Certbie

Free practice · No sign-up required

FCP in Cloud Security free practice test

15 questions with answer explanations. Choose an answer below to begin.

Question 1 of 15

Which capability best describes a Secure SD-WAN solution in a cloud environment?

Show hint

Understand Secure SD-WAN fundamentals in cloud architectures

0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.

Learn by doing

Put your answers into practice

Use official documentation and hands-on labs to work through topics you missed.

Explore all study resources →

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

  1. Question 1

    Link to question

    Which capability best describes a Secure SD-WAN solution in a cloud environment?

    1. Centralized policy enforcement across hybrid branches and cloud workloads

    2. Replacing all physical firewalls with virtual appliances

    3. Providing public IP addresses to all cloud instances

    4. Eliminating the need for identity-based access controls

    Show answer and explanation

    Correct answer

    • Centralized policy enforcement across hybrid branches and cloud workloads

    Secure SD-WAN enables centralized policy management and secure connectivity across distributed environments, including cloud and branch locations. It does not replace all firewalls or provide public IPs by default. Identity-based access remains essential.

  2. Question 2

    Link to question

    What is a primary security benefit of using a cloud-native firewall compared to a traditional perimeter firewall?

    1. Scalability and micro-segmentation at the workload level

    2. Lower cost for on-premises data centers

    3. Simplified physical cabling requirements

    4. Elimination of all network-based threats

    Show answer and explanation

    Correct answer

    • Scalability and micro-segmentation at the workload level

    Cloud-native firewalls can be deployed close to workloads, allowing fine-grained policies and dynamic scaling. They do not eliminate all threats or reduce physical cabling needs, and cost benefits depend on the environment.

  3. Question 3

    Link to question

    Which practice aligns with the principle of least privilege for cloud access?

    1. Granting users the minimum permissions needed for their tasks

    2. Allowing broad administrative rights to simplify management

    3. Sharing common credentials across team members

    4. Disabling all logging to reduce overhead

    Show answer and explanation

    Correct answer

    • Granting users the minimum permissions needed for their tasks

    Least privilege ensures users and services have only the access necessary to perform their roles, reducing risk. Broad rights, shared credentials, and disabled logging increase security exposure.

  4. Question 4

    Link to question

    What does encryption in transit primarily protect against?

    1. Unauthorized interception of data during transmission

    2. Data loss due to hardware failure

    3. Malware infection on endpoints

    4. Improper configuration of cloud storage buckets

    Show answer and explanation

    Correct answer

    • Data loss due to hardware failure

    Encryption in transit secures data as it moves across networks, preventing eavesdropping and tampering. It does not protect against storage failures, malware, or configuration errors.

  5. Question 5

    Link to question

    Which component is essential for maintaining visibility in a multi-cloud security strategy?

    1. Consistent logging and telemetry across cloud platforms

    2. Using a single cloud provider for all services

    3. Disabling automated alerts to avoid noise

    4. Storing all logs only on local servers

    Show answer and explanation

    Correct answer

    • Consistent logging and telemetry across cloud platforms

    Visibility in multi-cloud environments requires unified logging and telemetry to correlate events. Relying on a single provider or disabling alerts reduces security effectiveness.

  6. Question 6

    Link to question

    What is a common security risk associated with misconfigured cloud storage?

    1. Unintended public exposure of sensitive data

    2. Increased network latency

    3. Higher costs for compute resources

    4. Improved backup reliability

    Show answer and explanation

    Correct answer

    • Unintended public exposure of sensitive data

    Misconfigured storage often leads to public access, exposing confidential information. While it may affect costs or performance, public exposure is a direct security risk.

  7. Question 7

    Link to question

    Which security control helps prevent unauthorized use of privileged cloud accounts?

    1. Multi-factor authentication and session timeouts

    2. Allowing all ports to remain open for flexibility

    3. Using default passwords for convenience

    4. Sharing account credentials among administrators

    Show answer and explanation

    Correct answer

    • Multi-factor authentication and session timeouts

    Strong authentication and session management reduce the risk of compromised privileged accounts. Open ports, default passwords, and shared credentials increase risk.

  8. Question 8

    Link to question

    What is the purpose of network micro-segmentation in cloud security?

    1. Limiting lateral movement between workloads

    2. Increasing the number of open firewall ports

    3. Simplifying user password policies

    4. Removing the need for encryption

    Show answer and explanation

    Correct answer

    • Limiting lateral movement between workloads

    Micro-segmentation isolates workloads to contain threats and restrict unauthorized communication. It does not increase open ports, simplify passwords, or replace encryption.

