Separation of duties in a cloud account means that
Answer: A
It is an organisational control rather than a technical one, and it is enforced with approval workflows and separate roles. It limits both the damage a single compromised account can do and the damage a single mistaken engineer can do.
Please log in or register to report this question.
Consider the following statements about evidencing security controls.
1. An auditor asks for evidence that a control operated, not that it exists.
2. Automated configuration checks produce that evidence continuously.
3. A written policy alone is sufficient evidence that a control operated.
Answer: B
The first two are correct and describe what an audit actually looks for. The third confuses intent with operation, since a policy nobody followed produces no evidence at all and is precisely the gap an audit is designed to find.
Please log in or register to report this question.
Assertion (A): A managed database service does not relieve the customer of security duties.
Reason (R): The customer still controls who may connect to it and what the data contains.
Answer: C
Both are true and the reason gives what remains with the customer, and the most common breaches of such services come from permissive access rules rather than from the provider's patching. The provider's half of the bargain is rarely the half that fails.
Please log in or register to report this question.
Match each control with the layer it protects.
List I
A. Security group
B. Identity policy
C. Encryption at rest
D. Transport encryption
List II
1. data on the storage medium
2. network reachability of an instance
3. data while it crosses the network
4. which principal may call which action
Answer: D
Correct answer: A-2, B-4, C-1, D-3
Four controls at four different layers. A security group filters what may reach the instance over the network. An identity policy decides which principal may call which action. Encryption at rest protects the data on the storage medium. And transport encryption protects it while it crosses the network. Each answers a different question, and none substitutes for another - which is the substance of the defence in depth item at the end of this topic.
Please log in or register to report this question.
The principle of least privilege means a principal is granted
Answer: A
Broad permissions granted for convenience are the usual cause of a small compromise becoming a large one. The discipline is to start from nothing and add what is needed, rather than start from everything and remove what is not.
Please log in or register to report this question.
Assertion (A): Permissions should be granted starting from nothing rather than trimmed back from full access.
Reason (R): Nobody notices a permission that is present but unused, so trimming is never finished.
Answer: B
Both are true and the reason gives why the direction matters, and an over-broad policy produces no error message to prompt its correction. Access reviews exist precisely because the trimming approach does not converge on its own.
Please log in or register to report this question.
State whether the following is true or false.
Encryption at rest protects data against an attacker who has valid credentials to the service.
Answer: C
It protects against theft of the physical medium or of the raw stored blocks. A caller with valid credentials receives the data decrypted, which is why identity controls and encryption solve genuinely different problems and are both required.
Please log in or register to report this question.
All of the following are protected by encryption at rest EXCEPT
Answer: D
A valid credential causes the service to decrypt and return the data as designed. The other three all describe access to the stored bytes without going through the service, which is exactly what encryption at rest defeats.
Please log in or register to report this question.
Customer managed keys differ from provider managed keys chiefly in that
Answer: A
The algorithm is the same in both cases. What changes is who holds the authority over the key, which matters for separation of duties and for the ability to render data unreadable by destroying the key rather than the data.
Please log in or register to report this question.
Assertion (A): Destroying a key can be an effective way of rendering data unrecoverable.
Reason (R): Data encrypted with a destroyed key cannot be decrypted by anyone afterwards.
Answer: B
Both are true and the reason gives the mechanism, and this is the basis of crypto-shredding as an approach to deletion where the storage itself cannot be reliably erased. It also makes accidental key destruction a serious risk.
Please log in or register to report this question.
