1What is the primary objective of the 'Shared Responsibility Model' in cloud security?
A.To assign all security liabilities to the Cloud Customer
B.To define which security tasks belong to the provider and which belong to the customer
C.To share security passwords between the provider and the customer
D.To assign all security liabilities to the Cloud Service Provider
Correct Answer: To define which security tasks belong to the provider and which belong to the customer
Explanation:
The Shared Responsibility Model delineates the security obligations of the cloud provider (security of the cloud) and the customer (security in the cloud) based on the service model.
Incorrect! Try again.
2In an IaaS (Infrastructure as a Service) model, which of the following is strictly the customer's responsibility?
A.Physical security of data centers
B.Patching the hypervisor
C.Disposal of physical disk drives
D.Guest operating system updates and application security
Correct Answer: Guest operating system updates and application security
Explanation:
In IaaS, the provider manages the physical hardware and hypervisor, while the customer is responsible for the OS, applications, and data.
Incorrect! Try again.
3Which principle of 'Security by Design' advocates granting users only the permissions necessary to perform their work?
A.Principle of Least Privilege
B.Open Design
C.Security through Obscurity
D.Defense in Depth
Correct Answer: Principle of Least Privilege
Explanation:
The Principle of Least Privilege ensures that entities (users or services) have only the minimum access rights needed to perform their specific tasks.
Incorrect! Try again.
4Which component is considered the 'perimeter' in modern cloud-native security architectures?
A.The router
B.Identity
C.The DMZ
D.The physical firewall
Correct Answer: Identity
Explanation:
In cloud and microservices architectures, network perimeters are porous. Identity and Access Management (IAM) becomes the new effective security perimeter.
Incorrect! Try again.
5What is the main function of IAM (Identity and Access Management)?
A.To encrypt data at rest
B.To authenticate users and authorize access to resources
C.To monitor physical server performance
D.To manage network traffic routing
Correct Answer: To authenticate users and authorize access to resources
Explanation:
IAM is a framework of policies and technologies for ensuring that the right users have the appropriate access to technology resources.
Incorrect! Try again.
6Which attack vector involves an attacker overwhelming a cloud service to make it unavailable to legitimate users?
A.Distributed Denial of Service (DDoS)
B.Man-in-the-Middle (MitM)
C.SQL Injection
D.Cross-Site Scripting (XSS)
Correct Answer: Distributed Denial of Service (DDoS)
Explanation:
DDoS attacks aim to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target with a flood of Internet traffic.
Incorrect! Try again.
7In the context of Cloud Security Layers, where does 'Physical Security' fall?
A.It is the data layer managed by database administrators
B.It is the top layer managed by the customer
C.It is the application layer managed by developers
D.It is the foundational layer managed primarily by the Cloud Service Provider
Correct Answer: It is the foundational layer managed primarily by the Cloud Service Provider
Explanation:
Physical security involves protecting the actual data centers, servers, and hardware, which is the responsibility of the CSP.
Incorrect! Try again.
8What is a 'Security Group' in the context of cloud networking?
A.A team of security guards at the data center
B.A group of users with admin privileges
C.A virtual firewall that controls inbound and outbound traffic for instances
D.A compliance certification
Correct Answer: A virtual firewall that controls inbound and outbound traffic for instances
Explanation:
Security Groups act as virtual firewalls for your instances to control incoming and outgoing traffic at the protocol and port level.
Incorrect! Try again.
9Which concept ensures that data is unreadable to unauthorized users while it is being transmitted over a network?
A.Data Sovereignty
B.Encryption at Rest
C.Encryption in Transit
D.Data Deduplication
Correct Answer: Encryption in Transit
Explanation:
Encryption in transit protects data while it moves between locations, such as between the user and the cloud or between microservices.
Incorrect! Try again.
10What is 'Host Hardening'?
A.Adding more physical RAM to a server
B.Physically reinforcing the server rack
C.The process of securing a system by reducing its surface of vulnerability
D.Overclocking the CPU for better encryption speed
Correct Answer: The process of securing a system by reducing its surface of vulnerability
Explanation:
Host hardening involves removing unnecessary software, closing unused ports, and configuring settings to make a system more secure.