  9. Question 9

    Link to question

    Which action best supports compliance in cloud security operations?

    1. Maintaining detailed audit logs and access reports

    2. Relying solely on verbal approvals for changes

    3. Storing audit logs only in memory

    4. Using the same policy for all cloud services regardless of sensitivity

    Show answer and explanation

    Correct answer

    • Maintaining detailed audit logs and access reports

    Detailed logs and reports are critical for demonstrating compliance and investigating incidents. Verbal approvals, volatile log storage, and one-size-fits-all policies weaken compliance.

  10. Question 10

    Link to question

    Which strategy reduces the attack surface for cloud-based applications?

    1. Implementing least privilege and disabling unused ports

    2. Opening all inbound ports for easier troubleshooting

    3. Using the same credentials across multiple services

    4. Disabling all monitoring tools to reduce complexity

    Show answer and explanation

    Correct answer

    • Implementing least privilege and disabling unused ports

    Reducing exposed services and enforcing strict access controls minimize attack opportunities. Opening ports, reusing credentials, and disabling monitoring increase risk.

  11. Question 11

    Link to question

    What is a key advantage of using a cloud access security broker (CASB)?

    1. Enforcing security policies and data protection across cloud services

    2. Providing unlimited free storage for all cloud data

    3. Guaranteeing 100% uptime for cloud applications

    4. Replacing the need for any local security tools

    Show answer and explanation

    Correct answer

    • Enforcing security policies and data protection across cloud services

    A CASB helps enforce consistent security and compliance policies across multiple cloud services. It does not provide unlimited storage, guarantee uptime, or fully replace local tools.

  12. Question 12

    Link to question

    Which practice improves incident response readiness in cloud environments?

    1. Regularly testing response procedures and maintaining updated playbooks

    2. Ignoring low-severity alerts to focus only on critical events

    3. Storing incident data only on temporary cloud instances

    4. Limiting communication to a single team member

    Show answer and explanation

    Correct answer

    • Regularly testing response procedures and maintaining updated playbooks

    Testing procedures and maintaining documentation ensures faster and more consistent responses. Ignoring alerts, volatile storage, and limited communication hinder effective incident handling.

  13. Question 13

    Link to question

    What is a recommended practice for secure API usage in the cloud?

    1. Using short-lived tokens and validating input rigorously

    2. Embedding API keys directly in application source code

    3. Allowing unrestricted access to all API endpoints

    4. Transmitting API credentials in unencrypted requests

    Show answer and explanation

    Correct answer

    • Using short-lived tokens and validating input rigorously

    Short-lived tokens and input validation reduce the impact of compromised credentials and injection attacks. Hardcoded keys, open access, and unencrypted transmission expose APIs to abuse.

  14. Question 14

    Link to question

    Which cloud service model shifts the most security responsibility to the customer?

    1. Infrastructure as a Service (IaaS)

    2. Platform as a Service (PaaS)

    3. Software as a Service (SaaS)

    4. Function as a Service (FaaS)

    Show answer and explanation

    Correct answer

    • Infrastructure as a Service (IaaS)

    In the IaaS model, the customer is responsible for managing operating systems, applications, and data, whereas the provider manages the underlying infrastructure.

  15. Question 15

    Link to question

    What is the primary purpose of implementing a zero trust architecture in cloud security?

    1. To eliminate the need for firewalls

    2. To verify every access request as if it originates from an open network

    3. To reduce the cost of cloud storage

    4. To simplify user authentication

    Show answer and explanation

    Correct answer

    • To verify every access request as if it originates from an open network

    Zero trust assumes no implicit trust and requires verification for every access request, regardless of origin, to minimize risk.

Read all flashcards

Recall the answer before opening each card.

Primary function of Secure SD-WAN in cloud environments

Centralized policy enforcement across hybrid branches and cloud workloads. It does not replace all firewalls or provide public IPs by default.

Scalability benefit of cloud-native firewalls

Cloud-native firewalls can scale dynamically to match workload changes and provide fine-grained policies at the workload level.

Micro-segmentation benefit of cloud-native firewalls

They enable micro-segmentation by applying security controls close to individual workloads, isolating traffic and limiting lateral movement.

Core principle of least privilege

Grant users and services the minimum permissions necessary to perform their tasks, reducing the risk of unauthorized access or data breaches.

What does encryption in transit primarily protect against?

It secures data as it moves across networks, preventing eavesdropping and tampering. It does not protect against storage failures or malware.

Key to maintaining visibility in multi-cloud environments

Consistent logging and telemetry across all cloud platforms is essential for correlating events and detecting threats.

