Security and Compliance: Shared Responsibility and Identity-First Thinking
What to know
Security questions reward a layered, identity-centric mindset. Start with the shared responsibility model: the provider secures the cloud (physical facilities, hypervisor, managed service infrastructure), while you secure what you put in it (data, identities, configurations, network rules, application code). The split moves with the service model, so a managed database shifts patching to the provider but never shifts data classification or access control.
Know the pillars: identity and access management with least privilege, multi-factor authentication, and role-based rather than individual permissions; encryption at rest and in transit with key management and rotation; network segmentation through subnets, security groups, and private endpoints; logging, monitoring, and alerting for audit trails; and vulnerability management with timely patching. Understand data classification and retention, and the compliance vocabulary: regulations, audit evidence, data residency, and the difference between a provider's compliance attestation and your own compliance obligation.
Traps
Watch for the "encryption solves it" distractor - encryption protects confidentiality but not availability or integrity of access. Another common trap is granting broad permissions "temporarily"; exam answers favor scoped roles and time-bound credentials. Questions about the provider's certification often tempt you to assume your workload inherits compliance; it does not. Also distinguish authentication (who you are) from authorization (what you may do).
Worked rule of thumb
When a scenario asks how to let an application read one bucket, the correct pattern is a narrowly scoped role attached to the compute identity with only the needed action - not a shared long-lived access key stored in code. If an option embeds credentials in configuration, eliminate it.
Study approach
For any scenario, ask: whose responsibility is this control, what is the least privilege that works, and how would I detect misuse?