Incorrect! Try again.
11Which tool is commonly used by Cloud Service Providers to manage cryptographic keys?
A.Content Delivery Network (CDN)
B.Virtual Private Cloud (VPC)
C.Load Balancer
D.Key Management Service (KMS)
Correct Answer: Key Management Service (KMS)
Explanation:
KMS is a managed service that makes it easy to create and control the encryption keys used to encrypt data.
Incorrect! Try again.
12What does GDPR stand for in the context of security compliance?
A.Global Data Protection Regulation
B.General Digital Privacy Rule
C.Global Digital Policy Requirement
D.General Data Protection Regulation
Correct Answer: General Data Protection Regulation
Explanation:
GDPR is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.
Incorrect! Try again.
13Which compliance standard is specifically designed to handle credit card information?
A.SOC 2
B.PCI DSS
C.HIPAA
D.ISO 27001
Correct Answer: PCI DSS
Explanation:
The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards.
Incorrect! Try again.
14What is a major interoperability challenge in cloud security?
A.Too much bandwidth availability
B.Lack of internet connection
C.Vendor Lock-in and inconsistent security APIs across providers
D.Cheaper storage costs
Correct Answer: Vendor Lock-in and inconsistent security APIs across providers
Explanation:
Moving security policies and configurations between different cloud providers is difficult due to proprietary formats and APIs, leading to interoperability issues.
Incorrect! Try again.
15What is the purpose of a SIEM (Security Information and Event Management) system in cloud operations?
A.To backup database files
B.To manage payroll
C.To aggregate logs and analyze security alerts in real-time
D.To design user interfaces
Correct Answer: To aggregate logs and analyze security alerts in real-time
Explanation:
SIEM software products and services combine security information management (SIM) and security event management (SEM) for real-time analysis of security alerts.
Incorrect! Try again.
16How does 'Edge Computing' impact cloud security architectures?
A.It expands the attack surface by distributing processing to decentralized locations
B.It eliminates the need for encryption
C.It centralizes all data in one location
D.It removes the need for Identity Management
Correct Answer: It expands the attack surface by distributing processing to decentralized locations
Explanation:
While Edge computing reduces latency, it places compute resources closer to the source, creating a larger and more distributed attack surface that is harder to secure physically and logically.
Incorrect! Try again.
17Which AI application is most beneficial for Cloud Security Operations?
A.Creating 3D graphics
B.Project management scheduling
C.Automated anomaly detection and threat response
D.Generating marketing emails
Correct Answer: Automated anomaly detection and threat response
Explanation:
AI and Machine Learning are used to establish baseline behaviors and detect anomalies that indicate potential security threats much faster than humans can.
Incorrect! Try again.
18In the context of Cloud Microservices, what is 'Service Mesh' primarily used for regarding security?
A.User password resets
B.Database partitioning
C.Physical server cooling
D.Managing service-to-service communication with mTLS (mutual TLS)
Correct Answer: Managing service-to-service communication with mTLS (mutual TLS)
Explanation:
A Service Mesh (like Istio or Linkerd) abstracts network communication, providing features like mutual TLS for secure, encrypted service-to-service communication.
Incorrect! Try again.
19What is 'Data Sovereignty'?
A.A backup strategy for cloud data
B.The speed at which data travels
C.The concept that data is subject to the laws of the country in which it is physically located
D.The idea that data owns itself
Correct Answer: The concept that data is subject to the laws of the country in which it is physically located
Explanation:
Data sovereignty refers to the legal requirement that data is subject to the laws and governance structures within the nation it is collected or stored.
Incorrect! Try again.
20Which of the following is a 'Security by Design' strategy for APIs?
A.Disabling logging to save space
B.Implementing rate limiting and throttling
C.Using hardcoded credentials
D.Making all endpoints public for ease of use
Correct Answer: Implementing rate limiting and throttling
Explanation:
Rate limiting protects APIs from abuse, such as DDoS attacks or brute force attempts, by limiting the number of requests a user can make.
Incorrect! Try again.
21What is the risk of 'Insider Threats' in cloud computing?
