CSS Cloud Security & Infrastructure Protection 1 — Questions and Answers
Question 1: What does the 'shared responsibility model' in cloud security primarily define?
- The division of security responsibilities between the cloud provider and the customer (Correct answer)
- A framework for sharing encryption keys between cloud tenants
- A protocol for sharing security incidents between cloud vendors
- The process for dividing costs of security tools between teams
Correct answer: The division of security responsibilities between the cloud provider and the customer
The shared responsibility model delineates which security tasks are managed by the cloud provider versus those that remain the customer's obligation.
Question 2: Which cloud deployment model provides an organization with the highest level of control over its infrastructure?
- Public cloud
- Private cloud (Correct answer)
- Community cloud
- Hybrid cloud
Correct answer: Private cloud
A private cloud is dedicated exclusively to one organization, granting the greatest control over security configurations and infrastructure.
Question 3: What is a Cloud Access Security Broker (CASB)?
- A hardware device that encrypts cloud traffic at the network edge
- A security policy enforcement point between cloud users and cloud services (Correct answer)
- A type of cloud-based firewall specifically for blocking malicious IP ranges
- A government certification body for cloud service providers
Correct answer: A security policy enforcement point between cloud users and cloud services
A CASB acts as an intermediary security layer that enforces visibility and policy controls between users and cloud applications.
Question 4: Which security concern is MOST unique to multi-tenant cloud environments?
- Phishing attacks targeting end users
- Data isolation and tenant separation failures (Correct answer)
- Password complexity and rotation requirements
- Antivirus software management across endpoints
Correct answer: Data isolation and tenant separation failures
Multi-tenancy creates the risk of data leaking between co-located tenants, making proper logical isolation the defining security concern.
Question 5: What is the primary purpose of Cloud Security Posture Management (CSPM)?
- To monitor and optimize cloud network bandwidth usage
- To continuously assess cloud configurations for compliance gaps and security risks (Correct answer)
- To manage user password policies across cloud-based SaaS applications
- To back up cloud data to on-premises storage systems
Correct answer: To continuously assess cloud configurations for compliance gaps and security risks
CSPM tools automatically and continuously evaluate cloud infrastructure configurations to surface misconfigurations, compliance violations, and security risks.
Question 6: In cloud computing, what does 'data sovereignty' refer to?
- The encryption standard mandated for all cloud-stored data
- The legal principle that data is subject to the laws of the country where it resides (Correct answer)
- An organization's ownership rights over data it stores with a cloud provider
- A cloud provider's contractual right to access customer data for maintenance
Correct answer: The legal principle that data is subject to the laws of the country where it resides
Data sovereignty means data is governed by the laws and regulations of the nation in which it is physically stored, affecting cross-border transfer decisions.
Question 7: Which cloud service model gives customers the LEAST control over the underlying infrastructure?
- Infrastructure as a Service (IaaS)
- Platform as a Service (PaaS)
- Software as a Service (SaaS) (Correct answer)
- Function as a Service (FaaS)
Correct answer: Software as a Service (SaaS)
In SaaS, the provider manages all infrastructure, middleware, runtime, and application code, leaving customers with control only over their own data and user access settings.
CSS Cloud Security & Infrastructure Protection 1
What does the 'shared responsibility model' in cloud security primarily define?