5 exercises — Practice cloud security vocabulary in English: IAM, RBAC, ABAC, least privilege, VPC, security groups, KMS, WAF, CSPM, and assume role patterns.
Core cloud security vocabulary clusters
Identity: IAM user, role, group, policy, principal, assume role, service account, OIDC federation
Access control: RBAC (role-based), ABAC (attribute-based), least privilege, permission boundary, SCPs (Service Control Policies)
A cloud architect explains IAM roles to a developer who has been using long-lived access keys: "Stop using access keys for your EC2 instances. Attach an IAM role to the instance instead. The instance metadata service vends temporary credentials — access key, secret key, and session token — that rotate automatically every hour. Your application uses the AWS SDK, which picks up these credentials automatically. No secrets in code, no secrets in environment variables. If credentials leak, they expire within an hour. This is the correct way to grant AWS permissions to workloads running in AWS." What is the security advantage of an IAM role over long-lived IAM access keys?
IAM role temporary credentials: generated by STS (Security Token Service). Consist of AccessKeyId, SecretAccessKey, SessionToken, and Expiration (typically 1 hour). The SDK refreshes them automatically before expiry. Long-lived access keys: static credentials tied to an IAM user. If leaked (in code, GitHub, logs), they remain valid until manually rotated or deleted. Rotation is manual and error-prone. IAM entity types: User: represents a person or application. Has permanent credentials (password, access keys). Group: collection of users, policies attached to the group apply to all members. Role: assumed by a principal (EC2 instance, Lambda function, another AWS account, OIDC federated identity). Issues temporary credentials. Policy: JSON document defining allowed/denied actions. Assume role vocabulary: sts:AssumeRole: API call to get temporary credentials for a role. Trust policy: the role's policy that specifies who can assume it. Session policies: optional inline policy further restricting the assumed role's permissions. Cross-account: RoleA in Account A trusts Account B — Account B's principals can assume RoleA. Used for multi-account architectures. OIDC federation: GitHub Actions, Kubernetes service accounts, and other OIDC providers can assume AWS roles without storing long-lived credentials. In conversation: 'Every access key in a codebase is a potential breach waiting to happen. Instance roles are the first thing we enforce in our cloud security baseline.'
2 / 10
A security engineer explains access control models during an architecture review: "We're debating RBAC versus ABAC for our multi-tenant SaaS. With RBAC — Role-Based Access Control — you assign roles to users and attach permissions to roles. 'Admin', 'Editor', 'Viewer'. Simple, auditable. But it doesn't scale when you need fine-grained control: 'Editor can edit documents they own in their organization but not others'. For that you need ABAC — Attribute-Based Access Control. The policy evaluates attributes: user.organization must equal resource.organization AND user.role must include 'Editor'. AWS IAM conditions implement ABAC." What is the key difference between RBAC and ABAC?
RBAC: permissions are attached to roles, roles are assigned to users. Predictable and auditable. Scales poorly when roles proliferate (role explosion: hundreds of fine-grained roles). ABAC: access decisions use conditions on attributes — user tags, resource tags, environment context. AWS IAM ABAC example: tag resources with Project=Alpha, tag users with Project=Alpha. IAM policy condition: StringEquals: {"aws:ResourceTag/Project": "${aws:PrincipalTag/Project}"}. Users can only act on resources with the same Project tag. No need to create per-project roles. Least privilege vocabulary: Principle of least privilege: grant only the minimum permissions needed for the task. Review and reduce over time. Permission boundary: an IAM policy that caps the maximum permissions a user or role can have, even if attached policies grant more. Useful for delegated admin — developers can create roles but not grant more than their own permissions. Service Control Policy (SCP): applied at AWS Organizations level. Limits maximum permissions across all accounts in an OU. Cannot grant permissions, only restrict. Resource policy: attached to the resource (S3 bucket policy, KMS key policy) specifying who can access it. Identity policy + Resource policy both must allow for cross-account access. In conversation: 'RBAC is fine until you have 50 tenants and need isolation between them. ABAC with resource tags scales to thousands of tenants with a single policy.'
3 / 10
A cloud security engineer reviews a network architecture: "Your database should be in a private subnet — no route to the internet gateway. EC2 instances in the public subnet talk to the database via a security group rule: allow port 5432 from the EC2 security group ID. Security groups are stateful — you only need an inbound rule; the response traffic is automatically allowed. NACLs are stateless — you need explicit inbound AND outbound rules. VPC endpoints let your Lambda functions call S3 and DynamoDB without going to the internet, even though they're in a VPC. PrivateLink lets you consume services in another VPC as if they were in yours." What is the difference between a security group and a network ACL (NACL) in AWS?
