I85PREP
⌘ K
FCSS Public Cloud Security study materials
FCSS Public Cloud Security study resources

FCSS Public Cloud Security practice questions

One question at a time. Build your FCSS Public Cloud Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Public Cloud Security Fundamentals and Shared Responsibility

In the public cloud shared responsibility model, which security task always remains the customer's responsibility regardless of the service model (IaaS, PaaS, or SaaS)?

  1. Patching the physical hypervisor that hosts tenant virtual machines
  2. Securing the physical perimeter of the data center campus
  3. Managing the identity, access, and data classification of the customer's own users and content Correct answer.
  4. Maintaining redundant power distribution units across availability zones

Explanation

The provider owns the physical facility, hardware, and the hypervisor layer, while the customer always retains responsibility for its own identities, access decisions, and data governance. This data and identity responsibility persists through every service model, even SaaS. Physical controls are never delegated to the tenant.

Question 2Public Cloud Security Fundamentals and Shared Responsibility

A company moves a workload from virtual machines to a managed serverless function service. Which responsibility shifts from the customer to the provider?

  1. Encrypting application secrets stored in the configuration
  2. Patching the guest operating system and runtime that execute the function Correct answer.
  3. Classifying the sensitivity of the data the function processes
  4. Defining which callers may invoke the function

Explanation

In a serverless model the provider manages the underlying operating system and runtime, so patching moves to the provider. The customer still owns data classification, invocation authorization, and secret protection. This is the key shift when abstracting away from infrastructure.

Question 3Public Cloud Security Fundamentals and Shared Responsibility

Which control is the customer's responsibility when using a provider-managed relational database service?

  1. Managing database user accounts, privileges, and row-level access policies Correct answer.
  2. Applying database engine security patches released by the vendor
  3. Configuring the network ACLs on the provider's storage backend
  4. Replacing failed disks in the storage cluster hosting the database

Explanation

With a managed database the provider patches the engine and maintains the storage hardware, but the customer controls database accounts, privileges, and access policies. Identity and authorization inside the database remain tenant duties. Hardware replacement is always provider work.

Question 4Public Cloud Security Fundamentals and Shared Responsibility

What does the provider's 'security of the cloud' scope primarily cover?

  1. The customer's identity federation configuration and role mappings
  2. The customer's application code and its input validation logic
  3. Customer data encryption keys and their rotation schedules
  4. The physical infrastructure, hypervisor, and network fabric that host tenant resources Correct answer.

Explanation

'Security of the cloud' refers to the provider's own infrastructure: facilities, hardware, hypervisor, and core network. The customer's 'security in the cloud' covers data, identity, and application configuration. This split is the foundation of the shared responsibility model.

Question 5Public Cloud Security Fundamentals and Shared Responsibility

A regulated customer needs to prove that cloud-hosted controls meet an industry standard. What is the most appropriate use of the provider's compliance attestations?

  1. They replace the customer's obligation to notify regulators of a breach
  2. They transfer the customer's regulatory accountability to the provider
  3. They provide evidence about provider-controlled layers that the customer can incorporate into its own compliance package Correct answer.
  4. They eliminate the need for the customer to assess its own configurations

Explanation

Provider attestations such as audit reports and certifications give evidence about controls the provider operates, which customers can inherit or reference. They do not transfer the customer's legal accountability or remove the need to assess customer-controlled configurations. Compliance remains a shared effort.

Question 6Public Cloud Security Fundamentals and Shared Responsibility

Why does the shared responsibility boundary move when a customer adopts a higher-level managed service?

  1. Because regulatory requirements no longer apply to managed services
  2. Because the customer loses all security obligations once a service is managed
  3. Because encryption becomes optional for data stored in managed services
  4. Because the provider assumes more of the operational controls as it abstracts the underlying infrastructure Correct answer.

Explanation

As services abstract more of the stack, the provider takes on more operational controls such as patching and host hardening. The customer still retains data, identity, and configuration duties, so obligations are not eliminated. The boundary shifts rather than disappears.

