Match each cloud security concept to the best description.
Drag a concept onto its matching description — or click a concept then click the description.
Defines which security tasks belong to the cloud provider and which remain with the customer
Separates one customer's cloud resources from another customer's resources
Uses the provider's logging service to record workload and control-plane activity
Places workload resources where they are not directly exposed to the internet
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Encryption: Protects data by converting it into a secure format.
Each cloud security concept is matched to its primary function: encryption protects data at rest or in transit, IAM manages access, SIEM provides event analysis, IDS detects intrusions, and DLP prevents data loss.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Encryption: Protects data by converting it into a secure format.
Why this is correct
Encryption transforms plaintext data into ciphertext using cryptographic algorithms and keys, ensuring that only authorized parties possessing the correct decryption key can read it. This process protects data at rest, in transit, and in use, maintaining confidentiality against unauthorized access. It is a fundamental control for cloud data protection, especially when data is stored in shared infrastructure.
IAM: Manages digital identities and access rights.
Why this is correct
Identity and Access Management (IAM) encompasses the policies and technologies used to manage digital identities, authentication, and authorization. It ensures that the right users have appropriate access to cloud resources through mechanisms like multi-factor authentication, role-based access control, and single sign-on. IAM is the foundation for enforcing least privilege and auditing user activities.
SIEM: Provides real-time analysis of security alerts.
Why this is correct
Security Information and Event Management (SIEM) aggregates and correlates log data from across the cloud environment to provide real-time monitoring and threat detection. It analyzes events against known threat intelligence and rule sets, generating alerts for suspicious activity. SIEM tools enable security teams to rapidly identify potential incidents and support compliance reporting.
DLP: Prevents unauthorized sharing of sensitive data.
Why this is correct
Data Loss Prevention (DLP) tools inspect data content and context to detect and prevent unauthorized transmissions or sharing of sensitive information. They enforce policies that block exfiltration via email, web uploads, or removable media, and can also identify improperly stored data in cloud storage. DLP helps organizations meet compliance requirements by protecting regulated data.
Encryption: Manages user access to resources.
Why it's wrong here
This description is incorrect because managing user access to resources is the function of Identity and Access Management (IAM), not encryption. Encryption focuses on transforming data to maintain confidentiality, whereas access management controls who can perform actions on resources. Confusing these two controls undermines the understanding of defense-in-depth, as encryption and IAM address different security objectives.
IAM: Protects data by encoding it.
Why it's wrong here
This description is incorrect because encoding data to prevent unauthorized reading is the role of encryption, not Identity and Access Management. IAM governs user identities, their authentication, and the permissions they hold, but it does not alter the data itself. The error likely stems from mixing up the confidentiality mechanism (encryption) with the access governance framework (IAM).
Go deeper
Learn chapter
Cloud Security Fundamentals
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.