A.Software bugs in open source libraries
B.Hardware failure due to overheating
C.Authorized users misusing their access privileges
D.External hackers breaching the firewall
Correct Answer: Authorized users misusing their access privileges
Explanation:
Insider threats come from employees, contractors, or partners who have legitimate access but use it maliciously or accidentally to harm the system.
Incorrect! Try again.
22What does Multi-Factor Authentication (MFA) add to security?
A.It speeds up the login process
B.It removes the need for passwords
C.It adds layers of verification beyond just a password (e.g., something you have or are)
D.It requires multiple users to log in at once
Correct Answer: It adds layers of verification beyond just a password (e.g., something you have or are)
Explanation:
MFA requires two or more verification methods (password + token/biometric), significantly reducing the risk of compromised credentials.
Incorrect! Try again.
23In cloud monitoring, what is the difference between 'Logs' and 'Metrics'?
A.Logs are numerical data; Metrics are text records
B.There is no difference
C.Logs record discrete events; Metrics measure numerical data over time
D.Metrics are only for billing; Logs are only for security
Correct Answer: Logs record discrete events; Metrics measure numerical data over time
Explanation:
Logs provide detailed context about specific events (e.g., 'User X failed login'), while metrics provide statistical data (e.g., 'CPU usage is 80%').
Incorrect! Try again.
24What is 'Federated Identity'?
A.A government-issued ID
B.Linking a user's identity across multiple distinct security domains
C.Using the same password for all websites
D.An anonymous login method
Correct Answer: Linking a user's identity across multiple distinct security domains
Explanation:
Federated identity allows a user to use one set of credentials to access applications across different organizations or domains (e.g., 'Login with Google').
Incorrect! Try again.
25Which cloud security tool is primarily used for identifying vulnerabilities in container images?
A.VPN
B.Container Registry Scanning
C.Load Balancer
D.Network Firewall
Correct Answer: Container Registry Scanning
Explanation:
Container scanning tools analyze container images for known vulnerabilities (CVEs) before they are deployed.
Incorrect! Try again.
26What is the purpose of a 'Bastion Host' or 'Jump Box'?
A.To store backup files
B.To run the web application frontend
C.To serve as a secure gateway for administrators to access private resources
D.To host the main database
Correct Answer: To serve as a secure gateway for administrators to access private resources
Explanation:
A Bastion Host is a special-purpose computer on a network specifically designed and configured to withstand attacks, used as a secure entry point.
Incorrect! Try again.
27Which regulation governs the protection of personal health information in the US?
A.HIPAA
B.GDPR
C.SOX
D.FERPA
Correct Answer: HIPAA
Explanation:
The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for sensitive patient data protection.
Incorrect! Try again.
28What is 'Defense in Depth'?
A.Using multiple layered security controls to protect data
B.Using a very thick firewall
C.A military strategy not applicable to cloud
D.Relying solely on encryption
Correct Answer: Using multiple layered security controls to protect data
Explanation:
Defense in Depth is an information assurance concept in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system.
Incorrect! Try again.
29What is a 'Zero Trust' architecture?
A.Never trust, always verify, regardless of network location
B.Trusting everyone inside the network but no one outside
C.Not trusting the cloud provider
D.Operating without any security software
Correct Answer: Never trust, always verify, regardless of network location
Explanation:
Zero Trust assumes that threats exist both inside and outside the network and requires strict identity verification for every person and device accessing resources.
Incorrect! Try again.
30Which interoperability standard allows the exchange of authentication and authorization data between security domains?
SAML is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.
Incorrect! Try again.
31What is the primary security concern regarding 'Shadow IT' in cloud environments?
A.Unsanctioned use of cloud services leads to lack of visibility and control
B.It requires dark mode interfaces
C.It costs too much money
D.It slows down the internet speed
Correct Answer: Unsanctioned use of cloud services leads to lack of visibility and control
Explanation:
Shadow IT refers to IT systems deployed by departments other than the central IT department, bypassing security controls and compliance checks.
Incorrect! Try again.
32In the Shared Responsibility Model for SaaS (Software as a Service), what is the customer responsible for?
