CompTIA SecurityX Practice Questions: Cloud Security

16 free, exam-style CompTIA SecurityX (CAS-005) practice questions covering Cloud Security, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.

🧠

Mini Exam

25 Questions · 50 minutes

Start Quiz 🚀
🏆

Mock SecurityX Exam

85 Questions · 165 minutes

Start Quiz 🚀
📅

Daily Quiz

10 Questions · 20 minutes

Start Quiz 🚀
🎯

Standard Practice

50 Questions · 100 minutes

Start Quiz 🚀

Cloud Security practice questions

Answers and explanations are shown. Take the timed exam above to test yourself first.

Q1. Which of the following is a key security consideration when deploying serverless functions in the cloud?

  • A.No logging
  • B.Least privilege permissions✓ Correct
  • C.Hardcoded API keys
  • D.Disabling encryption
Explanation: Serverless functions should follow the principle of least privilege to minimize attack surfaces. Learn more.

Q2. Which of the following is a critical security control for Kubernetes clusters?

  • A.Running all pods as root
  • B.Network policies and pod security policies✓ Correct
  • C.Shared cluster admin credentials
  • D.Disabling audit logging
Explanation: Kubernetes requires strict network segmentation and pod restrictions. Learn more.

Q3. What is the PRIMARY security risk of Infrastructure as Code (IaC) misconfigurations?

  • A.Improved compliance
  • B.Automated deployment of insecure infrastructure✓ Correct
  • C.Slower provisioning
  • D.Increased manual reviews
Explanation: IaC errors can propagate security flaws at scale. Learn more.

Q4. What is the PRIMARY security benefit of using service mesh architecture?

  • A.Reduced observability
  • B.Mutual TLS and fine-grained traffic control✓ Correct
  • C.Disabled encryption
  • D.Shared service accounts
Explanation: Service meshes provide built-in mTLS and security policies. Learn more.

Q5. What is the PRIMARY security risk of over-permissioned cloud IAM roles?

  • A.Reduced attack surface
  • B.Lateral movement potential after initial compromise✓ Correct
  • C.Improved compliance
  • D.Slower API responses
Explanation: Excessive permissions enable privilege escalation. Learn more.

Q6. What is the PRIMARY purpose of a cloud security posture management (CSPM) tool?

  • A.Ignoring misconfigurations
  • B.Continuous monitoring for cloud security risks✓ Correct
  • C.Disabling encryption
  • D.Removing all access controls
Explanation: CSPM tools identify and remediate cloud misconfigurations. Learn more.

Q7. What is the PRIMARY security benefit of using SPIFFE/SPIRE for identity management?

  • A.Static credentials
  • B.Short-lived, workload-specific identities✓ Correct
  • C.Disabled authentication
  • D.No encryption
Explanation: SPIFFE provides cryptographic identity for workloads. Learn more.

Q8. What is the PRIMARY security consideration for multi-cloud deployments?

  • A.Consistent security policies across providers✓ Correct
  • B.Provider-specific security controls only
  • C.Disabled encryption
  • D.No identity federation
Explanation: Security must be uniformly enforced across different clouds. Learn more.

Q9. What is the PRIMARY security consideration for service mesh implementations?

  • A.Disabled mTLS
  • B.Certificate lifecycle management✓ Correct
  • C.Shared service accounts
  • D.No traffic encryption
Explanation: Service meshes require robust certificate management for mTLS. Learn more.

Q10. Which of the following is a key security control for mitigating side-channel attacks in cloud environments?

  • A.Shared physical cores
  • B.Cache partitioning and constant-time algorithms✓ Correct
  • C.Disabled memory protection
  • D.No process isolation
Explanation: Cloud multi-tenancy requires protection against cross-VM attacks. Learn more.

Q11. Which cloud deployment model provides the MOST control over security configurations?

  • A.Public cloud
  • B.Hybrid cloud
  • C.Private cloud✓ Correct
  • D.Community cloud
Explanation: Private clouds offer dedicated infrastructure with full control. Learn more.

Q12. What is the PRIMARY security concern with serverless architectures?

  • A.Cold starts
  • B.Function event injection✓ Correct
  • C.Limited logging
  • D.Vendor lock-in
Explanation: Event-driven functions (e.g., AWS Lambda) may process malicious input. Learn more.

Q13. Which cloud service model provides the MOST control over security configurations?

  • A.SaaS
  • B.PaaS
  • C.IaaS✓ Correct
  • D.FaaS
Explanation: IaaS (e.g., AWS EC2) allows full control over OS and network settings. Learn more.

Q14. Which control gives visibility and policy enforcement for sanctioned and unsanctioned cloud application use?

  • A.CASB✓ Correct
  • B.HIDS
  • C.KVM switch
  • D.RAID controller
Explanation: A cloud access security broker helps discover cloud usage and enforce security policy between users and cloud services. Learn more.

Q15. Which cloud-native identity risk occurs when a role trusts any principal in another account?

  • A.Overly broad trust policy✓ Correct
  • B.Short session duration
  • C.Encrypted object storage
  • D.Private subnet routing
Explanation: Broad cross-account trust can allow unintended principals to assume roles and access resources. Learn more.

Q16. Which cloud storage control prevents public exposure even if an object ACL is misconfigured?

  • A.Account-level public access block✓ Correct
  • B.Longer object names
  • C.Unencrypted metadata
  • D.Shared root keys
Explanation: Public access block controls provide a guardrail against accidental public object exposure. Learn more.

More CompTIA SecurityX practice topics

Keep studying CompTIA SecurityX

Full CompTIA SecurityX practice exam · CompTIA SecurityX study guide · All CompTIA practice questions

Last updated