Security group: virtual firewall at the instance/ENI level. Stateful: if you allow inbound TCP 443, the response traffic is automatically allowed regardless of outbound rules. Only allow rules (no explicit deny). Rules can reference other security groups (e.g., allow from sg-0abc123 on port 5432). Default: all inbound denied, all outbound allowed. NACL (Network ACL): firewall at the subnet level. Stateless: must explicitly allow both inbound request AND outbound response. Rules evaluated in order by rule number. Supports both allow and deny rules. Default NACL: allows all traffic. Custom NACL: denies all until you add rules. When to use each: Security groups for micro-segmentation (instance-level isolation). NACLs for blocking specific IPs or CIDR ranges across a subnet (e.g., blocking a known malicious IP). VPC network vocabulary: Internet Gateway (IGW): enables internet connectivity for public subnets. NAT Gateway: allows private subnet resources to initiate outbound internet connections without being reachable inbound. VPC endpoint (Gateway): private route to S3 and DynamoDB without internet. Free. VPC endpoint (Interface): PrivateLink-based ENI in your subnet for other AWS services (SSM, KMS, etc.). VPC peering: non-transitive private connection between two VPCs. Transit Gateway: hub-and-spoke for connecting many VPCs and on-premises networks. In conversation: 'Security groups are your primary tool. NACLs are a secondary layer — use them for blocking known-bad IPs across an entire subnet, not for micro-segmentation.'
4 / 10
A security architect explains key management to the engineering team: "Never store encryption keys alongside the data they encrypt. We use AWS KMS for key management. KMS holds the Customer Master Key (CMK) — it never leaves KMS. We use envelope encryption: generate a unique data key for each object, encrypt the data with the data key, encrypt the data key with the CMK. Store the encrypted data key next to the encrypted object. To decrypt: call KMS to decrypt the data key (KMS checks your IAM permissions), then use the plaintext data key to decrypt the object locally. The plaintext data key exists in memory only for the duration of the operation." What is envelope encryption and why is it used with KMS?
Envelope encryption: a two-tier key hierarchy. Tier 1: KMS Customer Master Key (CMK) — stays in KMS, never exported. Tier 2: Data Encryption Key (DEK) — generated per-object, used for actual data encryption (AES-256), then encrypted with the CMK. Why: KMS has a 4KB API limit — you cannot send a 1GB file to KMS to encrypt. Envelope encryption encrypts the large file locally using a random DEK (fast AES), then only sends the 32-byte DEK to KMS for wrapping (key encryption). Decryption flow: (1) retrieve encrypted DEK from storage, (2) call KMS Decrypt API — KMS checks IAM permissions, decrypts DEK with CMK, returns plaintext DEK, (3) use plaintext DEK to decrypt data locally, (4) zero the plaintext DEK from memory. Key management vocabulary: CMK (Customer Master Key) / KMS Key: master key that never leaves KMS. Can be AWS-managed (free tier) or customer-managed (more control, key policy, audit). Key policy: resource policy on the KMS key. Must explicitly allow the account root to use it. Key rotation: AWS can auto-rotate CMK annually. Old key material retained to decrypt old ciphertext. Multi-region key: same key material in multiple regions — for disaster recovery or global data replication. SSE-S3 vs SSE-KMS: SSE-S3 uses AWS-managed key (no audit trail, no policy); SSE-KMS uses CMK (CloudTrail logs every decrypt, key policy controls access, cross-account possible). In conversation: 'SSE-KMS adds ~1ms latency per decrypt but gives you an audit trail of every access. For sensitive data, that visibility is worth it.'
5 / 10
A cloud security engineer presents their detection and posture management stack: "We have three layers. First, AWS WAF in front of our ALB — blocks OWASP Top 10 attacks, rate limits, and allows/blocks based on IP reputation lists and geographic rules. Second, GuardDuty for threat detection — it analyzes CloudTrail, VPC Flow Logs, and DNS logs with ML to detect anomalies: unusual API calls, crypto mining traffic, compromised credentials. Third, AWS Security Hub / a CSPM tool continuously scans our configuration for misconfigurations: public S3 buckets, overly permissive security groups, unencrypted volumes. These are detective controls — they don't prevent misconfigs, they find them fast." What is CSPM and how does it differ from a WAF?
