Cloud Security Operations Flashcards

Question 1

What is the shared responsibility model in cloud security?

Accepted Answer

The shared responsibility model divides security duties between the cloud provider and the customer. The provider typically secures the underlying physical facilities, hardware, networking, and hypervisor layer. The customer remains responsible for what it deploys and configures, including its data, identities, access settings, operating system patches on virtual machines, and application code.

Question 2

What are the main cloud service models that change responsibility boundaries?

Accepted Answer

The main models are infrastructure, platform, and software as a service. With infrastructure as a service, the customer manages the operating system, runtime, applications, and data. Platform as a service shifts the operating system and runtime to the provider, leaving applications and data with the customer.

Question 3

What is the difference between a cloud region and an availability zone?

Accepted Answer

A region is a broad geographic area that contains several isolated data center locations. An availability zone is one of those isolated locations within a region, with independent power, cooling, and networking. Deploying across multiple availability zones helps applications survive the failure of a single facility, while multiple regions protect against larger regional outages.

Question 4

Why is the principle of least privilege important in cloud environments?

Accepted Answer

Least privilege means every user, service, and workload receives only the permissions required for its specific task. In cloud environments, automation grants permissions often, so excess access builds up easily. Limiting permissions reduces the damage an attacker can do with a stolen credential and limits the blast radius of a misconfiguration or compromised application.

Question 5

What does a cloud security baseline or hardened configuration accomplish?

Accepted Answer

A security baseline is a documented set of required settings that a system must meet before it enters production. It removes unnecessary services, enables logging, restricts network exposure, and enforces strong authentication. Baselines make configurations repeatable and measurable, so teams can detect drift when a setting changes.

Question 6

What is a cloud misconfiguration and why is it a common cause of breaches?

Accepted Answer

A cloud misconfiguration is an incorrect setting that exposes a resource or weakens its protection, such as a storage bucket readable by the public or a security group open to all addresses. It is common because cloud platforms offer many settings, defaults change over time, and resources can be created quickly by many teams.

Question 7

What is infrastructure as code and how does it support security?

Accepted Answer

Infrastructure as code is the practice of defining cloud resources in version-controlled configuration files rather than creating them by hand. Because the definitions are text, they can be reviewed, tested, and scanned before deployment. Security checks can run automatically in the pipeline, and every change leaves a reviewable history of who altered a setting.

Question 8

What is the purpose of a cloud security posture management tool?

Accepted Answer

A cloud security posture management tool continuously checks cloud accounts and resources against security best practices and compliance benchmarks. It reports misconfigurations, excessive permissions, and unencrypted data stores, and often suggests or applies fixes. Its main value is visibility across many accounts, since teams can rarely verify every setting by hand.

Question 9

What is the difference between authentication and authorization?

Accepted Answer

Authentication verifies who a user or service is, usually through a password, certificate, or token. Authorization decides what that verified identity is allowed to do, such as reading a particular dataset or starting a virtual machine. A system can authenticate a caller correctly and still deny the request if rules do not permit it.

Question 10

Why should cloud workloads use roles instead of long-lived access keys?

Accepted Answer

Roles issue temporary credentials that expire automatically, so there is no permanent secret to store, copy, or leak. A workload assumes a role when it needs access, and the platform rotates the credentials. Long-lived access keys often end up in source code, configuration files, or logs, where they can remain valid for months.

Question 11

What is multifactor authentication and why does it matter for cloud consoles?

Accepted Answer

Multifactor authentication requires a user to prove identity with two or more independent factors, such as a password plus a code from an app or a hardware security key. Cloud consoles control powerful administrative actions, so a stolen password alone should not be enough to log in.

Question 12

How does role-based access control assign permissions to users?

Accepted Answer

Role-based access control groups permissions into named roles, then assigns users or services to those roles instead of granting permissions one by one. A developer role might allow deploying applications to a test environment, while an auditor role allows reading logs without changing anything. Changes are made by editing a role once, which keeps access consistent.

Question 13

What is a service account and how should its permissions be managed?

Accepted Answer

A service account is an identity used by an application or automated process rather than a human user. Its permissions should cover only the API calls and resources the workload needs, and unused grants should be removed. Service accounts should not be shared, because a shared identity hides which workload performed an action.

Question 14

Why are regular access reviews important in cloud identity management?

