[NEW] Certificate of Cloud Security Knowledge v.5 [2026]

Cloud Data Protection (20%) Topics: Encryption at rest and in transit, Key management services, Data classification and tokenization

Identity and Access Management (IAM) (20%) Topics: Zero Trust principles for cloud, Federated authentication and SSO, Privileged access management in cloud

learn 1z0 997 26 oracle cloud infrastructure architect pro exam Security (20%) Topics: Network segmentation and micro-segmentation, Container and serverless hardening, Security automation and DevSecOps pipelines

Incident Response & Compliance (20%) Topics: Logging, monitoring, and threat detection, Cloud incident response lifecycle, Regulatory requirements (e.g., GDPR, HIPAA) in cloud

B. The consumer is solely responsible for physical security, hypervisor patching, and network routing.

C. The cloud provider manages the underlying infrastructure and operating system, while the consumer secures the application code and data.

D. Security responsibilities are completely transferred to a third-party managed security service provider.

E. The consumer secures the hardware and hypervisor, and the cloud provider secures the data layer.

F. The cloud provider manages the application code, and the consumer manages the identity and access management.

Correct Answer: C

Overall Explanation: In a PaaS shared responsibility model, the cloud service provider handles the physical infrastructure, virtualization, network, and operating system. The consumer focuses on the top layers, specifically securing their deployed application code and the data processing within it.

Why B is incorrect: The provider handles physical security and hypervisor patching, not the consumer.

Why D is incorrect: Responsibility cannot be fully completely transferred. The shared responsibility model always applies between provider and consumer.

Why E is incorrect: This is the exact opposite of how cloud service models work. The provider always owns physical hardware.

Why F is incorrect: In PaaS, the consumer owns the application code, not the provider.

B. Tokenization reduces the scope of compliance audits by replacing sensitive data with a non-sensitive equivalent that has no exploitable mathematical relationship to the original data.

C. Tokenization allows the cloud provider to directly index and search the original plaintext data without needing the encryption key.

D. Tokenization uses asymmetric key pairs which are significantly faster to process than symmetric encryption algorithms.

E. Tokenization automatically routes data through micro-segmented networks to prevent interception in transit.

F. Tokenization ensures that data is automatically replicated across multiple geographic zones for disaster recovery.

Correct Answer: B

Overall Explanation: Tokenization swaps sensitive data (like credit card numbers) with a random string of characters (a token). Because the token is mathematically unrelated to the original data, it cannot be decrypted. This drastically reduces the scope of compliance (like PCI-DSS) because the systems handling the tokens are not processing actual sensitive data.

Why C is incorrect: If the provider can see the plaintext data, the security mechanism is defeated. Tokenization specifically prevents this.

Why D is incorrect: Tokenization is not an encryption algorithm. It uses a database lookup (vault) rather than mathematical keys.

Why E is incorrect: Network routing and micro-segmentation are infrastructure security controls, unrelated to data tokenization mechanisms.

Why F is incorrect: Replication and disaster recovery are availability controls, whereas tokenization is a confidentiality control.

B. Relying entirely on static IP address filtering to establish trust between internal microservices.

C. Requiring continuous authentication and authorization for every single request, regardless of network location.

D. Utilizing a single shared service account for all administrative users to streamline logging.

E. Bypassing identity checks for internal traffic to reduce latency in DevSecOps pipelines.

F. Disabling federation to ensure all users maintain separate, isolated passwords for every microservice.

Correct Answer: C

Overall Explanation: The core philosophy of Zero Trust is "never trust, always verify." It assumes the network is already compromised. Therefore, trust is never granted based on network location (inside vs. outside). Every single request must be individually authenticated, authorized, and encrypted.

Why B is incorrect: IP addresses can be spoofed and change frequently in cloud environments. Zero trust relies on strong identity, not network location.

Why D is incorrect: Shared accounts destroy individual accountability and violate the principle of least privilege.

Why E is incorrect: Bypassing security checks for performance directly contradicts the Zero Trust model.

Why F is incorrect: Federated authentication and Single Sign-On (SSO) are actually foundational to Zero Trust, as they allow centralized, strong policy enforcement rather than managing scattered passwords.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app