Cloud Engineer
Cloud security and IAM questions
175 questions on Cloud security and IAM for cloud engineers, easiest first.
Easy 52
- Who patches the VM operating system?easy
- Principle of least privilegeeasy
- Which identity is the AWS CLI using?easy
- Google Cloud resource hierarchyeasy
- Showing cloud cost per teameasy
- Protecting the root usereasy
- What HTTPS protectseasy
- Shell access without opening port 22easy
- Looking after the root accounteasy
- The least privilege principleeasy
- What a key management service doeseasy
- IAM user vs IAM roleeasy
- Explicit deny always winseasy
- Nothing allowed means deniedeasy
- Why MFA for console sign-ineasy
- Problem with old access keyseasy
- Identity-based vs resource-based policyeasy
- What IAM groups are foreasy
- Parts of a policy statementeasy
- Managed vs inline policieseasy
- At rest vs in transiteasy
- Azure RBAC assignment scopeeasy
- GCP service accountseasy
- Workforce access through SSOeasy
- What a principal iseasy
- Meaning of s3:* in a policyeasy
- Getting AWS's own audit reportseasy
- Symmetric vs asymmetric keyseasy
- Hashing is not encryptioneasy
- Customer managed vs AWS managed keyseasy
- S3 Block Public Accesseasy
- Default encryption for new S3 objectseasy
- Which TLS versions to alloweasy
- Managed TLS certificateseasy
- Why rotate secretseasy
- Classify data before choosing controlseasy
- Encrypt new EBS volumes by defaulteasy
- Secrets committed in codeeasy
- Protecting backups from deletioneasy
- Recovering a deleted Key Vault secreteasy
- Tokenization of card numberseasy
- SSH open to 0.0.0.0/0easy
- Where to place a databaseeasy
- What CloudTrail recordseasy
- What VPC Flow Logs showeasy
- What GuardDuty doeseasy
- Blocking web attacks at the edgeeasy
- Protection against DDoSeasy
- Knowing what you owneasy
- Continuous configuration checkseasy
- One view of security findingseasy
- Finding personal data in S3easy
Medium 70
- Security groups vs network ACLsmedium
- Giving a VM access to cloud APIsmedium
- Reading an S3 SecureTransport policymedium
- AccessDenied from a VPC endpoint policymedium
- Overly broad GitHub OIDC trust policymedium
- Cross-account KMS decrypt failsmedium
- Where to keep a database passwordmedium
- Azure VM reading Key Vault safelymedium
- Giving an app on EC2 access to S3medium
- An allow and a deny on the same actionmedium
- What a service control policy doesmedium
- Two roles on an ECS taskmedium
- How KMS encrypts large datamedium
- A role nobody can assumemedium
- Where an Azure role assignment appliesmedium
- Downloaded service account keysmedium
- Requiring MFA for sensitive actionsmedium
- Allow with NotActionmedium
- Effect of a permissions boundarymedium
- ListBucket needs the bucket ARNmedium
- Trust policy vs permissions policymedium
- Both sides of cross-account AssumeRolemedium
- Finding resources shared outsidemedium
- Trimming unused permissionsmedium
- Attribute-based access controlmedium
- What a session policy doesmedium
- Restricting usable regionsmedium
- Finding unused access keysmedium
- GCP basic rolesmedium
- Azure NotActions is not a denymedium
- Per-user S3 foldersmedium
- How long a role session lastsmedium
- StringEquals vs StringLikemedium
- AND and OR inside conditionsmedium
- AWS managed policies can growmedium
- System vs user-assigned managed identitymedium
- Key policy without account accessmedium
- Using a key only through one servicemedium
- What KMS automatic rotation changesmedium
- High KMS cost from S3 uploadsmedium
- KMS encryption contextmedium
- How apps encrypt large files with KMSmedium
- Encrypting an unencrypted RDS databasemedium
- Copying encrypted snapshots to another regionmedium
- Secrets Manager vs Parameter Storemedium
- Rotation without app downtimemedium
- End-to-end TLS behind a load balancermedium
- When to use mutual TLSmedium
- What HSTS doesmedium
- Sharing an encrypted snapshotmedium
- Secrets in Lambda environment variablesmedium
- Default encryption vs CMEK in Google Cloudmedium
- Sharing a private S3 file brieflymedium
- Private S3 origin behind CloudFrontmedium
- Safer Azure Storage SAS tokensmedium
- One key for dev and prodmedium
- IMDSv2 and containersmedium
- Referencing security groupsmedium
- Reaching a partner service privatelymedium
- Controlling outbound trafficmedium
- Data leaking through DNSmedium
- Logging S3 object readsmedium
- Where to keep audit logsmedium
- Proving logs were not editedmedium
- Scanning container imagesmedium
- Catching misconfigurations in Terraformmedium
- Secrets in Terraform statemedium
- Kubernetes access in EKSmedium
- A Lambda function URL with no authmedium
- GCP VPC Service Controlsmedium
Hard 53
- Policy evaluation with SCPshard
- Why envelope encryptionhard
- aws:SourceIp after adding a VPC endpointhard
- Cannot read objects a partner uploadedhard
- A production KMS key scheduled for deletionhard
- Long session through role chaininghard
- Securing a role for a SaaS vendorhard
- Cross-account bucket access still deniedhard
- Deleting an encryption keyhard
- Access keys pushed to a public repohard
- A brand-new role fails at firsthard
- Deploying from GitHub without stored keyshard
- Backups you cannot decrypt in the DR regionhard
- Bucket policy alone in one accounthard
- Letting developers create roles safelyhard
- Escalation with CreatePolicyVersionhard
- Updating code of a privileged Lambdahard
- ForAllValues with a missing keyhard
- Confused deputy with service principalshard
- Killing stolen role credentialshard
- Access key pushed to public GitHubhard
- Allow only your organizationhard
- SCPs and the management accounthard
- An SCP that allows S3hard
- Stopping service account key downloadshard
- Standing admin in Azurehard
- Deny with NotPrincipalhard
- Protecting tags used for ABAChard
- Why KMS forces a waiting periodhard
- Crypto-shredding for deletion requestshard
- Object Lock governance vs compliance modehard
- KMS key with imported materialhard
- When CloudHSM instead of KMShard
- KMS grantshard
- SSE-C key responsibilityhard
- Generating a data key for later usehard
- Purge protection on Key Vaulthard
- Estimating KMS request costhard
- Client-side vs server-side encryptionhard
- Pinning certificates in a mobile apphard
- A public EBS snapshothard
- When to use multi-Region KMS keyshard
- Changing a bucket's default keyhard
- Containing a compromised VMhard
- Designing break-glass accesshard
- Data residency for a UAE regulatorhard
- Who secures a managed databasehard
- Triage of a credential findinghard
- Preventive vs detective controlshard
- Building an S3 data perimeterhard
- Shrinking PCI DSS scope in the cloudhard
- Too many posture findingshard
- Sharing a golden image publiclyhard