UAB - CS 443 - 643 - 743 - CLOUD SECURITY - MIDTERM EXAM - FALL
STUDYGUIDE QUESTIONS AND CORRECT ANSWERS
Question:
1. What is Cloud Computing
Answer:
A computing model that outsources data storage and computation to shared, on-demand
infrastructure provided by third parties.
Question:
2. What is Spoofing in Stride, what are mitigation strategies?
Answer:
Pretending to be another user/system to gain access; Mitigations: MFA, strong auth, certificates,
secure session handling, unique credentials
Question:
3. INtel SGX Architecture
Answer:
Offers fine grained secure enclaves, providing strong isolation with limited memory capacity at
the user level.
Question:
4. ARM Trustzone partitioning
Answer:
ARM TrustZone partitions systems into Secure and Normal worlds at the hardware level
protecting trusted operations from untrusted code, ideal for mobile and embedded device
security.
Question:
5. How to choose a TEE, plus what are the three TEE
Answer:
Choosing a TEE depends on application needs, platform compatibility, and performance
requirements for secure solutions. Intel SGX Architecture AMD SEV ARM TrustZone Partioning
Question:
6. AMD SEV-ES and SEV-SNP additions to base SEV
Answer:
ES - Add CPU register encryption SNP - memory integrity protection to enhance security on top of
base SEV default encryption.
Question:
7. What is runtime attestation for remote computations
Answer:
,Runtime attestation verifies the integrity of a system while computations are executing, ensuring
the code running in the cloud matches an expected trusted version. It uses cryptographic
challenge-response protocols or secure hardware (e.g., TPM or TEE) to detect any modifications
at runtime
Question:
8. What is Tampering in Stride, tion strategies?
Answer:
Unauthorized modification of data/code/configs; Mitigations: hashing, digital signatures,
encryption, input validation, secure updates
Question:
9. What is Repudiation in STRIDE, what are mitigation strategies? (4)
Answer:
denying an action due to weak/no evidence; Mitigations: tamper-evident logs, timestamps, digital
signatures, non-repudiation
Question:
10. What is Information Disclosure in STRIDE, what are mitigation strategies?
Answer:
Exposing sensitive data to unauthorized parties; Mitigations: encrypt at rest/in transit, access
control, masking, least privilege, patching
Question:
11. What is Denial of Service (DoS) in STRIDE, what are mitigation strategies?
Answer:
Exhausting resources to make a service unavailable; Mitigations: rate limiting, quotas, load
balancing, redundancy, anomaly detection user’admin);
Question:
12. What is Elevation of Privilege in STRIDE, what are mitigation strategies?
Answer:
Gaining higher permissions than intended (e.g., Mitigations: least privilege, RBAC, patching,
sandboxing, privilege separation
Question:
13. Explain how TPM and Secure Boot work together to prevent unauthotion. Why is this
critical in a multi-tenant cloud environment?
Answer:
Secure Boot ensures only trusted, signed software runs during startup. The TPM records and
verifies these components to confirm the system hasn't been tampered with. Together, they
block unauthorized code from loading. trusted, preventing one tenant or insider from
compromising others.
Question:
, 14. Advantages of Cloud Computing for consumers (3) and providers (1)
Answer:
Consumers: No upfront commitment for buying/leasing hardware Can scale usage according to
demand Barriers to entry lowered for startups Providers Increased utilization of datacenter
resources
Question:
15. In cloud computing, what is meant by "X as a Service"?
Answer:
The abstraction of a resource (infrastructure, platform, or software) into a managed, on-demand
service delivered over the internet.
Question:
16. What are the primary security concerns associated with cloud computing? (4)
Answer:
Confidentiality, Integrity, Availability, and Privacy (the CIA triad plus privacy).
Question:
17. What does co-tenancy mean in a cloud environment?
Answer:
Multiple independent users sharing the same physical infrastructure, often on the same host
machine.
Question:
18. Why does co-tenancy make cloud security different security?
Answer:
Because malicious users can legally share the same infrastructure, increasing risks like
side-channel or data-leakage attacks.
Question:
19. What is a "black box" problem in cloud security?
Answer:
Users have limited visibility or control over how the cloud provider handles data internally.
Question:
20. The three pillars for the CIA Triad.
Answer:
Confidentiality (preventing unauthorized access) Integrity (preventing tampering) Availability
(ensuring access when needed).
