Cloud Security Fundamentals
The Cloud Security Fundamentals course teaches how cloud-native security differs from traditional perimeter security — the shared responsibility model, identity-centric access, encryption services, network controls in cloud, posture management, and the cross-cutting patterns that apply across AWS, Azure, and GCP.
80
Minutes
64
Questions
70/100
Passing Score
Who Should Take This
Engineers and IT staff who deploy or operate workloads on AWS, Azure, or GCP and want to build secure-by-default cloud foundations. Assumes basic familiarity with at least one cloud provider's core services. Learners finish able to apply shared-responsibility-aware architectures, configure least-privilege IAM, encrypt data with cloud KMS, and recognize common cloud misconfigurations.
Course Outline
1Shared Responsibility and Cloud Models 3 topics
Shared Responsibility Model
- Define the shared responsibility model and identify the responsibility split for IaaS, PaaS, and SaaS at conceptual depth.
- Apply the shared responsibility model to a sample workload (EC2-based web app vs RDS managed DB vs SaaS CRM) and identify the customer's security responsibilities.
Cloud Service Categories
- Distinguish IaaS (raw VMs/storage), PaaS (managed runtimes), SaaS (full applications), and FaaS (serverless) and identify a representative service for each.
- Compare a self-managed EC2 + MySQL deployment with an Aurora Serverless deployment and analyze the security trade-offs.
Multi-Cloud and Hybrid Concepts
- Identify the security challenges of multi-cloud (consistent IAM, fragmented logging, divergent baseline configs) and describe how abstraction tools (Terraform, OPA) help.
2Cloud Identity and Access 3 topics
Cloud IAM Primitives
- Identify the core IAM constructs across providers: AWS IAM users/roles/policies, Azure AD/RBAC scopes, GCP IAM members/roles/bindings.
- Apply role-based access at appropriate scope (account/subscription/project, not individual resources where avoidable) and explain the blast-radius implications.
- Analyze a permissive IAM policy (e.g., AWS '*:*' on '*') and propose a scoped replacement grounded in observed access patterns.
Workload Identity
- Define workload identity and identify AWS IAM roles for EC2/ECS/EKS, GCP service accounts with Workload Identity, and Azure managed identities.
- Apply workload identity to eliminate long-lived access keys in CI/CD by federating GitHub/GitLab to short-lived cloud credentials via OIDC.
Privileged Access in Cloud
- Identify cloud-native PAM patterns: AWS IAM Identity Center with permission sets, Azure PIM, GCP just-in-time access via IAM conditions.
- Apply break-glass account design: separate emergency identity, hardware-key MFA, alerting on use, distinct from daily-use identities.
3Encryption and Key Management 3 topics
Cloud KMS Services
- Identify AWS KMS, Azure Key Vault, and GCP KMS as cloud-native key management services and describe what each provides.
- Apply customer-managed key (CMK) selection: when to use cloud-managed default keys vs customer-managed keys vs HSM-backed keys.
Envelope Encryption and Data Protection
- Define envelope encryption and describe the DEK/KEK pattern with cloud KMS performing wrap/unwrap.
- Apply at-rest encryption to S3/Blob/GCS, RDS/SQL/Cloud SQL, and EBS/Disk/PD using customer-managed keys with proper key policies.
Secrets Management
- Identify AWS Secrets Manager, Azure Key Vault secrets, GCP Secret Manager, and HashiCorp Vault as cloud-secrets options.
- Apply secret rotation, scoped IAM access to secrets, and integration with workload identity (no hard-coded fetch credentials).
4Network Security in Cloud 3 topics
VPCs and Subnets
- Identify the core network constructs: AWS VPC + subnets + route tables, Azure VNet + subnets + UDRs, GCP VPC + subnets + routes.
- Apply a baseline VPC design with public + private subnets, a NAT for egress, and route tables that prevent unintended internet exposure.
