3 Cloud Security Architecture Free Online FlashCards

What is the core division of cloud security responsibility?

The provider secures the underlying cloud infrastructure; customers secure the data, identities, and cloud settings they control.

Which security responsibilities typically belong to the customer in IaaS?

In IaaS, customers typically manage operating systems, applications, identities, data, and virtual network controls. Providers manage physical facilities, hardware, and underlying infrastructure.

How are responsibilities typically divided in PaaS?

In PaaS, customers typically secure data, identities, application code, and service configuration; providers manage infrastructure and much of the operating system or runtime.

Which responsibilities typically remain with SaaS customers?

In SaaS, customers typically manage data, user access, and tenant settings; providers manage the application platform and underlying infrastructure.

How should an organization handle service-specific responsibility boundaries?

Review the provider’s responsibility guidance for each service, then explicitly assign an owner to every control the provider does not secure.

What factors should guide workload separation?

Separate workloads when their environment, sensitivity, compliance obligations, ownership, or required controls differ.

Why separate production from development and testing?

Keep production separate from development and testing. This helps prevent development access or permissions from carrying over to production.

What can account or subscription boundaries do—and what can they not do?

They can limit access, simplify billing, and reduce an incident’s potential scope, but they do not automatically isolate every network path, identity, or shared service.

What is a secure configuration baseline?

A documented baseline defines secure settings for each service type and environment, including least privilege, strong administrator authentication, suitable encryption, and audit logging.

How can automation support consistent cloud configuration?

Reviewed templates, policy controls, and deployment pipelines make approved settings repeatable and help detect drift from the intended configuration.

How should teams manage approved configuration exceptions?

Test policies before broad rollout, monitor exceptions, and give each approved exception an owner and an expiration date.

What steps guide protection of cloud data?

Classify data before choosing storage and access controls; restrict access by identity and purpose, and encrypt data in transit and at rest.