Module 11 · Multi Cloud Security Curriculum
Multi-Cloud Architecture & Zero Trust
6 hours of structured interview prep covering multi-cloud security design, Zero Trust Architecture, SASE, and inter-cloud connectivity.
20
Interview Q&As
25
MCQ Questions
4
Simulations
6h
Module Duration
Topics Covered
| Topic | Key Areas |
|---|---|
| Multi-Cloud Architecture | Drivers, challenges, security design patterns, unified tooling |
| Zero Trust Architecture | NIST 800-207, BeyondCorp, 5 pillars, principles |
| Secure Inter-Cloud Connectivity | Direct Connect, ExpressRoute, Megaport, SD-WAN |
| Identity-Centric Security | Federated IdP, JIT access, continuous authentication |
| SASE & SSE | ZTNA, CASB, SWG, FWaaS, SD-WAN convergence |
| Future Trends | Confidential computing, quantum-safe crypto, AI SecOps |
💡 Exam Relevance: Multi-cloud and Zero Trust are core topics in AZ-500, AWS Security Specialty, GCP PCSE, CCSK, and CISM examinations.
Core Concepts · ~15 min
Multi-Cloud & Zero Trust Fundamentals
Multi-Cloud vs Hybrid Cloud
| Model | Definition | Example | Key Security Challenge |
|---|---|---|---|
| Multi-Cloud | Services from 2+ public cloud providers | AWS + Azure + GCP | Fragmented visibility, inconsistent IAM |
| Hybrid Cloud | Public cloud + private cloud/on-prem | Azure + on-prem datacenter | Secure connectivity, data sovereignty |
| Poly-cloud | Different clouds for different workloads (best-of-breed) | AWS for AI/ML, Azure for identity | Skills gap, governance complexity |
💡 Drivers for Multi-Cloud: Avoid vendor lock-in · Best-of-breed services · Geographic coverage · Regulatory requirements · Cost optimization · M&A integration
Zero Trust Architecture — Core Principles
🔍
Verify Explicitly
Always authenticate and authorize based on all available data points
🎯
Least Privilege
Limit user access with JIT and JEA, risk-based adaptive policies
⚠️
Assume Breach
Minimize blast radius, segment access, encrypt end-to-end, use analytics
| ZT Pillar | Focus | Tools/Technologies |
|---|---|---|
| Identity | Strong auth, continuous verification | MFA, Conditional Access, UEBA, Entra ID |
| Device | Device health and compliance | MDM, Intune, device compliance policies |
| Network | Microsegmentation, ZTNA | ZTNA brokers, SD-WAN, network policies |
| Application | Per-session app access | CASB, app proxy, WAF, API gateway |
| Data | Classify, label, protect data | DLP, Azure Purview, CASB, encryption |
SASE Architecture
SASE (Secure Access Service Edge) converges networking (SD-WAN) and security (SSE) into a single cloud-delivered service.
| Component | Type | Function |
|---|---|---|
| SD-WAN | Networking | Intelligent traffic routing across WAN |
| ZTNA | SSE / Security | Zero Trust application access (replaces VPN) |
| CASB | SSE / Security | Cloud app visibility and control |
| SWG | SSE / Security | Secure Web Gateway — web traffic inspection |
| FWaaS | SSE / Security | Firewall-as-a-Service — L7 inspection |
💡 SSE = SASE minus the SD-WAN networking component. Vendors: Zscaler (ZIA + ZPA), Netskope, Palo Alto Prisma Access, Microsoft Entra Internet Access.
Multi-Cloud Security Design Patterns
| Challenge | Solution Pattern | Tools |
|---|---|---|
| Fragmented identity | Federated IdP as single source of truth | Okta, Azure Entra ID, Ping Identity |
| No single pane of glass | Multi-cloud CNAPP | Wiz, Prisma Cloud, Lacework, Orca |
| Inconsistent policy | Policy-as-Code across all clouds | OPA/Rego, Checkov, Sentinel |
| IaC drift | Immutable infrastructure + IaC scanning | Terraform + Checkov, tfsec |
| Log fragmentation | Central SIEM aggregation | Splunk, Microsoft Sentinel |
| Inconsistent secrets | Multi-cloud secrets manager | HashiCorp Vault, AWS Secrets Manager |
| Inter-cloud connectivity | Private backbone or SD-WAN | Megaport, Equinix, Cisco SD-WAN |
Inter-Cloud Connectivity Options
| Option | Speed | Cost | Use Case |
|---|---|---|---|
| Public internet + TLS | Variable | Low | Non-sensitive, latency-tolerant workloads |
| IPSec VPN tunnel | Up to 1.25 Gbps | Low | SMB/dev environments |
| SD-WAN overlay | High | Med | Branch offices, multi-cloud routing |
| Megaport / Equinix (NaaS) | Up to 100 Gbps | High | Enterprise, low latency cross-cloud |
| AWS Direct Connect + Azure ExpressRoute (same colo) | Dedicated | High | Regulated industries, large data transfers |
Interview Q&A · 20 Questions
Interview Questions & Model Answers
Click to expand each question. Difficulty: Easy Medium Hard
1What is multi-cloud and how does it differ from hybrid cloud?Easy▼
Multi-cloud means using services from two or more public cloud providers (e.g., AWS + Azure + GCP) simultaneously. Hybrid cloud combines public cloud with private cloud or on-premises infrastructure.
