Cloud Security and Compliance Questions and Answers

Answer: A

Correct answer: A-2, B-4, C-1, D-3

The four A words in order. Authentication establishes who the principal is; authorisation decides what that principal may do; auditing records what they actually did; and accounting attributes the resource usage to them. Keeping the first two apart matters most in practice, since a great many incidents involve a correctly authenticated principal doing something it should never have been permitted to do.

Answer: B

Providers default such storage to private, so exposure nearly always follows an explicit change made for convenience during development. It is among the most frequently reported cloud data incidents and sits squarely on the customer's side of the line.

Answer: C

Encryption does not change who may call the service and read the objects, so a public bucket of encrypted objects is still a public bucket. The other three all act on the access policy itself. Access is decided before any object is fetched, so that is where the control belongs.

Answer: D

Rotation, not the nominal validity, sets the exposure, since the key is replaced after 30 days regardless. This is exactly why rotation intervals are set well inside the maximum lifetime the system would otherwise allow.

Answer: A

The distinction is purely a matter of routing. Outbound access, where it is needed, is usually provided through a network address translation gateway, which allows egress without permitting anyone to initiate a connection inward.

Answer: B

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the mechanism. A private subnet has no route to an internet gateway, so no connection can be initiated to the database from outside - the entire class of attacks that begins with an exposed port is removed by the routing table rather than by a filter that might be misconfigured. Outbound access for patching still works through a NAT gateway, which passes nothing inward.

Answer: C

Correct answer: True

Defence in depth assumes every control will eventually fail or be misconfigured, and arranges matters so that no single failure is sufficient. A database in a private subnet, behind a narrow security group, requiring authentication, encrypted at rest and in transit, and logged, survives the loss of any one of those. It is the reason the layered controls in this topic are used together rather than chosen between.

Answer: D

The first two are correct and are standard practice. The third is unsafe, because the credential may already have been read and rewriting history does not reach every clone or cache. Rotation is the only reliable remedy, and the commit removal is merely tidying up.

Answer: A

The audit log is detective, recording what happened rather than stopping it. The other three each block an action before it takes effect, which is the defining property of a preventive control. A mature design carries both kinds, since neither alone answers every question.