Cloud Computing MCQs - Cloud Security, IAM and Major Cloud Platforms (Set 6)

Q1. Granting each user or service only the permissions required to perform its task is known as

a) Defence in depth

b) The principle of least privilege

c) Separation of duties

d) Security by obscurity

Q2. Requiring a password plus a one-time code from a phone app at sign-in is an example of

a) Single sign-on

b) Role-based access control

c) Multi-factor authentication

d) Identity federation

Q3. What is the recommended way for an application running on a cloud VM to access an object storage bucket?

a) Embed the root account access keys in the code

b) Attach an IAM role to the VM so it receives temporary, automatically rotated credentials

c) Share an administrator password through environment files

d) Make the bucket publicly readable and writable

Q4. TLS mainly protects which state of data?

a) Data in transit over the network

b) Data at rest on disk

c) Data in use inside CPU registers

d) Data already deleted from storage

Q5. A key management service encrypts each object with a unique data key and then encrypts that data key with a master key that never leaves the service. This approach is called

a) Envelope encryption

b) Homomorphic encryption

c) Tokenisation

d) Hashing

Q6. Which technology aims to protect data while it is being processed, so even the cloud operator cannot read it in memory?

a) TLS 1.3

b) Full disk encryption

c) Trusted execution environments used for confidential computing

d) Site-to-site VPN

Q7. A company storing and processing payment card data in the cloud must comply with

a) HIPAA

b) FERPA

c) ISO 9001

d) PCI DSS

Q8. Which regulation governs the processing of personal data of individuals in the European Union?

a) GDPR

b) HIPAA

c) PCI DSS

d) SOX

Q9. Which group lists equivalent virtual machine (IaaS compute) services across AWS, Azure and Google Cloud?

a) Amazon EC2, Azure Virtual Machines, Google Compute Engine

b) Amazon S3, Azure Functions, Google BigQuery

c) AWS Lambda, Azure Blob Storage, Google Cloud SQL

d) Amazon RDS, Azure Cosmos DB, Google Pub/Sub

Q10. Which Azure service is the closest counterpart to Amazon S3?

a) Azure Files

b) Azure Blob Storage

c) Azure Disk Storage

d) Azure Functions

Q11. AWS Lambda belongs to which category of cloud service?

a) Block storage

b) Managed Kubernetes

c) Function as a Service

d) Content delivery

Q12. Which group consists only of managed Kubernetes services?

a) Amazon ECS, Azure Container Instances, App Engine

b) Amazon EBS, Azure Managed Disks, Persistent Disk

c) AWS KMS, Azure Key Vault, Cloud KMS

d) Amazon EKS, Azure Kubernetes Service, Google Kubernetes Engine

Q13. In AWS, security groups are stateful. What does this mean?

a) Return traffic for an allowed inbound connection is automatically permitted

b) Rules must be written separately for both directions of every connection

c) They store encrypted session data

d) They apply only at the subnet level

Q14. What is the primary purpose of Azure Key Vault?

a) Hosting virtual machines

b) Securely storing and controlling access to keys, secrets and certificates

c) Balancing HTTP traffic

d) Collecting application logs

Q15. A user has only the IAM policy below attached. What happens when the user tries to delete an object from a bucket?

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow", "Action": "s3:*", "Resource": "*"},
    {"Effect": "Deny", "Action": "s3:DeleteObject", "Resource": "*"}
  ]
}

a) It is allowed because s3:* includes every S3 action

b) It is denied because an explicit deny overrides any allow

c) It is allowed only if the user owns the bucket

d) The outcome depends on which statement appears first

Q16. Which security component sits between an organisation's users and its cloud services to enforce policies such as visibility, data protection and access control for SaaS usage?

a) Content delivery network

b) Web cache

c) Cloud Access Security Broker

d) DHCP server

Q17. Which model follows 'never trust, always verify', granting no implicit trust based on network location?

a) Perimeter-based security

b) Air gapping

c) Security through obscurity

d) Zero trust architecture

Q18. To keep an application running if a single AWS data centre fails, instances should be deployed across

a) Multiple security groups

b) Multiple IAM users

c) Multiple S3 buckets

d) Multiple Availability Zones in a region