Advanced cloud security

Correct — The workload trades a static credential for an identity-scoped, expiring token.

Correct — Policies grant; the boundary caps — safe delegation without escalation.

Correct — Evaluation is deny-by-default with explicit Deny winning.

Correct — A compromise in one account is bounded; SCP/Org Policy caps every account.

Correct — You find who can reach a resource, and how privileges chain, before an attacker does.

Correct — The token subject claim must satisfy your trust conditions.

Correct — Short-lived assumed-role sessions are logged and revocable.

Correct — Elevate on demand, with approval and expiry, instead of permanent privilege.

Correct — People authenticate via the IdP; access is centrally managed and revoked.

Correct — A captured session that already expired is a non-event.

Correct — Scope actions and resources to what the principal actually needs.

Correct — No static secret ships; the platform issues short-lived credentials.

Correct — The data plane stays on the cloud backbone, not the open internet.

Correct — Default-open outbound lets a compromised workload phone home freely.

Correct — Unapproved egress is blocked and visible.

Correct — A foothold in one segment cannot reach everything.

Correct — Deny-by-default; you open only what is needed.

Correct — It cuts off C2/exfil domains and gives visibility.

Correct — Both sides prove identity; certs are short-lived and auto-rotated.

Correct — Prefer TLS/mTLS end-to-end; internal networks are not inherently safe.

Correct — Private subnets plus deliberate egress shrink the attack surface.

Correct — You remove the public attack surface on the data tier.

Correct — It is a layer-7 control, not a substitute for secure code.

Correct — They reconstruct network activity after the fact.

Correct — You store the wrapped data key beside the ciphertext; only KMS can unwrap it.

Correct — Even a bucket reader cannot decrypt without key permissions.

Correct — Two independent permissions must be held to get plaintext.

Correct — Disabling the key renders the data unreadable — a powerful kill switch.

Correct — You can prove custody and, with HYOK, retain the ability to withdraw it.

Correct — Regulated workloads often require hardware-backed, non-exportable keys.

Correct — Envelope encryption makes rotation cheap and non-disruptive.

Correct — Secrets become a governed resource, not a file to copy.

Correct — Short validity shrinks the exposure of any single leak.

Correct — Customer-managed keys close that gap.

Correct — That is the intended envelope-encryption pattern.

Correct — You narrow who can ever see the plaintext of the most sensitive data.

Correct — Without the trail you cannot reconstruct what happened.

Correct — Segregating logs protects evidence integrity.

Correct — Write-once retention preserves the evidence trail.

Correct — They surface likely-malicious behavior for triage and response.

Correct — Tune, dedupe, and prioritize so responders act on what matters.

Correct — e.g. auto-isolate a resource or revoke a key on a high-severity finding.

Correct — Contain first; the trail tells you the blast radius.

Correct — You contain and capture evidence rather than destroying it.

Correct — Speed and correctness come from practice, not invention mid-incident.

Correct — Rules become auditable, repeatable, and hard to silently weaken.

Correct — A triggered canary is a near-certain intrusion indicator.

Correct — A permitted action at abnormal volume/pattern is the tell.

Correct — It flags the public bucket or open group before an attacker finds it.

Correct — Detecting drift from the approved baseline catches both.

Correct — They turn "secure config" into checkable, standard controls.

Correct — Shift-left posture: the public bucket is blocked in the PR, not in prod.

Correct — Per-workload identity limits what a compromised container can reach.

Correct — It catches post-exploitation activity image scanning cannot see.

Correct — Admission verifies the signature before the workload runs.

Correct — No OS to patch, but over-broad roles and vulnerable deps dominate the risk.

Correct — A preventive guardrail stops the misconfig from ever happening.

Correct — Security is provisioned with the account, not bolted on afterward.

Correct — Automated posture checks become your audit evidence.

Correct — Tight per-workload roles cap what a compromise can touch.