Cloud Security and Compliance Questions and Answers

Answer: C

The first two are correct and are the core of key hygiene. The third defeats the purpose, since anyone who obtains the storage obtains both the ciphertext and the means to read it. Separating the two is the whole reason a key management service exists at all.

Answer: D

It controls which traffic may reach or leave the instance and tracks connection state, so a permitted outbound request gets its reply back without a matching inbound rule. It says nothing about who the caller is once the connection is made.

Answer: A

Correct answer: encrypting the instance's disks at rest

Encryption at rest does not limit the blast radius, because an attacker who controls the instance has whatever access the instance itself has - the volumes are decrypted transparently for it. What it defends against is the disk being read outside that context. The other three genuinely contain a compromise: a narrow security group limits what the instance can reach, a minimal role limits what it can call, and a private subnet removes the direct route in and out.

Answer: B

Correct answer: 2 - 4 - 1 - 3

Revoke first, because every minute the credential remains valid the attacker can do more. Then read the audit log to find out what it was used for, since nothing can be assessed before that is known. Then contain and remediate whatever that activity affected. Correcting the underlying weakness comes last - essential, but not before the bleeding has stopped.

Answer: C

It is a detective control, not a preventive one, and it cannot stop an action that the permissions allowed. Its value appears entirely after an incident, when the question is what the compromised principal actually did.

Answer: D

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the threat. If the audited account can write to its own log destination, an attacker who takes it over can erase the record of the takeover, and the log is worth nothing at the moment it matters most. Writing to a separate account with append-only permissions and object locking preserves the evidence, which is why it is a standard requirement rather than a refinement.

Answer: A

The password alone no longer suffices, since the second factor is held separately. It is the single most effective control against credential theft and is why it is required on administrative accounts as a matter of course.

Answer: B

Correct answer: the geographic region where data may be stored and processed

Residency is about place: which country or jurisdiction the data may sit and be handled in. It constrains which regions may be used and often which providers, and it is separate from retention, encryption and replication requirements, which may accompany it in a regulation but are distinct obligations.

Answer: C

Correct answer: 1 and 2 only

Statements 1 and 2 are correct and are the whole of the shared responsibility position. A provider’s certification covers the provider’s part of the stack; the customer’s configuration, access control, encryption choices and operating practice are the customer’s part and are audited separately. Statement 3 is the misconception those two exist to correct - a certified region is a prerequisite, not a guarantee.

Answer: D

Both are true and the reason gives the limit of the certificate, and the customer is separately audited on the configuration and processes they control. Providers publish exactly which controls their certificate does and does not cover.