CSPM (Cloud Security Posture Management): continuously monitors cloud configurations against security benchmarks (CIS Benchmarks, AWS Foundational Security Best Practices). Finds: S3 buckets with public access, security groups with 0.0.0.0/0 on port 22, EC2 instances without encrypted EBS, IAM users without MFA, exposed secrets in environment variables. Tools: AWS Security Hub, Prisma Cloud, Wiz, Orca Security. WAF (Web Application Firewall): sits in front of HTTP endpoints. Inspects each request against managed rule groups (OWASP Top 10, bot control, IP reputation). Blocks matching requests. Actions: allow, block, count, challenge (CAPTCHA). AWS WAF vocabulary: Rule group: a collection of rules (AWS managed or custom). Web ACL: a set of rule groups attached to an ALB, CloudFront, or API Gateway. Rate-based rule: blocks IP addresses that exceed a request rate. Regex match condition: inspect specific request fields for patterns. Security tooling landscape: SIEM (Security Information and Event Management): aggregates logs from all sources, correlates events, generates alerts. Examples: Splunk, Sumo Logic, AWS Security Lake + OpenSearch. SOAR (Security Orchestration, Automation, Response): automates response to security events. IDS/IPS: intrusion detection/prevention. Network-level (AWS Network Firewall, Suricata). Secrets manager: AWS Secrets Manager, HashiCorp Vault — store and rotate credentials programmatically. In conversation: 'CSPM told us we had 14 public S3 buckets we didn't know about. WAF told us we were getting 50,000 SQLi attempts per hour. You need both.'
6 / 10
Review this code review comment from Sarah (a Senior Security Engineer) regarding a new Lambda function:
`@johndoe
'This Lambda function is deployed to an ECS task definition. The task definition uses the AWS Systems Manager Parameter Store service to retrieve a database connection string. The connection string contains credentials for accessing our RDS instance.
'
Sarah replies: 'I'm concerned about storing secrets in Parameter Store. Can you use IAM roles and temporary credentials instead?'
Sarah is correctly identifying a critical security risk: storing database credentials directly in code or configuration. Using IAM roles and temporary credentials (via AWS SDK) eliminates this risk by avoiding hardcoded secrets. The Lambda function automatically picks up these credentials, reducing the attack surface.
7 / 10
Mark from DevOps sends this message in a Slack channel:
`@team - just deployed new S3 bucket 'sensitive-data' with public read access. We need to change this! It's for staging only. Anyone who needs it, can grab it. No biggie.`
What is the *primary* security issue highlighted in Mark's message?
The core security issue is that Mark has granted public read access to an S3 bucket containing 'sensitive-data.' This bypasses all data classification and access control policies. Although the intention is for staging only, the broad permissions create a significant vulnerability. Ignoring data classification is a fundamental security failure.
8 / 10
You're debugging an application that fails to connect to S3. The API response from the S3 service is:
```json
{
"status": "AccessDenied",
"message": "The request could not be completed due to access denied.",
"code": 403,
"details": {
"errorCode": "NoSuchBucket",
"bucketName": "my-protected-data"
}
}
```
What is the most likely reason for this API response?
The `NoSuchBucket` error indicates that the requested S3 bucket (`my-protected-data`) does not exist. This commonly occurs due to a typo in the bucket name or misconfiguration during bucket creation. While other issues could cause access denied errors, this response specifically points to the absence of the resource.
9 / 10
A developer submits a pull request with the following description:
`'Updated the database connection string in the Lambda function. Used environment variables to store it.'`,
What is the *best* way to improve this PR description from a security perspective?
While using environment variables is an improvement over hardcoding secrets, it's not sufficient from a security standpoint. The developer needs to explicitly acknowledge and confirm that the environment variable itself *should* be encrypted – ideally via KMS or another secure mechanism. This demonstrates awareness of the potential vulnerability.
10 / 10
"Okay team, quick update: we've just finished setting up a new automated security scan for our EC2 instances using AWS Security Hub. It's currently running at a low severity level and flagging some overly permissive security group rules. We're going to investigate those further."
This is a positive update demonstrating proactive security monitoring. Security Hub's purpose is to continuously scan for misconfigurations and vulnerabilities, allowing teams to address them before they become significant risks. The low severity level indicates an opportunity for improvement rather than an immediate crisis.
What does the "Cloud Security Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to cloud security vocabulary through 10 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 10 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 14 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.