Cloud Architecture and Security Controls Flashcards

In the CSA Cloud Controls Matrix (CCM), what is the primary purpose of the control domains?

Answer: To provide security controls mapped to industry standards and cloud service models

The CCM provides a framework of security controls aligned to cloud service models and mapped to standards like ISO 27001, NIST, and PCI DSS.

What is 'cloud bursting' and what security challenge does it introduce?

Answer: Dynamically extending workloads from private to public cloud; it creates data spillage risk

Cloud bursting moves workloads to public cloud under peak load, creating risk that sensitive data may leave the private environment without proper controls.

Which of the following best describes a 'cloud broker' in the NIST cloud computing model?

Answer: An entity that manages use, performance, and delivery of cloud services between providers and consumers

A cloud broker acts as an intermediary who negotiates relationships and manages cloud services between providers and consumers.

What security advantage does immutable infrastructure provide in cloud environments?

Answer: It reduces configuration drift and ensures consistency across deployments

Immutable infrastructure replaces rather than patches instances, preventing configuration drift and ensuring every deployment matches a known good state.

In cloud security architecture, what is the function of a 'security group'?

Answer: A virtual firewall controlling inbound and outbound traffic to instances

Security groups act as virtual firewalls that control network traffic at the instance level in cloud environments like AWS and Azure.

Which architectural pattern is recommended by CCSK to reduce the attack surface of cloud workloads?

Answer: Micro-segmentation

Micro-segmentation divides the network into small zones to limit lateral movement if one workload is compromised.