📘CompTIA Security+ (SY0-701)
This topic focuses on how cloud environments are secured, where security controls are deployed, and how security rules (policies) are created and enforced.
For the exam, you must clearly understand what security tools exist, how they are deployed, and how policies control access and behavior in the cloud.
I will explain everything in simple English, using IT-based examples, so even non-IT learners can follow.
1. Why Cloud Security Capabilities Are Needed
Cloud environments are different from traditional on-premises networks because:
- Resources are shared
- Systems are internet-accessible
- Infrastructure changes dynamically
- Users access resources from any location
Because of this, cloud platforms provide built-in and add-on security capabilities to protect:
- Users and identities
- Networks and traffic
- Applications
- Data
- Configurations and compliance
2. Cloud Security Capabilities
Cloud security capabilities are tools and features used to protect cloud environments.
2.1 Identity and Access Management (IAM)
IAM is the most important security capability in the cloud.
Purpose:
Controls who can access cloud resources and what actions they can perform.
Key IAM concepts:
- Users
- Groups
- Roles
- Permissions
- Policies
How it works in IT terms:
- A user logs into a cloud portal
- IAM checks their identity
- IAM checks assigned permissions
- Access is allowed or denied
IAM security features:
- Multi-Factor Authentication (MFA)
- Role-Based Access Control (RBAC)
- Least privilege access
- Temporary credentials
Exam focus:
IAM replaces traditional username/password security with centralized identity control.
2.2 Network Security Capabilities
These protect network traffic inside and outside the cloud.
a. Security Groups / Network Security Groups
- Virtual firewalls
- Control inbound and outbound traffic
- Applied to cloud resources like virtual machines
Example (IT-based):
- Allow HTTPS traffic
- Block all other ports
b. Cloud Firewalls
- Protect internet-facing workloads
- Stateful inspection
- Can filter traffic by IP, port, and protocol
c. Web Application Firewall (WAF)
- Protects web applications
- Blocks attacks like:
- SQL injection
- Cross-site scripting (XSS)
- Works at Layer 7 (application layer)
d. Virtual Private Cloud (VPC) / Virtual Network
- Isolated cloud network
- Controls routing and segmentation
- Similar to a private network in a data center
2.3 Data Security Capabilities
These protect data at rest, in transit, and in use.
a. Encryption
- Data at rest (storage)
- Data in transit (TLS/HTTPS)
- Data in backups and snapshots
Key concept:
Even if someone accesses the data, they cannot read it without encryption keys.
b. Key Management Services (KMS)
- Manage encryption keys
- Rotate keys automatically
- Control key usage
c. Data Loss Prevention (DLP)
- Detects sensitive data
- Prevents unauthorized sharing
- Enforces data handling rules
2.4 Workload and Application Security
Protects virtual machines, containers, and applications.
a. Host-based Security
- Antivirus
- Host firewalls
- Integrity monitoring
b. Container Security
- Image scanning
- Runtime protection
- Secure container registries
c. Application Security
- Secure APIs
- Authentication tokens
- Secrets management
2.5 Monitoring, Logging, and Threat Detection
These capabilities provide visibility and alerting.
a. Logging
- Records user activity
- Records API calls
- Records configuration changes
b. Security Information and Event Management (SIEM)
- Centralizes logs
- Detects suspicious behavior
- Generates alerts
c. Cloud Security Posture Management (CSPM)
- Detects misconfigurations
- Checks compliance with standards
- Alerts on risky settings
3. Cloud Security Deployment Models
Deployment models describe where security controls are placed and managed.
3.1 Provider-Managed Security
- Security tools are built into the cloud platform
- Managed entirely by the cloud provider
Examples:
- IAM
- Native firewalls
- Logging services
Advantages:
- Easy to use
- Automatically updated
- Integrated with cloud services
Exam tip:
Most cloud security starts with provider-managed tools.
3.2 Customer-Managed Security
- Customer installs and manages security tools
- Runs on cloud infrastructure
Examples:
- Virtual firewalls
- IDS/IPS appliances
- Third-party security agents
Advantages:
- More control
- Custom configurations
Disadvantages:
- Requires maintenance
- Requires expertise
3.3 Hybrid Security Deployment
- Combination of:
- Cloud-native security
- Third-party security tools
- Very common in enterprises
Exam focus:
Hybrid deployment balances simplicity and control.
3.4 Shared Responsibility Model (Security Deployment View)
Security responsibility is shared:
| Area | Cloud Provider | Customer |
|---|---|---|
| Physical data centers | ✔ | ✖ |
| Cloud infrastructure | ✔ | ✖ |
| OS & applications | ✖ | ✔ |
| Data | ✖ | ✔ |
| Access control | ✖ | ✔ |
Important exam rule:
Customers are always responsible for data and access security.
4. Policy Management in the Cloud
Policy management defines rules that control security behavior.
4.1 What Is a Security Policy?
A security policy is a set of rules that define:
- Who can access resources
- What actions are allowed
- Under what conditions
Policies are:
- Written in JSON or similar formats
- Evaluated automatically
- Enforced by the cloud platform
4.2 Identity Policies
Used in IAM.
Define:
- Who can access what
- Read, write, delete permissions
- Time-based or condition-based access
Example (conceptual):
- User can read storage
- User cannot delete storage
4.3 Resource Policies
Attached directly to resources.
Control:
- Which users or services can access a resource
- Cross-account access
4.4 Network Policies
Control network behavior.
Examples:
- Firewall rules
- Security group rules
- Routing policies
4.5 Compliance and Governance Policies
Ensure environments follow security standards.
Functions:
- Enforce encryption
- Prevent public exposure
- Detect non-compliant resources
Used for:
- Regulatory compliance
- Security baselines
- Auditing
4.6 Policy Enforcement and Automation
Policies can:
- Block actions automatically
- Alert administrators
- Fix issues automatically
Key concept:
Security becomes automatic and consistent, not manual.
5. Exam Key Takeaways (Must Remember)
✔ Cloud security uses built-in and third-party capabilities
✔ IAM is the foundation of cloud security
✔ Security can be provider-managed, customer-managed, or hybrid
✔ Policies control access, behavior, and compliance
✔ Customers are always responsible for data and identity security
✔ Automation is critical for large cloud environments
6. One-Line Exam Summary
Cloud security is achieved by combining identity control, network protection, data encryption, monitoring, and policy-based management using provider-native and customer-managed tools.
