Unit 1: Understanding Cloud Security - Practice Quiz

1 What is the primary purpose of cloud security?

2 Which cloud security method converts readable data into an unreadable form?

3 In the shared responsibility model, who is generally responsible for securing the physical cloud data center?

4 In most cloud services, who is responsible for creating strong passwords for customer accounts?

5 Which issue is a common cloud security challenge?

6 What can happen when a cloud resource is configured with excessive permissions?

7 What is a data breach?

8 Which action can help reduce the impact of a stolen cloud database?

9 Who can be considered an insider threat?

10 Which security principle helps limit damage from an insider threat?

11 What does cloud compliance mainly involve?

12 Which activity helps an organization identify cloud compliance problems?

13 What is the main function of Identity and Access Management (IAM)?

14 Which IAM process confirms that a user is who they claim to be?

15 In Azure Active Directory, what is a tenant?

16 Which item is commonly stored in an Azure Active Directory tenant?

17 Why are users placed into groups in a cloud directory?

18 What should an administrator do when an employee permanently leaves an organization?

19 What does Multi-Factor Authentication (MFA) require?

20 A user receives an unexpected MFA approval request without trying to sign in. What should the user do?

21 An organization stores sensitive customer records in cloud object storage. Which combination of controls best protects the records against unauthorized disclosure?

22 A cloud administrator wants to identify virtual machines that are missing security patches. Which cloud security method is most appropriate?

23 A company runs an application on an Infrastructure as a Service (IaaS) virtual machine. Who is normally responsible for patching the guest operating system?

24 A software company uses a managed Platform as a Service (PaaS) database. Which task is generally the cloud provider's responsibility?

25 A development team creates cloud storage for testing and accidentally allows anonymous internet access. Which common cloud security challenge does this illustrate?

26 An organization uses services from three cloud providers but cannot consistently monitor security events across them. Which action best addresses this challenge?

27 A storage access key is accidentally published in a public code repository. What should the security team do first?

28 After detecting unusual downloads from a cloud database, which evidence would be most useful for determining which identity accessed the records?

29 A database administrator can both approve and execute the export of sensitive customer data. Which control would best reduce the insider threat?

30 An employee who is leaving the company begins downloading unusually large amounts of confidential data. Which control would most directly help detect and stop this behavior?

31 A regulation requires personal data to remain within a specific country. Which cloud design decision most directly supports this requirement?

32 An auditor asks the organization to prove that administrative actions are recorded and retained for one year. Which configuration best meets this requirement?

33 A support engineer needs permission to restart virtual machines but must not create, delete, or resize them. Which IAM approach is most appropriate?

34 A company wants employees to access several cloud applications by authenticating once with the corporate identity provider. Which IAM capability should it implement?

35 A company has several Azure subscriptions that should use the same employee identities. Which arrangement supports this requirement?

36 A partner must access an application in the company's Azure Active Directory tenant while continuing to use the partner organization's credentials. Which feature is most suitable?

37 All members of the Finance department need the same access to a reporting application. What is the most manageable approach?

38 An AAD dynamic group should contain all active users whose department attribute is set to Sales. What is the main management benefit?

39 An attacker obtains an employee's cloud password through phishing. Why can MFA still prevent account access?

40 A remote administrator signs in from an unfamiliar country and attempts to modify production firewall rules. Which response best balances security and legitimate access?

41 An enterprise needs continuous detection of publicly exposed storage, overly permissive IAM policies, and configuration drift across hundreds of cloud subscriptions. Which security method most directly addresses this requirement?

42 A company deploys an application on a managed Platform as a Service offering. A vulnerability is discovered in an application library packaged by the development team, while the underlying operating system is fully patched. Who is primarily responsible for remediating the library?

43 A cloud environment creates and deletes serverless resources within minutes. A nightly scanner repeatedly misses vulnerable resources that existed long enough to process sensitive data. Which change best addresses this visibility gap?

44 An attacker obtains a cloud administrator credential and attempts to erase evidence after downloading sensitive objects. Which preconfigured control would provide the strongest support for reconstructing the breach?

45 A production administrator requires privileged access for occasional maintenance but must not approve their own requests. Access must expire automatically, and every activation must be auditable. Which design best satisfies these requirements?

46 A regulated workload must keep all customer records within one approved country. The primary database is correctly located, but automated backups are copied to a provider-managed recovery region abroad. Encryption is enabled. What is the principal compliance issue?

47 An Azure user receives the Owner role at the subscription scope. A deny assignment at a child resource group prohibits deletion of virtual networks and applies to that user. What happens when the user attempts such a deletion in the resource group?

48 Which statement correctly describes the relationship between an Azure Active Directory tenant and Azure subscriptions?

49 A synchronized user's department attribute changes from Sales to Finance. Two minutes later, the user is still absent from an Azure AD dynamic group whose rule includes users with department equal to Finance. Audit records confirm that the new attribute is present. What is the most likely explanation?

50 An organization enables MFA for all users, yet an attacker successfully authenticates to a mailbox using a stolen password through an older email protocol. Which control gap most plausibly enabled the attack?

51 A tenant-wide Conditional Access policy requires federated authentication and MFA for every administrator. During an outage of the external identity provider, no administrator can sign in. Which prior design would have provided the safest recovery path?

52 A company regularly grants external consultants access to several Azure AD-integrated applications. Access must expire automatically, require sponsor approval, and be periodically recertified. Which Azure AD capability best fits the requirement?

53 An Azure-hosted application must retrieve secrets from Key Vault without storing credentials in source code, configuration files, or deployment pipelines. Which identity approach is most appropriate?

54 A database uses customer-managed encryption keys stored in Key Vault. An internet-facing application is compromised, and its identity already has permission to decrypt and read the database records. What protection do the customer-managed keys provide against this attack?

55 A cloud provider supplies a current independent audit report demonstrating that its infrastructure meets a security standard. Why can the customer not treat the report as complete proof that its own workload is compliant?

56 Users are repeatedly tricked into approving fraudulent push notifications generated through MFA fatigue attacks. Which replacement factor offers the strongest practical resistance to both push fatigue and credential phishing?

57 An engineer must start and stop one production virtual machine for a two-hour maintenance window each week. The engineer currently inherits Contributor access across the subscription. Which redesign best applies least privilege?

58 A database administrator can modify production records and delete the database audit logs that would reveal those modifications. Which architectural control most directly reduces this insider risk?

59 A web application's server-side request forgery vulnerability allows requests to the instance metadata service and exposes a workload identity token. Which measure most directly limits the resulting blast radius?

60 Monitoring confirms that a compromised cloud virtual machine is actively exfiltrating data. Investigators need to stop further loss while preserving useful evidence. Which response is most appropriate?