Cloud Security Architecture & Design Flashcards

Which cloud security architecture pattern uses a dedicated virtual network with no internet gateway to isolate sensitive workloads?

Answer: Air-gapped VPC

An air-gapped VPC has no internet gateway, ensuring complete network isolation for highly sensitive workloads.

In a multi-cloud security architecture, what is the primary purpose of a Cloud Access Security Broker (CASB)?

Answer: Provide visibility and control over cloud service usage

A CASB sits between users and cloud services to provide visibility, compliance enforcement, and threat protection across cloud usage.

Which security design principle ensures that a compromised cloud component cannot access resources beyond its specific function?

Answer: Least privilege

Least privilege limits each component's access to only what is required for its specific function, containing blast radius.

A company needs to enforce consistent security policies across 50 AWS accounts. Which architecture approach is MOST efficient?

Answer: Use AWS Organizations with Service Control Policies

AWS Organizations with Service Control Policies (SCPs) enforces guardrails across all member accounts centrally.

What is the security advantage of using immutable infrastructure in cloud environments?

Answer: Eliminates the risk of configuration drift and persistent attacks

Immutable infrastructure replaces rather than patches components, eliminating configuration drift and removing any persistent attacker footholds.

Which cloud architecture pattern provides the BEST protection against data exfiltration via DNS tunneling?

Answer: Deploy DNS filtering and logging at the VPC resolver level

DNS filtering at the VPC resolver level inspects and blocks suspicious DNS queries used for tunneling before they leave the network.

In a serverless architecture, which security control is MOST critical to prevent function-to-function lateral movement?

Answer: Assign each function the minimum IAM role required

Assigning each serverless function a unique IAM role with minimum permissions prevents a compromised function from accessing other resources.