Cloud Security & Compliance Flashcards

Which security model is widely used in cloud computing to control access?

Answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is a widely adopted security model in cloud computing that assigns permissions and access rights to users based on their organizational roles. Instead of granting individual permissions, users are assigned roles, and these roles have predefined access to resources. RBAC simplifies access management and enhances security by ensuring the principle of least privilege.

What is the primary function of a cloud firewall?

Answer: To filter network traffic and prevent unauthorized access

A cloud firewall serves as a security barrier that monitors and controls incoming and outgoing network traffic based on predefined security rules. Its primary function is to protect cloud resources by filtering out malicious traffic, preventing unauthorized access, and enforcing security policies. This safeguards data and applications hosted in the cloud from external threats.

Which compliance standard is commonly required for handling healthcare data in the cloud?

Answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that establishes national standards to protect sensitive patient health information. For organizations handling healthcare data in the cloud, compliance with HIPAA is crucial to ensure the privacy and security of Protected Health Information (PHI). Adherence to HIPAA regulations is mandatory for healthcare providers and their business associates.

What is a key advantage of multi-factor authentication (MFA) in cloud security?

Answer: It requires users to verify their identity with multiple authentication factors

Multi-factor authentication (MFA) significantly enhances cloud security by requiring users to provide two or more distinct verification factors to prove their identity. These factors typically fall into categories like something you know (password), something you have (phone, token), or something you are (biometrics). This layered approach makes it much harder for unauthorized individuals to gain access, even if one factor, such as a password, is compromised.

Which encryption method is commonly used to secure data at rest in the cloud?

Answer: AES

AES (Advanced Encryption Standard) is a widely adopted and highly secure symmetric encryption algorithm used to protect data at rest in cloud environments. Its strong cryptographic properties and efficiency make it an industry standard for encrypting sensitive information stored on servers, databases, and storage devices. Other options like SHA-256 and MD5 are hashing algorithms, and RSA is an asymmetric encryption algorithm typically used for key exchange or digital signatures, not bulk data encryption.

What is the purpose of a cloud compliance audit?

Answer: To verify compliance with security and regulatory standards

A cloud compliance audit is a systematic evaluation designed to verify that a cloud environment adheres to specific security policies, industry standards, and regulatory requirements. This process helps organizations ensure data protection, identify potential vulnerabilities, and demonstrate their commitment to legal and ethical guidelines, thereby maintaining trust and avoiding penalties.