Q.1 What is cloud security and why is it important?

Cloud security refers to the collection of technologies, controls, processes, and policies that work together to protect cloud-based systems, data, and infrastructure. It is important because organizations are moving sensitive workloads to the cloud, making them more accessible but also more exposed to cyberattacks. Without proper security, risks such as data breaches, unauthorized access, insider threats, and service outages can cause major financial and reputational damage. Cloud security ensures confidentiality, integrity, and availability of data and services.

Q.2 What’s the difference between IaaS, PaaS, and SaaS in terms of security?

  • IaaS (Infrastructure as a Service): You control OS, applications, and data. Security responsibilities include patching, securing VMs, and configuring firewalls. Example: AWS EC2, Azure VMs.
  • PaaS (Platform as a Service): Provider manages runtime and infrastructure. You are responsible for securing applications, data, and access control. Example: AWS Elastic Beanstalk, Google App Engine.
  • SaaS (Software as a Service): Provider manages almost everything. Your responsibility is limited to securing data, user access, and identity. Example: Office 365, Salesforce.

Understanding this model is crucial because most vulnerabilities come from unclear boundaries of responsibility.

Q.3 What is the shared responsibility model?

The shared responsibility model defines which security tasks are handled by the cloud provider and which by the customer.

  • Provider responsibilities: Physical infrastructure, hypervisors, networking, hardware security, global availability.
  • Customer responsibilities: Identity & access management (IAM), data protection, encryption, endpoint security, and network configuration.
    For example, AWS secures the cloud, while the customer secures what they put in the cloud. Misunderstanding this model is one of the top causes of security gaps.

Q.4 How do you secure data at rest and in transit in the cloud?

  • At rest: Encrypt data using AES-256 or provider-managed KMS. Ensure keys are rotated regularly, use customer-managed keys if compliance requires. Store data in private subnets when possible.
  • In transit: Protect communication using TLS/SSL, VPN tunnels, or private connectivity (AWS Direct Connect, Azure ExpressRoute). Use HTTPS for APIs.
    Securing data both at rest and in transit ensures attackers can’t exploit intercepted or stolen data.

Q.5 What are the most common cloud security threats?

  • Data breaches due to misconfigured storage (e.g., public S3 buckets).
  • Account hijacking through stolen credentials.
  • Insecure APIs that expose sensitive functions.
  • Insider threats from malicious or careless employees.
  • Misconfigurations, which are the #1 cause of cloud incidents.
    Recognizing these threats helps in prioritizing prevention strategies.

Q.6 What is cloud misconfiguration and how to prevent it?

Misconfiguration happens when cloud resources are set up incorrectly — for example, leaving a database open to the internet or not enabling encryption.
Prevention measures:

  • Implement automated compliance tools (AWS Config, Azure Security Center).
  • Use IaC scanning tools like Terraform Sentinel or Checkov.
  • Regular security audits and penetration testing.
  • Enforce least privilege access on all resources.

Q.7 What tools would you use for cloud security monitoring?

  • AWS: GuardDuty, CloudTrail, Config, Security Hub.
  • Azure: Security Center, Sentinel, Defender for Cloud.
  • GCP: Security Command Center.
  • Cross-platform: SIEM tools like Splunk, ELK, QRadar.

These tools provide real-time threat detection, compliance reports, and anomaly monitoring to strengthen cloud defenses.

Q.8 Explain IAM best practices.

Identity and Access Management (IAM) is critical in cloud security. Best practices include:

  • Least privilege principle: Give users the minimum permissions they need.
  • MFA (Multi-factor authentication): Prevents account hijacking.
  • Use IAM roles instead of access keys: Reduces risks of long-term credentials being leaked.
  • Periodic access reviews: Remove unused or unnecessary permissions.
  • Enable conditional access policies: Restrict logins by location, device, or time.

Q.9 What is Zero Trust in cloud security?

Zero Trust is a model where no user or device is trusted by default, whether inside or outside the network. Every access request must be authenticated, authorized, and continuously validated.
Core principles:

  • Verify explicitly (identity + context).
  • Apply least privilege.
  • Assume breach — always monitor and log.

It is particularly important in cloud since services are globally accessible.

Q.10 How do you handle DDoS attacks in cloud?

  • Use DDoS protection services like AWS Shield, Azure DDoS Protection, or Cloudflare.
  • Content Delivery Networks (CDN) like CloudFront absorb traffic spikes.
  • Auto-scaling ensures apps can handle sudden loads.
  • WAF rules & rate limiting block malicious requests.
  • Enable monitoring for unusual traffic spikes.

Q.11 What is CASB (Cloud Access Security Broker)?

CASB is a security solution that acts as a gatekeeper between cloud users and providers. It enforces security policies like authentication, encryption, malware detection, and compliance monitoring. Example: Microsoft Cloud App Security, Netskope. CASBs provide visibility into shadow IT, secure data, and enforce governance policies.

Q.12 How do you ensure compliance in cloud (GDPR, HIPAA, etc.)?

  • Use cloud-native compliance tools (AWS Artifact, Azure Compliance Manager).
  • Encrypt sensitive data (PII, PHI).
  • Maintain detailed logs and audit trails.
  • Apply data residency controls (store data in required regions).
  • Regular compliance audits and penetration testing.
    Failure to comply can result in fines and legal penalties.

Q.13 What is multi-tenancy in cloud, and what are its risks?

Multi-tenancy means multiple customers share the same cloud resources.
Risks: Data leakage, noisy neighbors affecting performance, weak isolation.
Mitigation: Strong encryption, tenant isolation, hypervisor security, and logical segmentation (VPCs, VNets).

Q.14 What is a Cloud Workload Protection Platform (CWPP)?

CWPP protects cloud workloads like VMs, containers, and serverless functions. Features include:

  • Vulnerability management
  • Runtime security monitoring
  • File integrity monitoring
  • Compliance enforcement
    Examples: Prisma Cloud, Trend Micro Deep Security.

Q.15 How do you secure APIs in the cloud?

  • Use authentication/authorization (OAuth 2.0, JWT).
  • Deploy API gateways to filter malicious traffic.
  • Apply rate limiting to prevent abuse.
  • Use input validation to stop injection attacks.
  • Always use TLS (HTTPS).

Q.16 What is cloud encryption key management?

Key management ensures encryption keys are created, stored, rotated, and destroyed securely. Best practices:

  • Use KMS (Key Management Services) from providers (AWS KMS, Azure Key Vault).
  • Rotate keys regularly.
  • Use customer-managed keys if compliance requires.
  • Apply strict IAM policies on key usage.

Q.17 How would you detect and respond to a cloud data breach?

Detection: Use tools like CloudTrail, GuardDuty, or SIEM for unusual activity.
Response:

  • Identify scope of breach (which accounts/data).
  • Revoke compromised credentials immediately.
  • Isolate affected workloads.
  • Notify stakeholders and follow legal reporting requirements (e.g., GDPR 72-hour rule).
  • Perform root cause analysis and harden security.

Q.18. Explain Cloud Security Posture Management (CSPM).

CSPM continuously monitors and improves cloud security by identifying misconfigurations, compliance risks, and vulnerabilities.
It enforces best practices like encryption, IAM policies, and logging. Examples: Wiz, Prisma Cloud, Dome9.
CSPM reduces risks caused by human error in large-scale multi-cloud environments.

Q.19 How do you secure containers and Kubernetes in cloud?

  • Scan container images for vulnerabilities before deployment.
  • Use RBAC (Role-Based Access Control) in Kubernetes.
  • Implement pod security policies and network segmentation.
  • Enable logging and runtime monitoring (Falco, Aqua Security).
  • Keep Kubernetes API server private.

Q.20 What are best practices for cloud backup and disaster recovery?

  • Automate scheduled backups.
  • Store backups in different availability zones/regions.
  • Encrypt backup data.
  • Regularly test recovery plans.
  • Maintain RPO (Recovery Point Objective) and RTO (Recovery Time Objective) according to business needs.

Q.21 What is a VPC and how do you secure it?

A Virtual Private Cloud (VPC) is a logically isolated network in cloud where you can launch resources like VMs, databases, and applications.

Security best practices:

  • Use private subnets for sensitive resources.
  • Configure Security Groups and Network ACLs for least privilege access.
  • Use VPC Flow Logs to monitor traffic.
  • Implement VPC peering or transit gateways securely.
  • Enable NAT gateways for outbound-only internet access.

Q.22 What is Cloud Security Alliance (CSA) and why is it important?

The Cloud Security Alliance is a global organization that defines best practices for secure cloud adoption. Their CSA Cloud Controls Matrix (CCM) provides a framework of security principles covering compliance, risk, and governance. It’s important because many enterprises align their cloud security with CSA guidelines, and knowledge of CSA shows you’re aware of industry standards.

Q.23 How do you secure multi-cloud and hybrid cloud environments?

  • Centralized monitoring with SIEM tools (Splunk, Sentinel).
  • Unified IAM policies across providers.
  • Encryption & consistent compliance controls across all platforms.
  • CSPM solutions like Wiz or Prisma Cloud to detect misconfigurations across multi-cloud.
  • Use secure interconnections (VPN, private peering) between clouds.

Q.24. What is the difference between cloud security and on-premises security?

  • On-premises security: Full control but higher responsibility — you manage physical security, networking, firewalls, patching, etc.
  • Cloud security: Provider handles infrastructure security, but you must handle identity, data, and workloads.
    Cloud offers more automation and scalability but also requires understanding the shared responsibility model.

Q.25 How do you secure serverless functions (FaaS) in the cloud?

  • Apply least privilege IAM roles (functions should only access what they need).
  • Validate and sanitize all inputs to prevent injection attacks.
  • Use secure secrets storage (e.g., AWS Secrets Manager).
  • Monitor logs and enable alerts for anomalies.
  • Keep dependencies updated and use vulnerability scanning tools.