ACL Cloud Security Architecture 2

Question 1

Which cloud ACL model evaluates permissions at the resource level rather than at the identity level?

Accepted Answer

Resource-Based Policy

Answer

Resource-based policies are attached directly to cloud resources (e.g., S3 buckets) and define who can access that specific resource.

Question 2

In AWS, which service acts as the central ACL enforcement point for cross-account resource access?

Accepted Answer

AWS IAM with resource-based policies

Answer

IAM resource-based policies with Principal elements allow cross-account access by explicitly naming trusted accounts or roles.

Question 3

A Security Group in AWS is best described as which type of access control?

Accepted Answer

Stateful virtual firewall ACL

Answer

Security Groups are stateful, meaning return traffic is automatically allowed without explicit outbound rules for established connections.

Question 4

What is the primary difference between AWS Network ACLs and Security Groups in cloud architecture?

Accepted Answer

NACLs operate at the subnet level and are stateless; Security Groups operate at the instance level and are stateful

Answer

NACLs process rules in numbered order at the subnet boundary and are stateless, while Security Groups are stateful and apply per-instance.

Question 5

In a Zero Trust cloud architecture, which principle governs how ACLs should be applied to internal network segments?

Accepted Answer

Never trust, always verify — apply least-privilege ACLs everywhere

Answer

Zero Trust mandates that no traffic is implicitly trusted regardless of network location, requiring explicit ACL verification for every connection.

(ACL) Access Control Lists Practice Test