Sample questions
Security Cloud Infra SecurityDifficulty 1
What does the principle of "least privilege" mean in access management?
- aGranting broad permissions by default and restricting them only if abuse occurs.
- bGiving every user administrator-level access to simplify support and troubleshooting.
- cOnly the permissions needed for its task, nothing more.✓
- dAllowing permissions to accumulate over time as a convenience for busy teams.
Explanation:Least privilege means granting an identity only the access it actually needs; any extra permission simply enlarges the blast radius an attacker gains if that identity is compromised.
Security Cloud Infra SecurityDifficulty 2
A batch job only needs to read files from one storage location and write logs to another. Which access setup best follows least privilege?
- aA dedicated identity limited to read there and write only on the log destination.✓
- bReuse the administrator identity already configured on the server.
- cGrant read/write access to all storage locations in the account for flexibility.
- dGrant the job owner's personal account permissions to the batch process.
Explanation:A dedicated, narrowly scoped identity for the job improves traceability and, if that identity is compromised, limits the impact to only the resources it was meant to touch; reusing an administrator or personal account creates unnecessarily broad access.
Security Cloud Infra SecurityDifficulty 2
A team gave a new intern account full administrative access "just to be safe" while the intern learns the systems. What is the main risk of this decision?
- aThe intern's account will automatically expire faster than a limited account.
- bAdministrative accounts are audited less often than limited accounts.
- cFull access accounts perform tasks more slowly due to extra permission checks.
- dIt can affect far more systems than the intern's job actually requires.✓
Explanation:If the actual task only requires narrow access, granting broad privileges only increases the potential damage from a mistake or a compromise; "just to be safe" produces the opposite of safety.
Security Cloud Infra SecurityDifficulty 1
In the shared responsibility model for cloud services, which statement is generally correct?
- aThe provider is fully responsible for the security of everything running in the customer's account.
- bThe provider secures the infrastructure; the customer secures what it configures on top.✓
- cThe customer is responsible for the physical security of the data centers.
- dResponsibility is split evenly and does not depend on which service model is used.
Explanation:The shared responsibility model is not a fixed line: the provider secures the underlying layers (hardware, network, and sometimes the operating system), while the customer remains responsible for the access, data, and application layers it configures on top.
Security Cloud Infra SecurityDifficulty 2
A company deploys an application on a fully managed platform where the provider handles the runtime and operating system. Who is still responsible for securing the application's own configuration and access controls?
- aThe customer, since infrastructure duty differs from application duty.✓
- bThe provider, since managed platforms take over all security decisions by design.
- cNeither party, since managed platforms are certified secure by default.
- dOnly the provider's support team, once a support contract is signed.
Explanation:Even though a managed platform takes on the infrastructure layer, decisions like the application's access controls, authentication flow, and data configuration remain the customer's responsibility.
Security Cloud Infra SecurityDifficulty 2
Why does the responsibility split in the shared responsibility model change depending on whether infrastructure, a platform, or ready-to-use software is delivered as a service?
- aThe split does not actually change; it is only a marketing distinction between service types.
- bThe split changes based only on the price the customer pays for the service.
- cEach model shifts a different layer of the stack into the provider's control.✓
- dThe split is decided case-by-case by the customer's legal department, not by architecture.
Explanation:Infrastructure, platform, and software service models each shift a different layer of the stack to the provider; consequently, the layers the customer still has to secure differ depending on the model.