Question:
21. What are common authentication factors? (4)
Answer:
STUDYGUIDE QUESTIONS AND CORRECT ANSWERS
Question:
1. What is Cloud Computing
Answer:
A computing model that outsources data storage and computation to shared, on-demand
infrastructure provided by third parties.
Question:
2. What is Spoofing in Stride, what are mitigation strategies?
Answer:
Pretending to be another user/system to gain access; Mitigations: MFA, strong auth, certificates,
secure session handling, unique credentials
Question:
3. INtel SGX Architecture
Answer:
Offers fine grained secure enclaves, providing strong isolation with limited memory capacity at
the user level.
Question:
4. ARM Trustzone partitioning
Answer:
ARM TrustZone partitions systems into Secure and Normal worlds at the hardware level
protecting trusted operations from untrusted code, ideal for mobile and embedded device
security.
Question:
5. How to choose a TEE, plus what are the three TEE
Answer:
Choosing a TEE depends on application needs, platform compatibility, and performance
requirements for secure solutions. Intel SGX Architecture AMD SEV ARM TrustZone Partioning
Question:
6. AMD SEV-ES and SEV-SNP additions to base SEV
Answer:
ES - Add CPU register encryption SNP - memory integrity protection to enhance security on top of
base SEV default encryption.
Question:
7. What is runtime attestation for remote computations
Answer:
,Runtime attestation verifies the integrity of a system while computations are executing, ensuring
the code running in the cloud matches an expected trusted version. It uses cryptographic
challenge-response protocols or secure hardware (e.g., TPM or TEE) to detect any modifications
at runtime
Question:
8. What is Tampering in Stride, tion strategies?
Answer:
Unauthorized modification of data/code/configs; Mitigations: hashing, digital signatures,
encryption, input validation, secure updates
Question:
9. What is Repudiation in STRIDE, what are mitigation strategies? (4)
Answer:
denying an action due to weak/no evidence; Mitigations: tamper-evident logs, timestamps, digital
signatures, non-repudiation
Question:
10. What is Information Disclosure in STRIDE, what are mitigation strategies?
Answer:
Exposing sensitive data to unauthorized parties; Mitigations: encrypt at rest/in transit, access
control, masking, least privilege, patching
Question:
11. What is Denial of Service (DoS) in STRIDE, what are mitigation strategies?
Answer:
Exhausting resources to make a service unavailable; Mitigations: rate limiting, quotas, load
balancing, redundancy, anomaly detection user’admin);
Question:
12. What is Elevation of Privilege in STRIDE, what are mitigation strategies?
Answer:
Gaining higher permissions than intended (e.g., Mitigations: least privilege, RBAC, patching,
sandboxing, privilege separation
Question:
13. Explain how TPM and Secure Boot work together to prevent unauthotion. Why is this
critical in a multi-tenant cloud environment?
Answer:
Secure Boot ensures only trusted, signed software runs during startup. The TPM records and
verifies these components to confirm the system hasn't been tampered with. Together, they
block unauthorized code from loading. trusted, preventing one tenant or insider from
compromising others.
Question:
, 14. Advantages of Cloud Computing for consumers (3) and providers (1)
Answer:
Consumers: No upfront commitment for buying/leasing hardware Can scale usage according to
demand Barriers to entry lowered for startups Providers Increased utilization of datacenter
resources
Question:
15. In cloud computing, what is meant by "X as a Service"?
Answer:
The abstraction of a resource (infrastructure, platform, or software) into a managed, on-demand
service delivered over the internet.
Question:
16. What are the primary security concerns associated with cloud computing? (4)
Answer:
Confidentiality, Integrity, Availability, and Privacy (the CIA triad plus privacy).
Question:
17. What does co-tenancy mean in a cloud environment?
Answer:
Multiple independent users sharing the same physical infrastructure, often on the same host
machine.
Question:
18. Why does co-tenancy make cloud security different security?
Answer:
Because malicious users can legally share the same infrastructure, increasing risks like
side-channel or data-leakage attacks.
Question:
19. What is a "black box" problem in cloud security?
Answer:
Users have limited visibility or control over how the cloud provider handles data internally.
Question:
20. The three pillars for the CIA Triad.
Answer:
Confidentiality (preventing unauthorized access) Integrity (preventing tampering) Availability
(ensuring access when needed).
Question:
21. What are common authentication factors? (4)
Answer:
