What is Amazon EC2?

 Amazon EC2 (Elastic Compute Cloud) is a cloud service that lets you rent virtual servers to run applications without needing physical hardware. It gives you the flexibility to start, stop, and scale servers anytime based on your needs, making it both cost-effective and efficient for hosting applications

What Are Some of the Security Best Practices for Amazon EC2?
To keep Amazon EC2 servers secure, you should control who can access them using AWS Identity and Access Management (IAM), allow only trusted computers or networks to connect, give only the permissions that are really needed, and turn off password logins for servers created from your images.

What are the top cloud security threats?

  • Data breaches
  • Misconfigurations
  • Insecure APIs
  • Insider threats
  • Account hijacking
  • Denial of Service (DoS/DDoS)
  • Lack of compliance

How do you secure data in the cloud?

Securing cloud data requires a multi-layered approach:

  • Encryption: Encrypt data-at-rest (AES-256, KMS) and data-in-transit (TLS/SSL, VPNs). Use Customer-Managed Keys (BYOK) when needed.
  • Access Controls: Implement strong IAM with Role-Based Access Control (RBAC), Principle of Least Privilege (PoLP), and Multi-Factor Authentication (MFA).
  • Data Classification & DLP: Classify sensitive data and apply Data Loss Prevention (DLP) policies to prevent leaks or unauthorized sharing.
  • Backups & Redundancy: Enable automated backups, geo-redundancy, and disaster recovery (RTO/RPO planning).
  • Monitoring & Logging: Use SIEM, CloudTrail, or equivalent to detect suspicious access or anomalies.
  • Compliance & Policies: Align data handling with frameworks like GDPR, HIPAA, PCI DSS, and enforce retention/deletion policies.

What’s Cloud IAM?

Cloud Identity and Access Management (IAM) is a framework that controls authentication and authorization in cloud environments. It allows administrators to create and manage users, groups, roles, and policies to define permissions. IAM enforces the Principle of Least Privilege (PoLP), ensuring users only get the minimum access needed. It helps secure resources by managing who can access what, when, and under what conditions in the cloud.

How do you secure cloud APIs?

  • Use OAuth 2.0 / JWT tokens.
  • Enable rate limiting.
  • Encrypt API traffic with TLS.
  • Perform regular security testing.
  • Implement WAF (Web Application Firewall)

Explain Zero Trust in cloud security.

Zero Trust is a security framework built on the principle of “Never trust, always verify.” Unlike  traditional perimeter-based security, Zero Trust assumes that no user, device, or network is inherently trusted — whether inside or outside the cloud.

   Key elements include:

  • Strong Authentication & MFA: Every access request must be verified with multi-factor authentication.
  • Least Privilege Access: Grant users only the permissions they need, reducing attack surface.
  • Micro-Segmentation: Break down networks into smaller zones so that even if one part is breached, attackers can’t move laterally.
  • Continuous Monitoring: Monitor identity, device health, and user behavior in real time to detect anomalies.

Encryption Everywhere: Ensure all traffic (internal and external) is encrypted

What is Cloud Encryption Key Management (KMS)?

Cloud Key Management Service (KMS) is a managed service that lets you create, store, rotate, and control encryption keys used to secure your data. It ensures only authorized users and apps can access encrypted data, supporting compliance with standards like HIPAA, PCI DSS, GDPR.

Examples: include AWS KMS, Azure Key Vault, and GCP Cloud KMS

What is a cloud security misconfiguration?

A cloud security misconfiguration occurs when cloud resources are set up incorrectly, leaving them vulnerable to threats. Common examples include publicly accessible storage buckets, overly permissive IAM roles, unrestricted firewall rules, and unencrypted databases. These mistakes are one of the leading causes of cloud data breaches, as attackers can easily exploit them. To prevent this, organizations must enforce proper security policies, continuous monitoring, and compliance checks to ensure configurations remain secure.

What is BYOK in Cloud Security?

Bring Your Own Key (BYOK) is a cloud security model where customers create, own, and manage their encryption keys, instead of relying fully on the cloud service provider (CSP). These keys are then imported into the CSP’s Key Management Service (like AWS KMS, Azure Key Vault, or GCP Cloud KMS) and used to encrypt data stored in the cloud.

Explain Cloud Forensics.

Cloud Forensics is the process of investigating security incidents in cloud environments by collecting, analyzing, and preserving digital evidence. It extends traditional digital forensics into the cloud, but with added complexity due to multi-tenancy, virtualization, and shared responsibility between the customer and cloud provider.

In practice, cloud forensics involves gathering evidence such as logs (CloudTrail, Azure Monitor), virtual machine snapshots, storage data, network traffic, and API calls. The goal is to identify how an incident occurred, who was responsible, and what data or systems were impacted.

What is Cloud DLP (Data Loss Prevention) and how does it work?

Cloud Data Loss Prevention (DLP) is a security solution that prevents sensitive data (like PII, financial info, or health records) from being exposed or leaked in the cloud.
It scans data at rest, in transit, and in use across cloud apps and storage.
DLP uses rules and policies to detect sensitive data, then applies controls like blocking, masking, or encrypting. It integrates with cloud services (e.g., Google Drive, Office 365, AWS S3) to monitor and protect data flow. This helps organizations stay compliant with regulations like GDPR, HIPAA, and PCI DSS.

How do you secure multi-cloud or hybrid cloud environments?

Securing multi-cloud or hybrid environments requires centralized IAM with SSO and MFA, consistent encryption and key management, and network segmentation to isolate workloads.
Use centralized monitoring/SIEM to detect threats across all platforms and enforce security policies and compliance using tools like CASB and IaC scans.

What is SSO?

Single Sign-On (SSO) is an authentication method that allows a user to access multiple applications or services with a single set of credentials. Instead of logging in separately to each application, the user authenticates once, and the SSO system manages access tokens or assertions to other services.

What is CASB (Cloud Access Security Broker) and why is it important?

A Cloud Access Security Broker (CASB) is a security solution that sits between users and cloud service providers to enforce security, compliance, and governance policies when accessing cloud applications. CASBs provide visibility, control, and protection for cloud usage across SaaS, PaaS, and IaaS environments.

Key Functions of CASB:

  • Monitor which cloud apps are being used and by whom.
  • Apply encryption, tokenization, and Data Loss Prevention (DLP) policies.
  • Detect and respond to suspicious activities, malware, or compromised accounts.
  • Ensure cloud usage meets regulatory standards like GDPR, HIPAA, or PCI DSS.