Security Groups and NSGs
- Distinguish stateful security groups (AWS, GCP firewall rules) from stateful NSGs (Azure) and identify the implicit-deny default.
- Apply least-privilege ingress rules: source-restricted (CIDR or security-group reference), specific ports, no 0.0.0.0/0 SSH or RDP.
- Analyze a security group ruleset that exposes a database port to the internet and trace the resulting attack surface.
Private Connectivity and Egress
- Identify private endpoints (AWS PrivateLink, Azure Private Endpoint, GCP Private Service Connect) and explain how they avoid traversing the public internet.
- Apply egress controls: VPC endpoints/NAT for managed services, egress proxies for outbound HTTPS, and restricting the open internet from private subnets.
5Logging, Detection, and Posture 3 topics
Audit Logging
- Identify AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs and describe what each captures (control-plane vs data-plane events).
- Apply audit-log centralization: organization-wide log aggregation to a dedicated security/log archive account/subscription/project with restricted write access.
Cloud-Native Threat Detection
- Identify AWS GuardDuty, Azure Defender for Cloud, and GCP Security Command Center as cloud-native threat detection services.
- Apply baseline detection coverage: enable provider-native detection org-wide, integrate findings into a SIEM, and tune the highest-noise rules.
Posture Management (CSPM)
- Define CSPM and identify cloud-native (Security Hub, Defender for Cloud, SCC) and third-party (Wiz, Prowler, ScoutSuite) options.
- Apply CIS Foundations Benchmark scanning across an organization and triage findings by exploitability and exposure rather than total count.
- Analyze a 'public S3 bucket' or 'overly permissive IAM' finding and trace the chain of misconfigurations that produced it.
6Compliance, Containers, and Common Failures 3 topics
Compliance and Benchmarks
- Identify CIS Benchmarks, Well-Architected security pillar, and provider compliance frameworks (FedRAMP, PCI-DSS in cloud, HIPAA-eligible services) and describe their roles.
- Apply a baseline compliance assessment using a CIS benchmark scanner and produce a prioritized remediation list grounded in business context.
Container and Kubernetes Security
- Identify the cloud-Kubernetes shared responsibility split (control plane managed by provider, worker nodes and workloads by customer in EKS/AKS/GKE).
- Apply baseline Kubernetes security: image scanning, signed images, network policies, pod security admission, restricted service accounts.
Common Cloud Misconfigurations
- Identify the canonical cloud misconfiguration list: public storage buckets, exposed databases, overly permissive IAM, unencrypted volumes, exposed metadata service.
- Apply IMDSv2 (AWS), instance metadata hardening, and service-account token projection patterns to mitigate metadata-service abuse.
- Analyze the Capital One 2019 breach (or a comparable SSRF-to-metadata-to-S3 chain) and identify each control that should have prevented or detected each step.
7DevOps, IaC, and Pipeline Security 8 topics
Infrastructure as Code Security
- Identify Terraform, CloudFormation, Bicep, and Pulumi as the dominant cloud IaC tools and identify the security benefits of declarative, reviewable, version-controlled infrastructure.
- Apply IaC security scanning: tfsec, Checkov, KICS, or cfn-nag in CI to catch insecure configurations before deploy.
- Analyze a Terraform module that creates an S3 bucket with default ACLs and identify the specific changes needed for a secure baseline (block public access, encryption, logging, versioning).
Cloud-Native Secret Management
- Identify common patterns for delivering secrets to cloud workloads: KMS-encrypted env vars, secret managers + IAM, and OIDC-federated short-lived credentials.
- Apply secret-zero patterns: avoid the chicken-and-egg of 'how do I authenticate to the secret store?' by using workload identity / instance metadata.
CI/CD to Cloud Authentication
- Identify GitHub OIDC, GitLab OIDC, and CircleCI OIDC federation as the modern alternatives to long-lived access keys for CI/CD-to-cloud authentication.