Question 7Public Cloud Security Fundamentals and Shared Responsibility

Which activity is part of the customer's responsibility in the cloud even though it involves provider tooling?

  1. Reviewing the provider's data center fire suppression design
  2. Certifying the provider's physical access badge readers
  3. Configuring logging, monitoring, and alerting for the customer's own cloud resources Correct answer.
  4. Auditing the provider's staff background-check program

Explanation

The customer must enable and configure logging, monitoring, and alerting for the resources it deploys, even though the provider supplies the tooling. Provider personnel and facility controls are audited by the provider and reported through attestations. Tenants do not assess provider physical controls directly.

Question 8Public Cloud Security Fundamentals and Shared Responsibility

What is the primary purpose of a cloud provider's acceptable use policy for a security practitioner?

  1. It defines prohibited activities and use restrictions that the customer must honor when using the service Correct answer.
  2. It defines the encryption algorithms the customer must use for all data
  3. It specifies the customer's incident response escalation contacts
  4. It sets the customer's internal password complexity requirements

Explanation

An acceptable use policy states what the customer may and may not do with the service, such as prohibitions on certain scanning or abusive workloads. It is not a substitute for the customer's own cryptographic or password standards. Security teams must align workloads with these terms.

Question 9Public Cloud Security Fundamentals and Shared Responsibility

A team stores regulated data in an object storage bucket and asks who is responsible for making the bucket private. Under the shared responsibility model, who owns this decision?

  1. A third-party auditor, because access control is externally mandated
  2. The provider, because it owns the storage platform
  3. The provider, because object storage is always private by design
  4. The customer, because access configuration of the bucket is a customer-controlled setting Correct answer.

Explanation

Bucket access policy is a customer-managed configuration, so the customer is responsible for making it private. The provider secures the storage platform itself but does not decide tenant access policies. Auditors assess but do not configure controls.

Question 10Public Cloud Security Fundamentals and Shared Responsibility

Which statement best describes the customer's responsibility for network security controls in an infrastructure-as-a-service environment?

  1. The customer configures security groups, routing, and segmentation for its own virtual networks Correct answer.
  2. The provider decides which ports the customer's applications may expose
  3. The customer manages the physical routers that carry provider backbone traffic
  4. The provider configures the customer's firewall rules on the customer's behalf by default

Explanation

In IaaS the customer designs and configures virtual network controls such as security groups, routes, and segmentation. The provider owns the physical backbone and does not set tenant firewall rules by default. Port exposure decisions belong to the customer.

Question 11Public Cloud Security Fundamentals and Shared Responsibility

A customer enables a provider-managed key service to encrypt data at rest. Which responsibility still belongs to the customer?

  1. Patching the firmware of the key management appliances
  2. Controlling key policies and access permissions for the keys it creates Correct answer.
  3. Maintaining the physical racks that host the key service
  4. Protecting the hardware security modules that store the root keys

Explanation

Even with a managed key service, the customer defines key policies and decides who may use or administer keys. The provider operates the hardware security modules, firmware, and racks. This is a classic split of control versus operation.

Question 12Public Cloud Security Fundamentals and Shared Responsibility

Why should a customer not rely solely on the provider's default encryption of storage volumes to satisfy a data-protection policy?

  1. Default encryption violates most regulatory frameworks
  2. Default encryption is never enabled on provider storage services
  3. Default encryption prevents the customer from ever reading its own data
  4. Default encryption addresses data at rest but the customer must still govern access, key custody, and data classification Correct answer.

Explanation

Provider default encryption protects data at rest but does not govern who can access the data, how keys are custodied, or how data is classified. A complete data-protection policy also covers access control and key management choices. Encryption alone is one layer of many.

Question 13Public Cloud Security Fundamentals and Shared Responsibility

Which of the following best illustrates the customer's responsibility for identity in a SaaS application integrated with the corporate directory?

