workload type and must be secured through image scanning, runtime protection, Kubernetes RBAC, network policies, and secrets management.

Answer

Relying solely on external audits

Answer

Ignoring container-based workloads

Question 9

You are auditing an Azure environment. You need to ensure that the security of your guest operating systems is maintained. Under the shared responsibility model, what is the customer's primary responsibility for IaaS Virtual Machines?

Accepted Answer

Applying security patches to the guest operating system. Under the cloud shared responsibility model for IaaS, the customer is responsible for everything from the guest operating system upward — including OS patching, application updates, and security configuration. Microsoft manages the physical hosts, network, and hypervisor, but the guest OS inside the VM belongs to the customer. Therefore applying security patches to the guest OS is the customer's primary responsibility.

Answer

Managing the physical security of the data center

Answer

Patching the host server virtualization layer

Answer

Managing the hypervisor configuration

Question 10

When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?

Accepted Answer

Host-level physical security and hypervisor integrity. Cloud providers are responsible for the physical security and the underlying virtualization layer (the 'Security of the Cloud').

Answer

Application-level vulnerability scanning

Answer

Encryption of data in transit at the application layer

Answer

Security configuration of virtual network firewalls

Question 11

You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?

Accepted Answer

The customer's responsibility for resource configuration and data security. The violation is the customer's responsibility for resource configuration and data security. In the shared responsibility model, the customer is always responsible for properly configuring resources (like S3 bucket policies) and securing their data. A public S3 bucket with sensitive data indicates a misconfiguration by the customer, not a failure of the provider.

Answer

The shared responsibility for data center perimeter security

Answer

The provider's responsibility for identity and access management

Answer

The provider's responsibility for infrastructure availability

Question 12

A company is migrating a legacy application to a containerized environment using Amazon EKS. Under the shared responsibility model, which action must the customer perform to secure the control plane?

Accepted Answer

Defining and enforcing Kubernetes RBAC and network policies. Under the shared responsibility model for Amazon EKS, AWS manages the control plane (including the Kubernetes API server, etcd, and master nodes), while the customer is responsible for securing access to the control plane through Kubernetes RBAC and network policies. Defining and enforcing RBAC and network policies is a customer action to secure the control plane's authorization and network access.

Answer

Applying security patches to the Kubernetes API server

Answer

Physical maintenance of the underlying master node servers

Answer

Updating the underlying host OS of the managed master nodes

Question 13

A security team is implementing 'Shift Left' security. What is the fundamental shift in responsibility for the development team?

Accepted Answer

Taking ownership of security compliance during the design and build phase. Shift Left security means moving security activities earlier into the software development lifecycle, so developers take ownership of security during design and build rather than relying solely on a downstream security team. This changes responsibility by embedding secure design, threat modeling, and automated checks into development. It is a cultural and process shift, not a transfer of risk to the provider.

Answer

Disabling all security controls to prioritize development velocity

Answer

Transferring all risk to the cloud provider's management console

Answer

Waiting for the security team to perform manual penetration tests after deployment

Answer

Outsourcing security scanning to the cloud provider

Question 14

Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?

Accepted Answer

Patching the application software. In a SaaS model, the cloud provider owns and operates the entire stack up to the application, so patching the application software (A) is exclusively the provider's job — the customer consumes the application as-is and never patches its code. Management of the underlying server hardware (B) is also entirely the provider's responsibility, since the customer has no visibility into or control over the physical servers, hypervisors, or host OS. Physical security of the data center (D) is likewise exclusively the provider's duty, covering facilities, power, cooling, and physical access controls. By contrast, encrypting the data stored within the application (C) is typically a shared or customer responsibility (e.g., managing keys or enabling encryption), and configuration of user access roles (E) is a customer responsibility, since the tenant administers its own users, roles, and permissions.

Answer

Encrypting the data stored within the application

Answer

Configuration of user access roles

Question 15

Which THREE of the following are examples of cloud-native security concepts?

Accepted Answer

Immutable infrastructure. Immutable infrastructure (A) is a cloud-native security concept because servers and containers are never patched or modified in place; instead, new hardened images are redeployed, which eliminates configuration drift and reduces the attack surface. Identity-based security perimeters (B) are correct because cloud-native architectures replace the fixed network perimeter with authentication and authorization of every user, service, and device based on strong identity (e.g., IAM roles, mTLS, zero trust), rather than trusting a network location. Infrastructure as Code (IaC) security (E) is correct because cloud-native environments define resources declaratively in templates (e.g., Terraform, CloudFormation), and scanning those templates for misconfigurations shifts security left into the CI/CD pipeline. Traditional perimeter-based network security (C) is not a cloud-native concept because it assumes a trusted internal network protected by firewalls, which breaks down in dynamic, distributed, and multi-cloud environments. Manual patch management cycles (D) are not cloud-native because they rely on long-lived mutable servers and human intervention, whereas cloud-native practice favors automated, immutable image rebuilds and redeployment.

Answer

Traditional perimeter-based network security

Answer

Manual patch management cycles