MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Which access control model is primarily based on the roles assigned to users within an organization in cloud computing?
   a. Discretionary Access Control (DAC)
   b. Mandatory Access Control (MAC)
   c. Role-Based Access Control (RBAC)
   d. Attribute-Based Access Control (ABAC)
   Answer: c. Role-Based Access Control (RBAC)nvlpubs.nist+1
2. What is the main principle of least privilege in cloud access control?
   a. Users have access to all resources
   b. Users are given minimal permissions necessary
   c. All permissions are shared
   d. Admin grants maximum permissions
   Answer: b. Users are given minimal permissions necessarycloudsecurityalliance+1
3. Which mechanism is commonly used to manage user authentication in cloud environments?
   a. Firewall rules
   b. Multi-Factor Authentication (MFA)
   c. Static routing
   d. Subnet masking
   Answer: b. Multi-Factor Authentication (MFA)learn.microsoft+2
4. In cloud computing, who is typically responsible for enforcing access controls on customer data?
   a. Internet Service Provider
   b. Cloud Service Provider and customer both
   c. Data center staff only
   d. Software vendor
   Answer: b. Cloud Service Provider and customer bothnvlpubs.nist+1
5. What is the purpose of an Access Control List (ACL) in cloud security?
   a. To encrypt data at rest
   b. To define permissions for resources
   c. To monitor traffic logs
   d. To store backup copies
   Answer: b. To define permissions for resourcescloud.google+1
6. Which access control model uses security labels to determine access to resources?
   a. DAC
   b. RBAC
   c. MAC
   d. ABAC
   Answer: c. MACscribd+1
7. Attribute-Based Access Control (ABAC) decisions are made based on:
   a. User’s organizational roles
   b. User identities only
   c. Attributes of user, resource, or environment
   d. Resource ownership
   Answer: c. Attributes of user, resource, or environmentwiz+1
8. Which cloud model gives the customer the most control over access?
   a. SaaS
   b. PaaS
   c. IaaS
   d. DaaS
   Answer: c. IaaSsanfoundry+1
9. What is a common risk if access controls are not properly managed in the cloud?
   a. Increased hardware performance
   b. Data breach or unauthorized access
   c. Improved scalability
   d. Enhanced latency
   Answer: b. Data breach or unauthorized accesscloudsecurityalliance+1
10. Which NIST publication provides guidance specifically on access control for cloud systems?
    a. NIST SP 800-53
    b. NIST SP 800-210
    c. NIST SP 800-44
    d. NIST SP 800-63
    Answer: b. NIST SP 800-210qualysec+1
11. What is the function of “separation of duties” in access control?
    a. Allows a single user full access
    b. Prevents conflict of interest by splitting responsibilities
    c. Promotes company mergers
    d. Centralizes management under one admin
    Answer: b. Prevents conflict of interest by splitting responsibilitieslearn.microsoft+1
12. Which of the following is NOT a type of access control?
    a. Discretionary Access Control (DAC)
    b. Mandatory Access Control (MAC)
    c. Policy-Driven Access Control (PDAC)
    d. Attribute-Based Access Control (ABAC)