Accepted Answer

Access reviews periodically confirm that each identity still needs the permissions it holds. People change roles, projects end, and contractors leave, but their access often stays in place by default. Reviews catch this accumulated access, known as privilege creep, before it becomes an opportunity for misuse or an audit finding.

Question 15

What does a federated identity allow an organization to do?

Accepted Answer

Federated identity lets users sign in to cloud services with credentials managed by an existing identity provider, such as the company directory. The organization keeps one authoritative place to create, disable, and audit accounts. When an employee leaves, disabling the directory account also removes access to connected cloud services, which reduces orphaned accounts.

Question 16

How can administrators reduce the risk of standing privileged access?

Accepted Answer

Standing privileged access is permanent administrative rights, which gives attackers a reliable target. Just-in-time elevation reduces this risk by granting elevated rights only when a justified request is approved, and by expiring them automatically after a short period. Logging every elevation creates an audit trail that shows who used high-level access and why.

Question 17

What is the difference between logs, metrics, and traces?

Accepted Answer

Logs are timestamped records of discrete events, such as a login attempt or a configuration change. Metrics are numeric measurements sampled over time, such as CPU load or request counts. Traces follow a single request as it moves across multiple services, showing where time was spent. Security teams use all three, but audit trails depend most heavily on logs.

Question 18

Why should cloud audit logs be stored in a separate, protected account?

Accepted Answer

Audit logs are valuable to attackers because they reveal activity and can be altered to hide it. Storing them in a separate account, with restricted write access and retention lock, means someone who compromises a workload cannot easily erase their own trail. Centralized logs also survive if the original account is compromised or deleted.

Question 19

What does a SIEM do in cloud security monitoring?

Accepted Answer

A security information and event management system collects logs from many sources, normalizes them into a common format, and correlates events to surface suspicious patterns. Analysts use it to search history, build dashboards, and trigger alerts. Its usefulness depends on good log sources and well-tuned rules.

Question 20

What is a detection rule and what makes one effective?

Accepted Answer

A detection rule is a condition applied to log or telemetry data that raises an alert when specific behavior appears, such as many failed logins followed by a success. An effective rule has a clear purpose, a defined threat it addresses, and a known false positive rate.

Question 21

Why is time synchronization important for cloud security logs?

Accepted Answer

Investigators build a timeline of events by comparing timestamps from many systems, so clocks must agree. If one service records time an hour off, its events may appear before the activity that caused them, which confuses analysis. Network Time Protocol is commonly used to keep system clocks aligned.

Question 22

What is a false positive in threat detection, and why does it matter?

Accepted Answer

A false positive is an alert triggered by activity that is actually benign, such as a backup job that reads many files. Too many false positives cause alert fatigue, leading analysts to ignore or dismiss alerts. This can allow a real intrusion to go unnoticed among the noise, so tuning detections is an ongoing security task.

Question 23

How does a cloud intrusion detection service differ from a traditional host-based agent?

Accepted Answer

A managed cloud detection service reads platform telemetry such as control plane activity, network flow records, and DNS queries without installing software on every machine. A traditional host-based agent runs on each server and inspects processes and files directly. Agents see deep system detail, while cloud-native services provide broad coverage across accounts.

Question 24

What is user and entity behavior analytics in cloud monitoring?

Accepted Answer

User and entity behavior analytics builds baselines of normal activity for users, services, and hosts, then flags deviations such as unusual login times or large data transfers. It relies on historical log data and statistical or machine learning models. They help find threats that signature rules miss, but they need analyst review and tuning.

Question 25

What is encryption at rest and encryption in transit?

Accepted Answer

Encryption at rest protects stored data, such as files in object storage, database contents, and disk volumes. Encryption in transit protects data as it moves across a network, typically using Transport Layer Security. Strong protection requires both, because data is exposed in different ways while stored and while being sent between systems.

Question 26

What is envelope encryption and how does it work?

Accepted Answer

Envelope encryption uses a data encryption key to encrypt the data, then encrypts that data key with a master key held in a key management service. The encrypted data key is stored alongside the encrypted data. To decrypt, the service unwraps the data key, and the data key decrypts the content.

Question 27

Why is key management important, and what does a key management service provide?

Accepted Answer

Encryption is only as strong as the protection of its keys, so keys need controlled creation, storage, rotation, and retirement. A key management service stores keys, enforces access policies on who may use each key, and logs every use. Rotating keys on a schedule limits how much data a single compromised key can expose.

Question 28

What is the difference between client-side and server-side encryption?

