Cloud Security (AWS & Azure)

Q1 Easy 10 pts

Under the cloud shared responsibility model, who secures your data and IAM config?

The cloud provider The customer No one The ISP

Q2 Easy 10 pts

A very common AWS misconfiguration exposing data publicly is:

A stopped EC2 A public S3 bucket An unused Lambda A private subnet

Q3 Medium 15 pts

The AWS service managing users, roles and permissions is ____ (acronym).

Q4 Medium 15 pts

Which AWS service records API activity for auditing?

CloudWatch CloudTrail CloudFront Route 53

Q5 Medium 15 pts

Microsoft Azure's cloud identity service is:

Azure Blob Microsoft Entra ID (Azure AD) Azure Functions Azure DevOps

Q6 Hard 20 pts

Using short-lived assumable roles instead of long-lived credentials avoids leaking permanent access ____ .

Q7 Medium 15 pts

The AWS root account should be:

Used daily for admin Locked down with MFA and used almost never Shared with the team Given no MFA

Q8 Hard 20 pts

IMDSv2 (Instance Metadata Service v2) mitigates:

Slow boot SSRF attacks stealing instance credentials from the metadata endpoint Disk failure DNS issues

Q9 Medium 15 pts

AWS KMS is used to:

Scan ports Create/manage encryption keys and control their use Serve static sites Route traffic

Q10 Medium 15 pts

AWS GuardDuty provides:

Load balancing Threat detection by analyzing logs (CloudTrail, VPC Flow, DNS) Object storage A CDN

Q11 Medium 15 pts

An over-privileged IAM policy (e.g. `:`) is risky because:

It's slower A compromised identity can do anything in the account It costs more It blocks logging

Q12 Medium 15 pts

Security Groups in AWS act as:

Physical firewalls Stateful virtual firewalls at the instance/ENI level DNS servers Load balancers

Q13 Hard 20 pts

Network ACLs (NACLs) differ from security groups by being:

Stateful Stateless and applied at the subnet level Identity-based Encryption keys

Q14 Medium 15 pts

'Block Public Access' for S3 should generally be:

Disabled everywhere Enabled to prevent accidental public exposure Ignored Only on empty buckets

Q15 Medium 15 pts

Encrypting EBS volumes and S3 objects addresses:

Latency Confidentiality of data at rest Availability Cost only

Q16 Hard 20 pts

AWS Config is used to:

Send email Track resource configuration and evaluate compliance over time Crack hashes Serve DNS

Q17 Medium 15 pts

Azure NSGs (Network Security Groups) control:

Billing Inbound/outbound traffic to Azure resources Identity Backups

Q18 Medium 15 pts

Azure Key Vault stores:

Container images Secrets, keys and certificates securely Log data Virtual machines

Q19 Medium 15 pts

Microsoft Defender for Cloud provides:

A CDN Cloud security posture management and threat protection Object storage A message queue

Q20 Hard 20 pts

CSPM (Cloud Security Posture Management) tools primarily:

Run workloads Detect misconfigurations and compliance drift across cloud accounts Encrypt disks only Replace IAM

Q21 Hard 20 pts

CWPP focuses on protecting:

Billing dashboards Cloud workloads (VMs, containers, serverless) at runtime DNS zones Marketing sites

Q22 Hard 20 pts

A CASB sits between users and cloud services to:

Speed downloads Enforce security policy, visibility and DLP for cloud usage Host VMs Sign code

Q23 Medium 15 pts

AWS Shield helps defend against:

SQL injection DDoS attacks Phishing Weak passwords

Q24 Easy 10 pts

Enabling MFA on privileged cloud accounts primarily prevents:

Slow logins Account takeover from stolen passwords Data at rest exposure High latency

Q25 Medium 15 pts

Key rotation in KMS/Key Vault is important to:

Speed encryption Limit exposure if a key is compromised Shorten keys Disable logging

Q26 Hard 20 pts

A public snapshot/AMI is risky because it may:

Boot faster Expose data or secrets baked into the image Cost less Improve security

