Cloud+ Domain 4: Security (19%)

Overview

Security covers protecting cloud environments, vendor-neutrally and comprehensively. It has four areas. Identity and access management covers authentication, authorization, multifactor authentication, single sign-on, federation, least privilege and role-based access. Securing networks and data covers network segmentation, firewalls, security groups, encryption at rest and in transit, key management and data classification. Compliance, governance and vulnerability management covers regulatory frameworks, policies, auditing, vulnerability scanning and patching. Deploying security controls covers implementing and managing controls such as web application firewalls, intrusion detection, and endpoint and workload protection.

At 19%, this is a top-weighted domain tied with Deployment. The exam rewards understanding layered, defense-in-depth security: verifying identity and granting least privilege, protecting networks and encrypting data, meeting compliance, managing vulnerabilities, and deploying the right controls, as principles that apply across any cloud provider.

Why it matters on the exam

Security is 19% of the exam and, with architecture and deployment, forms the majority of the content, reflecting how central security is to cloud work. The exam tests layered, provider-independent security. Candidates lose points by confusing authentication with authorization, by not applying least privilege, by misunderstanding where encryption at rest versus in transit applies, by confusing security groups with network ACLs, or by treating compliance and vulnerability management as afterthoughts. Knowing how to secure identity, networks, data and workloads in depth is the skill this domain rewards. Because Cloud+ is vendor-neutral, the exam rewards knowing the generic concept behind each provider's product name, so mapping your single-cloud experience to the general principle is what prevents avoidable lost marks.

How it's tested

Cloud+ questions in this domain describe a security, compliance or access need and ask for the correct control or concept. Cloud+ questions are vendor-neutral and scenario-based, so translate any provider-specific knowledge into the generic concept and read the requirement before choosing.

Identity and access

An access need is described, and you choose authentication, authorization, MFA or least-privilege RBAC.
Protect networks and data

A protection need is described, and you choose segmentation, firewalls or encryption.
Compliance and controls

A governance or control need is described, and you choose the compliance, vulnerability or security control.

Reasoning it through

A user with a valid password could still be compromised by a stolen credential, and the organization wants to reduce that risk for cloud access. A stronger password alone does not stop credential theft. Requiring multifactor authentication adds a second factor, so a stolen password alone cannot grant access, which is the identity control the exam expects to mitigate credential compromise.

Domains 4

Official domains from the CompTIA outline, in outline order.

4.1 Implement identity and access management in the cloudAuthentication, authorization, MFA, SSO, federation and least privilege.

What it means: This covers authentication and authorization, multifactor authentication, single sign-on, identity federation, role-based access control, least privilege, and managing identities, users, groups and service identities in the cloud.
What to understand: Authentication verifies identity, strengthened by MFA, while authorization grants access through roles. Single sign-on and federation let users authenticate across systems and providers. Least privilege grants only the access needed. Service identities authenticate workloads. These are the foundation of cloud security.
How it shows up: An access or identity need is described, and you must choose the authentication, authorization or access-control approach.
Common confusion: Confusing authentication with authorization; authentication verifies who you are, while authorization determines what you can do.

4.2 Secure cloud networks and dataSegmentation, firewalls, security groups, and encryption at rest and in transit.

What it means: This covers network segmentation and micro-segmentation, firewalls, security groups and network access control lists, VPNs and private connectivity, encryption of data at rest and in transit, key management, and data classification.
What to understand: Segmentation isolates workloads, and security groups and network ACLs filter traffic, with security groups stateful at the instance and ACLs stateless at the subnet. Encryption protects data at rest (stored) and in transit (moving), with keys managed securely. Data classification drives protection levels. Layered controls provide defense in depth.
How it shows up: A network or data protection need is described, and you must choose segmentation, the right firewall construct or encryption.
Common confusion: Confusing a stateful security group with a stateless network ACL; security groups track connection state, while ACLs evaluate each packet independently.

4.3 Apply compliance, governance, and vulnerability managementRegulatory frameworks, policies, auditing, scanning and patching.

What it means: This covers compliance with regulatory frameworks and standards, governance policies, auditing and logging for compliance, vulnerability scanning and assessment, penetration testing awareness, and patch management.
What to understand: Compliance meets legal and regulatory requirements, governance enforces organizational policy, and auditing provides evidence. Vulnerability management scans for weaknesses and remediates them through patching and configuration. These ongoing practices keep the environment compliant and reduce the attack surface.
How it shows up: A compliance or vulnerability need is described, and you must choose the governance, auditing or vulnerability-management action.
Common confusion: Confusing compliance with security; compliance meets external requirements, while security protects the environment, and the two overlap but are not identical.