- Multi-cloud: all workloads in public clouds, different providers for different services
- Hybrid: integrates on-prem data centres with cloud for data sovereignty, legacy app support
- Key multi-cloud drivers: avoid vendor lock-in, best-of-breed services, geographic reach, regulatory compliance, M&A
💡 Interviewers often ask: "Why would a company choose multi-cloud over single cloud?" Answer: risk distribution, negotiating leverage, service specialization (AWS for ML, Azure for identity).
2What are the main security challenges of a multi-cloud environment?Medium▼
- Fragmented visibility: each cloud has different dashboards, logs, and security tools — no single pane of glass
- Inconsistent IAM: AWS IAM policies, Azure RBAC, and GCP IAM all work differently; policy drift
- Skills gap: need expertise across multiple platforms simultaneously
- Network complexity: connecting VPCs, VNets, and GCP VPCs privately requires complex routing
- Compliance mapping: must demonstrate controls across all environments to auditors
- Data residency: data may land in unexpected regions depending on provider defaults
💡 Solution pattern: centralize identity (federated IdP), centralize logging (SIEM), use multi-cloud CNAPP (Wiz/Prisma), enforce Policy-as-Code (OPA).
3What is Zero Trust Architecture and what are its core principles?Easy▼
Zero Trust Architecture (ZTA) is a security model based on the principle of "never trust, always verify" — no user or device is trusted by default, even if inside the corporate network.
Three core principles (Microsoft model):
Three core principles (Microsoft model):
- Verify Explicitly: authenticate and authorize based on all available data points (identity, location, device health, service/workload, data classification, anomalies)
- Use Least Privileged Access: limit user access with JIT/JEA, risk-based adaptive policies, data protection
- Assume Breach: minimize blast radius, segment access, encrypt end-to-end, use analytics to get visibility, drive threat detection
💡 NIST SP 800-207 is the authoritative ZTA standard. ZTA is a strategy/philosophy, not a single product. It must be applied across identity, device, network, application, and data pillars.
4What is Google BeyondCorp and what did it pioneer?Medium▼
BeyondCorp is Google's implementation of Zero Trust, developed after the 2009 Operation Aurora attack. Google moved away from a perimeter-based VPN model where internal network = trusted.
Key innovations:
Key innovations:
- Access decisions based on device inventory + user identity + context — not network location
- All corporate resources accessed over the internet with strong authentication (no VPN required)
- Device trust certificate issued to compliant managed devices
- Access proxy (Identity-Aware Proxy) enforces authorization per request
💡 Real-world impact: Google engineers access internal tools from coffee shops exactly the same way as from the office — no VPN, all context-based. Published as public research papers in 2014–2018.
5What is NIST SP 800-207?Hard▼
NIST SP 800-207 is the definitive US government standard for Zero Trust Architecture, published in August 2020.
Key components:
Key components:
- Defines ZTA tenets: all data/services are resources; all communication is secured regardless of network location; access is granted per-session; access policy is dynamic and context-aware
- Identifies ZTA logical components: Policy Engine, Policy Administrator, Policy Enforcement Point (PEP)
- Describes three ZTA approaches: identity-based, network-based, and software-defined perimeter
- Covers ZTA deployment scenarios and migration strategies
💡 Government contractors and FedRAMP-authorized vendors frequently reference NIST 800-207. Know the Policy Engine/Administrator/Enforcement Point trio for senior roles.
