Cloud Security Fundamentals and Governance
This domain tests whether you can define cloud computing precisely and show how governance converts those definitions into enforceable, auditable decisions. The exam leans on NIST SP 800-145 vocabulary, so quote definitions accurately rather than loosely.
The definitions that carry marks
NIST SP 800-145 lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It defines three service models (SaaS, PaaS, IaaS) and four deployment models (private, public, hybrid, community). Memorize the control boundary: in IaaS the customer controls the guest OS and above; in PaaS the provider patches the runtime and middleware; in SaaS the customer controls only data, identities, and configuration.
Governance is a decision system
Governance answers who decides, against what criteria, and who is accountable. Typical structure: a cloud security steering committee sets risk appetite, a Cloud Center of Excellence publishes approved patterns, and control owners produce evidence. Policy flows downward - policy (intent), standard (mandatory requirement), procedure (steps), guideline (advisory). Data classification is the input that selects controls, and it must exist before any workload is approved.
Worked example
A marketing team requests a SaaS CRM holding customer PII. The analyst classifies the data as confidential, maps it to the standard requiring encryption in transit and at rest plus annual third-party assurance, confirms the vendor holds ISO/IEC 27017 and a current SOC 2 Type II covering the purchased service, verifies data residency, and records a conditional approval with a review date. The reasoning chain: classification drives the standard, the standard drives the evidence request, evidence drives the approval decision.
Traps
Equating governance with compliance - passing an audit is not the same as accepting the risk. Assuming a provider's certifications certify your workload. Treating shared responsibility as an equal split. Reading "measured service" as billing only, when it also means metering for capacity planning and monitoring.