4.4 - Cloud security tools (DLP, secrets, scanning)
Cloud+ CV0-004 objective 4.4 covers tools that enforce cloud security. Data loss prevention (DLP) detects and blocks sensitive data, such as card numbers, from leaving the organisation over email, uploads or copies. A secrets manager securely stores and rotates API keys, passwords and tokens for applications, so credentials are never hard-coded. Micro-segmentation splits a network into small isolated zones so a breach in one cannot spread, applied down to individual workloads. Vulnerability scanning regularly scans cloud images and running hosts for known CVEs so you can patch before attackers exploit them. You should also know posture management (CSPM), WAFs, endpoint protection and image hardening. Expect scenario questions that describe blocking sensitive data exfiltration, storing and rotating credentials, isolating workloads, or finding known flaws, and ask which security tool - DLP, secrets manager, micro-segmentation or vulnerability scanning - fits.
Block sensitive data from leaving = DLP. Store + rotate API keys/passwords/tokens = secrets manager. Isolate down to each workload = micro-segmentation. Regularly scan images/hosts for CVEs = vulnerability scanning.
Practice questions
1. Which service securely stores and rotates API keys, passwords and tokens for applications?
- Bastion host
- Secrets manager (correct answer)
- Object bucket
- Load balancer
A secrets manager (vault) stores credentials encrypted, controls access via IAM, audits usage and rotates secrets automatically - avoiding hard-coded keys.
2. Splitting a network into small isolated zones so a breach in one cannot spread is called:
- Load balancing
- Micro-segmentation (correct answer)
- Port forwarding
- Link aggregation
Micro-segmentation places fine-grained policy boundaries between workloads so lateral movement is blocked if one is compromised. It is a core zero-trust technique.
3. A tool that detects and blocks sensitive data such as card numbers from leaving the organization is:
- WAF
- DLP (correct answer)
- IDS
- CDN
DLP (data loss prevention) inspects content in email, uploads and storage to stop sensitive data exfiltration. A WAF protects web apps; an IDS only detects intrusions.
4. Regularly scanning cloud images and running hosts for known CVEs is called:
- Vulnerability scanning (correct answer)
- Active penetration testing
- Stress load testing
- Input fuzzing
Vulnerability scanning checks systems against a database of known CVEs to flag missing patches and misconfigurations. Penetration testing goes further by actively exploiting weaknesses.
5. Hard-coding a database password in application source code is risky mainly because it:
- Slows the whole build process
- Breaks the language compiler
- Exposes it in version control (correct answer)
- Uses more runtime memory
A hard-coded secret leaks into version control history and every copy of the repo, where it can be scraped by attackers. Store secrets in a vault and inject them at runtime instead.
6. A structured program to find, prioritize and remediate CVEs across cloud assets is:
- Peak load testing
- Chaos fault testing
- Active penetration testing
- Vulnerability management (correct answer)
Vulnerability management is the ongoing cycle of discovering, ranking and fixing weaknesses across assets, using scanners and CVSS. A penetration test is a point-in-time exploitation exercise.