  1. Managing the SaaS vendor's TLS certificate rotation for its public endpoint
  2. Operating the directory synchronization service and deciding which users are provisioned Correct answer.
  3. Patching the SaaS vendor's web application framework
  4. Maintaining the SaaS vendor's authentication servers

Explanation

When integrating SaaS with a corporate directory, the customer controls provisioning, deprovisioning, and which identities are granted access. The vendor manages its own authentication servers, application framework, and endpoint certificates. Identity governance is a persistent customer duty.

Question 14Public Cloud Security Fundamentals and Shared Responsibility

A security architect is mapping controls for a new workload and asks which layer the provider is accountable for in a platform-as-a-service offering. What is the most accurate answer?

  1. The runtime, middleware, and operating system beneath the application platform Correct answer.
  2. The customer's business logic and data retention rules
  3. The customer's role assignments and least-privilege design
  4. The customer's application source code and dependency updates

Explanation

In PaaS the provider is accountable for the runtime, middleware, and operating system that host the platform. The customer remains accountable for application code, business logic, data retention, and role design. Mapping controls requires distinguishing these layers.

Question 15Public Cloud Security Fundamentals and Shared Responsibility

Which practice best demonstrates that a customer understands its side of the shared responsibility model during onboarding of a new cloud service?

  1. Assuming the provider's certification covers all customer configurations
  2. Documenting which controls the provider operates and which the customer must implement, then validating them Correct answer.
  3. Deferring all security decisions to the provider's support team
  4. Disabling logging to reduce storage costs on the new service

Explanation

Effective onboarding documents the control split for each service and validates that customer-side controls are implemented. Assuming certification covers customer configurations or deferring decisions to support leaves gaps. Disabling logging removes needed evidence.

Question 16Public Cloud Security Fundamentals and Shared Responsibility

What is the customer's responsibility regarding vulnerability management on virtual machines it runs in the cloud?

  1. Patching the hypervisor that runs the instances
  2. Replacing failed host hardware beneath the instances
  3. Scanning and remediating guest operating system and application vulnerabilities on its instances Correct answer.
  4. Auditing the provider's firmware signing process

Explanation

For IaaS virtual machines, the customer manages the guest operating system and application patching, including vulnerability scanning and remediation. The provider handles hypervisor patching, hardware replacement, and firmware processes. This is a core IaaS customer duty.

Question 17Public Cloud Security Fundamentals and Shared Responsibility

A provider publishes a service level agreement with availability commitments. How does this relate to the customer's security responsibilities?

  1. The SLA transfers security control ownership to the provider
  2. The SLA guarantees the customer's data will never be breached
  3. The SLA addresses availability of the service, while the customer still owns security configuration and resilience planning Correct answer.
  4. The SLA removes the need for customer backup and recovery testing

Explanation

An SLA defines availability commitments for the service and is not a security guarantee. Customers still own configuration, access control, and their own resilience and recovery planning. Availability commitments do not shift security accountability.

Question 18Public Cloud Security Fundamentals and Shared Responsibility

Which customer activity supports the provider's ability to investigate a suspected compromise while respecting the shared responsibility split?

  1. Enabling and preserving service and audit logs for the customer's own resources Correct answer.
  2. Requesting provider root credentials to inspect the hypervisor
  3. Disabling multi-factor authentication to speed incident triage
  4. Relying only on provider-side monitoring without customer telemetry

Explanation

The customer must enable and preserve logs for its own resources so it can investigate activity it controls and share relevant evidence. Customers cannot access provider hypervisors, and disabling MFA weakens security. Provider monitoring alone does not cover tenant-level activity.

Question 19Public Cloud Security Fundamentals and Shared Responsibility

Which statement about the customer's responsibility for data residency and sovereignty is accurate?