4.4 Deploy and manage cloud security controlsWeb application firewalls, intrusion detection, and workload protection.

What it means: This covers deploying and managing security controls such as web application firewalls, intrusion detection and prevention systems, endpoint and workload protection, security monitoring and threat detection, and secrets management.
What to understand: A web application firewall protects web applications from attacks, intrusion detection and prevention monitor for malicious activity, and workload protection secures instances and containers. Secrets management stores credentials securely. These controls implement defense in depth and are chosen to match the threats.
How it shows up: A threat or protection need is described, and you must choose the security control to deploy.
Common confusion: Confusing a web application firewall with a network firewall; a web application firewall inspects application-layer traffic, while a network firewall filters by network attributes.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Authentication vs. authorization

Verifying identity versus granting access.

Remember
MFA and SSO authenticate; roles authorize.

Tested as
Identity questions.

Trap
Confusing the two.
Multifactor authentication

A second factor beyond a password.

Remember
It mitigates credential theft.

Tested as
Identity questions.

Trap
Relying on passwords alone.
Single sign-on and federation

Authenticate once across systems and providers.

Remember
They simplify and secure access.

Tested as
Identity questions.

Trap
Confusing SSO with MFA.
Least privilege

Granting only the access needed.

Remember
A core security principle.

Tested as
Access questions.

Trap
Over-granting access.
Security group vs. network ACL

Stateful instance filter versus stateless subnet filter.

Remember
Security groups track state; ACLs do not.

Tested as
Network security questions.

Trap
Confusing the two.
Encryption at rest vs. in transit

Protecting stored versus moving data.

Remember
Both are needed for full protection.

Tested as
Data security questions.

Trap
Protecting only one.
Key management

Securely storing and rotating encryption keys.

Remember
Control over keys matters.

Tested as
Data security questions.

Trap
Hard-coding or mishandling keys.
Compliance frameworks

Regulatory and standards requirements.

Remember
Compliance is ongoing and audited.

Tested as
Compliance questions.

Trap
Treating it as one-time.
Vulnerability management

Scanning and patching weaknesses.

Remember
Reduce the attack surface continuously.

Tested as
Vulnerability questions.

Trap
Ignoring patching.
Web application firewall

Protects web apps at the application layer.

Remember
Distinct from a network firewall.

Tested as
Control questions.

Trap
Confusing with a network firewall.
Defense in depth

Layered security controls.

Remember
No single control is enough.

Tested as
Security design questions.

Trap
Relying on one control.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Authentication vs. authorization

Concept	Meaning	Key difference	Common trap
Authentication	Verifies identity	Who you are	Confusing with authorization
Authorization	Grants access	What you can do	Confusing with authentication

Security group vs. network ACL

Concept	Meaning	Key difference	Common trap
Security group	Stateful, at the instance	Tracks connection state	Confusing with an ACL
Network ACL	Stateless, at the subnet	Evaluates each packet	Confusing with a security group

Encryption at rest vs. in transit

Concept	Meaning	Key difference	Common trap
At rest	Protects stored data	Disks, storage, backups	Protecting only in transit
In transit	Protects moving data	Network connections	Protecting only at rest

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Stronger password vs. MFA

What candidates pick
Require a longer password to stop account compromise from stolen credentials.

Why it looks right
Stronger passwords seem safer.

Why it's wrong
Multifactor authentication adds a second factor, so a stolen password alone cannot grant access.

Clue to watch for The risk is a stolen or phished credential.
MFA is authorization

What candidates pick
Use multifactor authentication to grant a user access to a resource.

Why it looks right
Both relate to access.

Why it's wrong
MFA strengthens authentication; authorization grants access through roles and least privilege.

Clue to watch for The need is to grant or limit what a user can do.
ACL is stateful

What candidates pick
Rely on a network ACL to automatically allow return traffic like a security group.

Why it looks right
Both filter traffic.

Why it's wrong
Security groups are stateful and allow return traffic; network ACLs are stateless and evaluate each direction.

Clue to watch for Return traffic handling distinguishes the two.
Encrypt only at rest

What candidates pick
Encrypt stored data but send it over the network unencrypted.

Why it looks right
At-rest encryption protects the data.

Why it's wrong
Data must be encrypted in transit too, or it can be intercepted on the network.

