CompTIA Security+ Preparation · lesson 22 of 45 · 25 min
Cloud Computing Fundamentals
Cloud computing delivers on-demand computing resources — servers, storage, databases, networking, software — over the internet. Security in the cloud requires understanding the shared responsibility model: the cloud provider secures the infrastructure; the customer secures what they put on it.
Cloud Service Models
Shared responsibility model
The higher up the stack you go (IaaS → PaaS → SaaS), the more the provider manages and the less the customer is responsible for. But the customer is always responsible for their data, user access management, and data classification — regardless of service model.
Cloud Deployment Models
Key Cloud Security Controls
Cloud Security Threats
Flashcard Drill
IaaS Infrastructure as a Service — provider manages hardware/hypervisor; customer manages OS through apps. PaaS Platform as a Service — provider manages up to runtime; customer manages apps and data. SaaS Software as a Service — provider manages everything; customer manages data and user access. Shared responsibility model Cloud security is split between provider (infrastructure) and customer (data, access, configuration). CASB Cloud Access Security Broker — proxy enforcing policy, DLP, and visibility between users and cloud services. CSPM Cloud Security Posture Management — continuously checks cloud configs for misconfigurations. VPC Virtual Private Cloud — isolated virtual network within a public cloud provider. Cloud misconfiguration The #1 cause of cloud breaches — e.g. publicly exposed S3 buckets, open security groups. IAM (cloud) Identity and Access Management — controls who can access which cloud resources; enforce least privilege + MFA. Multi-cloud Using multiple public cloud providers to avoid vendor lock-in and use best-of-breed services.
Scenario Practice
The Exposed S3 Bucket
This is a network attack — the attacker exploited a firewall vulnerability. This is a cloud misconfiguration — the developer left the bucket publicly accessible. CSPM would have detected this. This is an insider threat — the developer intentionally exposed the data. This is a SaaS vulnerability — AWS is responsible for securing S3. 1 Misconfigured cloud storage is the most common cause of cloud data breaches. The developer made a configuration error — not a malicious act. Under the shared responsibility model, the customer (healthcare company) is responsible for configuring S3 access controls. CSPM tools continuously scan for exactly this type of misconfiguration.
Choosing the Right Service Model
IaaS — they get full control over the OS and can configure everything. PaaS — the provider manages infrastructure and runtime; the team focuses on code. SaaS — they use an existing application without writing any code. Private cloud — they need dedicated hardware for compliance. 1 PaaS is ideal for developers who want to focus on code without managing infrastructure. The provider handles OS, runtime, and scaling. IaaS requires OS management. SaaS is for using existing apps, not building new ones.
Knowledge Check
Cloud Security — 10 Questions
In the shared responsibility model, which responsibility always belongs to the customer regardless of service model?
- Physical security of data centers
- Hypervisor patching
- Data classification and user access management
- Network infrastructure
Answer: Data classification and user access management
Customers are always responsible for their data and who can access it — regardless of IaaS, PaaS, or SaaS.
Which cloud service model requires the customer to manage the OS, middleware, and applications?
- SaaS
- PaaS
- IaaS
- FaaS
Answer: IaaS
In IaaS, the provider manages hardware and hypervisor. The customer manages everything from the OS upward.
The #1 cause of cloud data breaches is advanced persistent threats exploiting zero-day vulnerabilities.
- True
- False
Answer: False
Misconfiguration is the #1 cause of cloud breaches — not sophisticated attacks. Exposed storage buckets, open security groups, and overprivileged IAM roles are the most common culprits.
Which tool continuously monitors cloud configurations for misconfigurations and compliance violations?
- CASB
- CSPM
- SIEM
- NAC
Answer: CSPM
CSPM (Cloud Security Posture Management) continuously audits cloud configurations against security best practices.
A proxy that sits between users and cloud services to enforce policy, DLP, and visibility is called a _____.
Answer: CASB
CASB (Cloud Access Security Broker) provides visibility and control over cloud service usage.
Which are examples of cloud security controls? (Select all that apply)
- IAM least privilege
- VPC segmentation
- Physical server locks
- Encryption at rest
- CSPM
Answer: IAM least privilege
VPC segmentation
- Encryption at rest
- CSPM
Physical server locks are the provider’s responsibility. IAM, VPC, encryption, and CSPM are all customer-managed cloud security controls. A company uses AWS for production and Azure for disaster recovery to avoid vendor lock-in. This is:
- Hybrid cloud
- Private cloud
- Multi-cloud
- Community cloud
- Answer: Multi-cloud
Multi-cloud uses multiple public cloud providers. Hybrid cloud mixes public and private cloud.
AWS CloudTrail, Azure Monitor, and GCP Cloud Audit Logs all serve which security function?
- Encryption at rest
- Logging all API calls for audit and forensics
- Network segmentation
- Vulnerability scanning
Answer: Logging all API calls for audit and forensics
Cloud-native audit logging records every API call — who did what, when, from where — essential for incident response and compliance.
In a SaaS model, the customer is responsible for patching the application.
- True
- False
Answer: False
In SaaS, the provider manages everything including application patching. The customer only manages data and user access.
Which cloud deployment model provides dedicated infrastructure for a single organization?
- Public cloud
- Private cloud
- Community cloud
- Multi-cloud
Answer: Private cloud
Private cloud provides dedicated infrastructure for one organization — preferred for regulated industries and sensitive data.
Previous lesson: Network security architecture: segmentation, DMZ, VPN, firewall
Back to CompTIA Security+ Preparation
Next lesson: Cloud service models: IaaS, PaaS, SaaS — security responsibilities at each layer