Alibaba Cloud Security Engineer (Associate)

Under the Alibaba Cloud shared responsibility model, which of the following is the CUSTOMER's responsibility on a standard ECS instance?

• APatching the hypervisor that runs the ECS instance
• BPhysical security of the data center hosting the ECS host
• CConfiguring the guest operating system, application code, and IAM policies
• DReplacing failed physical disks attached to the host server

Which Chinese cybersecurity classification scheme defines five protection levels (1-5) that organizations must follow when operating information systems in mainland China?

• AGDPR
• BMLPS (Multi-Level Protection Scheme)
• CISO 27017
• DFedRAMP

A SaaS company hosts customer data on Alibaba Cloud and processes personal data of EU residents. Which framework is MOST relevant to evaluate when reviewing cross-border transfer obligations?

• AGDPR
• BMLPS Level 1
• CPCI DSS
• DHIPAA

A team plans to perform vulnerability scanning and penetration testing against their own ECS workload on Alibaba Cloud. What is the correct first step?

• ABegin the test immediately because customers own their workloads
• BSubmit a penetration testing notification to Alibaba Cloud through the official process b…
• CDisable Cloud Security Center to avoid alert noise
• DOpen the security group to 0.0.0.0/0 so the scanner can reach the instance

Which statement BEST describes a security incident response procedure on Alibaba Cloud?

• AContainment must always come AFTER full forensic imaging is complete
• BDetection, containment, eradication, recovery, and lessons-learned form a typical inciden…
• CRolling root credentials should be skipped if Cloud Security Center has not raised an ale…
• DActionTrail logs should be deleted immediately to prevent attacker pivoting

An organization wants to demonstrate alignment with an internationally recognized information-security management system (ISMS) standard for its Alibaba Cloud workloads. Which standard fits BEST?

• AISO 27001
• BMLPS Level 2
• CPCI DSS
• DSOC 1 Type 1

Which phrase BEST describes the goal of a vulnerability management lifecycle on Alibaba Cloud workloads?

• APerform a single annual scan to satisfy auditors
• BDiscover, prioritize, remediate, and verify vulnerabilities continuously
• CDisable patching during business hours to avoid downtime
• DReplace Cloud Security Center scans with self-developed scripts only

Which of the following is a defining characteristic of cloud-native threats that differs from traditional on-premises threats?

• AThreats only target hypervisors and never reach guest workloads
• BThreats include misconfigured cloud APIs, exposed object-storage buckets, and credential…
• CThreats can be eliminated entirely by purchasing a single managed service
• DThreats never involve identity because cloud APIs are anonymous

Which Alibaba Cloud service is the primary identity and access management service used to create users, groups, roles, and policies?

• ACloud Security Center
• BResource Access Management (RAM)
• CActionTrail
• DBastionhost

An administrator wants to grant temporary, time-limited credentials to a mobile application so it can upload to OSS without embedding long-term AccessKeys. Which Alibaba Cloud capability is MOST appropriate?

• ARAM STS (Security Token Service)
• BRAM user with permanent AccessKey pair
• CRoot account credential
• DBastionhost ticket

Which statement BEST describes the difference between a RAM system policy and a RAM custom policy?

• ASystem policies are managed by Alibaba Cloud and updated automatically; custom policies a…
• BCustom policies override the deny-by-default behavior of RAM
• CSystem policies allow root access only; custom policies allow read access only
• DCustom policies are stored outside Alibaba Cloud while system policies are stored inside…

When evaluating a RAM policy, which combination of statements wins if a user has BOTH an Allow statement and an explicit Deny for the same action and resource?

• AThe Allow wins because it is more permissive
• BWhichever statement appears first wins
• CThe explicit Deny always wins over any Allow
• DBoth are ignored and the default Allow is used

Which RAM feature requires a user to enter a one-time code from a virtual or hardware authenticator IN ADDITION to their password during console sign-in?

• AMulti-factor authentication (MFA)
• BAccessKey rotation
• CResource Directory
• DService-linked roles

A company wants employees to sign in to the Alibaba Cloud console using their existing corporate IdP via SAML 2.0 instead of creating individual RAM users. Which RAM feature supports this?

• ARAM SSO (single sign-on) with SAML federation
• BRAM AccessKey pairs only
• CBastionhost user import
• DCloud Config rules

A workload running on an ECS instance needs to call OSS APIs without embedded AccessKeys. Which approach follows Alibaba Cloud best practice?

• AHardcode the root user's AccessKey on the instance
• BAttach a RAM role to the ECS instance and use the metadata service to obtain temporary cr…
• CDisable RAM and rely on security groups
• DShare a single AccessKey across all ECS instances in the VPC

A multinational enterprise is creating dozens of Alibaba Cloud accounts for different business units and regions. Which service organizes these accounts into a hierarchy with centrally managed control policies?

• AResource Directory
• BRAM users only
• CCloud Firewall
• DActionTrail

Which best describes a 'Control Policy' in Alibaba Cloud Resource Directory?

• AA policy that enforces guardrails on member accounts and folders, restricting actions eve…
• BA policy that automatically scans ECS hosts for malware
• CA policy attached to KMS keys that defines envelope encryption parameters
• DA WAF managed rule set

Which RAM principle requires that users and roles only receive the permissions strictly needed to perform their tasks?

• ALeast privilege
• BConvenience principle
• CSingle point of trust
• DImplicit allow

Which RAM security setting automatically disables a RAM user AccessKey that has not been used for a configured period (such as 90, 180, 365, or 730 days)?

• AAccessKey maximum idle time (configured in RAM security settings)
• BBastionhost session recording
• COSS bucket policy
• DCloud Config conformance pack

Which RAM construct should be used to grant cross-account access from Account A to a workload in Account B without sharing long-term AccessKeys?

• ACreate a RAM role in Account B that trusts Account A and have Account A assume it via STS
• BEmail the root AccessKey of Account B to Account A
• CDisable RAM in Account B
• DCreate a RAM user in Account B and share its password

A RAM custom policy includes the condition `acs:SourceIp` set to a corporate CIDR. What does this condition enforce?

• AThe policy only allows the action when the request originates from the listed CIDR range
• BThe policy automatically encrypts traffic for that CIDR
• CThe policy creates a route entry to that CIDR in the VPC
• DThe policy whitelists that CIDR in WAF

Which RAM role type is used when an Alibaba Cloud SERVICE (such as Function Compute) needs to call other Alibaba Cloud APIs on the customer's behalf?

• AService role (RAM role for trusted service)
• BUser-managed AccessKey
• CRoot account credential
• DBastionhost role