Clue to watch for Data moves over a network and could be intercepted.
WAF is a network firewall

What candidates pick
Use a network firewall to block application-layer attacks such as injection.

Why it looks right
Both are firewalls.

Why it's wrong
A web application firewall inspects application-layer traffic for such attacks; a network firewall filters by network attributes.

Clue to watch for The threat is an application-layer attack on a web app.

Answer framework

For any Domain 4 scenario, use these steps to find the vendor-neutral answer Cloud+ expects.

Apply defense in depth: layer identity, network, data and workload controls rather than relying on one.
For identity, verify with authentication and MFA, and grant least-privilege authorization through roles, using SSO and federation where appropriate.
For networks and data, segment workloads, apply security groups and network ACLs correctly, and encrypt data at rest and in transit with managed keys.
For compliance, meet the required frameworks, enforce governance, audit, and run ongoing vulnerability scanning and patching.
Deploy the security controls that match the threats, such as a web application firewall for web attacks and intrusion detection for monitoring. Where several options could fit, choose the generic concept the requirements make defensible rather than a provider-specific product name.

Practice question

An organization wants to reduce the risk that a stolen or phished password alone could give an attacker access to cloud accounts. Which identity control BEST addresses this risk?

Enforcing longer, more complex passwords Requiring multifactor authentication for account sign-in Granting all users the administrator role Disabling single sign-on

Show the answer

Answer B. Multifactor authentication requires a second factor in addition to the password, so a stolen or phished password alone cannot grant access, directly addressing credential compromise. Longer passwords do not prevent a stolen credential from being used, granting everyone the administrator role drastically weakens security, and disabling single sign-on does not address credential theft and can reduce security and usability.

Want more like this? The Cloud+ practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as layered, provider-independent security. Start with identity and access, the foundation: fix the authentication-versus-authorization distinction, apply MFA and least privilege, and understand SSO and federation. Then learn network and data security, keeping stateful security groups and stateless network ACLs distinct, and knowing where encryption at rest and in transit apply with proper key management.

Next, learn compliance, governance and vulnerability management as ongoing practices, and the security controls to deploy, keeping a web application firewall distinct from a network firewall. The unifying idea is defense in depth: no single control suffices.

Because security is a large, high-value domain tied with deployment, invest substantial time and practice scenario questions across all four areas. Afterwards, move to Domain 5, DevOps Fundamentals. Because Cloud+ is vendor-neutral and partly hands-on, map each provider product you know to its generic concept and practice the tasks on a real cloud, and review missed practice questions by domain to find weak spots.

FAQ

How much of Cloud+ is Domain 4?

Security is 19% of the exam, tied with Deployment, and with Cloud Architecture the three make up the majority of the content.

What is the difference between authentication and authorization?

Authentication verifies who a user is, strengthened by multifactor authentication. Authorization determines what an authenticated user is allowed to do, through roles and least privilege.

What is the difference between a security group and a network ACL?

A security group is stateful and filters traffic at the instance, automatically allowing return traffic. A network ACL is stateless and filters at the subnet, evaluating each direction independently.

What is the difference between encryption at rest and in transit?

Encryption at rest protects stored data on disks, storage and backups. Encryption in transit protects data moving over the network. Both are needed for full protection.

What is defense in depth?

Layering multiple security controls across identity, network, data and workload, so that no single control failure compromises the whole environment.

What is the difference between a web application firewall and a network firewall?

A web application firewall inspects application-layer traffic to block attacks such as injection and cross-site scripting. A network firewall filters traffic by network attributes such as IP and port.

How does Domain 4 connect to the rest of the exam?

Security protects the architecture of Domain 1, the deployments of Domain 2 and the operations of Domain 3, integrates with DevOps in Domain 5, and its issues are diagnosed in Domain 6.

Related domains

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Cloud+ Domain 4: Security

Overview

How it's tested

Identity and access

Protect networks and data

Compliance and controls

Domains 4

High-yield concepts

Authentication vs. authorization

Multifactor authentication

Single sign-on and federation

Least privilege

Security group vs. network ACL

Encryption at rest vs. in transit

Key management

Compliance frameworks

Vulnerability management

Web application firewall

Defense in depth

Side by side

Authentication vs. authorization

Security group vs. network ACL

Encryption at rest vs. in transit

Exam traps

Stronger password vs. MFA

MFA is authorization

ACL is stateful

Encrypt only at rest

WAF is a network firewall

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cloud Computing certifications

Test your Domain 4 knowledge

Keep going