  1. The customer must choose regions and services that satisfy its residency obligations Correct answer.
  2. Residency obligations are waived for managed services
  3. Data residency is irrelevant once data is encrypted at rest
  4. The provider automatically enforces the customer's national data residency laws

Explanation

The customer must select regions and services consistent with its legal residency obligations, since the provider offers options rather than enforcing national law. Encryption does not change where data is stored. Managed services do not waive residency duties.

Question 20Public Cloud Security Fundamentals and Shared Responsibility

A team argues that because the provider is certified to a standard, the team can skip configuring least privilege. What is the best response?

  1. The certification transfers identity controls to the provider
  2. The certification only matters for physical security and has no bearing on identity
  3. The certification means least privilege is unnecessary for customer identities
  4. The certification covers provider infrastructure, so the team must still implement least privilege for its own identities Correct answer.

Explanation

Provider certifications address controls the provider operates, not the customer's identity configuration. Least privilege for customer identities remains a customer duty regardless of certification. Certifications do not transfer identity controls.

Question 21Public Cloud Security Fundamentals and Shared Responsibility

Which element of a cloud workload is the customer responsible for securing even when using a fully managed container orchestration service?

  1. The container images the customer builds and the secrets injected into them Correct answer.
  2. The control plane's etcd datastore encryption at the provider
  3. The provider's physical network isolation between tenants
  4. The provider's underlying node operating system patches

Explanation

With managed orchestration, the provider secures the control plane, node operating systems, and physical isolation, while the customer secures its images and secrets. Image provenance and secret handling remain tenant duties. This distinction is central to container security.

Question 22Public Cloud Security Fundamentals and Shared Responsibility

A customer uses a provider-managed monitoring service to collect logs from its workloads. Which responsibility remains with the customer?

  1. Patching the monitoring service's ingestion servers
  2. Deciding which events to collect, retaining them appropriately, and restricting who can read them Correct answer.
  3. Maintaining the availability zones hosting the monitoring backend
  4. Operating the monitoring backend's storage cluster

Explanation

The provider operates the monitoring backend, ingestion servers, and hosting zones, but the customer decides what telemetry to collect, how long to retain it, and who may view it. Log selection and access are tenant governance decisions. This preserves confidentiality and evidentiary value.

Question 23Public Cloud Security Fundamentals and Shared Responsibility

Why is the customer's responsibility for data classification considered foundational to the shared responsibility model?

  1. Because classification eliminates the need for identity controls
  2. Because classification drives which controls, encryption, and access restrictions are appropriate for each dataset Correct answer.
  3. Because classification determines which provider certifications apply to the account
  4. Because classification is performed automatically by the provider's storage layer

Explanation

Data classification determines the sensitivity of each dataset and therefore which encryption, access, and retention controls are appropriate. Providers cannot reliably classify tenant data on the customer's behalf. Classification does not remove the need for identity controls.

Question 24Public Cloud Security Fundamentals and Shared Responsibility

A customer deploys an internet-facing application and asks who is responsible for protecting it from application-layer attacks such as injection. What is the correct division?

  1. The customer and provider share equal code-level responsibility under all models
  2. The provider, because it operates the load balancer
  3. The provider, because it owns the network edge
  4. The customer, because application code and input handling are customer-controlled Correct answer.

Explanation

Application-layer vulnerabilities such as injection arise from customer code and input handling, so remediation belongs to the customer. The provider protects the network edge and load balancer infrastructure, but not tenant application logic. Code-level security is never delegated in IaaS or PaaS.

Question 25Public Cloud Security Fundamentals and Shared Responsibility

A customer wants to minimize its residual responsibility when adopting a new service. Which approach is most consistent with the shared responsibility model?

  1. Selecting a higher-level managed service and then configuring identity, data, and logging controls for the remaining customer scope Correct answer.
  2. Outsourcing all security decisions to an external party without customer oversight
  3. Selecting the lowest-level infrastructure service to maximize control over every layer
  4. Assuming the provider will configure all tenant controls after deployment

Explanation

Higher-level managed services shift more operational controls to the provider, but the customer must still configure identity, data, and logging for its remaining scope. Choosing the lowest-level service increases, not decreases, customer duties. Providers do not configure tenant controls automatically.

