CSI Self-assessment

Cloud Security: Knowledge and Practical Application Check

This short questionnaire is designed to help you pause and reflect on how you understand and approach cloud computing and cloud security in everyday, real-world situations.

As you answer the questions, think about the kinds of decisions an SME, trainer, or learner may need to make when using cloud services. Some questions may feel familiar, while others may make you pause and think a little more deeply - and that is exactly the point. This is not about getting everything right or wrong, but about recognising what you already know and identifying areas you may want to explore further.

Take your time, trust your first instinct and answer honestly. The aim is not to test you, but to support your learning and help you build greater confidence in cloud security.

Cloud Security for SMEs

An SME wants full control over the operating system and applications it uses, but doesn’t want to manage any physical hardware. Which cloud service model is most suitable for their needs?

Software as a Service (SaaS)

Platform as a Service (PaaS)

Infrastructure as a Service (IaaS)

Traditional On-Premises Infrastructure (no cloud)

None

In the context of cloud security’s shared responsibility, which of the following is the SME (cloud customer) responsible for (and NOT the cloud provider)?

Physically guarding the data center facilities where the servers are located.

Ensuring their users have strong passwords and multi-factor authentication.

Patching and securing the underlying hypervisor that runs virtual machines.

Keeping the cloud service available by adding redundancy to the provider’s network

None

Which characteristic of cloud computing allows an SME to increase storage or computing power during busy periods and reduce it when demand drops?

Resource pooling

Measured service

Scalability and rapid elasticity

Broad network access

None

Threat Landscape & SME Challenges

A cloud service provider encrypts customer data but stores the encryption keys in a shared location accessible to multiple users. Which CIA principle is at risk?

Integrity

Availability

Confidentiality

Resilience

None

Using personal cloud storage for work files is risky because

it decreases productivity.

it increases shadow IT and data leakage.

it contributes to redundancy.

it improves data governance.

None

What is the best strategy to safeguard cloud systems from ransomware attacks?

Turning off software updates.

Maintaining regular data backups.

Paying ransom quickly to regain access to files.

Depending only on antivirus tools for protection.

None

Designing Secure Cloud

What is the main principle of Zero Trust in cloud environments?

Trust all internal users by default

“Never trust, always verify”

Only encrypt sensitive data at rest

Grant full access to cloud services

None

In cloud IAM, Role-Based Access Control (RBAC) assigns permissions based on:

User attributes, device, and location

Predefined roles within the cloud service

Random assignment

Time of Day

None

Which of the following is true about Security Information and Event Management (SIEM)?

It replaces the need for MFA

It is only used for endpoint antivirus

It is used exclusively for physical security

It collects, correlates, and analyses logs for threat detection

None

Cloud Security Governance

Which of the following best describes Cloud Security Governance?

Installing antivirus software on every cloud server

A structured approach to managing cloud risks, compliance and security policies

Outsourcing all IT functions to a cloud provider

Using multiple passwords to secure cloud accounts

None

A company stores client data in a cloud application. Which governance control is MOST important to ensure that data remains accessible and unchanged during disruptions?

Using strong passwords

Regular backups and testing recovery procedures

Only allowing staff to work from the office

Buying more storage capacity

None

Your SME experiences a simulated attack where an employee’s credentials are compromised. Which governance approach would help the organisation respond effectively and prevent similar incidents?

Relying on the cloud provider to fix the issue

Resetting the employee’s password and continuing operations

Having a documented incident response plan with defined roles, escalation steps, and post-incident review

Ignoring the incident because no data was lost

None

Capacity Building for VET Providers

The capacity building process emphasizes the need to shift assessment and evaluation methods away from purely theoretical approaches toward which types of techniques?

Assessment methods that primarily measure the memorization of definitions and laws.

Techniques that prioritize the demonstration of practical hands on abilities to measure the acquisition of practical cloud security competencies.

Standardized written exams to ensure uniformity of assessment among different VET educators.

Self-assessment questionnaires compiled exclusively by industry experts.

None

The primary goal of establishing lasting partnerships with industry and SMEs (Building Partnerships with Industry and SMEs) is to create continuous feedback loops and generate opportunities for practical exposure (internships, real-world projects) for students, ensuring that the training is aligned with current industry best practices

True

False

None

Which combination of innovative pedagogical strategy and learner profiling element is mentioned as key to making the complex subject of cloud security engaging and effective while simultaneously tailoring the content?

Use of standard frontal lectures and analysis of the learner's professional background.

Innovative methodologies (such as scenario-based learning or gamification) and content tailoring to diverse learner backgrounds (from IT novices to experienced professionals).

Complex theoretical exams and the classification of SMEs based on their size.

Developing in-house peer mentoring programs and assigning a full-time Data Protection Officer (DPO) to every student.

None