Hard Difficulty Questions

Use a VPN to connect to the cloud provider's network.

Why wrong: VPN does not control where data is stored.

Conduct quarterly audits of data storage locations.

Why wrong: Audits are reactive and may not prevent violations.

Encrypt all data at rest and in transit.

Why wrong: Encryption protects data but does not address location requirements.

Set up Kerberos authentication between services

Why wrong: Kerberos is complex for microservices and not commonly used in cloud environments.

Configure a VPN between all service subnets

Why wrong: VPN encrypts at network layer but does not provide service-level identity.

Implement IPsec in the network layer

Why wrong: IPsec provides encryption but not per-service authentication.

The employee intentionally accessed the data from that country

Why wrong: Insider threat is possible but less likely without evidence.

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Why wrong: DDoS does not steal credentials.

The cloud storage bucket was misconfigured as public

Why wrong: Misconfiguration would not require stolen credentials.

Replace the base image with a minimal image like Alpine.

Why wrong: Minimal images reduce attack surface but vulnerable components may still exist.

Manually review and patch the base image before each build.

Why wrong: Cannot scale and is error-prone.

Configure the scanner to send alerts after deployment.

Why wrong: Reactive; vulnerable images are already deployed.

Store secrets as encrypted environment variables in each environment

Why wrong: Rotation requires updating configuration and redeploying, not automated.

Use Azure Key Vault with a federation bridge to AWS

Why wrong: While possible, it adds complexity and may not provide seamless rotation across both clouds.

Use AWS Secrets Manager for all secrets

Why wrong: Does not natively integrate with Azure applications.

Consent from all data subjects

Why wrong: Consent is not a practical mechanism for large-scale transfers and must be specific and informed.

Binding Corporate Rules (BCRs)

Why wrong: BCRs are for transfers within a corporate group, not for transfers to external third parties.

Privacy Shield

Why wrong: Privacy Shield was invalidated by the European Court of Justice and is no longer a valid mechanism.

Hypervisor Introspection

Why wrong: Introspection monitors VMs but does not provide hardware-level isolation.

Security Groups

Why wrong: Security Groups are network-level firewalls, not hardware isolation.

Network ACLs

Why wrong: NACLs are subnet-level firewalls, not hardware isolation.

VPC flow logs

Why wrong: Virtual network flow logs capture traffic metadata but do not include details about storage operations like requester identity or object-level access.

Cloud management events (e.g., CloudTrail equivalent)

Why wrong: Cloud API activity logs (management events) log control-plane operations, not data-plane operations such as object reads.

Log aggregation service for storage (e.g., CloudWatch equivalent)

Why wrong: Cloud monitoring logs for object storage may provide aggregate metrics but not granular details about individual requests.

Hold your own key (HYOK)

Why wrong: HYOK keys remain on-premises and are not managed in cloud KMS for service access.

Customer-supplied keys (CSEK)

Why wrong: CSEK keys are supplied per operation and not stored in KMS for ongoing use.

Cloud provider-managed keys

Why wrong: Provider-managed keys do not allow customer revocation.

Data protection by design

Why wrong: Data protection by design is a broader principle, not specific to subcontracting notification.

Data breach notification

Why wrong: Data breach notification applies to actual breaches, not subcontracting without notification.

Right to erasure

Why wrong: The right to erasure (right to be forgotten) is not directly related to subcontracting.

Right to audit

Why wrong: Audit rights allow verification but do not themselves restrict use.

Security incident response

Why wrong: Incident response clauses address breaches, not permissible data use.

Non-disclosure agreement

Why wrong: NDAs protect confidentiality but do not restrict how data is used.

The principal "*" grants access to all AWS services

Why wrong: Principal "*" includes all users and services, but the condition restricts IP; the main concern is the unrestricted second statement.

The policy version is outdated and should be updated

Why wrong: Version 2012-10-17 is the current version for S3 bucket policies.

The resource ARN does not include the bucket itself, only objects

Why wrong: The resource ARN with /* covers all objects; including the bucket is optional for object-level actions.

Strategy to avoid vendor lock-in with the CSP.

Why wrong: Vendor lock-in is a procurement concern, not a BCP requirement.

A detailed risk assessment for all cloud services.

Why wrong: Risk assessment is part of risk management, not BCP.

Network topology diagrams of the cloud environment.

Why wrong: While helpful, diagrams are not a required element of a BCP.

Store credentials as environment variables in the pod manifest

Why wrong: Environment variables can be exposed and do not rotate.

Embed credentials in the container image during build

Why wrong: Embedding credentials in images is insecure and not scalable.

Use Kubernetes Secrets without encryption at rest

Why wrong: Unencrypted Secrets lack protection and rotation.

Location independence

Why wrong: While cloud offers location independence, it is not one of the five NIST essential characteristics; 'resource pooling' is the characteristic.

Dedicated hardware per tenant

Why wrong: Cloud computing uses shared resources, not dedicated hardware per tenant.

Analyzing network latency between cloud regions

Why wrong: Latency is a performance metric, not a risk factor.

Evaluating the CSP's physical security controls in detail

Why wrong: Physical security is often inherited from the CSP and not a primary focus in customer risk assessment.

Use a condition in the policy that checks the source IP address.

Why wrong: IP condition is not specific to S3 bucket.

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Why wrong: VPC placement affects network access but not invocation permissions.

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Why wrong: Overly permissive.

Use object lock in compliance mode with a 7-year retention period

Why wrong: Compliance mode prevents legal holds from overriding.

Apply a lifecycle policy to delete objects after 7 years and rely on backups

Why wrong: Backups may not support legal holds properly.

Encrypt all objects with a client-managed key and store deletion timestamps in a database

Why wrong: No retention enforcement mechanism.

Notify the data protection authority.

Why wrong: Notification should come after the scope is determined.

Change the bucket's permission to private.

Why wrong: While necessary, this should be done after preserving logs for forensic analysis.

Immediately delete all objects in the bucket.

Why wrong: Deleting objects without investigation could destroy evidence needed to assess the breach.

Runtime security monitoring

Why wrong: Runtime monitoring detects threats in production, not before deployment.

Pre-commit hook in source control

Why wrong: Pre-commit hooks check source code, not built container images.

Admission controller in Kubernetes

Why wrong: Admission controllers can reject vulnerable images but scanning in registry is a more proactive and earlier control.