Free Practice Quiz Question List

3 Cloud Security Architecture Online Quiz Questions

Use this free practice quiz with 20 questions to review 3 Cloud Security Architecture, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: In cloud computing, the provider protects parts of the platform, while customers remain responsible for the data, identities, and settings they control.

A
True
B
False

Written response

1 point

What term describes the gradual departure of deployed cloud resources from their intended configuration?

Choose one

1 point

A company adopts a managed cloud database. Which responsibility does the customer retain even if the provider takes on some patching duties?

A
The provider takes responsibility for all database access, data protection, and compliance.
B
The customer still configures access, protects data, and meets its compliance requirements.
C
The customer must patch every part of the underlying cloud infrastructure.
D
The provider becomes responsible for deciding which data the customer may store.

Fill in the blank

1 point

To configure services consistently, start with a for each service type and environment.

Choose one

1 point

A team is choosing storage and access controls for a new cloud workload. What should it do first to make those choices appropriate to the data?

A
Choose storage based only on its default public-access setting.
B
Select access controls before identifying the data the workload will handle.
C
Classify the data before selecting storage and access controls.
D
Put sensitive data in resource names so teams can recognize it easily.

Choose all

1 point

A team is creating a secure configuration baseline for a cloud environment. Which controls should it include? Select all that apply.

A
Use least-privilege access.
B
Allow unrestricted public access by default.
C
Require strong authentication for administrators.
D
Treat internal cloud networks as automatically trusted.
E
Enable audit logging.

Written response

1 point

What access principle calls for granting workload teams only the permissions they need?

Fill in the blank

1 point

Use to control communication between environments, applications, and data services.

True or false

1 point

True or false: Placing workloads in separate cloud accounts or subscriptions automatically isolates every network path, identity, and shared service.

A
True
B
False

Choose one

1 point

A company runs production applications and development tests with different sensitivity and control requirements. Which account or subscription design best addresses those differences?

A
Put all environments in one workload area and rely on the application teams to avoid mistakes.
B
Separate production from development and testing, with boundaries and access controls suited to their differing risks.
C
Give development the same permissions as production so that deployments are easier to test.
D
Use a separate area only for production, but share its permissions with development.

Choose all

1 point

A team is protecting a sensitive cloud data store. Which actions align with the recommended data-protection approach? Select all that apply.

A
Restrict data access by identity and purpose.
B
Assume that data is protected once it is inside an internal cloud network.
C
Encrypt data in transit and at rest.
D
Keep sensitive information out of broadly visible resource names and tags.

Choose one

1 point

An organization wants consistent policies while allowing workload teams to manage their own resources. How should it combine hierarchy-level controls with team access?

A
Let each workload team set organization-wide policies independently.
B
Apply broad guardrails higher in the hierarchy and limit workload teams to the access they need within their own boundaries.
C
Place every resource in one boundary so that higher-level policies are unnecessary.
D
Grant workload teams unrestricted access throughout the hierarchy to simplify policy enforcement.

Open ended

1 point

A company is designing cloud hosting for production applications and development tests. Production handles sensitive data, and the company also wants centralized security monitoring. Propose an architecture that limits the impact of mistakes or compromise. Include how you would separate workloads, control access and test data, apply broad policies, and address the limits of account or subscription boundaries.

Choose one

1 point

A team deploys an application on a PaaS service. Which set of responsibilities should the team still plan to manage?

A
The provider takes over responsibility for customer data, identities, and compliance.
B
The customer remains responsible for data, identities, application code, and service configuration.
C
The customer manages physical facilities and underlying hardware.
D
The provider is responsible only for physical facilities, while the customer manages the runtime.

Choose one

1 point

A company runs workloads on IaaS virtual machines. Which responsibility assignment best matches the typical shared-responsibility model?

A
The provider manages operating systems and applications, while the customer manages only physical facilities.
B
The provider manages customer identities and data, while the customer manages the underlying infrastructure.
C
The customer manages operating systems, applications, identities, data, and virtual network controls.
D
The customer manages only application code because the provider manages all other controls.

Choose one

1 point

An organization wants to reduce the chance that a development mistake exposes production systems or data. Which design best supports that goal?

A
Place production and nonproduction workloads in separate boundaries, use separate test data, and prevent development from inheriting production permissions.
B
Keep all environments together so teams can share permissions and data without additional controls.
C
Separate production from development but allow development identities to retain production permissions for convenience.
D
Use separate boundaries only for billing, since environment separation does not help limit risk.

Choose one

1 point

How should an organization combine hierarchy-level policies with workload-team access?

A
Apply every policy only within individual resources and grant all teams organization-wide access.
B
Apply broad guardrails at the lowest level and allow workload teams to change them freely.
C
Avoid hierarchy-level policies because they cannot support consistent enforcement.
D
Apply broad guardrails at higher levels, then grant workload teams only the access they need within their boundaries.

True or false

1 point

True or false: A company separates two workloads into different cloud accounts. That boundary, by itself, guarantees that every network path, identity, and shared service between them is isolated.

A
True
B
False

Written response

1 point

What security principle calls for granting users and workload teams only the access they need to perform their tasks?

Written response

1 point

A team is designing a cloud workload that must meet specific needs for recovery after a disruption. Which planning factor should the architecture explicitly reflect?