ACL Cloud Security Architecture 3

Question 1

What happens when both an AWS Identity-Based Policy and a Resource-Based Policy exist for the same action, and neither has an explicit Deny?

Accepted Answer

Access is granted if either policy allows it

Answer

When both policy types exist without explicit denies, access is granted if either the identity-based or resource-based policy allows the action.

Question 2

Which AWS Organization feature allows enforcing ACL guardrails across all member accounts simultaneously?

Accepted Answer

Service Control Policies (SCPs)

Answer

SCPs applied at the AWS Organization level create guardrails that restrict what actions member accounts can perform, even for their root users.

Question 3

A cloud ACL rule with a lower rule number is evaluated before a rule with a higher number. What should the last rule in an AWS NACL always be?

Accepted Answer

An explicit deny-all rule (*)

Answer

AWS NACLs include an implicit deny-all at rule number *, which blocks any traffic not matched by earlier explicit rules.

Question 4

In cloud security architecture, what does 'micro-segmentation' achieve that traditional perimeter ACLs cannot?

Accepted Answer

Granular east-west traffic controls between individual workloads

Answer

Micro-segmentation applies ACL controls between individual workloads inside the data center or cloud VPC, limiting lateral movement after a breach.

Question 5

Which cloud-native control enforces ACLs on API calls to cloud management planes rather than on data-plane network traffic?

Accepted Answer

IAM policies

Answer

IAM policies control access to cloud provider APIs (management plane), whereas network ACLs and firewalls govern data-plane traffic flows.

(ACL) Access Control Lists Practice Test