Security, Compliance & Identity Concepts

In the shared responsibility model for cloud computing, who is always responsible for protecting the data and identities in the cloud?

• AThe customer is always responsible for their data, devices and accounts✓
• BThe cloud provider is always responsible for the data and the identities
• CResponsibility for data and identities is split evenly in every service model
• DA third-party auditor takes responsibility for the data once it is in the cloud

Answer: In the shared responsibility model the customer always retains responsibility for their data, identities and accounts, while the provider's share of infrastructure responsibility grows from IaaS to SaaS. The provider never takes over responsibility for the customer's data or identities.

What is the core principle of the Zero Trust security model?

• ATrust everything inside the corporate network and block everything outside it
• BVerify explicitly and never trust a request based only on network location✓
• CTrust any device that has connected successfully at least once before
• DTrust users automatically once they are on a virtual private network

Answer: Zero Trust assumes breach and verifies each request explicitly using all available signals, granting least-privilege access rather than trusting anything by its network location. The idea of a trusted internal network is exactly what Zero Trust replaces.

What does the defense-in-depth approach to security involve?

• ARelying on a single strong perimeter firewall to protect the whole cloud environment
• BConcentrating the organization's security controls at the data layer, where information is stored
• CUsing multiple layers of protection so no single control is a point of failure✓
• DDividing security duties between the cloud provider and the customer by service type

Answer: Defense-in-depth uses several layers of controls, such as physical, identity, perimeter, network, compute, application and data, so that if one layer is breached others still protect the asset. A single control, wherever placed, is a single point of failure.

What is the difference between authentication and authorization?

• AAuthentication decides what you can access, and authorization proves who you are
• BAuthentication and authorization are two names for the same sign-in process
• CAuthentication proves who you are, and authorization decides what you can access✓
• DAuthentication encrypts your data, and authorization creates a backup of it

Answer: Authentication (AuthN) verifies a person or service's identity, while authorization (AuthZ) determines what an authenticated identity is allowed to do. They are distinct steps, and neither performs encryption or backup.

How does encryption differ from hashing?

• AEncryption cannot be reversed, while hashing can be reversed with the right key
• BEncryption is reversible with a key, while hashing produces a fixed-length value that cannot be reversed✓
• CEncryption and hashing both produce an output value that is specifically designed to be decrypted again later on
• DEncryption is used for data in transit, while hashing is used for data at rest

Answer: Encryption transforms data so it can be decrypted back with the correct key, whereas hashing produces a fixed-length, one-way value that cannot be reversed and is used to verify integrity, such as for passwords. Reversibility is the key distinction.

In modern cloud security, why is identity often described as the primary security perimeter?

• AUsers, apps and data are accessed from anywhere, so identity is the consistent control point✓
• BBecause identities are stored in the cloud rather than in on-premises directories
• CBecause identity-based attacks are easier to detect than network-based attacks
• DBecause physical security, at the building level, is made unnecessary by the cloud

Answer: With users, devices and services connecting from anywhere, the traditional network boundary is no longer sufficient, so identity becomes the consistent perimeter where access is controlled. Firewalls and physical security still matter as other layers.

What do Governance, Risk, and Compliance (GRC) concepts help an organization to do?

• AReplace technical controls with written policies, procedures and staff training
• BDetect and block malware on the organization's devices and servers
• CEncrypt data at rest and in transit across the organization's systems
• DAlign its operations with policies, manage risk, and meet regulatory requirements✓

Answer: GRC provides the framework to govern operations by policy, identify and manage risk, and demonstrate compliance with laws and regulations. It complements technical controls rather than replacing them, and it is not itself a malware-blocking or encryption tool.

What is federation in the context of identity?

• AA trust relationship that lets users sign in to one system using an identity from another✓
• BA method of synchronizing password hashes from on-premises Active Directory to Microsoft Entra ID
• CA way of copying user accounts from the cloud back to a local server
• DA process that grants users administrator rights in a partner organization's tenant

Answer: Federation establishes trust between identity systems so a user authenticated by one (the identity provider) can access resources in another without a separate account. It is not password hash synchronization, account copying or a grant of admin rights.

What is the role of an identity provider (IdP)?

• ATo store the organization's business data and its application source code in one central location
• BTo route network traffic between the on-premises network and the cloud
• CTo scan connecting devices for malware and other threats before they are allowed onto the network
• DTo create, maintain and verify identities and issue authentication tokens✓

Answer: An identity provider manages identities and authenticates users or services, issuing tokens that applications trust. It does not store business data, route network traffic or perform malware scanning.

What is a directory service such as Active Directory used for?

• ATo provide antivirus protection for every server in the data center
• BTo back up application databases, copying them to a second region each night
• CTo measure the performance of the network between offices and the cloud
• DTo store and organize information about users, groups and resources for access✓

Answer: A directory service stores and organizes identity and resource information and supports authentication and authorization, as Active Directory does on-premises. It is not an antivirus, backup or network-performance tool.

Which statement best describes the relationship between compliance and security?

• ACompliance and security are the same discipline, managed by the same team with the same tools
• BSecurity protects assets, while compliance shows those protections meet required standards✓
• CCompliance is a one-time certification, while security is a continuous process
• DSecurity is mainly about paperwork, while compliance is mainly about technology

Answer: Security is the set of controls that protect assets, and compliance demonstrates that those controls satisfy legal, regulatory or industry requirements; they reinforce each other. Compliance is ongoing rather than a one-time certification, and it does not guarantee immunity from breaches.