Question 26Public Cloud Security Fundamentals and Shared Responsibility

In the shared responsibility model for infrastructure as a service, which control area is the cloud provider accountable for?

  1. Assigning least-privilege roles to the customer's workforce
  2. Classifying the sensitivity of the data stored in customer volumes
  3. Patching the guest operating system on customer virtual machines
  4. Physical security of the data centers hosting the hardware Correct answer.

Explanation

Under IaaS the provider owns the physical layer, including facilities, hardware, and the hypervisor that runs beneath the customer's instances. Everything inside the guest operating system and above, including identity assignments and data classification, stays with the customer.

Question 27Public Cloud Security Fundamentals and Shared Responsibility

A company signs up for a SaaS payroll product. Which security task remains with the company rather than the SaaS provider?

  1. Deciding which employees receive which application roles Correct answer.
  2. Maintaining the application's source code and build pipeline
  3. Operating the database cluster that stores payroll records
  4. Applying firmware updates to the servers running the service

Explanation

In SaaS the provider operates the application, runtime, and infrastructure, while the customer governs who inside its organization can access the service and with what permissions. Role assignment and user lifecycle management therefore stay on the customer side.

Question 28Public Cloud Security Fundamentals and Shared Responsibility

Which statement correctly describes how the shared responsibility boundary behaves as a customer moves from virtual machines to a serverless function platform?

  1. The customer absorbs more operating system patching because functions run on dedicated hosts
  2. The boundary stays fixed because the underlying hardware is the same in both models
  3. The provider absorbs more of the runtime and host layer, while the customer still owns code, configuration, and data Correct answer.
  4. Responsibility for the runtime becomes jointly held, with the customer patching the language interpreter

Explanation

Higher-level abstractions shift more of the stack to the provider: with functions the provider manages hosts, the operating system, and much of the runtime. The customer retains accountability for the function code, its configuration, secrets, and the data it touches.

Question 29Public Cloud Security Fundamentals and Shared Responsibility

A provider's compliance certificate covers its infrastructure. What does this certificate tell the customer about the customer's own workloads?

  1. That the customer's data classification scheme has been validated by the auditor
  2. That the customer no longer needs to log or monitor activity in its own accounts
  3. Nothing directly; the customer must still evidence controls it operates on top of the certified platform Correct answer.
  4. That the customer's application configurations automatically inherit the certification

Explanation

Provider certifications attest to controls the provider operates, and they can be inherited only where the customer's design actually relies on them. Controls the customer runs, such as access review, logging, and change management, must be evidenced separately.

Question 30Public Cloud Security Fundamentals and Shared Responsibility

Which artifact most directly helps a customer determine which controls it can inherit from a cloud provider?

  1. The provider's status page showing historical service uptime
  2. The provider's public marketing brochure about security features
  3. The provider's system and organization controls report describing tested controls Correct answer.
  4. The provider's developer blog announcing new regions

Explanation

An independent audit report on the provider's controls identifies the specific controls tested and their scope, which the customer can map to its own control framework. Marketing material, uptime dashboards, and announcements do not provide auditable control evidence.

Question 31Public Cloud Security Fundamentals and Shared Responsibility

A regulated customer must keep certain records inside a country. Which responsibility does the customer hold when using a provider's regional services?

  1. Selecting regions and configuring replication so data does not leave the permitted geography Correct answer.
  2. Auditing the provider's internal staff background checks in each region
  3. Certifying the provider's physical data centers to the customer's national standard
  4. Guaranteeing that the provider never replicates data across borders under any configuration

Explanation

Residency is achieved through the customer's architectural choices: region selection, replication settings, backup destinations, and service features that pin data. The provider offers regional scope, but the customer must configure workloads so data stays within the required boundary.

