SecurityX level · Domain 2.0 Security Architecture · 27% of the mapped exam

2.5 Given a scenario, securely implement cloud capabilities in an enterprise environment.

30 topics · 3 quiz questions

Enterprise cloud security combines visibility (CASB, shadow IT), secure pipelines and infrastructure code, careful key and data management and layered control strategies.

Visibility and governance

Cloud access security broker (CASB): Enforces security policy between users and cloud services: visibility, DLP, access control, threat protection.
API-based: CASB connects to SaaS APIs to scan data and settings out of band.
Proxy-based: CASB sits inline (forward or reverse proxy) to control traffic in real time.
Shadow IT detection: Discovering unsanctioned cloud services from proxy, DNS or firewall logs.
Shared responsibility model: Clarifying which controls the provider and the customer own for each service.

Pipelines and workloads

CI/CD pipeline: Secure build and deploy with least-privilege, short-lived credentials.
Terraform: Infrastructure as code; scan modules and protect state.
Ansible: Configuration as code; protect vaulted secrets and inventories.
Package monitoring: Watching dependencies for vulnerabilities and malicious updates.
Container security: Image scanning, signing, non-root, runtime protection.
Container orchestration: Hardened Kubernetes: RBAC, network policies, admission control, secrets encryption.
Serverless: Event-driven compute with its own risks.
Workloads: The code and data running in serverless platforms.
Functions: Individual functions need least-privilege roles and input validation.
Resources: Triggers, queues and storage connected to functions.

API security

Authorization: Every API call checked for the caller's rights to that object.
Logging: API access logs for detection and audit.
Rate limiting: Throttling to stop abuse and enumeration.

Cloud vs. customer-managed

Encryption keys: Provider-managed keys are simple; customer-managed keys (CMK/BYOK/HYOK) give more control and separation of duties.
Licenses: Whether software licences are provided by the cloud or brought by the customer.

Cloud data security considerations

Data exposure: Data unintentionally accessible to unauthorised parties.
Data leakage: Data flowing out through misconfiguration or misuse.
Data remanence: Residual data left on storage after deletion; mitigated by crypto-shredding (deleting keys).
Insecure storage resources: Public buckets, unencrypted volumes, open snapshots.

Cloud control strategies and integration

Proactive: Preventing problems before they occur, e.g. policy-as-code guardrails.
Detective: Finding issues, e.g. CSPM and log analytics.
Preventative: Blocking unsafe actions, e.g. service control policies.
Customer-to-cloud connectivity: VPN, dedicated links and private endpoints.
Cloud service integration: Securely connecting cloud services with each other and on-premises systems.
Cloud service adoption: Governed onboarding of new cloud services with security review.

Check your understanding

Loading quiz…

< 2.4 previous 2.6 next >

Original CoreQ Academy material, mapped to objective 2.5 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.