Q27 Hard 20 pts

VPC Flow Logs capture:

Full packet payloads Metadata about IP traffic to/from network interfaces User passwords Disk contents

Q28 Medium 15 pts

An IAM 'role' differs from a 'user' in that a role:

Has a permanent password Is assumed temporarily and provides short-lived credentials Can't have policies Is a network device

Q29 Medium 15 pts

Least privilege in the cloud is best achieved by:

Granting admin to all Starting minimal and adding permissions as needed, reviewing regularly Using `*` policies Sharing keys

Q30 Easy 10 pts

Encrypting data in transit in the cloud uses:

Plain HTTP TLS/HTTPS for service and API communication FTP Telnet

Q31 Hard 20 pts

A 'confused deputy' cross-account access issue is mitigated by:

Sharing credentials Using external IDs / condition keys in role trust policies Public roles No conditions

Q32 Medium 15 pts

EKS/AKS/GKE are managed:

Databases Kubernetes services in AWS/Azure/GCP CDNs Email systems

Q33 Medium 15 pts

Storing secrets in environment variables baked into an image is:

Best practice Risky — prefer a secrets manager and runtime injection Required Encrypted by default

Q34 Medium 15 pts

The AWS Well-Architected 'Security' pillar emphasizes:

Only cost Identity, detection, data protection, and incident response UI design Marketing

Q35 Easy 10 pts

Cloud pentesting requires:

No permission Following the provider's rules and having authorization Attacking any tenant Ignoring scope

Q36 Medium 15 pts

Disabling unused regions/services reduces:

Availability The attack surface and chance of unmonitored misuse Encryption Logging

Q37 Hard 20 pts

Centralized logging across accounts (e.g. to a security account) helps:

Hide activity Detection, correlation and tamper-resistance of logs Slow response Delete evidence

Q38 Medium 15 pts

A 'least-privilege' S3 bucket policy should:

Allow `*` principals Grant only specific principals the specific actions needed Be public Skip conditions

Q39 Hard 20 pts

Conditional Access (Entra ID) enforces:

Billing limits Context-based access policies (device, location, risk) for sign-ins Disk quotas DNS rules

Q40 Medium 15 pts

Public access to a cloud database (e.g. open Elasticsearch/Mongo) usually results in:

Better performance Data exposure/theft by internet scanners Encryption Compliance

Q41 Medium 15 pts

Tagging cloud resources supports security by:

Coloring the console Enabling ownership, cost tracking and policy/automation targeting Encrypting data Blocking traffic

Q42 Hard 20 pts

A guardrail like SCP (Service Control Policy) in AWS Organizations:

Grants permissions Sets the maximum permissions boundary accounts can have Encrypts S3 Runs Lambdas

Q43 Medium 15 pts

Data residency requirements affect:

Font choice Which geographic regions data may be stored/processed in CPU speed Image size

Q44 Medium 15 pts

Rotating and scoping cloud access keys reduces the impact of:

Faster APIs A leaked key being usable broadly or indefinitely Better UI More storage

Q45 Medium 15 pts

Encrypting inter-service traffic within a VPC helps against:

Slow apps Eavesdropping/interception on the internal network High cost Disk failure

Q46 Hard 20 pts

A misconfigured cloud IAM trust policy can allow:

Faster boot Unintended external accounts to assume your roles Cheaper billing Better logging

Q47 Medium 15 pts

Security Hub / centralized findings help teams:

Ignore alerts Aggregate and prioritize security findings across services/accounts Delete logs Disable GuardDuty

Q48 Easy 10 pts

The safest default for a new cloud resource's network exposure is:

Open to 0.0.0.0/0 Closed/private, opening only what's necessary Public with no auth All ports open

Q49 Hard 20 pts

Immutable, versioned logging (e.g. S3 Object Lock) protects logs from:

Being read Tampering/deletion by attackers covering tracks Encryption Compression

Q50 Medium 15 pts

The overarching cloud security mindset should be:

Trust the provider for everything Assume breach, enforce least privilege, and continuously monitor Open by default Set and forget