Cloud Computing Cloud Security and Compliance Syllabus

Cloud Security and Compliance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Cloud Security and Compliance in Cloud Computing, not a summary of it.

1. 1

   Cloud Security Fundamentals

   4 topics

   • Shared Responsibility Model
   • Defense in Depth
   • Common Cloud Threats
   • CIA Triad in the Cloud
2. 2

   Data Protection and Encryption

   4 topics

   • Encryption at Rest and in Transit
   • Key Management Services (KMS)
   • Secrets Management
   • Data Classification and Loss Prevention
3. 3

   Network Security

   4 topics

   • Security Groups and Network ACLs
   • Web Application Firewalls (WAF)
   • DDoS Protection
   • Zero Trust Networking
4. 4

   Identity Security and Governance

   4 topics

   • Privileged Access Management
   • Service Accounts and Workload Identity
   • Organization Policies and Guardrails
   • Audit Trails and CloudTrail
5. 5

   Compliance and Risk Management

   4 topics

   • Regulatory Frameworks
   • Governance, Risk, and Compliance (GRC)
   • Security Posture Management
   • Incident Response in the Cloud

Cloud Security and Compliance flashcards for Cloud Computing

19 of 50 cards from the Cloud Security and Compliance deck — real questions with worked answers.

1. What is the Shared Responsibility Model in cloud computing?

   A security framework dividing obligations between the cloud provider and the customer. The provider secures the cloud (physical infrastructure, hardware, hypervisor, managed services), while the customer secures what they put in the cloud (data, identities, configurations, access).

2. How does responsibility shift across IaaS, PaaS, and SaaS service models?

   The higher up the stack, the less the customer manages. In IaaS the customer secures OS, runtime, apps, and data; in PaaS the provider also manages OS/runtime, leaving apps and data to the customer; in SaaS the provider manages nearly everything and the customer mainly secures data and access.

3. In the Shared Responsibility Model, who is always responsible for data classification, IAM, and client-side encryption?

   The customer is always responsible for these regardless of service model. Data, identity/access management, and endpoint/client-side protection never transfer to the provider.

4. What is Defense in Depth?

   A layered security strategy that applies multiple independent, overlapping controls (physical, network, host, application, data, identity) so that if one layer fails, others still protect the asset. No single control is a point of total failure.

5. Name typical layers in a cloud Defense-in-Depth architecture.

   Physical/data-center security, network perimeter (firewalls, NACLs, WAF, DDoS), host/compute hardening, application security, identity and access controls, and data protection (encryption). Each layer is independently enforced.

6. What is the CIA Triad and what does each element mean?

   The three core goals of information security: Confidentiality (data is accessible only to authorized parties), Integrity (data is accurate and unaltered), and Availability (data and services are accessible when needed).

7. Which cloud controls primarily support each leg of the CIA Triad?

   Confidentiality: encryption, IAM, access controls. Integrity: hashing, digital signatures, checksums, versioning. Availability: redundancy, backups, DDoS protection, auto-scaling, multi-AZ/region deployment.

8. List common cloud-specific threats a student should recognize.

   Misconfiguration (e.g., public storage buckets), account/credential hijacking, insecure APIs, insider threats, data breaches, denial-of-service (DDoS), insufficient IAM, shadow IT, and supply-chain compromise.

9. What is the single most common cause of cloud data breaches?

   Misconfiguration, especially overly permissive access such as publicly exposed object storage buckets, open security groups, or excessive IAM permissions, rather than provider infrastructure failure.

10. What is the difference between encryption at rest and encryption in transit?

    Encryption at rest protects stored data (disks, databases, object storage) from unauthorized access to the storage medium. Encryption in transit protects data moving over networks from interception, typically via TLS.

11. Which protocol and version are standard for encryption in transit in the cloud?

    Transport Layer Security (TLS), with TLS 1.2 or 1.3 recommended. TLS provides confidentiality, integrity, and server (optionally mutual) authentication for data on the wire.

12. What symmetric algorithm and key size are the standard for cloud encryption at rest?

    AES (Advanced Encryption Standard), typically AES-256 in GCM mode. It is a symmetric cipher, meaning the same key encrypts and decrypts the data.

13. What is envelope encryption?

    A technique where data is encrypted with a data encryption key (DEK), and the DEK is itself encrypted with a key encryption key (KEK) held in a KMS. Only the wrapped DEK is stored alongside the data, and the KEK never leaves the KMS.

14. What is a Key Management Service (KMS)?

    A managed service that creates, stores, rotates, and controls access to cryptographic keys. It centralizes key lifecycle management and enforces access policies, so applications request cryptographic operations without handling raw key material directly.

15. Compare a provider-managed key with a customer-managed key (CMK) in KMS.

    Provider-managed keys are automatically created and rotated by the cloud provider with minimal customer control. Customer-managed keys (CMKs) are created and governed by the customer, who controls key policies, rotation schedule, and can disable or delete them.

16. What does BYOK (Bring Your Own Key) mean and how does it differ from HYOK?

    BYOK lets a customer import their own key material into the provider's KMS. HYOK (Hold Your Own Key) keeps the key entirely in the customer's own key store/HSM so the provider never possesses it, giving maximum control at the cost of complexity.

17. What is an HSM and why is it used in key management?

    A Hardware Security Module is a tamper-resistant physical device that generates, stores, and performs operations with cryptographic keys. Keys never leave the HSM in plaintext, providing strong protection and often FIPS 140-2/140-3 compliance.

18. What is Secrets Management and how does it differ from key management?

    Secrets management securely stores and controls access to credentials such as passwords, API keys, database strings, and tokens. Key management focuses specifically on cryptographic keys, while secrets management covers a broader set of sensitive configuration values.

19. Why should secrets never be hard-coded in source code or committed to repositories?

    Committed secrets are exposed to anyone with repository access, persist in git history even after deletion, and are a leading cause of breaches. Secrets should be stored in a secrets manager and injected at runtime, with rotation enabled.

See more Cloud Security and Compliance flashcards →

Planning Cloud Security and Compliance for Cloud Computing

Cloud Security and Compliance (Cloud Computing) FAQ