    Answer: c. Policy-Driven Access Control (PDAC)scribd+1
13. Cloud access control should be regularly:
    a. Ignored
    b. Audited and reviewed
    c. Outsourced to third parties
    d. Left unchanged
    Answer: b. Audited and reviewednvlpubs.nist+2
14. In RBAC, what are permissions assigned to?
    a. Applications
    b. Physical servers
    c. Roles
    d. Networks
    Answer: c. Rolesnvlpubs.nist+1
15. Which principle requires that administrative access be limited and monitored?
    a. Principle of least privilege
    b. Principle of maximum privilege
    c. Principle of shared risk
    d. Principle of elasticity
    Answer: a. Principle of least privilegecloud.google+1
16. What is a “root” user in cloud services?
    a. Lowest privilege user
    b. Unauthenticated guest
    c. Account with full ownership and highest privileges
    d. Billing user
    Answer: c. Account with full ownership and highest privilegesaws.amazon+1
17. Access controls in cloud computing must account for:
    a. Only external threats
    b. Only internal threats
    c. Both internal and external threats
    d. No threats
    Answer: c. Both internal and external threatscloudsecurityalliance+1
18. Which service model has the most customer control of user access?
    a. SaaS
    b. PaaS
    c. IaaS
    d. FaaS
    Answer: c. IaaSsanfoundry+1
19. What role do audit logs serve in access control?
    a. Encrypt data
    b. Track and monitor access activities
    c. Provide DRaaS
    d. Offer load balancing
    Answer: b. Track and monitor access activitiescloud.google+2
20. Which standard provides a cloud-specific access control baseline?
    a. PCI DSS
    b. CIS Cloud Foundations Benchmark
    c. ISO 9000
    d. FIPS 140-2
    Answer: b. CIS Cloud Foundations Benchmarkcloudsecurityalliance
21. What is Identity and Access Management (IAM) in cloud computing?
    a. Tool for hardware control
    b. Framework for managing digital identities and access
    c. Email marketing platform
    d. Backup software
    Answer: b. Framework for managing digital identities and accesslearn.microsoft+2
22. Which of the following enforces “time-bound” access?
    a. Expiry on credentials or tokens
    b. Firewall rules only
    c. Static IP rules
    d. Data redundancy policies
    Answer: a. Expiry on credentials or tokenscloud.google+2
23. What does ABAC allow that RBAC does not?
    a. Access control decisions based on multiple attributes
    b. Decisions only by group membership
    c. Assigning static permissions
    d. Disabling logging
    Answer: a. Access control decisions based on multiple attributeswiz+1
24. Which practice helps prevent privilege escalation attacks?
    a. Granting permanent admin access
    b. Regularly reviewing privilege assignments
    c. Using default passwords
    d. Ignoring audit logs
    Answer: b. Regularly reviewing privilege assignmentsnvlpubs.nist+1
25. What is the purpose of “Just-In-Time” (JIT) access in cloud control?
    a. Provide permanent elevated privileges
    b. Provide temporary elevated privileges as needed
    c. Remove all user access
    d. Allow guest users only
    Answer: b. Provide temporary elevated privileges as neededaws.amazon+1
26. What is a common feature of IAM systems?
    a. Weather monitoring
    b. Centralized user management
    c. Video conferencing
    d. VPN gateway
    Answer: b. Centralized user managementlearn.microsoft+2
27. Which entity is responsible for compliance with regulatory access control standards in the cloud?
    a. Only the provider
    b. The customer organization
    c. Only auditors
    d. Cloud hardware vendor
    Answer: b. The customer organizationoracle+2
28. What does usage of “service accounts” with minimal privileges help enforce?
    a. Principle of least privilege
    b. Maximum privilege allocation
    c. Default password practices
    d. Resource overprovisioning
    Answer: a. Principle of least privilegecloudsecurityalliance+1
29. For API access, what should be used for secure authentication?
    a. Open tokens and plain strings
    b. Cryptographic keys/tokens and secure protocols
    c. Cleartext name-value pairs
    d. User’s first name only
    Answer: b. Cryptographic keys/tokens and secure protocolsnvlpubs.nist+1
30. What is the best response if unauthorized access is detected?
    a. Ignore it
    b. Immediately investigate and respond
    c. Disable all user accounts
    d. Notify only end-users
    Answer: b. Immediately investigate and respondcloudsecurityalliance+1
31. How often should access to sensitive cloud resources be reviewed?
    a. Never
    b. Annually at minimum
    c. Monthly or as organization policy dictates
    d. Only after incidents
    Answer: c. Monthly or as organization policy dictatescloud.google+1
32. What feature in cloud platforms helps enforce compliance through automated policies?
    a. Policy-based access control engines
    b. Static routing tables
    c. Bandwidth optimizers
    d. Print servers
    Answer: a. Policy-based access control engineslearn.microsoft+1
33. Which model uses labels such as “Confidential,” “Secret,” or “Top Secret”?
    a. RBAC
    b. MAC
    c. DAC
    d. PBAC
    Answer: b. MACscribd+1
34. “Separation of duties” can help prevent:
    a. Single point of failure
    b. Key loss
    c. Insider threats or fraud
    d. Increased downtime
    Answer: c. Insider threats or fraudlearn.microsoft+1
35. Which protocol is often used for federated access control in the cloud?
    a. FTP
    b. OAuth
    c. SMTP
    d. Telnet
    Answer: b. OAuthnvlpubs.nist+1
36. Why is it important to revoke access promptly when personnel leave the organization?
    a. Reduce license costs
    b. Minimize risk of unauthorized data access
    c. Enhance data redundancy
    d. Increase backup speed
    Answer: b. Minimize risk of unauthorized data accesscloudsecurityalliance+1
37. The ultimate goal of access control in the cloud is to:
    a. Restrict all access to data
    b. Enable secure, authorized access while preventing unauthorized use
    c. Allow public access to all data
    d. Increase computational speed
    Answer: b. Enable secure, authorized access while preventing unauthorized usewiz+1
