1. What is Shared responsibility model ? Junior A. endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2) B. cloud service managing identities, roles, and fine-grained permissions for resources C. virtual stateful firewall controlling inbound/outbound traffic to cloud instances D. division of security duties where the provider secures the cloud and the customer secures what is in it
2. Which term means: "division of security duties where the provider secures the cloud and the customer secures what is in it"? Junior A. Shared responsibility model B. Confidential computing C. CIEM D. Encryption at rest
3. Which statement is correct? Junior A. Shared responsibility model — endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2) B. Shared responsibility model — encrypting data as it moves across networks, typically with TLS C. Shared responsibility model — division of security duties where the provider secures the cloud and the customer secures what is in it D. Shared responsibility model — uncontrolled proliferation of credentials across code, configs, and pipelines
4. What is IAM (cloud) ? Junior A. cloud service managing identities, roles, and fine-grained permissions for resources B. encrypting data as it moves across networks, typically with TLS C. preconfigured, secure, multi-account baseline for deploying cloud workloads consistently D. managed service for creating, storing, and controlling cryptographic keys
5. Which term means: "cloud service managing identities, roles, and fine-grained permissions for resources"? Junior A. Workload identity B. IAM (cloud) C. CIEM D. Landing zone
6. Which statement is correct? Junior A. IAM (cloud) — cloud service managing identities, roles, and fine-grained permissions for resources B. IAM (cloud) — uncontrolled proliferation of credentials across code, configs, and pipelines C. IAM (cloud) — keeping traffic to a cloud service on the private network rather than the public internet D. IAM (cloud) — managed service for creating, storing, and controlling cryptographic keys
7. What is Security group ? Junior A. managed service for creating, storing, and controlling cryptographic keys B. protecting data in use by processing it inside hardware-based trusted execution environments C. virtual stateful firewall controlling inbound/outbound traffic to cloud instances D. misconfiguration that makes object storage readable by anyone on the internet
8. Which term means: "virtual stateful firewall controlling inbound/outbound traffic to cloud instances"? Junior A. Security group B. Workload identity C. Key Management Service (KMS) D. CIEM
9. Which statement is correct? Junior A. Security group — granting cloud permissions to a service/workload via an attached identity instead of static keys B. Security group — protecting data in use by processing it inside hardware-based trusted execution environments C. Security group — managed service for creating, storing, and controlling cryptographic keys D. Security group — virtual stateful firewall controlling inbound/outbound traffic to cloud instances
10. What is Encryption at rest ? Junior A. encrypting stored data so it is unreadable without the key if storage is accessed B. misconfiguration that makes object storage readable by anyone on the internet C. managed service for creating, storing, and controlling cryptographic keys D. encrypting data as it moves across networks, typically with TLS
11. Which term means: "encrypting stored data so it is unreadable without the key if storage is accessed"? Junior A. Encryption at rest B. Security group C. Shared responsibility model D. Secrets sprawl
12. Which statement is correct? Junior A. Encryption at rest — division of security duties where the provider secures the cloud and the customer secures what is in it B. Encryption at rest — uncontrolled proliferation of credentials across code, configs, and pipelines C. Encryption at rest — encrypting stored data so it is unreadable without the key if storage is accessed D. Encryption at rest — misconfiguration that makes object storage readable by anyone on the internet
13. What is Encryption in transit ? Junior A. granting cloud permissions to a service/workload via an attached identity instead of static keys B. protecting data in use by processing it inside hardware-based trusted execution environments C. encrypting data as it moves across networks, typically with TLS D. endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2)
14. Which term means: "encrypting data as it moves across networks, typically with TLS"? Junior A. Secrets sprawl B. Encryption at rest C. Shared responsibility model D. Encryption in transit
15. Which statement is correct? Junior A. Encryption in transit — misconfiguration that makes object storage readable by anyone on the internet B. Encryption in transit — Cloud Infrastructure Entitlement Management analyzing and right-sizing excessive cloud permissions C. Encryption in transit — granting cloud permissions to a service/workload via an attached identity instead of static keys D. Encryption in transit — encrypting data as it moves across networks, typically with TLS
16. What is Public bucket exposure ? Junior A. tooling that continuously detects misconfigurations and compliance gaps in cloud environments B. misconfiguration that makes object storage readable by anyone on the internet C. managed service for creating, storing, and controlling cryptographic keys D. keeping traffic to a cloud service on the private network rather than the public internet