Accepted Answer

Server-side encryption is performed by the cloud service after data arrives, so the provider handles the encryption process. Client-side encryption happens before data leaves the customer's environment, so the provider stores only ciphertext it cannot read. Client-side approaches give stronger separation but add complexity for key handling, indexing, and search.

Question 29

Why are cloud storage buckets and object stores a frequent data exposure risk?

Accepted Answer

Object storage is designed for easy sharing and broad access, so a single permissive policy can expose every file in a container. Public access settings and overly broad sharing links are common causes. Organizations reduce this risk by blocking public access, and by monitoring for changes to exposure settings.

Question 30

What is data classification and why does it guide protection choices?

Accepted Answer

Data classification sorts information into categories such as public, internal, confidential, and restricted, based on sensitivity and legal obligations. Each category maps to required controls, such as encryption standards, access approval levels, retention periods, and permitted regions. Without classification, teams cannot consistently decide how much protection a dataset needs, so protection is often uneven.

Question 31

What is data loss prevention and what does it typically inspect?

Accepted Answer

Data loss prevention is a set of tools and policies that detect and block sensitive data leaving approved boundaries. It typically inspects content for patterns such as payment card numbers, national identifiers, or confidential labels, and it examines data in storage, in transit, and in use.

Question 32

Why do backups matter for cloud data protection, and what makes them resilient to ransomware?

Accepted Answer

Backups let an organization restore data after deletion, corruption, or encryption by ransomware. Resilient backups are stored in a separate account or location, protected from routine deletion, and often kept immutable for a set retention period. Restore procedures should be tested, because untested backups may fail when they are needed.

Question 33

What are the main phases of cloud incident response?

Accepted Answer

A common framework includes preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation establishes roles, tools, and runbooks before an incident occurs. Containment limits the damage, while eradication removes the attacker's access and persistence. Recovery restores services safely, and lessons learned feed improvements back into preparation.

Question 34

What should a cloud responder do first when a compromised access key is suspected?

Accepted Answer

The first step is to disable or rotate the suspected key so the attacker cannot use it further, while preserving the record of what it did. Responders then review audit logs for actions taken with that key, looking at resources created, data accessed, and new identities or keys issued.

Question 35

Why must evidence be preserved during a cloud incident?

Accepted Answer

Evidence supports root cause analysis, legal obligations, and regulatory reporting, so it must be collected in a trustworthy way. Responders should snapshot volumes, export logs to protected storage, and record hashes and timestamps. Because cloud resources are ephemeral, instances can be terminated and logs can roll over, so preservation steps should begin early.

Question 36

What is a root cause analysis in incident response?

Accepted Answer

Root cause analysis is the process of identifying the underlying condition that allowed an incident to occur, rather than only the symptoms. In cloud incidents, the root cause is often a configuration gap, an excessive permission, or a process failure. The findings should lead to corrective actions with owners and deadlines, so the same weakness does not recur.

Question 37

What does a cloud compliance framework require from operations teams?

Accepted Answer

Compliance frameworks such as those for payment cards or healthcare data set requirements for controls, documentation, and evidence. Operations teams must show that controls are designed correctly and operating over time, not just configured once. Common requirements include access reviews, change records, encryption, logging, and documented responses to security events.

Question 38

How does continuous compliance monitoring differ from periodic audits?

Accepted Answer

Continuous compliance monitoring checks controls automatically and frequently, so drift is found soon after it happens. Periodic audits sample evidence at fixed points, which can miss problems that appear and disappear between reviews. Many teams combine both, using automated checks for ongoing assurance and formal audits to confirm the overall control design.

Question 39

Why is a cloud change management process important for security?

Accepted Answer

Change management ensures that modifications to cloud resources are requested, reviewed, approved, and recorded before or shortly after they take effect. Security reviews catch risky changes such as opening a network port or weakening encryption. Without this process, unauthorized or accidental changes can create exposures that no one notices until an incident occurs.

Question 40

What are the core elements of a post-incident report?

Accepted Answer

A useful post-incident report summarizes what happened, when it was detected, the scope and impact, and how it was contained and recovered. It also describes the root cause, the timeline of key actions, and the corrective actions with owners and due dates. The report should be written for both technical and executive readers.

Cloud Security Operations Flashcards

1Shared Responsibility and Cloud Basics

2Identity and Access Management

3Logging, Monitoring, and Detection

4Data Protection and Encryption

5Incident Response and Compliance

Learning Resources