CLOUD SECURITY · QUIZ

Cloud Security Quiz

Twenty technical questions on AWS/Azure IAM, S3/blob exposure, VMs, metadata SSRF, NSGs, and common misconfigs.

Switch to Web Application Security Switch to Secure Coding

August 2026 · monthly

Leaderboard

No public scores yet this month. Opt in under Email, then finish the quiz.

Welcome to the Cloud Security Quiz. Ten short multiple-choice questions on IAM, storage exposure, metadata risks, and shared responsibility.

Name

Show my name on this month's leaderboard Optional.

Who is responsible for securing data in a public cloud SaaS app?

Shared: the provider secures the platform, you secure your data and access

Only the cloud provider

Only the customer

Only the ISP

None

An S3 bucket (or blob container) is left publicly listable and readable. What is the main risk?

Anyone on the internet can discover and download the objects

Only IAM admins can read the objects

Objects become encrypted at rest automatically

The bucket deletes itself after 24 hours

None

Why is attaching AdministratorAccess (or Owner) to a human IAM user a bad default?

It grants far more privilege than needed if the account is abused

It disables MFA forever

It makes billing free

Cloud APIs reject that policy

None

A web app fetches a user-supplied URL and an attacker hits the instance metadata IP (169.254.169.254). What is this?

Server-Side Request Forgery (SSRF) that can steal cloud credentials

SQL injection

Cross-Site Scripting (XSS)

DNS cache poisoning

None

What is the safest everyday pattern for long-lived cloud access keys on developer laptops?

Prefer short-lived roles / SSO federation instead of permanent access keys

Email the access key to the team

Commit keys into a private Git repo

Put keys in a world-readable home directory

None

Security groups / NSGs should usually allow which inbound pattern on production databases?

Only from known app tiers or bastion hosts, never 0.0.0.0/0

Open 0.0.0.0/0 on the database port for convenience

Only ICMP from the whole internet

No rules at all, so nothing can connect

None

Turning on cloud audit logs (CloudTrail, Activity Log, Cloud Audit Logs) primarily helps you:

Investigate who changed IAM, storage, and network settings

Speed up CPU performance

Replace encryption

Disable MFA prompts

None

A CI job needs to deploy to one cloud account. Which option is strongest?

OIDC / workload identity with a short-lived role limited to deploy actions

A root account access key stored in the pipeline

A shared password in the README

Disabling all IAM policies

None

Public snapshots or machine images of a hardened server are risky mainly because they may contain:

Secrets, keys, or customer data baked into the image

Only empty disks

Faster CPUs

Automatic MFA for every SSH login

None

MFA on the cloud console root / break-glass account matters because:

Password alone is not enough if that credential leaks

MFA removes the need for logging

MFA encrypts every S3 object

Providers ban accounts without MFA marketing emails

None

Which AWS CLI check best confirms an S3 bucket is not publicly accessible via Block Public Access?

aws s3api get-public-access-block --bucket my-bucket

aws s3 ls s3://my-bucket --recursive

aws ec2 describe-instances

aws iam list-users

None

An EC2 security group allows inbound TCP 22 from 0.0.0.0/0. What is the safest fix?

Remove the open rule; use SSM Session Manager or restrict SSH to a bastion/VPN CIDR

Change the port to 2222 but keep 0.0.0.0/0

Disable CloudTrail so scans are quieter

Attach AdministratorAccess to the instance role

None

Why prefer IMDSv2 (hop limit / required tokens) over IMDSv1 on AWS EC2?

IMDSv2 makes SSRF-based credential theft from the metadata service much harder

IMDSv2 turns off all IAM roles

IMDSv1 is encrypted and IMDSv2 is not

IMDSv2 deletes security groups

None

An Azure Storage account has "Blob anonymous access" enabled and a container set to Blob. Risk?

Anyone with the blob URL can read objects without a SAS or Azure AD auth

Only the subscription Owner can read blobs

Blobs become write-only

Azure automatically enables MFA for every download

None

An IAM role trust policy sets Principal to "AWS": "*" with no external ID/conditions. What happens?

Any AWS account that knows the role ARN may be able to AssumeRole into it

Only the creating user can assume the role

The role becomes read-only automatically

AssumeRole is permanently disabled

None

An Azure NSG allows inbound RDP (3389) from the Internet. What should you do?

Deny internet RDP; use Azure Bastion, VPN, or Just-In-Time access instead

Open WinRM 5985 to the world as well

Disable Microsoft Defender for Cloud

Store the local admin password in a public blob

None

Which finding is most severe on a production RDS / Azure SQL instance?

Publicly reachable endpoint with a weak password or open firewall (0.0.0.0)

Automated backups enabled

Encryption at rest enabled with a customer-managed key

Private endpoint only inside the VNet

None

A VM managed identity / instance profile can read all S3 buckets in the account. Best remediation?

Scope the role to only the buckets/prefixes the workload needs (least privilege)

Add AdministratorAccess so apps stop failing

Disable CloudWatch logs

Expose the access keys in user-data for debugging

None

You run: aws s3api get-bucket-policy --bucket app-logs and see Principal "*" with s3:GetObject. Meaning?

The policy allows the public (or any principal) to read objects if other controls allow it

Only the AWS support team can read objects

The bucket is encrypted with a customer key only

The policy blocks all GetObject calls

None

Which control best hardens an Azure Linux VM used only for private apps?

No public IP; access via Bastion/VPN; disks encrypted; just-enough RBAC on the identity

Public IP + password SSH from the internet + Owner role on the subscription

Disable activity logs and keep NSG allow-all

Store SSH private keys in the custom image

None

Time's up