Enterprise Virtual, Cloud, and Wireless Network Protection · Topic 4 of 5
AWS, Azure, GCP and Cloud Security Best Practices
Learn the main security services of AWS, Azure and Google Cloud, plus general cloud security best practices and tools tested on the CND 312-38 exam.
- 5 min
- AWS: IAM, CloudTrail, GuardDuty, Inspector, Macie, KMS, Security Hub.
- Azure: Entra ID, RBAC, NSG, Defender for Cloud, Sentinel, Key Vault.
- GCP: Cloud IAM, Cloud Audit Logs, Security Command Center, Cloud KMS, VPC Service Controls.
What it is
Every large cloud provider offers the same families of security services under different names: identity, network filtering, logging, threat detection, key management and posture checks. The CND exam asks you to recognize which service does which job on each platform.
Learn the job first, then the name.
How it works
Security in Amazon Web Services (AWS)
| Service | Job |
|---|---|
| IAM | Users, groups, roles and policies. Use roles and temporary credentials, and enable MFA on the root account |
| Security groups | Stateful virtual firewall at the instance level |
| Network ACLs | Stateless filtering at the subnet level |
| AWS CloudTrail | Records API calls and account activity |
| Amazon CloudWatch | Metrics, logs and alarms |
| VPC Flow Logs | Records IP traffic to and from network interfaces |
| Amazon GuardDuty | Threat detection from logs and network activity |
| Amazon Inspector | Scans workloads for vulnerabilities |
| Amazon Macie | Finds sensitive data in S3 |
| AWS Config | Tracks configuration and checks it against rules |
| AWS KMS | Creates and controls encryption keys |
| AWS Security Hub | Collects findings from many services in one place |
| AWS WAF and AWS Shield | Web application firewall and DDoS protection |
| S3 Block Public Access | Prevents buckets from being made public |
| AWS Organizations | Account structure with service control policies |
Security in Microsoft Azure
| Service | Job |
|---|---|
| Microsoft Entra ID | Identity service (formerly Azure Active Directory), with MFA and Conditional Access |
| Azure role based access control (RBAC) | Controls who can do what on resources |
| Privileged Identity Management | Just in time, time limited admin access |
| Network security groups (NSG) | Allow and deny rules for subnets and network interfaces |
| Azure Firewall | Managed network firewall |
| Azure DDoS Protection | Protection against volumetric attacks |
| Microsoft Defender for Cloud | Posture management and threat protection |
| Microsoft Sentinel | Cloud SIEM and SOAR |
| Azure Monitor | Metrics and logs, including the activity log |
| Azure Key Vault | Stores keys, secrets and certificates |
| Azure Policy | Enforces rules on how resources are configured |
Security in Google Cloud Platform (GCP)
| Service | Job |
|---|---|
| Cloud IAM | Roles and permissions on projects and resources |
| VPC firewall rules | Allow and deny traffic for instances |
| Cloud Audit Logs | Admin activity, data access and system event logs |
| Security Command Center | Central view of risks, vulnerabilities and threats |
| Cloud KMS | Key management |
| Secret Manager | Stores secrets |
| VPC Service Controls | A perimeter that reduces the risk of data exfiltration from managed services |
| Organization Policy | Constraints applied across the resource hierarchy |
| Cloud Armor | Web application firewall and DDoS defense |
General cloud security best practices and tools
- Least privilege. Grant the minimum role, review permissions often, and remove unused accounts.
- MFA everywhere. Especially for administrators and the root or global admin account.
- No long lived keys in code. Use roles, managed identities and a secrets store.
- Encrypt data. At rest and in transit, with managed keys, and rotate them.
- Turn on logging. Send audit logs to a protected, separate location and alert on unusual events.
- Close the network by default. Allow only needed ports, and use private connectivity for internal services.
- Check configuration continuously. Use CSPM and policy rules to find drift.
- Patch and scan. Images, workloads and containers.
- Back up and test recovery.
- Apply Zero Trust. Verify each request, regardless of network location.
| Tool type | What it does |
|---|---|
| CSPM | Posture and misconfiguration checks |
| CWPP | Protects workloads such as VMs and containers |
| CASB | Policy enforcement and shadow IT discovery between users and services |
| CIEM | Reviews and trims cloud permissions |
| SIEM and SOAR | Collect cloud logs, detect and automate response |
| Scanners | Open source auditing tools such as ScoutSuite and Prowler |
A worked example
A security team wants to know who deleted a virtual machine in AWS last night. The right source is CloudTrail, which records API calls with the identity and time. In Azure the equivalent is the activity log in Azure Monitor, and in GCP it is Cloud Audit Logs.
If the team also wants an alert for a stolen credential used from an odd location, a threat detection service such as GuardDuty, Defender for Cloud or Security Command Center would raise it.
How the exam asks about this
- "Which AWS service records API activity for an account?" → AWS CloudTrail.
- "Which Azure service is a cloud native SIEM?" → Microsoft Sentinel.
- "Which GCP service provides a central view of security risks?" → Security Command Center.
What to remember for the exam
- AWS: IAM, CloudTrail, GuardDuty, Inspector, Macie, KMS, Security Hub.
- Azure: Entra ID, RBAC, NSG, Defender for Cloud, Sentinel, Key Vault.
- GCP: Cloud IAM, Cloud Audit Logs, Security Command Center, Cloud KMS, VPC Service Controls.
- Security groups are stateful, network ACLs are stateless.
- Least privilege, MFA, encryption, logging and configuration checks apply on every cloud.
Do not confuse the activity log (who did what to the control plane) with a threat detection service (which flags suspicious behavior). They answer different questions.
Common mistakes
Mixing up platform names. Learn each service by its job, then match it across clouds.
Leaving logs only on the account that may be attacked. Store audit logs in a separate protected place.
Using the root or global admin account for daily work. Protect it with MFA and keep it for rare tasks.
Check yourself
Which AWS service finds sensitive data stored in S3?
Amazon Macie.
What is the difference between a security group and a network ACL in AWS?
A security group is stateful and works at the instance level, while a network ACL is stateless and works at the subnet level.
What does a CASB do?
It enforces security policy between users and cloud services and discovers shadow IT.
Topic 4 of 5 in Enterprise Virtual, Cloud, and Wireless Network Protection
Test yourself on Enterprise Virtual, Cloud, and Wireless Network Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.