Question 32Public Cloud Security Fundamentals and Shared Responsibility

Which element of a managed Kubernetes service remains the customer's responsibility even though the control plane is provider-operated?

  1. Security context, network policies, and image provenance for the workloads it deploys Correct answer.
  2. Patching of the control plane's underlying hosts
  3. Physical access controls at the regional facility
  4. Availability of the managed control plane endpoints

Explanation

Managed Kubernetes splits the cluster: the provider runs the control plane, while the customer secures what it schedules onto the nodes. That includes pod security settings, network policy, and trusting only verified container images.

Question 33Public Cloud Security Fundamentals and Shared Responsibility

A customer enables a provider's managed threat detection service. Which task still belongs to the customer?

  1. Ensuring the detection engine's signature updates are deployed to sensors
  2. Triaging findings and deciding which alerts require remediation in its environment Correct answer.
  3. Operating the sensors that inspect provider backbone traffic
  4. Maintaining the machine learning models that score anomalies

Explanation

Managed detection services surface findings, but judgment about relevance, escalation, and remediation rests with the customer who understands its own workloads. The detection engine, sensors, and models are operated by the provider.

Question 34Public Cloud Security Fundamentals and Shared Responsibility

Why does the shared responsibility model treat the customer as accountable for data even when the provider offers encryption by default?

  1. Default encryption transfers legal accountability for the data to the provider
  2. Encryption removes the need for the customer to authorize data access
  3. Encryption protects the medium, but decisions about classification, access, and lawful use of the data remain with its owner Correct answer.
  4. Default encryption means the provider can classify the data on the customer's behalf

Explanation

Encryption at rest protects stored bytes but does not decide who may read them, how they are classified, or whether their use is lawful. Accountability for the data's content and governance never transfers to the provider through a technical control.

Question 35Public Cloud Security Fundamentals and Shared Responsibility

A team deploys an application that calls a provider API using a long-lived access key embedded in source code. Which shared responsibility failure does this represent?

  1. A shared failure of the provider's physical controls
  2. A provider-side failure to rotate platform credentials
  3. A provider-side failure to encrypt API traffic
  4. A customer-side identity and secrets management failure Correct answer.

Explanation

Credential issuance, storage, and rotation for the customer's own workloads sit on the customer side of the model. Embedding long-lived keys in code is a customer secrets-management defect, not a provider control gap.

Question 36Public Cloud Security Fundamentals and Shared Responsibility

Which customer practice best supports the provider's obligation to keep the platform available while preserving the customer's own accountability?

  1. Relying on a single region because the provider guarantees uptime
  2. Requesting that the provider disable maintenance windows for the account
  3. Assuming provider availability commitments cover application downtime
  4. Designing workloads to tolerate zone failure and testing failover regularly Correct answer.

Explanation

Availability commitments cover the service, not the customer's architecture, so resilience must be designed and tested by the customer. Multi-zone design and failover testing let the customer meet its own obligations while the provider maintains the platform.

Question 37Public Cloud Security Fundamentals and Shared Responsibility

During onboarding, a team must document which controls it operates versus inherits. Which approach aligns with the shared responsibility model?

  1. Assign all controls to the provider because it operates the underlying hardware
  2. Map each control in the chosen service model to an owner and record the evidence source Correct answer.
  3. Defer ownership decisions until after the first production incident
  4. Assume every control is inherited once the provider's certification is reviewed

Explanation

A control matrix that assigns each control an owner and an evidence source makes the split explicit and auditable. Blanket assumptions about inheritance or deferral leave gaps that surface only during incidents or audits.

Question 38Public Cloud Security Fundamentals and Shared Responsibility

A customer stores backups in a provider's archive tier. Which responsibility is uniquely the customer's regardless of the storage service used?