Main security risk of misconfigured cloud storage

Unintended public exposure of sensitive data is the primary risk. This can lead to data breaches and compliance violations.

Control to prevent unauthorized use of privileged cloud accounts

Multi-factor authentication (MFA) adds an extra layer of security, making it harder for attackers to use compromised credentials.

Additional control for privileged account security

Session timeouts automatically log out idle sessions, reducing the window of opportunity for misuse of privileged access.

Purpose of network micro-segmentation in cloud security

It limits lateral movement between workloads by isolating them, containing potential breaches and restricting unauthorized communication.

Best practice for supporting compliance in cloud operations

Maintaining detailed audit logs and access reports provides evidence for audits and helps detect unauthorized activities.

Strategy to reduce attack surface via permissions

Implementing least privilege by granting only necessary permissions minimizes the number of access points available to attackers.

Strategy to reduce attack surface via network configuration

Disabling unused ports and services reduces the number of potential entry points for attackers into cloud applications.

Primary role of a Cloud Access Security Broker (CASB)

A CASB enforces security policies and data protection consistently across multiple cloud services, providing visibility and control.

How to improve incident response readiness

Regularly testing response procedures and keeping playbooks updated ensures faster and more effective handling of security incidents.

Documentation essential for incident response

Maintaining updated playbooks and procedures guides responders during incidents, reducing confusion and improving outcomes.

Recommended token type for secure API usage

Use short-lived tokens so that if a token is compromised, the window of misuse is limited.

Input validation importance for secure APIs

Rigorous input validation prevents injection attacks (e.g., SQLi, XSS) by ensuring only expected data is processed.

Which cloud service model shifts most security responsibility to customer?

In IaaS, the customer manages operating systems, applications, and data, while the provider secures the underlying infrastructure.

Core goal of zero trust architecture in cloud

To verify every access request as if it originates from an open network, eliminating implicit trust and minimizing risk.

Active recall deck

Practice FCP in Cloud Security with real flashcards

Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.

20 free cards

Card 1 of 20

1 reviewed this session

Connect the concepts

Your FCP in Cloud Security study mind map

Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.

FCP in Cloud Security15 questions in this practice set
Understand Secure SD-WAN fundamentals in cloud architectures(1)
Compare cloud-native and traditional firewall deployment models(1)
Apply identity and access management best practices in cloud security(1)
Understand encryption fundamentals for data protection in transit(1)
Evaluate visibility and monitoring approaches in multi-cloud setups(1)
Identify risks from cloud storage misconfigurations(1)
Implement identity protection measures for privileged cloud accounts(1)
Understand network segmentation strategies in cloud environments(1)
Align security operations with compliance requirements(1)
Apply strategies to reduce cloud application attack surface(1)
Understand the role of CASB in cloud security architecture(1)
Strengthen incident response processes in cloud security(1)
More practice connections(3)
Exam-focused analysis

What this FCP in Cloud Security practice set measures

This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.

Foundational Security Architectures

This section covers the core architectural concepts tested in the practice bank, including Secure SD-WAN, cloud-native firewalls, micro-segmentation, and zero trust. These technologies redefine perimeter security for cloud and hybrid environments. Secure SD-WAN enables centralized policy enforcement across branches and cloud workloads. Cloud-native firewalls provide scalability and micro-segmentation at the workload level. Micro-segmentation limits lateral movement between workloads. Zero trust architecture verifies every access request regardless of origin, assuming no implicit trust.

  • Secure SD-WAN centralizes policy across hybrid branches and cloud workloads.
  • Cloud-native firewalls allow fine-grained policies and dynamic scaling near workloads.
  • Micro-segmentation contains threats by isolating workload communication.
  • Zero trust requires verification for every access request as if from an open network.

Identity and Access Management

Identity and access management (IAM) controls are critical for cloud security. The practice bank emphasizes least privilege, privileged account protection, and secure API usage. Least privilege grants users only the permissions needed for their tasks, reducing blast radius. Multi-factor authentication and session timeouts prevent unauthorized use of privileged accounts. For APIs, short-lived tokens minimize exposure if compromised, and rigorous input validation prevents injection attacks. These practices align with zero trust principles by continuously verifying identity and intent.

  • Least privilege grants minimum permissions for each user or service.
  • Multi-factor authentication and session timeouts protect privileged accounts.
  • Short-lived tokens and input validation secure API interactions.
  • Shared credentials and hardcoded keys increase risk and should be avoided.

