Cloud+: Security & Compliance CompTIA CV0-004 Study Guide

Core Concepts

Eight essential security and compliance areas for Cloud+ CV0-004 Domain 3.

1. Shared Responsibility Model

Cloud provider responsibility: physical security, hypervisor, global network, managed service patches
Customer responsibility varies by service model:
- IaaS: OS patches, application security, data encryption, IAM configuration
- PaaS: application security, data, IAM
- SaaS: user access management, data classification, configuration
Common misunderstanding: "cloud is secure" — providers secure OF the cloud; customers secure IN the cloud
Shared controls: patch management (provider patches infrastructure; customer patches OS/apps), configuration management, awareness training

The division of responsibility shifts as you move from IaaS to SaaS — less customer control, less customer responsibility.

2. Identity and Access Management (IAM)

Principle of least privilege: grant only minimum permissions needed — reduce blast radius of compromised credentials
IAM components (AWS model): Users, Groups, Roles, Policies (JSON permission documents)
Role-based access control (RBAC): assign permissions to roles, assign roles to users — easier management than per-user permissions
Attribute-based access control (ABAC): permissions based on tags/attributes — more dynamic, scales better
Multi-factor authentication (MFA): require second factor (TOTP, hardware key) — critical for all privileged accounts and root/admin
Service accounts / Managed identities: machine identities for applications — avoid storing credentials in code; use managed identity to authenticate to cloud services
Federation: use existing identity provider (Active Directory, Okta, Google) via SAML 2.0 or OIDC — single sign-on across cloud and on-premises
Privileged Access Management (PAM): extra controls for admin/root access — just-in-time access, session recording, approval workflows

3. Encryption

Encryption at rest: protect stored data — AES-256 standard. Provider-managed keys (SSE-S3), customer-managed keys (SSE-KMS / Azure Key Vault), customer-provided keys (SSE-C)
Encryption in transit: protect data moving over network — TLS 1.2+ for all services; enforce HTTPS, disable HTTP
Key management: AWS KMS, Azure Key Vault, GCP Cloud KMS — centralized key creation, rotation, and access control
Key rotation: automatically rotate encryption keys on schedule — reduces impact of key compromise
Certificate management: ACM (AWS Certificate Manager), Azure App Service certificates — automate TLS cert provisioning and renewal
Hardware Security Module (HSM): dedicated hardware for key storage — AWS CloudHSM, Azure Dedicated HSM — FIPS 140-2 Level 3 compliance

4. Vulnerability Management

Vulnerability scanning: automated tools scan resources for known CVEs — AWS Inspector, Azure Defender, Qualys, Nessus
Patch management: timely application of OS and software patches — cloud SSM Patch Manager (AWS), Azure Update Manager
CVE (Common Vulnerabilities and Exposures): public database of known vulnerabilities with severity scores (CVSS)
CVSS scoring: 0–10 scale — Critical (9–10), High (7–8.9), Medium (4–7), Low (0–3.9)
Penetration testing: authorized simulated attack to find exploitable vulnerabilities — requires cloud provider approval (AWS has policy, GCP allows without approval for most services)
OWASP Top 10: web application vulnerability list — injection, broken auth, sensitive data exposure, XXE, broken access control, misconfig, XSS, insecure deserialization, known vulnerabilities, insufficient logging
WAF (Web Application Firewall): filters malicious HTTP/S traffic — protects against SQLi, XSS, DDoS

5. Container Security

Image scanning: scan container images for CVE vulnerabilities before deployment — AWS ECR scanning, Azure Container Registry, Trivy, Snyk
Minimal base images: use distroless or Alpine images — smaller attack surface, fewer vulnerabilities
Non-root containers: run container processes as non-root user — limits damage if container is compromised
Read-only filesystems: mount container filesystem as read-only where possible — prevents attacker from writing payloads
Pod Security Standards (Kubernetes): Privileged (no restrictions), Baseline (minimal restrictions), Restricted (hardened) — enforce with admission controllers
Network policies (Kubernetes): restrict pod-to-pod traffic — default deny all, explicitly allow required paths
Secrets management in containers: never bake secrets into images — inject via K8s Secrets or external vault at runtime
Container registry security: private registries only, sign images (Notary/Cosign), enforce image signing policy

