Module A12 Assessment
Test your ability to reason across cloud shared responsibility, identity, storage, network boundaries, logging and monitoring, secrets, recovery, misconfiguration prevention, and governance.
All scenarios are fictional and defensive. The test focuses on architecture judgment, evidence quality, ownership, and safe security decision-making.
Readiness Check
0/4 ready
Test Coverage
Provider-operated capabilities, customer-owned configuration, shared outcomes, ownership, accountability, and evidence boundaries.
Review emphasis
Know why shared responsibility should clarify ownership instead of making responsibility vague.
Human identities, workload identities, least privilege, privileged access, external access, separation of duties, lifecycle, and access evidence.
Review emphasis
Know why private network location does not replace identity and why workload identity is preferred where practical.
Data classification, public/private exposure, access scope, retention, encryption responsibilities, copies, backups, lineage, and ownership.
Review emphasis
Know why encryption alone does not prove storage security and why secondary copies expand the protected data boundary.
Public ingress, private service paths, partner connectivity, administrative access, egress, environment separation, trust boundaries, and monitoring.
Review emphasis
Know why public exposure should be limited and why internal/private network placement is not the same as authorization.
Telemetry domains, source health, identity context, configuration changes, data access, alerting, retention, evidence quality, and visibility gaps.
Review emphasis
Know the difference between no-event and no-source states.
Workload identity, managed secret references, service credentials, key references, certificates, emergency access, rotation, revocation, environment separation, and retirement.
Review emphasis
Know why architecture documentation should use safe metadata and never secret values.
Availability, redundancy, backup, restoration, recovery, RTO, RPO, dependencies, failure domains, recovery ownership, and current exercise evidence.
Review emphasis
Know why healthy backups do not automatically prove full service recovery.
Secure baselines, desired vs. observed state, drift, preventive guardrails, detective controls, exceptions, remediation, and closure evidence.
Review emphasis
Know why configuration assurance is continuous and why a valid exception remains different from the preferred baseline.
Policy, standards, ownership, service inventory, risk acceptance, review cadence, evidence, lifecycle, architecture decisions, blockers, and release recommendations.
Review emphasis
Know why unowned risk should not be silently accepted and why finding impact matters more than a simple majority of passing controls.
Assessment
Work through all 25 questions before reviewing explanations. Focus on what the evidence actually supports and which architecture decision is most defensible.
Check Your Understanding
Choose your answers first. Explanations appear only after submission.
Performance Guide
Strong A12 readiness. You can connect cloud architecture domains and reason from evidence, ownership, lifecycle, and governance.
Next action: Review any missed questions, then proceed to A13.
Good working understanding with a few architecture gaps.
Next action: Use the targeted review map below for the missed domains before moving on.
Partial understanding. You recognize many concepts but may be treating domains too independently.
Next action: Revisit A12.5–A12.10 and any earlier domain where you missed multiple questions.
Rebuild the architecture model before continuing.
Next action: Review the full A12 module from shared responsibility through the capstone, focusing on why each control exists and what evidence supports it.
Targeted Review Map
| Misses | Lesson | Topic | Revisit |
|---|---|---|---|
| Questions 1–2 | A12.1 | Shared responsibility | Provider vs. customer responsibility, customer configuration, ownership, and evidence boundaries. |
| Questions 3–4 | A12.2 | Cloud IAM | Workload identity, least privilege, privileged access, lifecycle, and ownership. |
| Questions 5–7 | A12.3 | Storage security | Classification, exposure, copies, retention, encryption responsibilities, backup sensitivity, and public-content decisions. |
| Questions 8–11 | A12.4 | Network boundaries | Trust boundaries, private vs. authorized access, partner connectivity, egress, and environment separation. |
| Questions 12–14 | A12.5 | Logging and monitoring | Source health, no-event vs. no-source, alert context, retention, and sensitive-data minimization. |
| Questions 15–16 | A12.6 | Secrets and key handling | Safe metadata, workload identity, ownership, rotation, revocation, environment separation, and retirement. |
| Questions 17–20 | A12.7 | Recovery and resilience | RTO, RPO, backup vs. recovery, current restoration evidence, dependencies, and failure domains. |
| Questions 21–22 | A12.8 | Misconfiguration prevention | Baseline, observed state, drift, exceptions, compensating controls, remediation, and closure evidence. |
| Questions 23–25 | A12.9–A12.10 | Governance and architecture decisions | Policy vs. standard, risk acceptance, decision authority, blockers, release criteria, and evidence-based recommendations. |
Defender Habits
Key Takeaways
Module Complete
You have completed the A12 module homepage, all ten Advanced lessons, the Cloud Security Architecture Assessment capstone, and the 25-question module test.
The next Advanced module is A13 — Identity, Zero Trust, and Access Control.
Safety Boundary
Do not use these questions as instructions to access, probe, configure, modify, restore, or test real cloud accounts, networks, storage, credentials, logs, backups, or production services. All scenarios are designed for safe architecture learning.