ACL Cloud Security Architecture 5

Question 1

Which type of cloud ACL evaluation logic uses Boolean combinations of attributes like department, clearance level, and resource sensitivity to make access decisions?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

ABAC evaluates policies using attributes of the subject, resource, and environment to make fine-grained access control decisions.

Question 2

A Kubernetes NetworkPolicy in a cloud-native deployment is most analogous to which traditional ACL concept?

Accepted Answer

Host-based firewall rules controlling pod-to-pod traffic

Answer

Kubernetes NetworkPolicies function like host-based firewall rules, controlling which pods can communicate with each other within the cluster.

Question 3

When designing cloud ACLs for a PCI DSS-compliant environment, what is the minimum segmentation requirement for the cardholder data environment (CDE)?

Accepted Answer

Firewall ACLs must isolate the CDE from all other network zones

Answer

PCI DSS requires firewall-based network segmentation to isolate the CDE from untrusted networks and reduce the scope of compliance requirements.

Question 4

In AWS, what is the effect of adding an explicit Deny in a Service Control Policy (SCP) on an AWS Organizations member account?

Accepted Answer

The deny applies even to the account's root user for the affected actions

Answer

SCPs restrict the actions available in member accounts including to the root user, though they do not affect the management account itself.

Question 5

Which cloud security architecture pattern uses ACLs to enforce isolation between different customers sharing the same cloud infrastructure?

Accepted Answer

Multi-tenancy isolation via IAM and VPC segmentation

Answer

Cloud providers implement multi-tenancy isolation using IAM policies, VPC boundaries, and network ACLs to ensure one tenant cannot access another's resources.

(ACL) Access Control Lists Practice Test

(ACL) Access Control Lists Practice Test

ACL Cloud Security Architecture 5