IBM Cloud Security Engineer flashcards
IBM Cloud Security Engineer · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared responsibility boundary
- IBM secures facilities, hardware, and hypervisor; the customer secures identities, data, workload configuration, and network rules for resources they provision. Managed services shift more of the stack to IBM.
- Resource group purpose
- A resource group partitions services within one IBM Cloud account for access control and billing. IAM policies can grant access scoped to a resource group rather than the whole account.
- Tag policy enforcement
- Account-level tag policies require specified tags on resources before creation. They enforce ownership and cost metadata at provisioning time rather than through after-the-fact reporting.
- IBM Cloud Framework for Financial Services
- A control set mapped to NIST Cybersecurity Framework functions that underlies IBM Cloud compliance profiles. Security and Compliance Center uses it to evaluate account resources against controls.
- IAM policy components
- A policy combines a subject, a role, a resource scope, and optional context-based restrictions. Access is granted only when a matching policy allows the action on the target resource.
- Platform versus service roles
- Platform roles such as Administrator and Editor govern resource lifecycle and configuration. Service roles such as Manager or Writer govern data-plane operations defined by each service.
- Access group
- A container for users, service IDs, and trusted profiles. Policies attached to the group apply to every member, making the group the recommended unit for access review.
- Trusted profile
- Lets federated or compute identities assume an IBM Cloud identity through a defined trust relationship, avoiding long-lived API keys. It links to an access group for permissions.
- Context-based restrictions
- Network zones and rules that restrict which networks may reach a resource. They are evaluated after IAM allow and can only narrow access, never expand it.
- Service ID API key scope
- API keys belong to a user or service ID and are displayed once at creation. A service ID key inherits only the policies granted to that service ID.
- Root key deletion effect
- Deleting a root key in Key Protect or HPCS makes wrapped data encryption keys unwrappable. Data encrypted under those keys becomes permanently unrecoverable.
- Envelope encryption
- A root key in the key management service wraps a data encryption key. The service stores the wrapped key with the data and calls the KMS to unwrap it on access.
- Key suspension versus destruction
- Suspending a root key blocks unwrap operations and makes data unreadable but is reversible. Destruction is permanent and requires a waiting period plus force delete.
- Automatic key rotation
- Key Protect rotation policies create new key versions on a schedule. Older versions remain usable to unwrap existing data, so rotation does not re-encrypt stored objects.
- Hyper Protect Crypto Services
- A key management service backed by FIPS 140-2 Level 4 validated hardware with keep-your-own-key capability. It offers stronger isolation than the multi-tenant Key Protect service.
- COS object lock
- Bucket-level retention and legal hold that prevent object deletion or overwrite for a defined period. Used for immutable audit evidence and ransomware resilience.
- VPC security group behavior
- Stateful, allow-only rules attached to instances. The default group denies all inbound traffic and permits all outbound, and there is no explicit deny rule.
- VPC network ACL
- Stateless rules attached to a subnet that support both allow and deny, evaluated in rule-number order. Return traffic must be explicitly permitted.
- Public gateway
- Provides internet egress for an entire subnet in a VPC. Instances in private-only subnets have no public gateway and rely on private service endpoints.
- Transit Gateway
- Connects VPCs, classic infrastructure, and Direct Link across accounts and regions. It is the usual hub for segmentation and centralized traffic inspection.
- Private service endpoints
- Service endpoints resolvable with the private DNS suffix inside a VPC. They keep traffic to services such as COS and Key Protect off the public internet.
- Cloud Internet Services
- An edge service providing DDoS mitigation, web application firewall, TLS termination, and global load balancing for public endpoints. It does not inspect private VPC traffic.
- Activity Tracker scope
- Records control-plane API events including action, outcome, initiator, target CRN, and source IP. It is the primary audit source for account-level changes.
- VPC flow logs
- Capture per-flow five-tuple, byte counts, and accept or reject decisions. Delivered to Cloud Object Storage or log analysis for network forensics and anomaly detection.
- Security and Compliance Center
- Evaluates account resources against profiles derived from the IBM Cloud Framework for Financial Services or custom controls, producing findings that feed ticketing and SIEM.
- Incident containment order
- Revoke API keys, suspend service IDs, apply context-based restriction deny rules, and disable public endpoints first. Then preserve evidence before eradication and recovery.
- Break-glass identity
- A documented emergency identity with elevated access whose use raises an alert. Its credential is vaulted and rotated after each use.
- Log retention planning
- Activity Tracker routes deliver to a target service whose retention is configurable. Common compliance patterns keep 90 days hot and archive one year to object storage.
- Service-level compliance scope
- Certifications such as PCI DSS or HIPAA apply per catalog service, not to the whole account. Verify the service's compliance tab before placing regulated data.
- Data residency in regions
- IBM Cloud regions determine where data at rest is stored. Cross-region resiliency features may replicate outside the primary region and must be checked against residency rules.
- Risk treatment options
- Accept, mitigate, transfer, or avoid. On IBM Cloud, missing native controls are usually mitigated with context-based restrictions, transit gateway inspection, or custom compliance controls.
- Third-party catalog services
- Some catalog offerings are built by partners rather than IBM. The shared responsibility boundary and compliance evidence differ, so the provider must be identified during review.