A.Application code
B.Physical security
C.Data and Identity Management
D.Network controls
Correct Answer: Data and Identity Management
Explanation:
In SaaS, the provider manages the entire stack (App, OS, Infrastructure), leaving the customer responsible primarily for their data, user identities, and access policies.
Incorrect! Try again.
33What is 'Cloud Security Posture Management' (CSPM)?
A.Automated tools that identify misconfigurations and compliance risks in cloud environments
B.Managing physical security guards
C.Writing code for cloud applications
D.Training employees on posture ergonomics
Correct Answer: Automated tools that identify misconfigurations and compliance risks in cloud environments
Explanation:
CSPM tools continuously monitor cloud environments to detect misconfigurations (like open S3 buckets) and ensure compliance.
Incorrect! Try again.
34How does 'Casus belli' relate to Cyberwarfare in future cloud trends? (Note: Contextual interpretation)
A.It is a new coding language
B.It refers to acts that justify war, now potentially including severe state-sponsored cyberattacks
C.It is a cloud monitoring tool
D.It refers to AI-generated code
Correct Answer: It refers to acts that justify war, now potentially including severe state-sponsored cyberattacks
Explanation:
While a traditional term, in future trends, severe attacks on critical cloud infrastructure by AI or state actors are increasingly discussed as potential acts of war.
Incorrect! Try again.
35What is a 'Man-in-the-Middle' (MitM) attack?
A.An attack where the attacker secretly relays and possibly alters communications between two parties
B.A physical theft of a server
C.A virus that deletes data
D.An attack on the central server
Correct Answer: An attack where the attacker secretly relays and possibly alters communications between two parties
Explanation:
In MitM attacks, the attacker intercepts communication between two systems to eavesdrop or manipulate data.
Incorrect! Try again.
36Why is 'Observability' important for security performance management?
A.It allows you to see the physical servers
B.It enables understanding the internal state of a system based on external outputs (logs, metrics, traces) to diagnose security incidents
C.It is required by law
D.It reduces the cost of storage
Correct Answer: It enables understanding the internal state of a system based on external outputs (logs, metrics, traces) to diagnose security incidents
Explanation:
Observability goes beyond simple monitoring; it helps teams understand why a security anomaly or performance issue is happening within complex microservices.
Incorrect! Try again.
37Which of the following is a challenge of AI in cloud security?
A.AI cannot process data
B.AI works too slowly
C.AI requires manual operation
D.Adversarial attacks where attackers manipulate input data to fool AI models
Correct Answer: Adversarial attacks where attackers manipulate input data to fool AI models
Explanation:
A major future risk is adversarial AI, where attackers reverse-engineer or poison the learning models used by security systems to bypass detection.
Incorrect! Try again.
38What role does 'DevSecOps' play in security?
A.It integrates security practices into the DevOps software delivery lifecycle
B.It is a specific software tool
C.It separates developers from security teams
D.It slows down deployment
Correct Answer: It integrates security practices into the DevOps software delivery lifecycle
Explanation:
DevSecOps emphasizes 'shifting left', meaning security is addressed early in the development process rather than at the end.
Incorrect! Try again.
39What is 'Data Loss Prevention' (DLP)?
A.A method to delete data permanently
B.A backup system
C.A database optimization technique
D.Software that detects and prevents potential data breaches by blocking sensitive data from leaving the network
Correct Answer: Software that detects and prevents potential data breaches by blocking sensitive data from leaving the network
Explanation:
DLP tools monitor data in use, in motion, and at rest to prevent sensitive information (like credit card numbers) from being leaked.
Incorrect! Try again.
40Which encryption type protects data stored on a hard drive or database?
A.Symmetric Encryption only
B.Encryption in Transit
C.Encryption at Rest
D.End-to-End Encryption
Correct Answer: Encryption at Rest
Explanation:
Encryption at rest ensures that if physical media is stolen or accessed improperly, the data remains unreadable without the key.
Incorrect! Try again.
41What is the primary function of a Web Application Firewall (WAF)?
