ACL Cloud Security Architecture 2 — Questions and Answers
Question 1: Which cloud ACL model evaluates permissions at the resource level rather than at the identity level?
- Role-Based Access Control
- Resource-Based Policy (Correct answer)
- Attribute-Based Access Control
- Mandatory Access Control
Correct answer: Resource-Based Policy
Resource-based policies are attached directly to cloud resources (e.g., S3 buckets) and define who can access that specific resource.
Question 2: In AWS, which service acts as the central ACL enforcement point for cross-account resource access?
- AWS Config
- AWS IAM with resource-based policies (Correct answer)
- AWS CloudTrail
- AWS Shield
Correct answer: AWS IAM with resource-based policies
IAM resource-based policies with Principal elements allow cross-account access by explicitly naming trusted accounts or roles.
Question 3: A Security Group in AWS is best described as which type of access control?
- Stateless packet filter
- Stateful virtual firewall ACL (Correct answer)
- Network ACL at the subnet level
- Identity-based permission boundary
Correct answer: Stateful virtual firewall ACL
Security Groups are stateful, meaning return traffic is automatically allowed without explicit outbound rules for established connections.
Question 4: What is the primary difference between AWS Network ACLs and Security Groups in cloud architecture?
- NACLs are stateful; Security Groups are stateless
- NACLs operate at the subnet level and are stateless; Security Groups operate at the instance level and are stateful (Correct answer)
- Security Groups require explicit deny rules; NACLs do not
- NACLs support IPv6; Security Groups do not
Correct answer: NACLs operate at the subnet level and are stateless; Security Groups operate at the instance level and are stateful
NACLs process rules in numbered order at the subnet boundary and are stateless, while Security Groups are stateful and apply per-instance.
Question 5: In a Zero Trust cloud architecture, which principle governs how ACLs should be applied to internal network segments?
- Trust all internal traffic by default
- Block only known threats
- Never trust, always verify — apply least-privilege ACLs everywhere (Correct answer)
- Apply ACLs only at the perimeter
Correct answer: Never trust, always verify — apply least-privilege ACLs everywhere
Zero Trust mandates that no traffic is implicitly trusted regardless of network location, requiring explicit ACL verification for every connection.
Question 6: Which cloud ACL feature allows administrators to define maximum permission boundaries for IAM entities without granting those permissions directly?
- Service Control Policies
- Permission Boundaries (Correct answer)
- Inline Policies
- Trust Policies
Correct answer: Permission Boundaries
Permission Boundaries set the maximum permissions an IAM entity can have, but the entity still needs identity-based policies to actually use those permissions.
Question 7: In GCP, which construct is equivalent to AWS Security Groups for controlling VM-level network traffic?
- Cloud Armor policies
- VPC firewall rules with target tags or service accounts (Correct answer)
- Cloud NAT rules
- Shared VPC ACLs
Correct answer: VPC firewall rules with target tags or service accounts
GCP VPC firewall rules applied via network tags or service accounts control ingress/egress traffic at the VM instance level.
ACL Cloud Security Architecture 2
Which cloud ACL model evaluates permissions at the resource level rather than at the identity level?