FCSS Public Cloud Security flashcards
FCSS Public Cloud Security · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared responsibility model
- The provider secures the physical and managed-service layers, while the customer secures identity, data, guest configuration, and workload-level controls within the cloud account.
- Security of vs in cloud
- Security of the cloud covers provider facilities, hardware, and managed-service patching. Security in the cloud covers customer data, access management, encryption choices, and workload configuration.
- IaaS responsibility boundary
- The customer patches the guest operating system, secures the runtime and applications, and configures network controls, while the provider secures hypervisor and physical infrastructure.
- Compliance inheritance limits
- Provider audit reports cover only provider infrastructure. Customers must generate their own evidence for workload configuration, access logs, and data handling to satisfy auditors.
- Account isolation blast radius
- Splitting environments and tiers into separate cloud accounts or subscriptions confines a compromised credential or misconfiguration to one boundary rather than the whole estate.
- Cloud audit log enablement
- Audit trails such as CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs are often not fully enabled by default and must be turned on per account or project.
- VPC peering limitation
- Peering connects two networks directly but is non-transitive, so a peered network cannot reach a third network through the peer without additional transit infrastructure.
- Stateful versus stateless filtering
- Security groups and NSGs track connection state and allow return traffic automatically. NACLs are stateless and require explicit rules for both directions and ephemeral ports.
- Longest prefix route match
- When multiple routes match a destination, the most specific prefix wins. A /24 route to a firewall overrides a broader /16 route to a gateway.
- Hub-and-spoke inspection
- Spoke networks route traffic to a central hub firewall, which applies policy and forwards to the destination spoke or to the internet through a NAT gateway.
- Asymmetric routing failure
- A stateful firewall drops traffic when the return path bypasses it, because the returning packet matches no existing session. Both directions must traverse the same device.
- Private endpoint connectivity
- PrivateLink, Azure Private Endpoint, and Private Service Connect expose managed services over private addresses, keeping data-plane traffic off the public internet.
- Overlapping CIDR conflict
- Two networks with identical or overlapping address ranges cannot be peered directly. Resolve with a redesigned address plan or NAT performed by the firewall.
- FortiGate VM licensing models
- BYOL requires applying a license file tied to the instance. On-demand or pay-as-you-go instances bundle entitlement and register automatically with FortiCare.
- NIC to port mapping
- FortiGate VM images map cloud network interfaces to firewall ports in a fixed order, typically port1 for management or outside and port2 onward for internal segments.
- Cloud HA floating IP
- On failover the secondary FortiGate assumes the floating or secondary address, and cloud route tables or load balancer targets must be repointed to the new active unit.
- FGCP unicast heartbeat
- Cloud instances cannot rely on Layer 2 broadcast, so FortiGate HA uses unicast heartbeat traffic over a dedicated path or cloud-native HA API integration.
- Bootstrap configuration injection
- Cloud-init or user-data supplies the initial admin password, management route, and FortiManager registration so a new appliance is reachable without console access.
- Autoscale cluster orchestration
- Elastic FortiGate deployments need external orchestration to license new instances and synchronize policy, since instances are created and destroyed dynamically by cloud APIs.
- FortiGate VM sizing drivers
- Throughput for IPsec and TLS inspection, plus concurrent and new session rates, determine the required vCPU and memory tier more than the cloud instance family.
- CNAPP scope
- A converged platform combining cloud security posture management, workload protection, identity entitlement analysis, infrastructure-as-code scanning, and container protection.
- CSPM benchmark evaluation
- Posture tools compare resource configuration against CIS Foundations Benchmarks and provider best practices, scoring findings by severity and reachable exposure.
- CIEM effective permissions
- Identity entitlement analysis finds unused permissions, privilege escalation paths, and cross-account trust relationships rather than misconfigured resource settings.
- CWPP runtime coverage
- Workload protection monitors vulnerability and patch state, malware, file integrity, and process behavior on virtual machines and container workloads.
- Infrastructure-as-code scanning
- Templates such as Terraform and CloudFormation are evaluated before deployment for public storage, open security groups, missing encryption, and absent logging.
- Attack path prioritization
- Chaining a public exposure to a privileged identity to a sensitive data store identifies genuinely exploitable risk, reducing alert volume compared with flat finding lists.
- Posture drift remediation
- Continuous re-evaluation after each deployment detects configuration drift, and event-driven or policy-as-code automation restores the approved baseline automatically.
- Gateway load balancer inspection
- AWS GWLB and Azure Gateway Load Balancer encapsulate traffic with GENEVE and steer it transparently to FortiGate appliances without changing spoke route tables.
- Egress inspection design
- Private subnets route default traffic through a FortiGate pair for domain filtering, application control, and TLS inspection before reaching a NAT gateway.
- TLS inspection prerequisites
- The firewall presents a certificate from a trusted internal CA that endpoints trust. Without distribution, filtering falls back to SNI and category-based controls.
- Dynamic address objects
- Cloud or SDN connectors populate firewall address objects from instance tags or metadata, so policy follows workloads as they scale or move.
- Firewall log correlation
- FortiGate traffic and event logs sent to FortiAnalyzer or a SIEM are joined with VPC flow logs and cloud audit logs to reconstruct incident timelines.