A.To filter email spam
B.To block all internet access
C.To scan for viruses on user desktops
D.To protect web applications by filtering and monitoring HTTP traffic
Correct Answer: To protect web applications by filtering and monitoring HTTP traffic
Explanation:
A WAF protects against web-specific attacks like SQL injection and Cross-Site Scripting (XSS) at the application layer.
Incorrect! Try again.
42What is a 'Hypervisor' security risk?
A.It cannot run Windows
B.The hypervisor is too slow
C.VM Escape, where an attacker breaks out of a virtual machine to access the host
D.It uses too much electricity
Correct Answer: VM Escape, where an attacker breaks out of a virtual machine to access the host
Explanation:
If a hypervisor is compromised (VM Escape), the attacker could potentially access all virtual machines running on that physical host.
Incorrect! Try again.
43In the context of Interoperability, what is 'Portability'?
A.Using mobile phones for access
B.The speed of the network
C.The weight of the server
D.The ability to move applications and data from one cloud provider to another
Correct Answer: The ability to move applications and data from one cloud provider to another
Explanation:
Portability ensures that customers are not locked into a single vendor and can migrate their systems with minimal friction.
Incorrect! Try again.
44What is SOC 2 (Service Organization Control 2)?
A.A networking protocol
B.A programming language
C.A type of computer chip
D.A compliance standard for service organizations, focusing on security, availability, processing integrity, confidentiality, and privacy
Correct Answer: A compliance standard for service organizations, focusing on security, availability, processing integrity, confidentiality, and privacy
Explanation:
SOC 2 is an auditing procedure that ensures service providers securely manage your data to protect the interests of your organization and the privacy of its clients.
Incorrect! Try again.
45Which future trend involves processing data on local devices (like IoT) rather than sending it to a centralized cloud?
A.Edge Computing
B.Monolithic Computing
C.Mainframe Computing
D.Centralized Computing
Correct Answer: Edge Computing
Explanation:
Edge computing brings computation and data storage closer to the sources of data (IoT devices), improving response times and saving bandwidth.
Incorrect! Try again.
46What is 'Configuration Drift'?
A.When ad-hoc changes cause environments to diverge from their known secure state
B.A racing game
C.Slow internet speeds
D.Moving servers to a new location
Correct Answer: When ad-hoc changes cause environments to diverge from their known secure state
Explanation:
Configuration drift occurs when changes are made directly to production environments without going through proper configuration management, leading to security inconsistencies.
Incorrect! Try again.
47What is the benefit of 'Immutable Infrastructure' for security?
A.It is cheaper
B.Servers are never modified after deployment; they are replaced with new instances
C.It allows manual patching
D.Servers are never replaced
Correct Answer: Servers are never modified after deployment; they are replaced with new instances
Explanation:
Immutable infrastructure prevents configuration drift and ensures that if a server is compromised, it is quickly destroyed and replaced with a fresh, secure image.
Incorrect! Try again.
48Which tool is an example of 'Infrastructure as Code' (IaC) that helps standardize security configurations?
A.Photoshop
B.Terraform
C.Skype
D.Microsoft Word
Correct Answer: Terraform
Explanation:
Terraform allows you to define infrastructure in code, ensuring that security groups, VPCs, and IAM roles are deployed consistently and securely.
Incorrect! Try again.
49What is the primary goal of a 'Penetration Test'?
A.To repair broken hardware
B.To simulate a cyberattack against your computer system to check for exploitable vulnerabilities
C.To train users on phishing
D.To install antivirus software
Correct Answer: To simulate a cyberattack against your computer system to check for exploitable vulnerabilities
Explanation:
Penetration testing (ethical hacking) involves authorized simulated attacks to identify weaknesses before malicious attackers do.
Incorrect! Try again.
50How does 'Fog Computing' relate to Cloud Security?
A.It deletes old data
B.It is a weather monitoring system
C.It clouds the vision of attackers
D.It is an intermediate layer between the Edge and the Cloud, requiring security protocols for data aggregation
Correct Answer: It is an intermediate layer between the Edge and the Cloud, requiring security protocols for data aggregation
Explanation:
Fog computing extends the cloud to be closer to the things that produce and act on IoT data. It requires securing the nodes that aggregate data before sending it to the central cloud.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →