ICC Cloud Security & Compliance 1 — Questions and Answers

Question 1: Which security model is widely used in cloud computing to control access?

Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC) (Correct answer)
Time-Based Access Control (TBAC)

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a widely adopted security model in cloud computing that assigns permissions and access rights to users based on their organizational roles. Instead of granting individual permissions, users are assigned roles, and these roles have predefined access to resources. RBAC simplifies access management and enhances security by ensuring the principle of least privilege.

Question 2: What is the primary function of a cloud firewall?

To encrypt data at rest
To filter network traffic and prevent unauthorized access (Correct answer)
To manage cloud service costs
To create cloud backups

Correct answer: To filter network traffic and prevent unauthorized access

A cloud firewall serves as a security barrier that monitors and controls incoming and outgoing network traffic based on predefined security rules. Its primary function is to protect cloud resources by filtering out malicious traffic, preventing unauthorized access, and enforcing security policies. This safeguards data and applications hosted in the cloud from external threats.

Question 3: Which compliance standard is commonly required for handling healthcare data in the cloud?

PCI DSS
ISO 27001
HIPAA (Correct answer)
SOC 2

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that establishes national standards to protect sensitive patient health information. For organizations handling healthcare data in the cloud, compliance with HIPAA is crucial to ensure the privacy and security of Protected Health Information (PHI). Adherence to HIPAA regulations is mandatory for healthcare providers and their business associates.

Question 4: What is a key advantage of multi-factor authentication (MFA) in cloud security?

It eliminates the need for passwords
It prevents all types of cyberattacks
It requires users to verify their identity with multiple authentication factors (Correct answer)
It reduces cloud storage costs

Correct answer: It requires users to verify their identity with multiple authentication factors

Multi-factor authentication (MFA) significantly enhances cloud security by requiring users to provide two or more distinct verification factors to prove their identity. These factors typically fall into categories like something you know (password), something you have (phone, token), or something you are (biometrics). This layered approach makes it much harder for unauthorized individuals to gain access, even if one factor, such as a password, is compromised.

Question 5: Which encryption method is commonly used to secure data at rest in the cloud?

SHA-256
RSA
AES (Correct answer)
MD5

Correct answer: AES

AES (Advanced Encryption Standard) is a widely adopted and highly secure symmetric encryption algorithm used to protect data at rest in cloud environments. Its strong cryptographic properties and efficiency make it an industry standard for encrypting sensitive information stored on servers, databases, and storage devices. Other options like SHA-256 and MD5 are hashing algorithms, and RSA is an asymmetric encryption algorithm typically used for key exchange or digital signatures, not bulk data encryption.

Question 6: What is the purpose of a cloud compliance audit?

To increase cloud service costs
To verify compliance with security and regulatory standards (Correct answer)
To restrict data access for all users
To disable all cloud security controls

Correct answer: To verify compliance with security and regulatory standards

A cloud compliance audit is a systematic evaluation designed to verify that a cloud environment adheres to specific security policies, industry standards, and regulatory requirements. This process helps organizations ensure data protection, identify potential vulnerabilities, and demonstrate their commitment to legal and ethical guidelines, thereby maintaining trust and avoiding penalties.

ICC Cloud Security & Compliance 1

Which security model is widely used in cloud computing to control access?