Cloud Computing Cloud Security and Compliance Syllabus

What is Data Loss Prevention (DLP)?

A set of tools and policies that detect and prevent unauthorized access, exfiltration, or exposure of sensitive data. DLP scans content (e.g., for credit card or PII patterns) in storage, in transit, and at endpoints, blocking or alerting on violations.

What is the difference between a Security Group and a Network ACL (NACL)?

Security groups are stateful firewalls attached to instances/resources; return traffic is automatically allowed. NACLs are stateless firewalls applied at the subnet level; you must explicitly allow both inbound and outbound traffic.

Do security groups support deny rules? How is traffic evaluated?

Security groups support only allow rules (implicit deny for anything not allowed) and are evaluated as a whole. NACLs support both allow and deny rules and are evaluated in numbered order, using the first matching rule.

What is a Web Application Firewall (WAF)?

A security control that filters, monitors, and blocks HTTP/HTTPS traffic to and from a web application at Layer 7. It protects against application-layer attacks such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

At which OSI layer does a WAF operate, and how does that differ from a network firewall?

A WAF operates at Layer 7 (application), inspecting HTTP payloads and application semantics. A traditional network firewall operates at Layers 3-4 (network/transport), filtering by IP address, port, and protocol.

What is DDoS protection and what attack types does it defend against?

DDoS protection detects and mitigates Distributed Denial-of-Service attacks that flood a target to exhaust resources. It defends against volumetric (Layer 3/4 bandwidth floods), protocol (e.g., SYN floods), and application-layer (Layer 7) attacks.

Distinguish volumetric, protocol, and application-layer DDoS attacks.

Volumetric attacks saturate bandwidth (e.g., UDP/amplification floods, measured in Gbps/pps). Protocol attacks exhaust connection-state resources (e.g., SYN floods). Application-layer attacks (Layer 7) send seemingly legitimate requests to overwhelm app resources (e.g., HTTP floods).

What is Zero Trust Networking?

A security model based on 'never trust, always verify.' No user, device, or network location is trusted by default; every request is authenticated, authorized, and continuously validated regardless of whether it originates inside or outside the network perimeter.

What are the core principles of Zero Trust?

Verify explicitly (authenticate and authorize on every request), use least-privilege access (just-enough, just-in-time), and assume breach (segment, encrypt end-to-end, and continuously monitor). Trust is never granted implicitly by network location.

How does Zero Trust differ from the traditional perimeter (castle-and-moat) model?

The perimeter model trusts everything inside the network once past the firewall. Zero Trust removes implicit trust entirely, treating the internal network as hostile and requiring per-request verification and micro-segmentation.

What is the Principle of Least Privilege?

Granting each user, service, or process only the minimum permissions needed to perform its function, and no more. It limits the blast radius of compromised credentials and reduces the attack surface.

What is Privileged Access Management (PAM)?

A discipline and set of tools for controlling, monitoring, and securing accounts with elevated permissions (admins, root). PAM enforces least privilege, just-in-time access, credential vaulting, session recording, and approval workflows for privileged operations.

What is Just-in-Time (JIT) privileged access?

A model where elevated permissions are granted only for a limited time window when needed and automatically revoked afterward, rather than standing (always-on) access. It shrinks the window of exposure for privileged credentials.

What is a Service Account?

A non-human identity used by an application, VM, or workload to authenticate and access cloud resources programmatically. It has its own credentials and IAM permissions rather than belonging to a person.

What is Workload Identity and what problem does it solve?

A mechanism that lets workloads (containers, pods, functions) assume cloud identities without long-lived static credentials, typically via federated tokens. It eliminates the risk of storing and rotating service-account keys by using short-lived, automatically issued credentials.

Why are long-lived service account keys a security risk, and what is the preferred alternative?

Static keys can be leaked, rarely rotated, and grant standing access if stolen. The preferred alternative is short-lived credentials via workload identity federation or instance/attached roles that auto-rotate and require no stored secret.

What are Organization Policies (guardrails) in cloud governance?

Centrally enforced, preventive constraints applied across an organization's accounts/projects that restrict what configurations or actions are allowed (e.g., block public IPs, restrict regions, require encryption). They enforce compliance by construction, independent of individual IAM permissions.

What is the difference between preventive and detective guardrails?

Preventive guardrails stop non-compliant actions before they occur (e.g., a policy denying resource creation). Detective guardrails identify non-compliant configurations after the fact through monitoring and reporting, triggering alerts or remediation.

What is an Audit Trail in the context of cloud security?

A chronological, tamper-evident record of events and actions (who did what, when, from where) across cloud resources. It supports accountability, forensic investigation, compliance evidence, and detection of unauthorized activity.

What is AWS CloudTrail and what does it record?

An AWS service that logs API calls and account activity, recording the identity of the caller, the time, the source IP, the request parameters, and the response. It provides the audit trail used for governance, compliance, and security analysis. (Equivalents: Azure Activity Log, Google Cloud Audit Logs.)

Why should audit logs be stored immutably and in a separate account?

To prevent attackers from deleting or altering evidence of their activity. Storing logs immutably (e.g., write-once storage, object lock) in a dedicated, tightly controlled account preserves integrity for forensics and compliance.

What is GRC (Governance, Risk, and Compliance)?

An integrated framework aligning IT and security with business objectives. Governance sets policies and accountability, Risk identifies and manages threats to objectives, and Compliance ensures adherence to laws, regulations, and internal standards.

What is the difference between a control and a policy in GRC?

A policy is a high-level statement of intent or rule (what must be done and why). A control is the specific technical or procedural safeguard implemented to enforce the policy and reduce risk (how it is done).

How is risk commonly quantified in risk management?

Risk is expressed as a function of likelihood and impact: $$\text{Risk} = \text{Likelihood} \times \text{Impact}$$ Higher scores indicate risks that require prioritized treatment (mitigate, transfer, accept, or avoid).

Define the risk-management formula terms ALE, SLE, and ARO.

$SLE$ (Single Loss Expectancy) is the cost of one incident; $ARO$ (Annualized Rate of Occurrence) is how many times per year it is expected; and $$ALE = SLE \times ARO$$ gives the Annualized Loss Expectancy used to justify security spending.

What is the difference between SOC 2 and ISO 27001?

SOC 2 is an attestation report (by an auditor) on controls relevant to the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy), common in North America. ISO 27001 is an international certifiable standard for an Information Security Management System (ISMS).

What does GDPR regulate and to whom does it apply?

The EU General Data Protection Regulation governs the processing of personal data of individuals in the EU/EEA. It applies to any organization worldwide handling such data, mandating lawful basis, data-subject rights, breach notification, and heavy fines for non-compliance.

What is HIPAA and what data does it protect?

The U.S. Health Insurance Portability and Accountability Act protects Protected Health Information (PHI). It requires safeguards (administrative, physical, technical) for healthcare data; cloud providers handling PHI must sign a Business Associate Agreement (BAA).

What is PCI DSS and who must comply?

The Payment Card Industry Data Security Standard is a set of requirements for any organization that stores, processes, or transmits cardholder data. It mandates controls like network segmentation, encryption of cardholder data, access control, and regular testing.

What is the difference between compliance and security?

Security is the actual protection of systems and data against threats. Compliance is meeting a defined set of external or internal requirements. An organization can be compliant yet insecure (controls satisfy an audit but real gaps remain), so compliance is a baseline, not a guarantee of security.