17. Which term means: "misconfiguration that makes object storage readable by anyone on the internet"? Junior A. Public bucket exposure B. Private endpoint C. Cloud Security Posture Management (CSPM) D. Instance metadata service (IMDS)
18. Which statement is correct? Junior A. Public bucket exposure — preconfigured, secure, multi-account baseline for deploying cloud workloads consistently B. Public bucket exposure — endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2) C. Public bucket exposure — misconfiguration that makes object storage readable by anyone on the internet D. Public bucket exposure — granting cloud permissions to a service/workload via an attached identity instead of static keys
19. What is Key Management Service (KMS) ? Mid A. managed service for creating, storing, and controlling cryptographic keys B. tooling that continuously detects misconfigurations and compliance gaps in cloud environments C. uncontrolled proliferation of credentials across code, configs, and pipelines D. virtual stateful firewall controlling inbound/outbound traffic to cloud instances
20. Which term means: "managed service for creating, storing, and controlling cryptographic keys"? Mid A. Landing zone B. CIEM C. Secrets sprawl D. Key Management Service (KMS)
21. Which statement is correct? Mid A. Key Management Service (KMS) — keeping traffic to a cloud service on the private network rather than the public internet B. Key Management Service (KMS) — preconfigured, secure, multi-account baseline for deploying cloud workloads consistently C. Key Management Service (KMS) — managed service for creating, storing, and controlling cryptographic keys D. Key Management Service (KMS) — tooling that continuously detects misconfigurations and compliance gaps in cloud environments
22. What is Instance metadata service (IMDS) ? Mid A. uncontrolled proliferation of credentials across code, configs, and pipelines B. endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2) C. Cloud Infrastructure Entitlement Management analyzing and right-sizing excessive cloud permissions D. misconfiguration that makes object storage readable by anyone on the internet
23. Which term means: "endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2)"? Mid A. Workload identity B. Landing zone C. Encryption at rest D. Instance metadata service (IMDS)
24. Which statement is correct? Mid A. Instance metadata service (IMDS) — uncontrolled proliferation of credentials across code, configs, and pipelines B. Instance metadata service (IMDS) — granting cloud permissions to a service/workload via an attached identity instead of static keys C. Instance metadata service (IMDS) — endpoint giving a VM its config and credentials; a common SSRF target if unprotected (mitigated by IMDSv2) D. Instance metadata service (IMDS) — encrypting data as it moves across networks, typically with TLS
25. What is Cloud Security Posture Management (CSPM) ? Mid A. tooling that continuously detects misconfigurations and compliance gaps in cloud environments B. division of security duties where the provider secures the cloud and the customer secures what is in it C. managed service for creating, storing, and controlling cryptographic keys D. keeping traffic to a cloud service on the private network rather than the public internet
26. Which term means: "tooling that continuously detects misconfigurations and compliance gaps in cloud environments"? Mid A. IAM (cloud) B. Shared responsibility model C. Cloud Security Posture Management (CSPM) D. Public bucket exposure
27. Which statement is correct? Mid A. Cloud Security Posture Management (CSPM) — tooling that continuously detects misconfigurations and compliance gaps in cloud environments B. Cloud Security Posture Management (CSPM) — keeping traffic to a cloud service on the private network rather than the public internet C. Cloud Security Posture Management (CSPM) — misconfiguration that makes object storage readable by anyone on the internet D. Cloud Security Posture Management (CSPM) — Cloud Infrastructure Entitlement Management analyzing and right-sizing excessive cloud permissions
28. What is Workload identity ? Mid A. encrypting data as it moves across networks, typically with TLS B. protecting data in use by processing it inside hardware-based trusted execution environments C. misconfiguration that makes object storage readable by anyone on the internet D. granting cloud permissions to a service/workload via an attached identity instead of static keys
29. Which term means: "granting cloud permissions to a service/workload via an attached identity instead of static keys"? Mid A. CIEM B. Instance metadata service (IMDS) C. Confidential computing D. Workload identity
30. Which statement is correct? Mid A. Workload identity — encrypting stored data so it is unreadable without the key if storage is accessed B. Workload identity — granting cloud permissions to a service/workload via an attached identity instead of static keys C. Workload identity — preconfigured, secure, multi-account baseline for deploying cloud workloads consistently D. Workload identity — virtual stateful firewall controlling inbound/outbound traffic to cloud instances Showing 30 of 45 Cloud Security questions — the full set, with answers, explanations and an AI tutor on every question, is inside.