ACL Cloud Security Architecture 3 — Questions and Answers
Question 1: What happens when both an AWS Identity-Based Policy and a Resource-Based Policy exist for the same action, and neither has an explicit Deny?
- The identity-based policy always wins
- Access is denied by default unless at least one policy allows it
- Access is granted if either policy allows it (Correct answer)
- The resource-based policy always takes precedence
Correct answer: Access is granted if either policy allows it
When both policy types exist without explicit denies, access is granted if either the identity-based or resource-based policy allows the action.
Question 2: Which AWS Organization feature allows enforcing ACL guardrails across all member accounts simultaneously?
- AWS Config Rules
- Service Control Policies (SCPs) (Correct answer)
- IAM Permission Boundaries
- AWS Trusted Advisor
Correct answer: Service Control Policies (SCPs)
SCPs applied at the AWS Organization level create guardrails that restrict what actions member accounts can perform, even for their root users.
Question 3: A cloud ACL rule with a lower rule number is evaluated before a rule with a higher number. What should the last rule in an AWS NACL always be?
- An allow-all rule for outbound traffic
- An explicit deny-all rule (*) (Correct answer)
- An allow for administrative SSH traffic
- A log rule for audit purposes
Correct answer: An explicit deny-all rule (*)
AWS NACLs include an implicit deny-all at rule number *, which blocks any traffic not matched by earlier explicit rules.
Question 4: In cloud security architecture, what does 'micro-segmentation' achieve that traditional perimeter ACLs cannot?
- Faster packet processing at the network edge
- Granular east-west traffic controls between individual workloads (Correct answer)
- Elimination of the need for encryption
- Simplified ACL rule management
Correct answer: Granular east-west traffic controls between individual workloads
Micro-segmentation applies ACL controls between individual workloads inside the data center or cloud VPC, limiting lateral movement after a breach.
Question 5: Which cloud-native control enforces ACLs on API calls to cloud management planes rather than on data-plane network traffic?
- Virtual firewall rules
- Network ACLs
- IAM policies (Correct answer)
- WAF rules
Correct answer: IAM policies
IAM policies control access to cloud provider APIs (management plane), whereas network ACLs and firewalls govern data-plane traffic flows.
Question 6: What is the recommended practice when an S3 bucket ACL conflicts with a bucket policy in AWS?
- The bucket ACL always overrides the bucket policy
- AWS evaluates both, and an explicit deny in either will block access (Correct answer)
- The bucket policy always overrides the bucket ACL
- Conflicts result in automatic denial with no evaluation
Correct answer: AWS evaluates both, and an explicit deny in either will block access
AWS evaluates all applicable policies together; an explicit Deny in any policy (ACL or bucket policy) overrides all Allows.
Question 7: In Azure, which resource acts as the cloud equivalent of a network ACL applied at the subnet level?
- Azure Firewall Policy
- Network Security Group (NSG) (Correct answer)
- Application Security Group (ASG)
- Azure DDoS Protection
Correct answer: Network Security Group (NSG)
Azure NSGs contain inbound and outbound security rules that filter traffic at the subnet or NIC level using priority-ordered rules.
ACL Cloud Security Architecture 3
What happens when both an AWS Identity-Based Policy and a Resource-Based Policy exist for the same action, and neither has an explicit Deny?