CAP Cloud Security Architecture 2 — Questions and Answers
Question 1: Which cloud deployment model places infrastructure on-premises but uses cloud management tools and APIs?
- Public cloud
- Private cloud (Correct answer)
- Hybrid cloud
- Community cloud
Correct answer: Private cloud
Private cloud hosts infrastructure on-premises (or dedicated facilities) while leveraging cloud-like management tools and APIs.
Question 2: In a shared responsibility model, who is responsible for patching the hypervisor in an IaaS environment?
- The tenant/customer
- The cloud service provider (Correct answer)
- A third-party auditor
- The data owner
Correct answer: The cloud service provider
In IaaS, the cloud service provider owns and patches the hypervisor layer; the customer manages OS and above.
Question 3: What is the primary purpose of a Cloud Access Security Broker (CASB)?
- Encrypt data at rest in cloud storage
- Enforce security policies between users and cloud services (Correct answer)
- Manage cloud provider SLAs
- Provision virtual machines automatically
Correct answer: Enforce security policies between users and cloud services
A CASB acts as an intermediary to enforce security policies, visibility, and compliance between enterprise users and cloud services.
Question 4: Which encryption key management approach gives an organization the most control over its keys in a cloud environment?
- Provider-managed keys (PMK)
- Customer-managed keys (CMK) (Correct answer)
- Shared key management
- Ephemeral session keys
Correct answer: Customer-managed keys (CMK)
Customer-managed keys (CMK) allow the organization to generate, store, rotate, and revoke keys independently of the cloud provider.
Question 5: A virtual private cloud (VPC) peering connection allows two VPCs to communicate — what is a key security consideration?
- Peered VPCs automatically share all IAM roles
- Traffic between peered VPCs traverses the public internet
- Overly permissive security groups can expose resources across both VPCs (Correct answer)
- Peering requires disabling encryption in transit
Correct answer: Overly permissive security groups can expose resources across both VPCs
VPC peering routes traffic privately, but misconfigured security groups or NACLs can unintentionally expose resources in both VPCs.
Question 6: Which framework specifically addresses cloud security controls and is published by the Cloud Security Alliance?
- ISO 27001
- NIST SP 800-53
- Cloud Controls Matrix (CCM) (Correct answer)
- CIS Benchmarks
Correct answer: Cloud Controls Matrix (CCM)
The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework specifically designed for cloud environments.
Question 7: What does the concept of 'elasticity' in cloud computing introduce as a security concern?
- Permanent data retention after scale-down
- Attack surface expansion during auto-scaling events (Correct answer)
- Inability to apply encryption to new instances
- Reduced availability during peak loads
Correct answer: Attack surface expansion during auto-scaling events
Auto-scaling can rapidly expand the attack surface by spinning up new instances that may not have the latest security patches or configurations applied.
CAP Cloud Security Architecture 2
Which cloud deployment model places infrastructure on-premises but uses cloud management tools and APIs?