  1. Defining retention periods and verifying that restores succeed Correct answer.
  2. Preventing disk-level failures in the storage cluster
  3. Guaranteeing durability of the stored objects across facilities
  4. Ensuring the archive media is physically destroyed at end of life

Explanation

Retention policy and restore validation express the customer's own recovery requirements and cannot be delegated to the storage provider. Media destruction, durability, and disk-level fault handling are provider functions.

Question 39Public Cloud Security Fundamentals and Shared Responsibility

Which statement about the provider's acceptable use policy is accurate for a security practitioner?

  1. It defines the customer's internal data retention schedule
  2. It replaces the customer's obligation to monitor its own account activity
  3. It transfers enforcement of customer application abuse to the provider
  4. It sets constraints the customer must reflect in its own workloads and monitoring Correct answer.

Explanation

An acceptable use policy defines prohibited uses of the platform, and the customer must ensure its workloads comply and that it can detect violations. It does not displace the customer's monitoring duties or set internal retention rules.

Question 40Public Cloud Security Fundamentals and Shared Responsibility

A customer wants to reduce residual risk when adopting a new managed database service. Which action is most consistent with the shared responsibility model?

  1. Review the service's documented control split and configure encryption, access, and auditing accordingly Correct answer.
  2. Skip network isolation because the database is not customer-managed infrastructure
  3. Rely on the provider's default settings until a security review is scheduled
  4. Assume the managed label means every database control is handled by the provider

Explanation

Residual risk shrinks when the customer reads the service's control documentation and then configures the controls it still owns, such as encryption keys, access policy, and audit logging. Assuming full coverage or deferring configuration leaves customer-side controls unset.

Question 41Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

In a public cloud VPC or VNet, what is the primary purpose of segmenting resources into multiple subnets?

  1. To eliminate the need for security groups
  2. To automatically encrypt all traffic between instances
  3. To reduce the cost of outbound internet data transfer
  4. To provide Layer 2 broadcast domain isolation and enable separate routing and security policy per segment Correct answer.

Explanation

Subnets create separate network segments that can carry their own route tables and network ACLs, so workloads of different trust levels can be isolated and controlled independently. Cost, encryption, and security groups are separate concerns that subnetting does not address by itself.

Question 42Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

A security architect needs a dedicated isolated network segment whose instances have no route to the internet in either direction. Which design achieves this?

  1. A subnet with a route to an internet gateway but a deny-all security group
  2. A subnet with a route to a transit gateway that has a default route
  3. A subnet with a route to a NAT gateway and a restrictive network ACL
  4. A subnet whose route table contains only the local VPC route and no NAT or internet gateway entry Correct answer.

Explanation

Egress isolation is enforced by routing: if the subnet's route table has no path to an internet or NAT gateway, traffic cannot leave toward the internet. Security groups and ACLs filter but do not by themselves remove reachability, and a transit gateway with a default route reintroduces egress.

Question 43Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

What distinguishes a security group from a network ACL in a typical cloud VPC?

  1. Both are stateless, but only security groups evaluate source ports
  2. Security groups are stateless and applied to subnets, while network ACLs are stateful and attached to interfaces
  3. Both are stateful, but only network ACLs support deny rules
  4. Security groups are stateful and attached to interfaces, while network ACLs are stateless and applied to subnets Correct answer.

Explanation

Security groups act as stateful virtual firewalls bound to elastic network interfaces, so return traffic is automatically allowed. Network ACLs are stateless filters evaluated per subnet in both directions, which is why ephemeral port ranges must be explicitly permitted.

Question 44Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

An application subnet must reach the internet for software updates but must not be directly reachable from the internet. Which routing pattern satisfies this?

  1. Associate an elastic IP with each application instance
  2. Route 0.0.0.0/0 directly to an internet gateway on the application subnet
  3. Route 0.0.0.0/0 to a virtual private gateway
  4. Route 0.0.0.0/0 to a NAT gateway located in a public subnet Correct answer.

Explanation

A NAT gateway performs source address translation for outbound flows initiated from private subnets while blocking unsolicited inbound connections. Direct internet gateway routing or public IPs would expose the instances, and a virtual private gateway serves site-to-site connectivity rather than internet egress.

