Ethical Hacking Cloud Security Syllabus

What is an insecure API in cloud security?

An application programming interface with weak authentication, authorization, encryption, or input validation that attackers can exploit to access data or manipulate cloud services.

Name common API security weaknesses attackers exploit.

Broken authentication, lack of rate limiting, excessive data exposure, missing input validation/injection flaws, broken object-level authorization (BOLA), and unencrypted endpoints.

What API practices help secure cloud APIs?

Strong authentication (OAuth 2.0/tokens), authorization checks, TLS encryption, input validation, rate limiting/throttling, and regular security testing.

What is Identity and Access Management (IAM)?

A framework of policies, processes, and technologies that ensures the right individuals and services have the appropriate access to resources, controlling authentication and authorization.

What is the difference between authentication and authorization?

Authentication verifies who you are (identity); authorization determines what you are allowed to do (permissions) once authenticated.

What is multi-factor authentication (MFA)?

An access control method requiring two or more independent verification factors—something you know (password), something you have (token/phone), or something you are (biometric)—to authenticate.

What is Role-Based Access Control (RBAC)?

An access control model that assigns permissions to roles rather than individuals, and users gain permissions by being assigned to roles, simplifying management at scale.

How does RBAC differ from ABAC?

RBAC grants access based on predefined roles; ABAC (Attribute-Based Access Control) grants access based on evaluated attributes of the user, resource, action, and environment, allowing finer-grained, dynamic policies.

What is the principle of Single Sign-On (SSO)?

An authentication scheme letting a user log in once with one set of credentials to access multiple related but independent systems, often via federation protocols like SAML or OpenID Connect.

What is data encryption?

The process of converting readable plaintext into unreadable ciphertext using an algorithm and key, so only authorized parties with the correct key can decrypt and read it.

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared key for both encryption and decryption (fast, e.g., AES); asymmetric encryption uses a public/private key pair (slower, e.g., RSA), where one key encrypts and the paired key decrypts.

What is AES and what key sizes does it support?

AES (Advanced Encryption Standard) is a symmetric block cipher operating on 128-bit blocks, supporting key sizes of 128, 192, and 256 bits. AES-256 is the common standard for strong data-at-rest encryption.

In RSA, which key encrypts and which decrypts for confidentiality?

For confidentiality, the sender encrypts with the recipient's public key, and only the recipient's private key can decrypt it. (For digital signatures the roles are reversed.)

What is the mathematical basis of RSA's security?

RSA relies on the difficulty of factoring the product of two large primes. The modulus is $n = p \cdot q$, and security depends on factoring $n$ being computationally infeasible for large $p$ and $q$.

What is Euler's totient function used in RSA, and its value for $n = p \cdot q$?

$\varphi(n) = (p-1)(q-1)$, used to compute the private exponent $d$ such that $e \cdot d \equiv 1 \pmod{\varphi(n)}$, where $e$ is the public exponent.

What is envelope encryption in the cloud?

A technique where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a separate key encryption key (KEK) stored in a key management service, improving key management and scalability.

What is a hardware security module (HSM) and a Key Management Service (KMS)?

An HSM is a tamper-resistant hardware device that generates, stores, and protects cryptographic keys; a KMS is a managed cloud service (often HSM-backed) for creating, rotating, and controlling access to encryption keys.

What is a hash function and how does it differ from encryption?

A hash function maps data to a fixed-length digest and is one-way (irreversible), used for integrity/verification; encryption is reversible (with a key) and used for confidentiality.

What is security monitoring in the cloud?

The continuous collection, analysis, and correlation of logs, events, and metrics across cloud resources to detect, alert on, and respond to security threats and anomalies in real time.

What is a SIEM?

Security Information and Event Management—a system that aggregates and correlates log and event data from across an environment to provide real-time analysis, alerting, and forensic investigation of security events.

What is the difference between SIEM and SOAR?

SIEM focuses on collecting, correlating, and alerting on security data; SOAR (Security Orchestration, Automation and Response) adds automated playbooks and workflows to respond to and remediate incidents.

What is the difference between an IDS and an IPS?

An IDS (Intrusion Detection System) detects and alerts on suspicious activity passively; an IPS (Intrusion Prevention System) actively blocks or drops malicious traffic inline.

What does MTTD and MTTR measure in security monitoring?

MTTD is Mean Time To Detect (average time to discover an incident) and MTTR is Mean Time To Respond/Remediate (average time to contain or resolve it). Lower values indicate more effective monitoring.

What is a Cloud Access Security Broker (CASB)?

A security enforcement point (software or service) placed between cloud users and cloud providers that monitors activity and enforces security policies for data, access, compliance, and threat protection across cloud services.

What are the four pillars of a CASB?

Visibility (discovering cloud usage/shadow IT), Compliance (meeting regulatory requirements), Data Security (DLP, encryption), and Threat Protection (detecting anomalies and malware).

What deployment modes can a CASB use?

API-based (out-of-band, integrating via provider APIs), proxy-based forward proxy (agent on endpoints), and reverse proxy (inline, no agent needed), or a multimode combination of these.

What is shadow IT and how does a CASB address it?

Shadow IT is the use of unauthorized cloud apps/services without IT approval. A CASB discovers and provides visibility into this usage, letting security teams assess risk and enforce policy.

What is Cloud Security Posture Management (CSPM)?

A category of tools that continuously monitor cloud infrastructure to detect misconfigurations, compliance violations, and security risks, and automate their remediation across IaaS/PaaS environments.

What is the primary risk CSPM addresses?

Misconfigurations—such as publicly exposed storage buckets, overly permissive IAM policies, unencrypted resources, and open security groups—which are a leading cause of cloud data breaches.

What is a Cloud Workload Protection Platform (CWPP)?

A security solution focused on protecting workloads—virtual machines, containers, and serverless functions—across cloud environments through vulnerability scanning, runtime protection, and system hardening.

How do CSPM and CWPP differ in focus?

CSPM secures the cloud configuration and control plane (misconfigurations, compliance posture), while CWPP secures the running workloads themselves (VMs, containers, serverless) at runtime. They are complementary and often combined in a CNAPP.