Cloud Infrastructure

Question 1 of 6

A company deploys a web application on IaaS virtual machines. The cloud provider's data center suffers a physical intrusion, but no customer data is accessed. Separately, the company's virtual machine is later compromised because the OS had not been patched in eight months. Which statement BEST describes the security responsibilities in these two incidents?

Both incidents are the provider's responsibility — the provider is responsible for all security in an IaaS deployment. The physical intrusion is the provider's responsibility (they secure the data center); the OS compromise is the customer's responsibility (in IaaS, the customer owns OS patching). Each party failed to secure their own layer. The OS compromise is the provider's responsibility — providers are required to patch OS vulnerabilities on virtual machines they host. Both incidents are shared responsibility — the provider should have detected the unpatched OS and notified the customer.

Question 2 of 6

An organization uses a SaaS email platform. A former employee's account is not disabled after they leave. Three months later, the account is used by an attacker to access confidential email threads and exfiltrate client data. Under the shared responsibility model, who failed, and at which layer?

The SaaS provider failed — they should have detected the orphaned account and disabled it automatically. The SaaS provider failed — they are responsible for application security in a SaaS model, which includes account lifecycle management. The customer failed — access management (user account lifecycle, enabling/disabling accounts, managing who has access) is always the customer's responsibility regardless of service model. Failing to disable a former employee's account is an access management failure at the customer layer. Shared failure — the provider should have required re-authentication after 30 days of inactivity, and the customer should have disabled the account.

Question 3 of 6

A development team uses Terraform to manage cloud infrastructure. During an incident, an engineer manually adds a security group rule in the cloud console to allow monitoring traffic. Three weeks later, a Terraform deployment overwrites the security group to match the stored template, removing the manual rule. Which IaC characteristic caused this, and why is it a security benefit even though it broke the monitoring?

Scalability — IaC scales infrastructure changes across all environments, which removed the rule from all regions simultaneously. Version control — the Terraform state file contained the wrong version of the security group definition. Configuration drift prevention — IaC treats the code as the source of truth and overwrites actual state to match the defined state on deployment. This is a security benefit because it ensures that manual changes (which bypass code review and may introduce misconfigurations) are not permanently applied. All changes must go through the reviewed, version-controlled IaC process to persist. Consistency — IaC applies the same configuration to all environments including development, which deleted the rule from production.

Question 4 of 6

A serverless function processes incoming webhook payloads and has been granted an IAM role with AdministratorAccess. An attacker sends a malformed payload that causes the function to expose its temporary IAM credentials in an error log. The attacker uses the credentials to exfiltrate data from all S3 buckets in the account. Which TWO security failures are directly responsible?

The cloud provider failed to protect the function's execution environment and failed to prevent the IAM credential exposure. The function had excessive IAM permissions (AdministratorAccess instead of only the specific permissions required) AND the function failed to validate input (a malformed payload should be rejected with an error, not processed in a way that leaks credentials). Both are customer responsibilities in the serverless model. The function's runtime was unpatched, allowing the credential exposure vulnerability. This is the provider's responsibility in serverless. The function should have used FDE to encrypt the IAM credentials stored in the execution environment.

Question 5 of 6

A company runs an on-premises Active Directory for internal authentication and uses a public cloud provider for a customer-facing application. Users must authenticate to both environments. The security team notes that when employees leave, their cloud accounts are sometimes still active weeks after their on-premises accounts are disabled. Which solution BEST addresses this gap?

Deploy a host-based firewall on each cloud instance to block access from disabled AD accounts. Require all cloud users to change their passwords every 30 days, ensuring that disabled on-premises account users cannot use old credentials. Implement identity federation linking on-premises Active Directory to the cloud IAM system using SAML or OIDC. When an account is disabled in AD, the federated session token for the cloud environment becomes invalid — account disablement propagates automatically across both environments without a separate cloud account management step. Conduct a monthly manual audit comparing Active Directory accounts to cloud IAM accounts and disable orphaned cloud accounts found in the review.

Question 6 of 6

A company migrates from a monolithic application to microservices. Each service communicates with others via REST APIs over the internal network. A security review notes that the inter-service APIs have no authentication — the team's reasoning is that "the services are internal and cannot be reached from the internet." Why is this reasoning flawed, and what is the correct model?

The reasoning is correct — internal APIs do not need authentication because network-level segmentation provides sufficient access control. The reasoning is flawed because network location does not imply trust. If any one microservice is compromised, the attacker can make calls to all other services as if they were a legitimate internal caller — with no authentication, the account service cannot distinguish the legitimate transaction service from a compromised reporting service. Every service-to-service API call must be authenticated (service identity tokens, mutual TLS) and authorized (the caller must have explicit permission for the specific operation). The reasoning is partially correct — external-facing APIs need authentication but internal service meshes should remain unauthenticated to minimize latency overhead. The reasoning is flawed only for services that process payment data — other internal services can safely remain unauthenticated.

Matching — Cloud Infrastructure Concepts

Match each term on the left to its correct description on the right.

1. IaC

2. Shared Responsibility Model

3. Serverless / FaaS

4. Microservices

1. 2. 3. 4.

A. An application architecture that decomposes a monolithic application into many small, independently deployable services that communicate via APIs — providing blast radius isolation but requiring authenticated, authorized API calls between all services

B. The practice of defining cloud infrastructure in version-controlled text files executed by an automation engine — providing consistent, reviewed deployments and preventing configuration drift by treating code as the source of truth

C. A cloud execution model where the provider manages all infrastructure including OS, runtime, and scaling, while the customer is responsible for function code security, IAM permissions (least privilege), and input validation of all event trigger payloads

D. The framework that divides security responsibilities between the cloud provider and the customer based on service model — with data governance and access management remaining the customer's responsibility regardless of whether the deployment is IaaS, PaaS, or SaaS

Cloud Infrastructure Quiz

Matching — Cloud Infrastructure Concepts