Security
Core concepts
Layered security: network (security groups, network ACLs, WAF, Anti-DDoS), host (patch management, antivirus, baseline checks via Security Center), data (encryption at rest with KMS, TLS in transit, OSS bucket policies), and identity (RAM). Security Center provides threat detection and vulnerability assessment. ActionTrail records API activity for audit. KMS manages encryption keys; OSS supports server-side encryption.
Traps in questions
- WAF vs. Anti-DDoS: WAF filters application-layer attacks (SQLi, XSS); Anti-DDoS absorbs volumetric network attacks. Neither replaces the other.
- Encryption at rest vs. in transit: KMS/SSE protects stored data; TLS protects data on the wire. Questions often require both.
- Public bucket risk: an OSS bucket set to public-read exposes objects; use signed URLs or bucket policies instead.
- Least privilege: broad wildcard policies are a red flag in answer choices.
- Audit vs. monitoring: ActionTrail audits API calls; CloudMonitor tracks metrics and alarms.
Rule of thumb
Defense in depth: assume any single control can fail. Combine network segmentation, host hardening, encryption, least-privilege identity, and audit logging.
Worked example
An app stores customer documents in OSS and must prevent public exposure while encrypting data. Keep the bucket private, enable server-side encryption with KMS, grant access only through a RAM role scoped to that bucket, and enable ActionTrail logging. A public-read bucket with a password in the URL fails the requirement.