Cloud Concepts, Architecture and Design Flashcards

What is the primary purpose of identity federation in cloud computing environments?

Answer: To enable users to authenticate once and access resources across multiple cloud services using a single identity

Identity federation enables single sign-on (SSO) across multiple cloud services by establishing trust between identity providers, reducing authentication complexity and credential sprawl.

Which cloud security architecture model assumes that no user, device, or network segment should be inherently trusted and requires continuous verification for all access requests?

Answer: Zero Trust Architecture

Zero Trust Architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every access request regardless of network location or prior session.

What does the concept of 'data sovereignty' refer to in cloud computing?

Answer: The legal principle that data is subject to the laws and regulations of the country where it physically resides

Data sovereignty means digital data is subject to the laws and governance structures of the nation where it is stored, which is critical when selecting cloud data center locations for regulated data.

What is the key purpose of a Service Level Agreement (SLA) between a cloud customer and cloud service provider?

Answer: To establish measurable performance commitments, uptime guarantees, and remedies for service failures

An SLA formalizes performance expectations such as uptime guarantees (e.g., 99.9%), response times, and the remedies or penalties applicable if the provider fails to meet commitments.

In cloud reference architectures, what does the term 'availability zone' typically refer to?

Answer: An isolated location within a cloud region with independent power, cooling, and networking infrastructure

An availability zone is a physically separate, fault-isolated data center within a cloud region with independent infrastructure, enabling high availability through zone-redundant deployments.

Which cloud architecture principle recommends designing systems to expect and handle component failures gracefully rather than trying to prevent all failures?

Answer: Design for failure

'Design for failure' is a core cloud architecture principle that assumes components will fail and builds systems with automated detection, isolation, and recovery mechanisms to maintain availability.

When evaluating a cloud provider's security posture using the CSA STAR program, which level provides the highest assurance through ongoing automated attestation of security controls?

Answer: Level 3: Continuous monitoring-based certification with automated attestation

CSA STAR Level 3 represents continuous monitoring-based certification, providing the highest assurance through ongoing automated validation of security controls rather than point-in-time assessments.