Security, Compliance, and Governance
Security, Compliance, and Governance
This domain tests least-privilege access, data protection, auditability, and governance on IBM Cloud.
Core rules
- Apply least privilege with IAM policies, service IDs, and scoped API keys. Rotate credentials and avoid long-lived user keys.
- Encrypt data at rest with Key Protect or Hyper Protect Crypto Services; manage secrets in Secrets Manager, not environment variables or Git.
- Segment networks with VPC security groups and ACLs; use private endpoints and controlled egress. Use Cloud Internet Services WAF and DDoS protection for public edges.
- Enable Activity Tracker and Log Analysis for audit trails; route logs to a secured bucket with retention.
- Govern with resource groups, tags, budgets, and compliance mappings. IBM Cloud documents certifications such as SOC 2, ISO 27001, and HIPAA; verify service eligibility.
Worked example
An application must meet least privilege and audit requirements. The team creates a service ID with a reader policy on one Object Storage bucket, stores its key in Secrets Manager, enables Key Protect with customer-managed keys, and sends Activity Tracker events to a central log archive. Reasoning: the service ID cannot delete buckets, the key is not in code, and every API action is auditable.
Traps
Overprivileged API keys and shared credentials break least privilege. Secrets in environment variables leak through logs. Network controls alone do not protect data. Missing audit logs makes compliance evidence impossible. Do not assume a certification covers every service in the catalog; check the service's compliance page.