38. What is the recommended best practice for managing access keys and credentials?
    a. Hard-code them in applications
    b. Rotate and manage them securely
    c. Share via email
    d. Post to public repositories
    Answer: b. Rotate and manage them securelyaws.amazon+1
39. Shadow IT increases risk to access control because:
    a. It is always more secure
    b. Unauthorized services can bypass standard controls
    c. It reduces agility
    d. It adds more logging
    Answer: b. Unauthorized services can bypass standard controlsnvlpubs.nist+1
40. Tokens used for cloud resource access should:
    a. Never expire
    b. Have reasonable expiration and scope
    c. Be shared freely
    d. Replace passwords entirely
    Answer: b. Have reasonable expiration and scopecloud.google+1
41. What is the first step in managing cloud access control?
    a. Assign global read permissions
    b. Identify and classify resources and users
    c. Upgrade hardware
    d. Enable public APIs
    Answer: b. Identify and classify resources and userscloud.google+1
42. What may result if least privilege is NOT followed in cloud access control?
    a. Lower risk
    b. Data exfiltration or misuse
    c. Improved usability
    d. Stronger encryption
    Answer: b. Data exfiltration or misusecloudsecurityalliance+1
43. In the event of an access control policy violation, what is the recommended process?
    a. Investigate, report, and remediate
    b. Ignore the event
    c. Escalate privileges for all users
    d. Disable encryption
    Answer: a. Investigate, report, and remediatenvlpubs.nist+1
44. What does “delegated admin access” allow in a cloud service?
    a. Full root power always
    b. Temporary administrative access as needed
    c. Disables audit logging
    d. Restricts to read-only roles
    Answer: b. Temporary administrative access as neededaws.amazon+1
45. Which of the following is a user authentication method supported in cloud access control?
    a. Retinal scan
    b. Username and password
    c. Security questions
    d. All of the above
    Answer: d. All of the abovelearn.microsoft+1
46. Why is cloud access control complex compared to traditional IT?
    a. Multiple tenants, remote access, dynamic resources
    b. Less complexity in IT
    c. Single user base
    d. No API integrations
    Answer: a. Multiple tenants, remote access, dynamic resourcesnvlpubs.nist+1
47. Logs related to user access should be stored:
    a. Unencrypted and publicly accessible
    b. Securely, with regular review and restricted access
    c. Deleted immediately
    d. Ignored for audit
    Answer: b. Securely, with regular review and restricted accesscloud.google+1
48. Which function ensures access is removed after contract expiration?
    a. Automated deprovisioning
    b. Manual backup
    c. Unmonitored escalation
    d. Static ACLs
    Answer: a. Automated deprovisioningaws.amazon+1
49. The access control process should support:
    a. Only manual provisioning
    b. Both automated and manual provisioning
    c. Guest account creation only
    d. Legacy server access only
    Answer: b. Both automated and manual provisioningcloudsecurityalliance+1
50. Security controls for access management in cloud computing should:
    a. Be continuously monitored and improved
    b. Never be changed
    c. Be ignored once set
    d. Rely on external consultants only
    Answer: a. Be continuously monitored and improvednvlpubs.nist+2

1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-210.pdf
2. https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
3. https://cloudsecurityalliance.org/blog/2024/10/25/unpacking-the-cloud-security-best-practices-from-cisa-and-the-nsa
4. https://cloud.google.com/storage/docs/access-control/best-practices-access-control
5. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
6. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-145.pdf
7. https://frontegg.com/guides/access-control-in-security
8. https://www.scribd.com/document/514967426/MCQ-Question-Bank-IS-2
9. https://www.wiz.io/academy/nist-cloud-security-standards
10. https://www.sanfoundry.com/cloud-computing-questions-answers-cloud-security/
11. https://qualysec.com/nist-cloud-security/
12. https://www.oracle.com/a/ocom/docs/industries/government/scca-nist-800-controls-mapping.pdf
13. https://www.sanfoundry.com/1000-cloud-computing-questions-answers/
14. https://www.interviewbit.com/cloud-computing-mcq/
15. https://www.placementpreparation.io/mcq/cloud-computing/
16. https://interviewkickstart.com/blogs/interview-questions/cloud-computing-mcqs-it-professionals
17. https://examradar.com/cloud-computing-and-security-challenges-mcqs/
18. https://testbook.com/objective-questions/mcq-on-cloud-technology–5eea6a0d39140f30f369e30f
19. https://www.vinsys.com/blog/aws-cloud-practitioner-certification-exam-mcqs
20. https://www.scribd.com/document/492269518/cloud-UNIT-4-MCQ