Free 312-40 practice test: 30 questions with answers

Rapid elasticity means capacity is provisioned and released automatically to match demand, which is exactly what the scenario asks for. Resource pooling describes sharing provider resources among consumers, broad network access describes availability over standard networks, and multi-tenant hardware sharing is an implementation pattern rather than an essential characteristic.

A private cloud is provisioned for exclusive use by a single organization, whether that organization or a third party runs it. A public cloud is open to the general public, a community cloud serves a defined group with shared concerns, and a hybrid cloud combines two or more distinct models.

A community cloud serves a defined group of organizations that share a mission, regulatory obligations or security concerns, which matches the consortium. A public cloud is open to any customer, a private cloud serves only one organization, and a hybrid cloud combines distinct models instead of defining a shared group.

PaaS gives customers a managed runtime and development platform, and the customer is responsible for the applications and data it deploys on top. Delivering finished applications describes SaaS, renting bare physical servers is not a standard cloud service model, and a dedicated facility describes a deployment choice rather than a service model.

Software as a Service delivers a complete application that users access through a browser, while the provider handles the software, servers and patching. Infrastructure and platform models leave application or OS management with the customer, and desktop as a service delivers virtual desktops rather than an email application.

Resource pooling means the provider serves multiple consumers from a shared set of resources that are assigned and reassigned dynamically. Broad network access concerns availability over standard networks, measured service concerns metering and billing, and on-demand self-service concerns provisioning without human interaction with the provider.

Availability zones are isolated locations inside a region that help protect workloads from a single facility failure, and hybrid cloud joins private and public environments through standardized, portable technology. A region is made up of several zones rather than one building, and multi-tenancy means shared infrastructure, the opposite of dedicated hardware.

Containers package an application with its dependencies and share the host operating system kernel, which makes them lighter than virtual machines. Full guest operating systems per instance describe virtual machines, dedicated servers provide isolation without sharing, and object storage holds data rather than running services.

Under the shared responsibility model, the customer remains responsible for its data, access decisions and encryption configuration even when the provider manages the engine and hardware. The provider's responsibility covers the platform, the shared responsibility model does define a boundary, and network carriers are not part of the customer's contract.

In IaaS the customer manages the guest operating system, its patches and its configuration, while the provider secures the facility, host hardware and hypervisor. Building security, disk replacement and hypervisor maintenance all belong to the provider in this model.

With SaaS the provider manages the application code and infrastructure, but the customer still controls who has accounts, what roles they hold and how they authenticate. Patching code, drive replacement and hypervisor maintenance are all provider duties in a SaaS model.

Customers decide which identities exist and what each one may do with their own resources, even though the provider supplies the IAM service. Treating IAM as wholly the provider's job or as irrelevant in the cloud misunderstands where the boundary sits.

Access policies are configuration choices made by the customer, so the customer is accountable for correcting a public exposure caused by those settings. The provider secures the service itself, while auditors and end users do not control the account's configuration.

Under PaaS the customer still owns its application code, the data it processes and the access rules around that data, while the provider manages the runtime and underlying platform. Cooling, firmware and cabling are facility or hardware duties that stay with the provider in every service model.

In IaaS the customer manages the guest operating system and the encryption and key configuration for its data. Physical rack access and hypervisor patching remain with the provider, so those options are wrong even though they sound like security tasks.

In a FaaS model the customer still owns the function code, its configuration and the identity permissions attached to it. The facility, hypervisor and host hardware remain with the provider even though the customer deploys code on that platform.

NIST SP 800-145 defines cloud computing, its essential characteristics, deployment models and service models. SP 800-53 is a catalog of security and privacy controls, SP 800-37 describes the risk management framework, and SP 800-171 covers protection of controlled unclassified information.

ISO/IEC 27017 is the code of practice for information security controls for cloud services and extends ISO/IEC 27002 with cloud-specific guidance. ISO/IEC 27001 specifies management system requirements, 27018 focuses on protecting personal data in public clouds, and 27035 covers incident management.

ISO/IEC 27018 is the cloud standard that addresses protection of PII in public clouds acting as processors. The other three standards cover general cloud controls, the management system itself and incident handling, so none is focused on PII in public cloud services.

CIS Benchmarks are consensus-based configuration guidelines that give step-by-step hardening settings for operating systems and cloud platforms. The Cloud Controls Matrix maps control objectives rather than settings, a SOC 2 report is an attestation of controls, and SP 800-145 defines cloud concepts.

The Cloud Controls Matrix is a control framework that maps cloud-specific security controls to many standards and regulations, which helps assess a provider's posture. Scripts, physical certification and model definitions are provided by other resources, not by the matrix.

A SOC 2 Type II report covers the operating effectiveness of controls over a period, which shows they worked over time. A Type I report only describes design at a single point in time, while an ISO certificate and an SP 800-145 summary do not provide period-based operating evidence.

ISO/IEC 27001 specifies requirements for an information security management system and can be certified by accredited bodies. It is not a server hardening guide, and breach notification deadlines come from privacy law such as GDPR rather than from this standard.

Under GDPR the controller determines the purposes and means of processing, which describes this company. The provider acts as the processor, the data subjects are the individuals whose data is held, and a supervisory authority is the regulator.

GDPR requires a processor to notify the controller without undue delay once it becomes aware of a personal data breach, and the controller then handles regulator and individual notifications. Direct regulator notice by the processor, individual notice first, or waiting for the controller are not the required first step.

A legal hold stops relevant data from being deleted once litigation is reasonably anticipated, and a documented chain of custody shows who handled the evidence. Undocumented exports, deleting records or editing timestamps would all weaken admissibility.

Data residency requires that data be stored in a specified geographic location, which is what the regulator demands. Data minimization limits how much data is collected, pseudonymization replaces identifiers, and least privilege restricts access rights, and none of these addresses where data is physically stored.

HIPAA sets privacy and security rules for protected health information held by covered entities and business associates. Sarbanes-Oxley covers financial reporting controls, Gramm-Leach-Bliley covers financial institutions, and PCI DSS is an industry standard for payment card data rather than a law.

Right-to-audit clauses and independent attestation reports give the customer ways to check that controls exist and operate. Relying on marketing claims or disabling logs does nothing to verify controls and would weaken the customer's own oversight.

Using a compliant provider does not transfer the merchant's obligations, because the company remains accountable for its cardholder data environment. The provider's compliance covers only the parts of the environment it manages, and PCI DSS applies to merchants as well as processors and to cloud workloads.