Implementing Security Management

CompTIA Cloud+ · Objective 4.x · Security Operations

Chapter 9
Implementing Security Management

IAM, access models, hardening, vulnerability management, and the threats and monitoring practices that hold a cloud environment together — condensed into one field guide, with a few things to click.

8 Parts 40 Exam Keywords 3 Interactive Tools Read time ~12 min

security-baseline.log

$ whoami --role

# Principle of Least Privilege in effect

✓ authenticated · ✓ authorized · ✓ logged

$ scan --target cloud-env --output=cvss

# 4 findings: 1 critical, 1 high, 2 medium

$

1 IAM 2 Access 3 AuthN/Z 4 Controls 5 Firewalls 6 Vuln Mgmt 7 Threats 8 Monitoring Keywords Quiz

01

Identity and Access Management

Everything in cloud security traces back to knowing who someone is and what they're allowed to touch.

The AAA model — Authentication (proving identity), Authorization (determining access rights), Accounting (recording what was done). Every access decision in the cloud runs through these three gates, in this order.

Core IAM topics

• IAM policies
• User and group management
• Account lifecycle management
• Authentication requirements & password policies
• Multifactor Authentication (MFA)

Where it lives in the major clouds

• Microsoft Entra ID
• AWS IAM
• Google Identity Platform

Why "least privilege" is the exam's favorite phrase

Users should receive only the permissions required to perform their jobs — nothing more. It shows up as the correct answer whenever a scenario describes over-provisioned access, and it's the design principle underneath RBAC, MAC, and DAC alike.

02

Secure Access to Cloud Resources

Admins reach cloud resources through web portals, APIs, SDKs, and CLI tools — each remote path needs its own hardening.

ADMIN PROTOCOLS — click to toggle exposure

Try it: leave only 443 open and see what the console says about your attack surface.

Best practices

• Use SSH key-based authentication instead of passwords
• Restrict RDP access to trusted networks only
• Route administration through a bastion host
• Protect API keys and secrets like passwords, not config

03

Authorization & Authentication Models

Authorization decides what you can do. Authentication decides who you are. The cloud runs on models for both.

Authorization models

• Mandatory Access Control (MAC)
• Discretionary Access Control (DAC)
• Group-Based Access Control
• Role-Based Access Control (RBAC) — the cloud default
• Rule-Based Access Control

Common Azure Role	Grants
Reader	View resources only
Contributor	Manage resources, no access control changes
Owner	Full control, including access management
Network Contributor	Manage networking resources
Virtual Machine Contributor	Manage VMs
Backup Operator	Manage backup operations

Authentication models

• Local authentication
• Directory-based authentication
• Federated authentication — SAML, OpenID Connect, OAuth 2.0
• Token-based authentication
• Multifactor Authentication (MFA)
• Single Sign-On (SSO)

Together, these let a user authenticate once and securely reach multiple cloud services.

04

Security Controls in the Cloud

Controls that stand between an attacker and your workloads.

Endpoint protection

• Endpoint Detection and Response (EDR)
• Host-based IDS / IPS (HIDS / HIPS)
• Antivirus & host firewalls

Data Loss Prevention (DLP) — three goals

• Identify sensitive data
• Protect data automatically
• Detect exfiltration attempts

	IDS	IPS
Action	Detects	Detects and blocks
Posture	Passive	Active
Behavior	Logs events	Logs and mitigates

DDoS protection — Azure DDoS Protection and AWS Shield are the go-to managed services for absorbing large-scale denial-of-service attacks before they reach your workloads.

05

Firewalls & Network Security

Filtering happens at different layers, from raw packets to application logic.

Network ACLs filter on

• Source IP · Destination IP · Protocol · Port number

Web Application Firewalls (WAF)

Protect apps from SQL Injection, XSS, CSRF, and DDoS — using Allow Lists or Deny Lists.

Security Groups

Virtual firewalls at the VM level (AWS Security Groups, Azure NSGs).

Layer cheat sheet — Security groups operate primarily at Layer 3, while WAFs operate at Layer 7. This distinction is a frequent exam trap.

06

Vulnerability Management

A repeatable loop, not a one-time scan.

• Scan — sweep the environment
• Identify — catalog findings against known CVEs
• Assess — score severity with CVSS
• Remediate — patch, script, or reconfigure

CVSS Score

5.0

MEDIUM

0.1 Low4.0 Medium7.0 High9.0 Critical

Type	Cloud-native	Third-party
Scanners	Amazon Inspector, Azure Defender, GCP Container Analysis	Nessus, Burp Suite, Nmap

Standards to know: CVE (the catalog), CVSS (the score), NVD (the database). Remediation happens via patching, Ansible, scripts, Docker image updates, or configuration management tools.

07

Common Cloud Threats & Attacks

Most cloud incidents trace back to one of these categories.

Human Error

Misconfigured firewalls, weak permissions, exposed storage buckets — still the leading cause of cloud breaches.

Outdated Software

Unsupported systems keep running with known, unpatched vulnerabilities.

Social Engineering

Phishing emails, fake support messages, and credential theft that bypass technical controls entirely.

Malware, Ransomware & Cryptojacking

Viruses, worms, spyware, and keyloggers fall under malware. Ransomware encrypts data for payment. Cryptojacking quietly mines cryptocurrency on your compute bill.

Zombie Resources

Unmanaged VMs, containers, storage buckets, and cloud services left running — a security risk and a cost leak at once.

08

Monitoring & Incident Response

Detection tools and the baseline they compare against.

What gets watched

• User activity · Resource deployment changes · Configuration drift · Performance changes
• Tools: AWS CloudWatch, Azure Monitor

Security baseline defines

• Approved OS versions & software · Patch levels · Network configurations · Encryption requirements

Incident	Response
Data breach	Contain, notify, recover
Website defacement	Restore from backup
DDoS	Filter traffic, contact CSP
Virus infection	Reimage affected systems

Remember — Unnecessary open ports should always be closed. Nmap is the standard tool for finding exposed services before an attacker does.

✦

Exam Keyword Flashcards

Tap a card to flip it. These are the terms most likely to show up as answer choices.

✓

Quick Self-Check

Four questions pulled straight from the chapter. No pressure — just recall.

Score: 0 / 0

Chapter 9 · Implementing Security Management CompTIA Cloud+ Objective 4.x