Unit 6: Cloud Security - Practice Quiz

1 Which is a common security issue in cloud computing?

2 In a shared responsibility model, who usually secures the physical cloud infrastructure?

3 In most cloud service models, who is responsible for protecting user data and access settings?

4 What does security by design mean?

5 Which principle gives users only the permissions they need?

6 What is the main purpose of Identity and Access Management (IAM)?

7 What does multi-factor authentication require?

8 Which layer protects applications from unauthorized use?

9 What is the purpose of a cloud firewall?

10 What does a virtual private cloud provide?

11 Which action is a basic host security practice?

12 What is endpoint protection designed to secure?

13 What is encryption used for?

14 What is data encryption at rest?

15 What is the main purpose of a security information and event management system?

16 What does security compliance mean?

17 What is a common cloud interoperability challenge?

18 What does cloud monitoring primarily track?

19 Which technology is increasingly used to detect unusual cloud security behavior?

20 What is a key benefit of processing data at the edge?

21 A company discovers that confidential reports stored in a cloud object-storage bucket are publicly accessible. Which action most directly addresses the root security issue?

22 An organization runs virtual machines using an Infrastructure as a Service (IaaS) provider. Who is normally responsible for installing security patches on the guest operating systems?

23 A company uses a Software as a Service (SaaS) customer relationship management platform. Which security task generally remains the company's responsibility?

24 A development team is designing a payment microservice. Which activity best applies security by design before implementation begins?

25 A new API endpoint should be accessible only to explicitly authorized services. Which default configuration best follows secure design principles?

26 A microservice needs temporary access to a cloud database without storing long-lived credentials in its container image. Which approach is most appropriate?

27 Employees must access several cloud applications using their existing corporate identities. Which solution most directly supports this requirement?

28 A cloud application uses a web application firewall, private subnets, hardened virtual machines, and database encryption. What security concept does this layered arrangement illustrate?

29 Two microservices must communicate internally, but neither should accept traffic from the public internet. Which configuration best meets this requirement?

30 Instances in a private subnet must download operating-system updates without accepting inbound internet connections. Which component should be used?

31 A vulnerability scanner finds a critical library flaw in the base image used by several containers. What is the most appropriate remediation?

32 A cloud application encrypts each data object with a unique data key and then encrypts that key with a centrally managed master key. Which technique is being used?

33 A testing team needs realistic customer records but must not receive actual credit card numbers. Which control best satisfies this requirement?

34 An incident responder must determine which identity changed an AWS security group and when the change occurred. Which AWS service provides the most relevant audit record?

35 A regulation requires customer records to remain within an approved geographic region. Which combination best supports compliance?

36 A retailer wants to reduce the number of systems included in its Payment Card Industry Data Security Standard (PCI DSS) assessment. Which design change is most effective?

37 A company plans to move an event-driven microservice between cloud providers. Which design choice most improves portability?

38 Users report intermittent delays in a request that passes through six microservices. Which observability capability is most useful for locating the slow service?

39 A healthcare organization wants cloud servers to process sensitive data while reducing exposure to the host operating system and hypervisor. Which emerging technology best fits this goal?

40 Several edge devices must collaboratively train an AI model without uploading their raw sensor data to the cloud. Which approach is most suitable?

41 A cloud-hosted URL preview service must retrieve user-supplied external URLs. An attacker attempts SSRF against the instance metadata service to steal temporary credentials. Which control combination most directly mitigates this attack while preserving the preview feature?

42 An organization runs workloads on a managed Kubernetes service where the provider operates the control plane, while the organization manages worker nodes. A vulnerable container runtime on a worker node causes a breach. Which responsibility assignment is most accurate?

43 A company migrates from self-managed databases on virtual machines to a managed relational database service. Which responsibility most clearly remains with the customer after migration?

44 A microservices platform currently allows administrators to patch production containers interactively. Which redesign best applies immutability and secure supply-chain principles?

45 A payment API loses connectivity to its external authorization policy service. Which behavior best reflects fail-secure design without unnecessarily disrupting already validated operations?

46 A SaaS platform assumes roles in customer cloud accounts. An attacker creates a different SaaS account and tries to make the platform assume a victim's role, creating a confused-deputy risk. Which condition best mitigates this risk?

47 A multi-cloud service currently stores static cloud access keys in Kubernetes secrets. Which architecture most effectively reduces credential theft and rotation risk?

48 A multi-tenant API has a defect in its object-level authorization code. Which layered control design is most likely to prevent the defect from exposing another tenant's database rows?

49 A workload accesses object storage through a private service endpoint. Security testing shows that compromised code can still upload data to an attacker's bucket through that endpoint. Which change most directly blocks this exfiltration path?

50 All services in a mesh use mutual TLS, but one pod is compromised and makes unauthorized calls using its valid workload certificate. Which additional control most directly addresses this limitation?

51 A cluster runs untrusted third-party containers. A kernel vulnerability could allow a container escape even though Linux capabilities and privileged mode are disabled. Which mitigation most strongly reduces the resulting host-level blast radius?

52 A storage system uses envelope encryption: each object is encrypted with a data-encryption key, and each data-encryption key is wrapped by a key-encryption key in a KMS. The key-encryption key must be rotated without rewriting petabytes of object data. What should the system do?

53 An organization needs backups that remain undeletable for seven years even if its primary cloud administrator account is compromised. Which design provides the strongest protection?

54 Which mapping of AWS security services to their primary functions is correct?

55 An EU company replicates personal data to a US region where support personnel may access plaintext records. The company uses strong encryption at rest. Which action is still required to address GDPR international-transfer obligations?

56 A merchant wants to reduce PCI DSS scope by replacing card numbers with tokens. Which architecture provides the strongest basis for excluding ordinary application services from the cardholder data environment?

57 A company must express equivalent authorization intent across cloud providers whose IAM systems differ in resource hierarchies, deny semantics, and condition operators. Which approach best balances portability and provider-specific correctness?

58 A service has a 30-day availability SLO of . During one hour, of requests fail. Assuming request volume is uniform, approximately what fraction of the entire 30-day error budget is consumed?

59 A company wants to process sensitive data on cloud hosts while reducing trust in the cloud administrator and hypervisor. Which emerging architecture most directly addresses this requirement?

60 An edge-based federated learning system uses secure aggregation, but an attacker controls many participating devices and submits poisoned model updates. Which design most directly reduces poisoning risk while preserving update confidentiality?