Question 45Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

Two VPCs each use the CIDR block 10.0.0.0/16 and must be connected with VPC peering. What is the recommended resolution?

  1. Rely on security group references to disambiguate the duplicate addresses
  2. Enable overlapping CIDR support in the peering connection settings
  3. Re-IP one VPC with a non-overlapping CIDR block before establishing peering Correct answer.
  4. Use a NAT gateway between the two VPCs to translate the overlapping ranges

Explanation

Peering requires unique, non-overlapping address ranges because routing is based on destination prefix; duplicate prefixes make destinations ambiguous. Overlapping ranges must be re-addressed, or connectivity must be mediated by a purpose-built overlay such as a private NAT or transit solution that translates addresses.

Question 46Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

Which statement correctly describes the transitivity of VPC peering?

  1. Peering is non-transitive, so A peered to B and B peered to C does not give A reachability to C Correct answer.
  2. Peering is transitive only when all three VPCs share the same region
  3. Peering is transitive only when a transit gateway is attached to VPC B
  4. Peering is transitive by default, so A can reach C through B without additional connections

Explanation

VPC peering creates a one-to-one relationship, and routes are not propagated onward, so traffic cannot hop from A through B to C. Full mesh peering or a transit gateway hub is needed for spoke-to-spoke reachability.

Question 47Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

A company wants centralized inspection of traffic between many spoke VPCs and on-premises networks. Which architecture is most appropriate?

  1. A full mesh of VPC peering connections between every pair of spoke VPCs
  2. A NAT gateway in each spoke VPC with no central routing
  3. A separate internet gateway in each spoke VPC
  4. A hub VPC with a transit gateway or virtual network hub that routes spoke traffic through inspection appliances Correct answer.

Explanation

A hub-and-spoke design with a transit gateway or virtual WAN hub allows all inter-spoke and hybrid traffic to be routed through a central inspection VPC. Full mesh peering scales poorly and does not naturally insert inspection, while per-spoke internet or NAT gateways bypass central control.

Question 48Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

What is the effect of associating a subnet with a custom route table that lacks a route for the VPC's own CIDR block?

  1. Intra-VPC traffic continues to flow because the local route is implicit and cannot be removed
  2. All traffic is blackholed, including traffic to the internet gateway
  3. The subnet automatically falls back to the main route table
  4. Intra-VPC traffic to that prefix is not routed because the local route must be present for VPC-internal reachability Correct answer.

Explanation

The local route that maps the VPC CIDR to the local target is what enables intra-VPC communication; if a custom table omits it, destinations in that range have no matching route. The route is present by default but can be removed, and no automatic fallback to the main table occurs once a subnet is explicitly associated.

Question 49Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

Which control is evaluated first when a packet enters a subnet in a VPC that uses both network ACLs and security groups?

  1. Both are evaluated simultaneously and the more permissive result wins
  2. The network ACL associated with the subnet is evaluated before the security group on the instance Correct answer.
  3. Only the security group is evaluated for inbound traffic; the ACL applies to outbound only
  4. The security group is evaluated before the network ACL regardless of direction

Explanation

Inbound packets hit the subnet boundary first, so the network ACL is evaluated before the packet reaches the instance's security group. Both must allow the traffic for it to be delivered, and the ACL applies in both directions.

Question 50Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

Why must a stateless network ACL explicitly allow ephemeral ports in its outbound rules for return traffic to a client?

  1. Because ephemeral ports are reserved by the cloud provider and blocked by default
  2. Because security groups rewrite the destination port of return traffic
  3. Because the ACL does not track connection state, so replies to client source ports require an explicit allow Correct answer.
  4. Because the ACL evaluates only the first packet of each connection

Explanation

Stateless filtering means each packet is judged independently, so the return packet's destination port, which is the client's ephemeral source port, must be permitted. Security groups handle this automatically because they are stateful.