- Apply OIDC federation: configure cloud trust to a specific repo/branch/workflow with scoped role permissions, and remove static access keys.
- Analyze a CI pipeline that uses a long-lived access key stored in repository secrets and propose the OIDC migration steps.
Cloud Account Structure
- Identify cloud organization patterns: AWS Organizations + OUs, Azure management groups, GCP folders/projects, and the security benefit of multi-account/subscription/project boundaries.
- Apply landing-zone patterns: separate accounts for production / non-production / log-archive / security / shared-services with SCPs / Azure Policy / org policies preventing cross-boundary blast.
- Analyze a 'one big AWS account with everything in it' scenario and propose a multi-account migration sequence with quantified blast-radius reduction.
Cost-Aware Security and Backups
- Identify the security relevance of backups (ransomware recovery), versioning, MFA-Delete on object storage, and immutable / object-lock storage.
- Apply 3-2-1 backup principles in a cloud context: production data + cross-region copy + cross-account/immutable copy with restoration tested at least annually.
Tenant Isolation in Multi-Tenant Cloud
- Identify tenant-isolation patterns: silo (separate account per tenant), pool (shared infrastructure with policy-enforced separation), and bridge (mixed) — and identify their trade-offs.
- Apply ABAC tags + IAM conditions to enforce tenant isolation in pool-model multi-tenant deployments.
- Analyze a leaked-bucket-policy scenario in a multi-tenant SaaS where bucket policies omit a tenant condition and propose detection and prevention controls.
Cloud Incident Response
- Identify cloud-native IR primitives: snapshot-and-quarantine for compromised VMs, IAM credential rotation, role-trust review, and forensic copy via cloud APIs.
- Apply a cloud IR playbook for 'compromised IAM access key' that includes immediate revocation, scope-of-impact analysis from CloudTrail, and key-creator review.
- Analyze a credential-leak scenario where developer credentials were accidentally pushed to GitHub and trace each remediation step in time-sensitive order.
Cloud Cryptographic Boundaries
- Identify Cloud HSM offerings (AWS CloudHSM, Azure Dedicated HSM, GCP Cloud HSM) and identify when single-tenant HSMs are required (FIPS 140-2/3 high-assurance, regulatory mandates).
- Apply Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK) patterns and analyze the operational cost vs. control trade-off vs. provider-managed keys.
Exam Structure
Question Types
- Multiple Choice
- Multiple Response
What's Included in AccelaStudy® AI
Adaptive Knowledge Graph
Practice Questions
Lesson Modules
Console Simulator Labs
Exam Tips & Strategy
72 Activity Formats
Scope
Included Topics
- Shared responsibility model across IaaS, PaaS, SaaS and the three major cloud providers.
- Cloud IAM: roles, policies, service principals, workload identity, and least-privilege design.
- Encryption: KMS-managed keys, customer-managed keys (CMK), envelope encryption, at-rest and in-transit defaults.
- Cloud network security: VPCs/VNets, security groups, NSGs, private endpoints, NAT/egress controls.
- Cloud-native logging and monitoring: CloudTrail, Activity Logs, Audit Logs, GuardDuty, Defender, SCC.
- Posture management (CSPM): Security Hub, Defender for Cloud, SCC, Prowler, ScoutSuite.
- Common cloud misconfigurations: public S3 buckets, overly permissive roles, exposed metadata, default secrets.
- Compliance and benchmarks: CIS benchmarks, Well-Architected security pillar, FedRAMP/PCI-DSS in cloud context.
- Container and Kubernetes security at conceptual depth: workload identity, network policies, image scanning.
Not Covered
- Vendor-specific certification depth (covered in CSP-specific specs).
- Detailed Kubernetes security (covered in CKS).
- Deep packet inspection and traditional perimeter NGFW configuration.
Start Cloud Security Fundamentals — free
Adaptive learning that maps what you already know and closes the gaps.
No credit card, no trial clock, no paywall.