CSCU Cloud Security Fundamentals 2 — Questions and Answers
Question 1: What is the primary security concern when using public cloud storage services for sensitive business documents?
- Slow upload speeds
- Data may be accessed by unauthorized parties if not properly encrypted (Correct answer)
- Cloud storage has limited capacity
- Files cannot be organized into folders
Correct answer: Data may be accessed by unauthorized parties if not properly encrypted
Public cloud storage can expose sensitive data if proper encryption and access controls are not implemented, as data travels through and resides on third-party infrastructure.
When sensitive business documents are stored in public cloud services, the data is hosted on infrastructure managed by a third party. Without proper encryption (both in transit and at rest) and robust access controls, unauthorized individuals—including malicious actors, rogue employees of the cloud provider, or attackers who compromise the service—could potentially access the data. Organizations must implement strong encryption, multi-factor authentication, and careful access management to mitigate these risks.
Question 2: Which cloud deployment model provides dedicated infrastructure for a single organization?
- Public cloud
- Private cloud (Correct answer)
- Hybrid cloud
- Community cloud
Correct answer: Private cloud
A private cloud is dedicated to a single organization, providing greater control over security, compliance, and customization of the infrastructure.
A private cloud deployment model allocates computing resources exclusively to one organization. This can be hosted on-premises or by a third-party provider, but the key distinction is that the infrastructure is not shared with other tenants. This provides enhanced security controls, regulatory compliance capabilities, and customization options, making it ideal for organizations handling sensitive data or subject to strict regulatory requirements.
Question 3: What does the shared responsibility model in cloud computing define?
- How cloud costs are split between departments
- The division of security obligations between the cloud provider and the customer (Correct answer)
- How bandwidth is shared among cloud users
- The process of sharing data between cloud regions
Correct answer: The division of security obligations between the cloud provider and the customer
The shared responsibility model clarifies which security tasks the cloud provider handles (such as physical security and infrastructure) and which the customer must manage (such as data encryption and access controls).
The shared responsibility model is a fundamental cloud security framework that delineates security obligations between the cloud service provider (CSP) and the customer. The CSP typically secures the underlying infrastructure—physical data centers, networking hardware, and hypervisors. The customer is responsible for securing their data, managing user access, configuring security settings, and ensuring application-level security. The exact division varies by service model (IaaS, PaaS, SaaS), with customers bearing more responsibility in IaaS and less in SaaS.
Question 4: Which practice helps prevent unauthorized access to cloud-based accounts?
- Using the same password across all cloud services
- Enabling multi-factor authentication (MFA) (Correct answer)
- Sharing login credentials with team members via email
- Disabling session timeout settings
Correct answer: Enabling multi-factor authentication (MFA)
Multi-factor authentication adds an additional verification step beyond a password, significantly reducing the risk of unauthorized access even if credentials are compromised.
Multi-factor authentication (MFA) requires users to provide two or more verification factors to gain access to an account—typically something they know (password), something they have (phone or hardware token), or something they are (biometrics). Even if an attacker obtains a user's password through phishing or a data breach, they cannot access the account without the additional factor. This makes MFA one of the most effective defenses against unauthorized account access in cloud environments.
Question 5: What is a key risk associated with shadow IT in cloud computing?
- Increased hardware costs
- Employees using unapproved cloud services that bypass security policies (Correct answer)
- Slower internet connection speeds
- Reduced availability of cloud applications
Correct answer: Employees using unapproved cloud services that bypass security policies
Shadow IT occurs when employees use unauthorized cloud applications without IT department approval, creating security blind spots and potential data leaks outside the organization's security controls.
Shadow IT refers to the use of cloud services, applications, or devices by employees without the knowledge or approval of the IT department. This creates significant security risks because these unapproved services may lack proper encryption, compliance certifications, or access controls. Sensitive corporate data could be stored in insecure locations, data loss prevention tools cannot monitor these services, and the organization loses visibility into where its data resides. Addressing shadow IT requires clear policies, user education, and tools to discover unauthorized cloud usage.
Question 6: What type of cloud attack involves intercepting data transmitted between the user and the cloud service?
- Denial of Service attack
- Man-in-the-middle attack (Correct answer)
- SQL injection attack
- Brute force attack
Correct answer: Man-in-the-middle attack
A man-in-the-middle (MITM) attack intercepts communications between a user and a cloud service, allowing the attacker to eavesdrop on or alter the data being transmitted.
In a man-in-the-middle (MITM) attack, an attacker positions themselves between the user and the cloud service to intercept, read, or modify data in transit. This can occur on unsecured Wi-Fi networks, through DNS spoofing, or via compromised network equipment. The attacker may steal credentials, session tokens, or sensitive data. Countermeasures include using HTTPS/TLS encryption, certificate pinning, VPNs, and avoiding untrusted networks when accessing cloud services.
CSCU Cloud Security Fundamentals 2
What is the primary security concern when using public cloud storage services for sensitive business documents?