6. Security Controls

Preventive controls: stop attacks before they happen — MFA, encryption, firewalls, least privilege IAM
Detective controls: identify attacks in progress or after the fact — CloudTrail, GuardDuty, SIEM, log analysis
Corrective controls: remediate after incident — snapshots for recovery, security group rules to isolate compromised instance
Security groups / NACLs: network-level access control — function as preventive controls
AWS GuardDuty / Azure Defender: ML-based threat detection — analyzes CloudTrail, VPC Flow Logs, DNS logs for anomalies
AWS CloudTrail / Azure Activity Log: API call logging — who did what, when, from where — critical for forensics and compliance
SIEM (Security Information and Event Management): aggregate and correlate logs from multiple sources — detect patterns
DDoS protection: AWS Shield (Standard free, Advanced paid), Azure DDoS Protection — scrub volumetric attacks

7. Compliance Standards

PCI DSS: required for organizations handling credit card data. 12 requirements covering: network security, cardholder data protection, vulnerability management, access control, monitoring, information security policy
SOC 2: AICPA standard for service providers. 5 Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy. Type 1: point-in-time. Type 2: controls over 6–12 months (more rigorous)
ISO 27001: international standard for Information Security Management Systems (ISMS). Requires risk assessment, controls implementation, continual improvement
HIPAA: US healthcare data — PHI must be encrypted, access controlled, audit logged. Business Associate Agreements (BAA) required with cloud providers
GDPR: EU data privacy — right to erasure, data residency requirements, breach notification within 72 hours
FedRAMP: US federal government cloud authorization — cloud providers must achieve FedRAMP authorization to sell to federal agencies
Compliance as code: automate compliance checking — AWS Config Rules, Azure Policy — continuous enforcement

8. Zero Trust Architecture

Zero Trust principle: "never trust, always verify" — no implicit trust based on network location
Traditional perimeter model: trusted inside network, untrusted outside — fails when attacker gets inside
Zero Trust pillars: verify identity explicitly (MFA + contextual signals), use least privilege access, assume breach (minimize blast radius, segment networks, encrypt everything)
Microsegmentation: divide network into small zones — restrict lateral movement if one zone is compromised
Zero Trust Network Access (ZTNA): replace VPN with identity-aware proxy — only grants access to specific applications, not entire network
Cloud-native Zero Trust: use service mesh (Istio) for mTLS between microservices, identity-based policies (no IP-based trust)

Study Advisor

Choose your role to get a personalized study path for Domain 3.

🛠 Security Engineer — Study Path

Master the Shared Responsibility Model

Map out exactly where provider security ends and customer security begins for IaaS, PaaS, and SaaS. Draw the dividing line for each service type.

Study Security Control Taxonomy

Memorize Preventive / Detective / Corrective categories. For each AWS/Azure service (GuardDuty, CloudTrail, Shield), classify what type of control it represents.

Deep Dive: Vulnerability Management

Understand CVSS scoring tiers (Critical/High/Medium/Low), CVE lifecycle, and the workflow from scan to patch. Practice with AWS Inspector and Nessus conceptually.

Zero Trust Architecture

Contrast traditional perimeter security with Zero Trust. Map ZTNA, microsegmentation, and mTLS to real cloud services. Understand why VPNs alone are insufficient.

Encryption Hierarchy

Drill SSE-S3 vs SSE-KMS vs SSE-C distinctions. Understand when to use CloudHSM vs KMS. Know FIPS 140-2 Level 3 requirements and what satisfies them.

Compliance Mapping

For each standard (PCI DSS, SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP), identify the specific technical controls required and the cloud services that satisfy them.