6How do you centralize identity management across multiple cloud providers?Hard▼
Use a federated Identity Provider (IdP) as the single authoritative source of identity:
- Step 1: Choose a central IdP — Azure Entra ID, Okta, Ping Identity, or Google Workspace
- Step 2: Federate to AWS via SAML 2.0 / OIDC (AWS IAM Identity Center), assign roles via SCIM provisioning
- Step 3: Federate to GCP via Workforce Identity Federation (OIDC/SAML)
- Step 4: Enforce consistent MFA and Conditional Access policies from the central IdP
- Step 5: Use SCIM to automatically provision/deprovision users across all clouds
💡 Critical benefit: when an employee leaves, disabling them in the IdP removes access from all three clouds simultaneously — eliminating orphaned accounts.
7What is Policy-as-Code and how does OPA enable multi-cloud consistency?Medium▼
Policy-as-Code (PaC) means defining security and governance rules in code (version-controlled, testable, automated) instead of manual processes.
OPA (Open Policy Agent) is a general-purpose policy engine using the Rego language:
OPA (Open Policy Agent) is a general-purpose policy engine using the Rego language:
- Write policies once in Rego → enforce across Kubernetes, Terraform, APIs, Envoy, cloud configurations
- Decouples policy decisions from application code
- Enables pre-deployment policy checks in CI/CD (Conftest)
- Cloud-agnostic: works with AWS, Azure, and GCP resources
💡 OPA is the CNCF standard for policy. Kubernetes uses OPA/Gatekeeper as an admission controller. HashiCorp Sentinel is similar but specific to HashiCorp tools.
8What is SASE and what components does it combine?Medium▼
SASE (Secure Access Service Edge), pronounced "sassy", converges wide-area networking (SD-WAN) and network security (SSE) into a unified, cloud-delivered service — coined by Gartner in 2019.
Components:
Components:
- SD-WAN: intelligent WAN routing, traffic optimization
- ZTNA: Zero Trust Network Access — replaces VPN, app-level access
- CASB: Cloud Access Security Broker — SaaS visibility and control
- SWG: Secure Web Gateway — web proxy, malware inspection
- FWaaS: Firewall-as-a-Service — L7 inspection, threat prevention
💡 SSE = SASE minus SD-WAN. If a company already has SD-WAN and wants to add cloud security, they add SSE. Microsoft Entra Internet/Private Access are Microsoft's SSE offering.
9What is the difference between ZTNA and traditional VPN?Easy▼
| Feature | Traditional VPN | ZTNA |
|---|---|---|
| Trust model | Network-based: once connected, trusted | Identity + context: per-request verification |
| Access scope | Full network segment access | Per-application access only |
| Lateral movement | High risk — can reach any internal host | Minimized — no network-level access |
| User experience | Slow, client software required | Seamless, browser-based options |
| Scalability | VPN concentrator bottleneck | Cloud-delivered, elastic |
| Visibility | Limited — IP-level only | Full app-level audit trail |
💡 ZTNA is one of the biggest Zero Trust wins: a compromised device or credential in a ZTNA model can only reach the specific apps it was authorized for — not the entire network.
10How do you achieve consistent logging across AWS, Azure, and GCP?Hard▼
- AWS: Enable CloudTrail in all regions → send to S3 → stream to SIEM via Kinesis Firehose or direct connector
- Azure: Enable Diagnostic Settings on all resources → send to Log Analytics Workspace → Microsoft Sentinel
- GCP: Enable Cloud Audit Logs → export via Log Sink → Pub/Sub → SIEM connector
- Central SIEM: Microsoft Sentinel (has native AWS + GCP connectors) or Splunk Cloud (AWS/Azure/GCP add-ons)
- Normalization: Use OCSF (Open Cybersecurity Schema Framework) or SIEM-specific data models to normalize across providers
- Retention: Route to cold storage (S3 Glacier, Azure Archive) for long-term compliance retention
💡 The biggest challenge is normalization — CloudTrail events, Azure Activity Log entries, and GCP Audit Logs have completely different schemas. A good SIEM parser/connector is essential.
11What is a multi-cloud CNAPP? Name examples of vendors.Medium▼
CNAPP (Cloud Native Application Protection Platform) unifies CSPM + CWPP + CIEM into a single platform for comprehensive cloud security visibility across environments.
- CSPM: Cloud Security Posture Management — misconfiguration detection
- CWPP: Cloud Workload Protection Platform — runtime protection for VMs, containers, serverless
- CIEM: Cloud Infrastructure Entitlement Management — over-privileged IAM detection
- Wiz: agentless, graph-based attack path analysis, all three major clouds
- Palo Alto Prisma Cloud: comprehensive, strong container/K8s security
- Lacework: anomaly-based detection, strong DevSecOps integrations
- Orca Security: agentless SideScanning, no performance impact
💡 Wiz became the fastest-growing enterprise security company to reach $100M ARR. Its "attack path" visualization showing how misconfigurations chain together to reach crown jewels is a key differentiator.