Data Protection and Compliance

Protecting data in cloud environments involves encryption, storage security, and compliance controls. Encryption in transit secures data moving across networks against eavesdropping and tampering. Misconfigured cloud storage often leads to unintended public exposure of sensitive data. Cloud Access Security Brokers (CASBs) enforce consistent security policies and data protection across multiple cloud services. Maintaining detailed audit logs and access reports supports compliance and incident investigations. These measures help meet regulatory obligations and reduce data breach risk.

  • Encryption in transit prevents eavesdropping and tampering during data transfer.
  • Misconfigured storage risks unintended public exposure of sensitive data.
  • CASB enforces security policies and data protection across cloud services.
  • Detailed audit logs and access reports are critical for demonstrating compliance.

Operational Security and Incident Response

Operational readiness and incident response are key to maintaining security in dynamic cloud environments. Consistent logging and telemetry across multiple cloud platforms provide the visibility needed to detect and correlate threats. Reducing the attack surface by implementing least privilege and disabling unused ports minimizes opportunities for attackers. Regularly testing incident response procedures and maintaining updated playbooks ensure faster and more effective handling of security events. Understanding the shared responsibility model, especially in IaaS where the customer secures operating systems, applications, and data, is fundamental.

  • Consistent logging across cloud platforms ensures visibility for threat detection.
  • Disabling unused ports and enforcing least privilege reduces attack surface.
  • Regularly test incident response procedures and keep playbooks updated.
  • In IaaS, the customer is responsible for securing OS, applications, and data.

Study workflow

Turn one FCP in Cloud Security attempt into a study plan

  1. 1

    Implement Least Privilege Access

    Review all cloud user and service roles. Remove any permissions not strictly required for job functions. Use role-based access control (RBAC) to assign minimal privileges. Regularly audit permissions to ensure they remain appropriate. This practice reduces the blast radius of compromised accounts.

  2. 2

    Deploy Cloud-Native Firewalls with Micro-Segmentation

    Implement cloud-native firewall instances within each virtual network. Define security groups or rules that allow only necessary traffic between workloads. Use micro-segmentation to isolate sensitive applications. Scale firewall resources dynamically based on load. This architecture limits lateral movement and adapts to workload changes.

  3. 3

    Enable Unified Logging and Monitoring Across Clouds

    Centralize logs from all cloud providers into a single security information and event management (SIEM) system. Enable telemetry for identity, storage, network, and compute services. Set up alerts for anomalous behavior and unauthorized access attempts. Consistent visibility enables faster detection and response to threats.

  4. 4

    Use a Cloud Access Security Broker (CASB)

    Deploy a CASB to enforce security policies across your cloud services. Configure data loss prevention rules, access controls, and activity monitoring. Integrate with existing identity providers for single sign-on. A CASB provides visibility and control over shadow IT and ensures consistent policy enforcement.

  5. 5

    Adopt Zero Trust Architecture

    Assume no implicit trust for any user, device, or network. Verify every access request explicitly using strong authentication and least privilege. Continuous monitoring and micro-segmentation enforce trust decisions. Apply zero trust principles to all cloud resources, including APIs and storage, to minimize risk from insider threats and compromised credentials.

FAQ

Questions about this exam practice page

Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.

What is the primary advantage of a cloud-native firewall over a traditional perimeter firewall?+

A cloud-native firewall can be deployed close to individual workloads, enabling fine-grained micro-segmentation and dynamic scaling. It adapts to changing cloud environments and provides granular policy control at the workload level, unlike traditional firewalls that operate at network boundaries.

How does Secure SD-WAN enhance cloud connectivity compared to standard SD-WAN?+

Secure SD-WAN integrates security functions like centralized policy enforcement and encryption directly into the WAN architecture. This ensures consistent security policies across hybrid branches and cloud workloads, providing secure, optimized connectivity without relying on separate security appliances.

Why is encryption in transit critical for cloud security?+

Encryption in transit protects data as it travels across networks from eavesdropping, tampering, and man-in-the-middle attacks. Without it, sensitive information transmitted between cloud services, users, and on-premises systems could be intercepted.

What is a common risk of misconfigured cloud storage?+

Misconfigured cloud storage often results in unintended public exposure of sensitive data, such as customer records or internal documents. This can lead to data breaches, compliance violations, and reputational damage. Regular audits and access controls help prevent this.

How does zero trust architecture reduce cloud security risk?+

Zero trust eliminates implicit trust by verifying every access request, whether from inside or outside the network. It enforces least privilege, continuous monitoring, and micro-segmentation, minimizing the blast radius of compromised credentials and limiting lateral movement of attackers.

Keep studying

Build the next review session

Browse another free bank or use the study strategy guide to turn your misses into spaced review.

All free testsStudy strategy