Cloud Security and Compliance Questions and Answers

Q: Match each term with what it describes.List IA. AuthenticationB. AuthorisationC. AuditingD. AccountingList II1. recording what the principal actually did2. establishing who the principal is3. attributing resource usage to the principal4. deciding what that principal may do

Correct answer: A-2, B-4, C-1, D-3The four A words in order. Authentication establishes who the principal is; authorisation decides what that principal may do; auditing records what they actually did; and accounting attributes the resource usage to them. Keeping the first two apart matters most in practice, since a great many incidents involve a correctly authenticated principal doing something it should never have been permitted to do.

Q: State whether the following is true or false.Defence in depth means the failure of any one control should not by itself expose the system.

Correct answer: TrueDefence in depth assumes every control will eventually fail or be misconfigured, and arranges matters so that no single failure is sufficient. A database in a private subnet, behind a narrow security group, requiring authentication, encrypted at rest and in transit, and logged, survives the loss of any one of those. It is the reason the layered controls in this topic are used together rather than chosen between.

21.

Match each term with what it describes.
List I
A. Authentication
B. Authorisation
C. Auditing
D. Accounting
List II
1. recording what the principal actually did
2. establishing who the principal is
3. attributing resource usage to the principal
4. deciding what that principal may do

A.A-2, B-4, C-1, D-3
B.A-4, B-2, C-1, D-3
C.A-2, B-4, C-3, D-1
D.A-3, B-1, C-4, D-2

Answer: A

Correct answer: A-2, B-4, C-1, D-3

The four A words in order. Authentication establishes who the principal is; authorisation decides what that principal may do; auditing records what they actually did; and accounting attributes the resource usage to them. Keeping the first two apart matters most in practice, since a great many incidents involve a correctly authenticated principal doing something it should never have been permitted to do.

Discuss in Forum

22.

A public storage bucket exposed to the internet is usually the result of

A.an expired transport certificate
B.a permissive access policy set by the customer
C.a defect in the provider's storage service
D.a failure of encryption at rest

Answer: B

Providers default such storage to private, so exposure nearly always follows an explicit change made for convenience during development. It is among the most frequently reported cloud data incidents and sits squarely on the customer's side of the line.

Discuss in Forum

23.

All of the following reduce the risk of an exposed storage bucket EXCEPT

A.automated scanning of every bucket policy
B.requiring approval for any policy change
C.enabling server side encryption on the bucket
D.an account level block on all public access

Answer: C

Encryption does not change who may call the service and read the objects, so a public bucket of encrypted objects is still a public bucket. The other three all act on the access policy itself. Access is decided before any object is fetched, so that is where the control belongs.

Discuss in Forum

24.

An access key is valid for 90 days and is rotated every 30. Roughly what is the maximum exposure of a key stolen on the day it was issued?

A.90 days
B.120 days
C.1 day
D.30 days

Answer: D

Rotation, not the nominal validity, sets the exposure, since the key is replaced after 30 days regardless. This is exactly why rotation intervals are set well inside the maximum lifetime the system would otherwise allow.

Discuss in Forum

25.

A private subnet differs from a public one in that instances in it

A.have no route to the internet gateway
B.cannot communicate with any other instance
C.cannot be assigned any address at all
D.are automatically encrypted at rest

Answer: A

The distinction is purely a matter of routing. Outbound access, where it is needed, is usually provided through a network address translation gateway, which allows egress without permitting anyone to initiate a connection inward.

Discuss in Forum

26.

Assertion (A): Placing a database in a private subnet is a meaningful security control.
Reason (R): It removes any route by which the internet can initiate a connection to it.

A.A is false but R is true
B.Both A and R are true, and R is the correct explanation of A
C.Both A and R are true, but R is not the correct explanation of A
D.A is true but R is false

Answer: B

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the mechanism. A private subnet has no route to an internet gateway, so no connection can be initiated to the database from outside - the entire class of attacks that begins with an exposed port is removed by the routing table rather than by a filter that might be misconfigured. Outbound access for patching still works through a NAT gateway, which passes nothing inward.

Discuss in Forum

27.

State whether the following is true or false.
Defence in depth means the failure of any one control should not by itself expose the system.

A.True only at large scales
B.False only at small scales
C.True
D.False

Answer: C

Correct answer: True

Defence in depth assumes every control will eventually fail or be misconfigured, and arranges matters so that no single failure is sufficient. A database in a private subnet, behind a narrow security group, requiring authentication, encrypted at rest and in transit, and logged, survives the loss of any one of those. It is the reason the layered controls in this topic are used together rather than chosen between.

Discuss in Forum

28.

Consider the following statements about secrets in application code.
1. A credential committed to a repository must be treated as compromised.
2. Secrets belong in a managed secret store rather than in source.
3. Removing the commit from history makes the credential safe again.

A.3 only
B.1 only
C.All of them
D.1 and 2 only

Answer: D

The first two are correct and are standard practice. The third is unsafe, because the credential may already have been read and rewriting history does not reach every clone or cache. Rotation is the only reliable remedy, and the commit removal is merely tidying up.

Discuss in Forum

29.

Three of the following are preventive controls. Which is the odd one out?

A.an audit log of control plane activity
B.a policy that denies public access
C.multi-factor authentication on the account
D.a security group restricting inbound traffic

Answer: A

The audit log is detective, recording what happened rather than stopping it. The other three each block an action before it takes effect, which is the defining property of a preventive control. A mature design carries both kinds, since neither alone answers every question.

Discuss in Forum

Loading…

Topics

Other Subjects

Tags: Cloud Security and Compliance Questions and Answers || Cloud Security and Compliance MCQ Questions and Answers || Cloud Security and Compliance GK Questions and Answers || Cloud Security and Compliance GK MCQ Questions || Cloud Security and Compliance Multiple Choice Questions and Answers || Cloud Security and Compliance GK || GK on Cloud Security and Compliance || Cloud Computing Questions and Answers || Cloud Computing MCQ Questions and Answers || Cloud Computing GK Questions and Answers || GK on Cloud Computing

Cloud Security and Compliance Questions and Answers

Topics

Other Subjects

About Us

Stay informed about all important Dates & Notifications