12How does microsegmentation support Zero Trust?Medium▼
Microsegmentation applies granular network access controls at the workload level, implementing the "assume breach" pillar of Zero Trust by limiting lateral movement.
- Traditional segmentation: VLANs/subnets — coarse-grained, attacker who breaches a subnet can reach all hosts in it
- Microsegmentation: policies applied per workload/container/VM — even within the same subnet, only authorized communication is allowed
- East-west traffic (server to server) is controlled, not just north-south (internet to server)
- Cloud implementations: AWS Security Groups per EC2/ENI, Kubernetes NetworkPolicies per pod, Istio service mesh (mTLS between microservices)
💡 Microsegmentation is critical in cloud because workloads in the same VPC/subnet are not automatically trusted. A compromised EC2 instance should not be able to reach the database — even if they're in the same subnet.
13What is confidential computing?Hard▼
Confidential computing protects data in use (during processing) using hardware-based Trusted Execution Environments (TEEs) — complementing encryption at rest and in transit.
- Data is encrypted in memory, inaccessible even to the hypervisor, cloud provider, or privileged OS
- Intel TDX (Trust Domain Extensions) and AMD SEV-SNP (Secure Encrypted Virtualization): encrypt VM memory
- Intel SGX (Software Guard Extensions): encrypted CPU enclaves for specific application code
- Use cases: multi-party computation, ML on sensitive data (medical/financial), key management HSMs, blockchain
- Cloud support: Azure Confidential VMs, AWS Nitro Enclaves, GCP Confidential VMs
💡 Addresses the "malicious insider at CSP" threat model. Even if a cloud provider employee or a hypervisor-level attacker gains access, encrypted memory cannot be read without the TEE attestation key.
14What is identity federation in a multi-cloud context?Medium▼
Identity federation allows users to authenticate once with a trusted Identity Provider (IdP) and access resources across multiple cloud platforms without separate credentials for each.
- Protocol: SAML 2.0 or OIDC used to exchange identity assertions between IdP and cloud SP (Service Provider)
- AWS: IAM Identity Center (SSO) with SAML federation from Entra ID/Okta; Workforce Identity Federation for external IdPs
- Azure: B2B federation with Google Workspace, Salesforce, other Azure ADs
- GCP: Workforce Identity Federation (SAML/OIDC from any IdP)
- Benefits: single set of credentials, centralized MFA policy, instant offboarding across all clouds
💡 Without federation, employees have separate IAM users in AWS, separate Azure accounts, and separate GCP service accounts — meaning 3x credentials to manage, rotate, and offboard.
15How do you connect AWS and Azure privately without going over the internet?Hard▼
Several options for private AWS-Azure connectivity:
- Megaport (NaaS): Connect AWS Direct Connect + Azure ExpressRoute at the same Megaport PoP — private layer 2/3 circuit between clouds, no internet traversal. Best for enterprise.
- Equinix Fabric: Similar to Megaport — software-defined interconnects via Equinix colocation facilities
- IPSec VPN tunnel: AWS VPN + Azure VPN Gateway connected over internet with encryption — functional but subject to internet variability
- Azure ExpressRoute + AWS Direct Connect at same colo: both terminate at same physical facility (e.g., Equinix DC), connected via cross-connect
💡 Megaport's Virtual Cross Connect (VXC) is the most common enterprise solution. It appears as a private dedicated circuit on both sides but is provisioned via a web portal in minutes.
16What are the risks of vendor lock-in in cloud security?Medium▼
- Proprietary security services: AWS GuardDuty, Azure Defender — difficult to replace/migrate if changing providers
- IAM model differences: AWS IAM policies don't translate to Azure RBAC — migration requires significant rework
- Logging format lock-in: CloudTrail logs can't be directly ingested by GCP tools without transformation
- Pricing leverage: heavy lock-in reduces negotiation power on renewals
- Resilience risk: a single CSP outage (e.g., AWS us-east-1 2021) takes down everything
💡 True multi-cloud security requires accepting some complexity in exchange for resilience and negotiating leverage. Not every workload needs to be multi-cloud — only the most critical ones.
17What is an identity-centric security model?Medium▼
Identity-centric security treats identity as the primary control plane for security decisions — replacing the traditional network perimeter ("castle-and-moat") model.
- In cloud, there is no physical perimeter — anyone can attempt to call an API from anywhere
- IAM policies become the new firewall — what can this identity do, to what resource, under what conditions?
