Cloud Security Fundamentals and Architecture
This domain tests whether you can reason about who secures what in a cloud environment, how CrowdStrike's CNAPP modules divide the problem, and how architecture choices - account structure, ephemeral compute, managed services - change the telemetry you actually have. Questions are scenario-framed, not definition-recall.
Shared responsibility is a boundary, not a percentage
- The provider secures facilities, hypervisor and managed-service internals ("security of the cloud"); the customer secures identities, configuration, data and workloads ("security in the cloud").
- Moving IaaS → PaaS → SaaS shrinks the customer's share, but identity, account governance, data classification and configuration stay customer-owned in every model. A public storage bucket is a customer finding even in a PaaS service.
- Controls can be inherited, shared or customer-owned; "the provider is compliant therefore I am" is never valid.
The CNAPP map
Falcon Cloud Security consolidates posture (CSPM, expressed as indicators of misconfiguration), cloud identity entitlement management (CIEM), cloud workload protection (CWPP, agent and agentless), data security posture (DSPM) and application security posture (ASPM). Match the module to the question: is this bucket public? is CSPM; who can read it? is CIEM; is this host running a vulnerable package? is CWPP.
Architecture facts that change detection
- Assets are ephemeral. Autoscaled instances may never live long enough to carry a sensor, which is why snapshot-based agentless assessment and registry image scanning sit alongside runtime agents.
- Tenancy hierarchy matters: AWS Organizations and Control Tower, Azure management groups and subscriptions, GCP folders and projects determine where guardrails (SCPs, Azure Policy, org policies) apply and how a landing zone inherits controls.
- Control plane and data plane are separate evidence streams. API activity lands in CloudTrail / Activity Log / Cloud Audit Logs; process and network behaviour needs a sensor. Serverless functions produce control-plane evidence only.
Worked example
A billing export bucket is found world-readable. The candidate must decide responsibility and next step. Reasoning: storage configuration is customer-owned in every service model, so this is a customer finding, detected by CSPM, remediated by enabling account-level public access blocks and scoping the bucket policy, then verified by a fresh assessment. It is not a CIEM question, because the defect is exposure, not entitlement - though CIEM would answer the follow-up of which principals still hold read access.
Traps that cost marks
Assuming an agentless-only deployment gives runtime prevention; assuming a sensor on the node gives container-level visibility; treating a clean compliance report as proof of secure configuration; forgetting that serverless and managed services have no kernel to instrument.