40 questions · Cloud Security Fundamentals And Shared Responsibility · All types, answers revealed
Which TWO of the following are primary security benefits of using cloud-native security tools? (Choose two)
Essential for speed and consistency.
Why this answer
Automation and unified visibility are key benefits of cloud-native tools.
Which type of encryption should be used to protect data at rest in a cloud storage bucket?
This is the built-in way to protect data at rest.
Why this answer
Server-side encryption is the standard method for ensuring data is encrypted before being stored on the provider's disk.
Which THREE of the following are critical components of a comprehensive Cloud Security strategy? (Choose three)
The new security perimeter.
Why this answer
Governance, Identity, and Detection form the foundation of a robust strategy.
Which THREE of the following are required to maintain a secure cloud-native environment? (Choose three)
Prevents human error at scale.
Why this answer
Visibility, automation, and identity governance are key components.
When using Azure Key Vault to store secrets, which entity holds the responsibility for the protection of the underlying hardware security module (HSM)?
Microsoft manages the physical HSM infrastructure.
Why this answer
While the customer manages the keys and secrets, the underlying physical infrastructure and the HSM management are the responsibility of the cloud provider.
You are configuring a security group in AWS. What is the default behavior for inbound traffic?
Security groups block all incoming traffic unless specified.
Why this answer
AWS security groups are stateful and default to denying all inbound traffic until an explicit allow rule is added.
In the context of 'Shared Responsibility', what does the customer typically manage in a SaaS (Software as a Service) offering?
Data and access are almost always the user's responsibility.
Why this answer
In SaaS, the provider manages almost everything except the user access and the data itself.
What is the primary function of a Cloud Security Posture Management (CSPM) tool?
CSPM provides visibility and remediation for cloud misconfigurations.
Why this answer
CSPM tools are designed to continuously monitor cloud environments to detect and remediate configuration risks and compliance violations.
When implementing a 'Zero Trust' architecture in cloud, which component is most critical for verifying requests?
Verifying identity is the core of Zero Trust.
Why this answer
Zero Trust requires continuous verification of every request, which is typically handled by an Identity and Access Management (IAM) system integrated with context-aware policies.
Which of the following is a benefit of using 'Identity and Access Management' (IAM) groups?
Groups aggregate permissions, reducing complexity.
Why this answer
IAM groups allow for the efficient management of permissions for a collection of users with similar job functions.
You are deploying a workload on Azure and need to ensure that the underlying hardware maintenance is handled by Microsoft. Which aspect of the Shared Responsibility Model does this represent?
Microsoft manages physical security and hardware maintenance.
Why this answer
Hardware maintenance, such as physical server upkeep and datacenter security, falls under Microsoft's responsibility in the IaaS model.
Which service should you use to monitor for potential unauthorized API calls in your AWS account?
CloudTrail captures API activity logs.
Why this answer
AWS CloudTrail records all API activity within an account, which is the primary source for detecting unauthorized or suspicious actions.
You are auditing a cloud environment where a developer has created an S3 bucket with public read access. Under the AWS Shared Responsibility Model, who is responsible for configuring the bucket policy to restrict this access?
Configuring S3 bucket policies is a customer responsibility under data security.
Why this answer
The customer is responsible for the security of data in the cloud, including the configuration of S3 bucket policies.
In a Google Cloud environment using Cloud SQL, which task remains the customer's responsibility?
Access control and user permissions are the customer's responsibility.
Why this answer
While Google manages the underlying OS and database software patching, the customer is responsible for managing database user permissions and access control.
Which TWO of the following are common risks associated with misconfigured cloud storage buckets? (Choose two)
Sensitive data leaks lead to compliance issues.
Why this answer
Data breaches and compliance violations are the most significant risks.
Which THREE of the following are pillars of a Zero Trust approach? (Choose three)
Core principle of Zero Trust.
Why this answer
Zero Trust is based on verify explicitly, least privilege access, and assuming breach.
You are analyzing a security risk in a multi-cloud environment. What is the most significant challenge regarding the Shared Responsibility Model?
Inconsistent definitions create security gaps between clouds.
Why this answer
The biggest challenge is that different cloud providers (AWS, Azure, GCP) have different boundaries for shared responsibility, leading to potential gaps if not clearly understood.
Which TWO of the following are common cloud-native security practices? (Choose two)
Testing early in the pipeline.
Why this answer
Shift-left security and automated testing are standard practices.
When securing a containerized application, where should you place the primary focus for security?
These are the core components of the application workload.
Why this answer
Securing the container image, the registry, and the container runtime is critical for securing the workload itself.
A security administrator is evaluating the shared responsibility model for an AWS deployment. Which task remains the sole responsibility of the customer when using Amazon RDS?
IAM policies and database-level permissions remain the responsibility of the customer.
Why this answer
In managed services like Amazon RDS, AWS manages the underlying OS and patching, but the customer retains responsibility for data encryption and access management.
When using 'Infrastructure as Code' (IaC), what is a key security risk if templates are shared publicly?
This is a common IaC security vulnerability.
Why this answer
Publicly shared IaC templates often contain hardcoded credentials or overly permissive security group rules that can lead to immediate compromise.
