Cloud Security and Compliance Questions and Answers

Q: Three of the following limit the blast radius of a compromised instance. Which is the odd one out?

Correct answer: encrypting the instance's disks at restEncryption at rest does not limit the blast radius, because an attacker who controls the instance has whatever access the instance itself has - the volumes are decrypted transparently for it. What it defends against is the disk being read outside that context. The other three genuinely contain a compromise: a narrow security group limits what the instance can reach, a minimal role limits what it can call, and a private subnet removes the direct route in and out.

Q: Arrange these steps of responding to a suspected credential compromise in order.1. assess and contain what that activity affected2. revoke or rotate the credential immediately3. correct the weakness that exposed the credential4. review the audit log for what it was used to do

Correct answer: 2 - 4 - 1 - 3Revoke first, because every minute the credential remains valid the attacker can do more. Then read the audit log to find out what it was used for, since nothing can be assessed before that is known. Then contain and remediate whatever that activity affected. Correcting the underlying weakness comes last - essential, but not before the bleeding has stopped.

Q: Consider the following statements about compliance regimes.1. A provider's certification does not by itself make the customer compliant.2. The customer must still configure and operate their part correctly.3. Deploying to a certified region guarantees the customer is compliant.

Correct answer: 1 and 2 onlyStatements 1 and 2 are correct and are the whole of the shared responsibility position. A provider’s certification covers the provider’s part of the stack; the customer’s configuration, access control, encryption choices and operating practice are the customer’s part and are audited separately. Statement 3 is the misconception those two exist to correct - a certified region is a prerequisite, not a guarantee.

11.

Consider the following statements about key management.
1. Rotating a key limits the exposure of any single compromised key.
2. Keys and the data they protect should be under separate controls.
3. A key stored beside the data it encrypts provides good protection.

A.1 only
B.All of them
C.1 and 2 only
D.3 only

Answer: C

The first two are correct and are the core of key hygiene. The third defeats the purpose, since anyone who obtains the storage obtains both the ciphertext and the means to read it. Separating the two is the whole reason a key management service exists at all.

Discuss in Forum

12.

A security group most closely resembles

A.a set of identity permissions for a principal
B.an encryption policy applied to stored data
C.a logging configuration for the control plane
D.a stateful firewall attached to an instance

Answer: D

It controls which traffic may reach or leave the instance and tracks connection state, so a permitted outbound request gets its reply back without a matching inbound rule. It says nothing about who the caller is once the connection is made.

Discuss in Forum

13.

Three of the following limit the blast radius of a compromised instance. Which is the odd one out?

A.encrypting the instance's disks at rest
B.a narrow security group on the instance
C.a minimal instance role with few permissions
D.placing the instance in a private subnet

Answer: A

Correct answer: encrypting the instance's disks at rest

Encryption at rest does not limit the blast radius, because an attacker who controls the instance has whatever access the instance itself has - the volumes are decrypted transparently for it. What it defends against is the disk being read outside that context. The other three genuinely contain a compromise: a narrow security group limits what the instance can reach, a minimal role limits what it can call, and a private subnet removes the direct route in and out.

Discuss in Forum

14.

Arrange these steps of responding to a suspected credential compromise in order.
1. assess and contain what that activity affected
2. revoke or rotate the credential immediately
3. correct the weakness that exposed the credential
4. review the audit log for what it was used to do

A.2 - 1 - 4 - 3
B.2 - 4 - 1 - 3
C.3 - 1 - 4 - 2
D.4 - 2 - 1 - 3

Answer: B

Correct answer: 2 - 4 - 1 - 3

Revoke first, because every minute the credential remains valid the attacker can do more. Then read the audit log to find out what it was used for, since nothing can be assessed before that is known. Then contain and remediate whatever that activity affected. Correcting the underlying weakness comes last - essential, but not before the bleeding has stopped.

Discuss in Forum

15.

An audit log of control plane activity is valuable chiefly because

A.it encrypts the data the actions touched
B.it replaces the need for access controls
C.it records who did what and when after the fact
D.it prevents unauthorised actions from occurring

Answer: C

It is a detective control, not a preventive one, and it cannot stop an action that the permissions allowed. Its value appears entirely after an incident, when the question is what the compromised principal actually did.

Discuss in Forum

16.

Assertion (A): Audit logs should be written to a destination the audited account cannot modify.
Reason (R): An attacker with control of the account would otherwise delete the record of their activity.

A.Both A and R are true, but R is not the correct explanation of A
B.A is true but R is false
C.A is false but R is true
D.Both A and R are true, and R is the correct explanation of A

Answer: D

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the threat. If the audited account can write to its own log destination, an attacker who takes it over can erase the record of the takeover, and the log is worth nothing at the moment it matters most. Writing to a separate account with append-only permissions and object locking preserves the evidence, which is why it is a standard requirement rather than a refinement.

Discuss in Forum

17.

State whether the following is true or false.
Multi-factor authentication protects an account whose password has been stolen.

A.True
B.False
C.True only at large scales
D.False only at small scales

Answer: A

The password alone no longer suffices, since the second factor is held separately. It is the single most effective control against credential theft and is why it is required on administrative accounts as a matter of course.

Discuss in Forum

18.

Data residency requirements constrain

A.how long a backup of the data may be retained for
B.the geographic region where data may be stored and processed
C.the encryption algorithm that must be used on the data
D.the number of replicated copies that may be kept at once

Answer: B

Correct answer: the geographic region where data may be stored and processed

Residency is about place: which country or jurisdiction the data may sit and be handled in. It constrains which regions may be used and often which providers, and it is separate from retention, encryption and replication requirements, which may accompany it in a regulation but are distinct obligations.

Discuss in Forum

19.

Consider the following statements about compliance regimes.
1. A provider's certification does not by itself make the customer compliant.
2. The customer must still configure and operate their part correctly.
3. Deploying to a certified region guarantees the customer is compliant.

A.1 only
B.All of them
C.1 and 2 only
D.3 only

Answer: C

Correct answer: 1 and 2 only

Statements 1 and 2 are correct and are the whole of the shared responsibility position. A provider’s certification covers the provider’s part of the stack; the customer’s configuration, access control, encryption choices and operating practice are the customer’s part and are audited separately. Statement 3 is the misconception those two exist to correct - a certified region is a prerequisite, not a guarantee.

Discuss in Forum

20.

Assertion (A): A provider's compliance certification is necessary but not sufficient for the customer.
Reason (R): It covers only the provider's own layer of the shared responsibility model.

A.Both A and R are true, but R is not the correct explanation of A
B.A is true but R is false
C.A is false but R is true
D.Both A and R are true, and R is the correct explanation of A

Answer: D

Both are true and the reason gives the limit of the certificate, and the customer is separately audited on the configuration and processes they control. Providers publish exactly which controls their certificate does and does not cover.

Discuss in Forum

Loading…

Topics

Other Subjects

Tags: Cloud Security and Compliance Questions and Answers || Cloud Security and Compliance MCQ Questions and Answers || Cloud Security and Compliance GK Questions and Answers || Cloud Security and Compliance GK MCQ Questions || Cloud Security and Compliance Multiple Choice Questions and Answers || Cloud Security and Compliance GK || GK on Cloud Security and Compliance || Cloud Computing Questions and Answers || Cloud Computing MCQ Questions and Answers || Cloud Computing GK Questions and Answers || GK on Cloud Computing

Cloud Security and Compliance Questions and Answers

Topics

Other Subjects

About Us

Stay informed about all important Dates & Notifications