Practice Scenario Questions

Focus on questions that present a security incident or compliance gap and ask you to identify the correct control or response. Use the quiz to test applied knowledge.

☁ Cloud Admin — Study Path

IAM Foundations First

Understand Users, Groups, Roles, Policies in AWS (and equivalents in Azure/GCP). Practice writing least-privilege policy statements. Know RBAC vs ABAC differences.

MFA and Privileged Access

Know when MFA is mandatory (root account, admin users, console access). Understand PAM concepts: just-in-time access, session recording, and approval workflows.

Patch Management Tooling

Learn AWS Systems Manager Patch Manager and Azure Update Manager. Understand the scan-assess-approve-deploy cycle and how to handle critical patches vs. scheduled windows.

Compliance Tooling and Automation

Study AWS Config Rules and Azure Policy for compliance-as-code. Know how to set up continuous compliance monitoring and automatic remediation for common misconfigurations.

Logging and Audit Trails

Master CloudTrail (AWS) and Azure Activity Log. Know what events are logged, how long logs are retained, and how to use logs for compliance reporting and forensic investigation.

Shared Responsibility in Practice

For your cloud platform (AWS/Azure/GCP), document what you are responsible for vs. the provider. Focus on the controls you own: IAM, OS patching, network security groups, data encryption.

Quiz and Scenario Practice

Take the 10-question quiz. Focus on questions about which service to use for a specific requirement and what your customer responsibility is in a given scenario.

💻 Developer — Study Path

Container Security Hardening

Study the SNRN framework: Scan images (Trivy/Snyk), Non-root user, Read-only filesystem, Network policies. Understand why each matters with a concrete attack scenario.

Secrets Management

Never store secrets in code, environment variables, or container images. Learn AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, and Kubernetes Secrets — and when to use each.

IAM for Applications

Understand managed identities (Azure) and EC2 instance profiles (AWS) for application authentication. Learn why you should never hard-code credentials and how IMDS provides temporary credentials.

OWASP Top 10 Awareness

Review the 10 categories: injection, broken auth, sensitive data exposure, XXE, broken access control, misconfiguration, XSS, insecure deserialization, known vulnerabilities, logging failures.

Encryption in Code

Know when your application must handle encryption vs. delegating to the platform. Understand TLS enforcement, certificate handling via ACM/Key Vault, and why you should not roll your own crypto.

Kubernetes Security Context

Study Pod Security Standards (Privileged / Baseline / Restricted). Know how to configure runAsNonRoot, readOnlyRootFilesystem, and Network Policies in deployment manifests.

Integrate Security into CI/CD

Understand shifting security left: image scanning in pipelines, dependency scanning, SAST/DAST tools, and blocking deployments that fail security gates — then practice the quiz questions.

Cloud+: Security &
Compliance

Core Concepts

1. Shared Responsibility Model

2. Identity and Access Management (IAM)

3. Encryption

4. Vulnerability Management

5. Container Security

6. Security Controls

7. Compliance Standards

8. Zero Trust Architecture

Memory Hooks

Practice Quiz

Flashcards

Study Advisor

🛠 Security Engineer — Study Path

☁ Cloud Admin — Study Path

💻 Developer — Study Path

Resources

CompTIA Cloud+ Official

AWS Security Hub

OWASP Top 10

Cloud+: Security &Compliance

Core Concepts

1. Shared Responsibility Model

2. Identity and Access Management (IAM)

3. Encryption

4. Vulnerability Management

5. Container Security

6. Security Controls

7. Compliance Standards

8. Zero Trust Architecture

Memory Hooks

Practice Quiz

Flashcards

Study Advisor

🛠 Security Engineer — Study Path

☁ Cloud Admin — Study Path

💻 Developer — Study Path

Resources

CompTIA Cloud+ Official

AWS Security Hub

OWASP Top 10

Cloud+: Security &
Compliance