Which THREE of the following are examples of cloud-native security concepts?
A core cloud-native security concept where components are replaced rather than updated.
Why this answer
Cloud-native security relies on immutable infrastructure, automated policy enforcement, and identity-centric perimeters.
Which cloud security concept allows for the rapid restoration of services after a security incident?
IaC enables rapid, consistent reconstruction of environments.
Why this answer
Infrastructure as Code (IaC) allows for the repeatable and rapid deployment of secure environments, which is essential for fast recovery.
A security team is implementing 'Shift Left' security. What is the fundamental shift in responsibility for the development team?
Shift left involves building security into the development process.
Why this answer
Shift left moves security responsibility earlier in the lifecycle, requiring developers to ensure code and infrastructure definitions (IaC) are secure before deployment.
Which TWO of the following are examples of customer responsibilities in the AWS Shared Responsibility Model? (Choose two)
Customer responsibility.
Why this answer
Data security and IAM configuration are fundamental customer responsibilities.
What is the primary goal of the 'Principle of Least Privilege' in a cloud environment?
This directly defines the purpose of least privilege.
Why this answer
Least privilege ensures that users and services have only the minimum permissions necessary to perform their tasks, reducing the blast radius of a credential compromise.
When evaluating Cloud-Native Security Platforms (CNSP), which area is primarily the responsibility of the cloud provider?
This is the responsibility of the cloud provider.
Why this answer
Cloud providers are responsible for the physical security and the underlying virtualization layer (the 'Security of the Cloud').
Which of the following is a core characteristic of cloud-native security?
DevSecOps/automation is a pillar of cloud-native security.
Why this answer
Cloud-native security is designed to be automated and integrated into the CI/CD pipeline, rather than treated as an afterthought.
In the context of AWS, which tool provides visibility into compliance and configuration drift?
Config monitors and records resource configurations.
Why this answer
AWS Config is the service designed to track resource configuration changes and evaluate them against compliance rules.
Which TWO of the following are effective ways to secure access to your cloud management console? (Choose two)
Reduces risk of brute force.
Why this answer
MFA and strong password policies are the standard methods for securing console access.
You are analyzing a Prisma Cloud deployment to enforce compliance. You discover that a developer has created a public S3 bucket containing sensitive data. Which principle of the cloud security model is being violated?
Securing the configuration of cloud resources is a core customer responsibility.
Why this answer
The customer is responsible for 'Security in the Cloud', which includes misconfiguration management and data exposure risks, even if the platform provides the security tools.
You are auditing an Azure environment. You need to ensure that the security of your guest operating systems is maintained. Under the shared responsibility model, what is the customer's primary responsibility for IaaS Virtual Machines?
Patching the OS is a customer responsibility in the IaaS model.
Why this answer
For IaaS in Azure, the customer is responsible for guest OS updates, application security, and configuration, while Azure manages the host hardware and virtualization layer.
In AWS, what is the best way to grant a temporary role to an external third-party auditor without creating permanent IAM users?
This is the best practice for cross-account access.
Why this answer
Using IAM Roles with 'AssumeRole' and an external ID is the standard, secure method for granting cross-account access.
Which of the following is a critical step when performing a 'Cloud-Native' threat model?
Microservices communication is a primary attack vector.
Why this answer
Mapping data flows and identifying trust boundaries between microservices is a fundamental step in modern cloud threat modeling.
What is the primary function of 'Multi-Factor Authentication' (MFA) in a cloud environment?
This is the definition of MFA.
Why this answer
MFA adds a layer of defense by requiring two or more pieces of evidence to verify a user's identity, protecting against password-only compromises.
Which THREE of the following tasks are exclusively the responsibility of the cloud provider in a SaaS model?
Provider responsibility.
Why this answer
In a SaaS model, the provider manages almost everything except the user's data and access.
A security architect is designing a multi-cloud strategy on GCP. Which component must the customer configure to ensure data protection within the shared responsibility model for Google Cloud Storage?
The customer is responsible for defining who can access the data.
Why this answer
While Google secures the infrastructure, the customer must define access policies (IAM) and enable encryption settings to protect data stored in buckets.
When configuring 'VPC Service Controls' in GCP, what is the main security benefit?
Service perimeters block unauthorized data transfers.
Why this answer
VPC Service Controls help mitigate data exfiltration risks by creating a security perimeter around sensitive services, even if identity credentials are stolen.
A company is migrating a legacy application to a containerized environment using Amazon EKS. Under the shared responsibility model, which action must the customer perform to secure the control plane?
The customer is responsible for the security configuration within the cluster.
Why this answer
While AWS manages the EKS control plane (master nodes), the customer remains responsible for managing the Kubernetes RBAC, network policies, and the worker node security.
In GCP, what is the primary purpose of 'Organization Policy Service'?
It provides centralized governance for cloud resources.
Why this answer
The Organization Policy Service allows administrators to set guardrails and restrictions on resources across the entire organization to ensure compliance.
Ready to test yourself?
Try a timed practice session using only Cloud Security Fundamentals And Shared Responsibility questions.