- Every access decision evaluates: Who (identity) + What device + From where + What resource + What time
- Continuous authentication: re-verify identity throughout a session (not just at login)
- JIT (Just-in-Time) access: privileges granted on-demand for specific tasks, then revoked
💡 The Gartner quote captures it: "Identity is the new perimeter." The best firewall in the world won't stop an attacker with valid stolen credentials. But strong identity controls (MFA + UEBA + JIT) will.
18What is Megaport/Equinix and how do they enable multi-cloud networking?Hard▼
Megaport and Equinix are Network-as-a-Service (NaaS) providers that operate global carrier-neutral colocation facilities where cloud on-ramps (AWS Direct Connect, Azure ExpressRoute, GCP Cloud Interconnect) physically terminate.
- Megaport: Virtual Cross Connects (VXCs) enable point-to-point private circuits between any two cloud/network endpoints on the Megaport fabric, provisioned via portal/API in minutes
- Equinix Fabric: Similar capability across 240+ Equinix IBX data centres globally
- How it works: Company connects its on-prem router to Megaport PoP → provision VXC to AWS Direct Connect gateway + another VXC to Azure ExpressRoute → both clouds now on private fabric
- Benefit: No internet traversal, predictable latency, SLA-backed bandwidth
💡 Megaport is particularly popular for hybrid multi-cloud because a single physical port gives you a "software-defined" connection to dozens of cloud on-ramps via a web portal.
19What are future cloud security trends you should be aware of?Medium▼
- SASE maturation: Convergence of networking + security — VPN replacement at scale
- Confidential computing: Encrypt data in use; multi-party compute without revealing inputs
- Post-quantum cryptography: NIST PQC standards (CRYSTALS-Kyber, Dilithium) being adopted by cloud providers; quantum computers threaten RSA/ECC
- AI-driven SecOps: LLM-powered SIEM queries (Microsoft Copilot for Security), automated threat hunting, AI-generated playbooks
- Platform Engineering for security: Security as internal developer platform APIs — developers "order" secure infrastructure
- SBOM + supply chain security: Software Bill of Materials mandated; Sigstore/Cosign for artifact signing
💡 "Harvest now, decrypt later" attacks make post-quantum readiness urgent even before quantum computers are viable — encrypted data stolen today can be decrypted once quantum is available.
20How would you design a Zero Trust architecture for a multi-cloud organization?Hard▼
A structured answer covering all ZT pillars in a multi-cloud context:
- Identity: Federated IdP (Entra ID/Okta) → MFA enforced for all users → Conditional Access (device compliance, location, risk score) → JIT for privileged access (PIM) → SCIM provisioning to all clouds
- Device: MDM enrollment required (Intune/Jamf) → device health attestation → non-compliant devices blocked regardless of valid credentials
- Network: Replace VPN with ZTNA (Zscaler ZPA/Netskope) → microsegmentation within each cloud VPC/VNet → private inter-cloud connectivity via Megaport → no direct internet-to-internal access
- Application: CASB for SaaS app control → WAF/API gateway for web apps → per-session access tokens → OAuth 2.0 with PKCE
- Data: CNAPP for data classification across all clouds → DLP policies → encrypt all data at rest (CMK) and in transit (TLS 1.3) → data residency controls
- Visibility: Centralized SIEM (Sentinel/Splunk) aggregating all cloud logs → UEBA for behavioral baseline → continuous compliance scanning (Wiz/Prisma)
💡 Structure your answer with the 5 pillars — interviewers for senior cloud security architect roles expect pillar-by-pillar thinking, not generic "use MFA and encryption."
MCQ Quiz · 25 Questions
Multiple Choice Questions
Select an answer then click Check. Explanations shown after each submission.
Progress:
0 / 25
Simulation 1 · Zero Trust Pillar Classifier
Zero Trust Pillar Classifier
Classify each scenario into the correct Zero Trust pillar using the dropdown.
Simulation 2 · Multi-Cloud Tool Mapper
Multi-Cloud Security Tool Mapper
Match each tool/service to its primary function in multi-cloud security.
Simulation 3 · SASE Component Builder
SASE Component Builder
Drag each technology chip into the correct zone — SASE Component or Not SASE.
ZTNA
CASB
SWG
FWaaS
SD-WAN
Traditional VPN Appliance
On-premises SIEM
Physical Firewall Hardware
🌐 SASE Components
Cloud-delivered networking + security convergence
🚫 Not SASE
Traditional or on-premises security/networking
Simulation 4 · Multi-Cloud Architecture Security Checklist
Multi-Cloud Architecture Security Checklist
Assess a fictional multi-cloud organization's security posture. Toggle each control and submit for your score.