CCSP Practice Test 22 — 15 Questions

Question 1

In a Kubernetes environment, a security team wants to enforce that only images signed by a trusted authority can be deployed. Which component can be used to validate image signatures at admission time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admission controller (e.g., OPA Gatekeeper). Admission controllers like OPA Gatekeeper or Kyverno can verify image signatures before a pod is created. RBAC controls access, not image validity; network policies manage traffic; secrets management handles credentials.

Answer

Network policies

Answer

RBAC policies

Answer

Secrets management with Vault

Question 2

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag grants all capabilities and disables most security mechanisms, making container escape trivial. Other options like Seccomp or AppArmor would restrict actions, and read-only root filesystem would prevent writes, but the privileged mode is the most direct enabler.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 3

A company is deploying a microservices architecture on Kubernetes and wants to implement supply chain security. Which THREE of the following practices should be adopted?

Accepted Answer

Signing container images with Cosign. Image signing ensures integrity, scanning for CVEs identifies vulnerabilities, and using admission controllers to verify signatures enforces policy.

Answer

Allowing all images from public registries

Answer

Using the :latest tag for all images

Question 4

A cloud security architect is designing a data loss prevention (DLP) strategy for a cloud environment that stores sensitive customer data. Which TWO techniques should be implemented to proactively identify and protect sensitive data? (Select TWO.)

Accepted Answer

De-identification transforms. Automated DLP scanning can discover sensitive data, and de-identification transforms can protect data by masking or tokenizing sensitive elements.

Answer

Cross-region replication

Answer

Bucket policies blocking all public access

Answer

Enabling object versioning

Question 5

A cloud security team is designing network security for a multi-VPC architecture in AWS. Which TWO of the following are valid considerations for VPC peering?

Accepted Answer

VPC peering is a one-to-one relationship. VPC peering is a direct, non-transitive connection between two VPCs, and transitive routing is not supported without additional components.

Answer

VPC peering can be used to connect on-premises networks

Answer

VPC peering requires an internet gateway for communication

Answer

VPC peering supports transitive routing across multiple VPCs

Question 6

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Accepted Answer

Extended Page Tables (EPT). Memory isolation is enforced by the hypervisor using Extended Page Tables (EPT) or similar technologies. EPT ensures that each VM's memory mappings are isolated, preventing one VM from accessing another's memory.

Answer

Seccomp profiles

Answer

CPU pinning

Answer

IOMMU

Question 7

A cloud architect is designing VPC connectivity for a global organization with multiple AWS accounts. They need a central hub for connecting many VPCs together, supporting transitive routing. Which service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway acts as a central hub that allows transitive routing between multiple VPCs and on-premises networks.

Answer

Private Link

Answer

VPN Connection

Answer

VPC Peering

Question 8

A security engineer is reviewing container image security. Which of the following practices best ensures that a container image has not been tampered with and originates from a trusted source?

Accepted Answer

Signing the image with Cosign and verifying it at deployment. Image signing using tools like Cosign provides cryptographic verification of image integrity and authenticity. Scanning for CVEs identifies vulnerabilities but does not verify origin.

Answer

Scanning the image with Trivy for CVEs

Answer

Using a minimal base image like Alpine

Answer

Setting the image tag to :latest

Question 9

A cloud security team is implementing container runtime security. Which of the following measures is most effective at preventing a container from breaking out to the host OS?

Accepted Answer

Applying a Seccomp profile that whitelists only necessary syscalls. Seccomp profiles restrict system calls available to containers, significantly reducing the attack surface for container escape vulnerabilities. Dropping capabilities and read-only root filesystem are important but not as comprehensive as seccomp.

Answer

Setting the container's root filesystem to read-only

Answer

Using a non-root user inside the container

Answer

Dropping all Linux capabilities except those required

Question 10

A cloud security architect is designing a multi-tenant virtualized environment. Which type of hypervisor is considered most secure for cloud deployments due to its reduced attack surface and direct hardware control?

Accepted Answer

Type 1 bare-metal hypervisor. Type 1 (bare-metal) hypervisors run directly on hardware without an underlying OS, reducing attack surface and improving isolation. Type 2 hypervisors run on a host OS, adding complexity and potential vulnerabilities.

Answer

Type 2 hosted hypervisor

Answer

Emulated hypervisor (e.g., QEMU without KVM)

Answer

Container runtime (e.g., Docker)

Question 11

Which of the following is the primary benefit of using client-side encryption for data stored in the cloud?

Accepted Answer

Maximum control over encryption keys. Client-side encryption ensures that the cloud provider never has access to the encryption keys or the plaintext data, giving the customer maximum control.

Answer

Automatic key rotation

Answer

Simplified key management

Answer

Reduced latency for data access

Question 12

A security analyst is configuring an API Gateway for a cloud application. The application must handle high traffic and prevent abuse from a single client. Which feature should the analyst enable to limit the number of requests from a client within a specified time window?

Accepted Answer

Rate limiting. Rate limiting throttles requests from a client to prevent abuse and ensure fair usage. API keys authenticate but do not limit rate; WAF filters malicious traffic; TLS enforces encryption.

Answer

TLS enforcement

Answer

Web Application Firewall (WAF) integration

Answer

API key authentication

Question 13

An organization is moving sensitive customer data to the cloud and must ensure that data is encrypted before being sent to the cloud provider. They want to maintain full control over the encryption keys and not rely on the cloud provider for any key management. Which approach should they use?

Accepted Answer

Client-side encryption. Client-side encryption involves encrypting data on-premises or on the client side before uploading to the cloud. The keys are controlled entirely by the customer, and the cloud provider never has access to the plaintext or keys.

Answer

VPN encryption

Answer

Server-side encryption with AWS KMS

Answer

Transparent Data Encryption (TDE)

Question 14

A cloud security engineer is hardening container runtime environments. Which TWO of the following are effective measures to prevent container escape?

Accepted Answer

Dropping all Linux capabilities except those required. Seccomp profiles restrict system calls, and dropping unnecessary Linux capabilities reduces the attack surface, both of which help prevent container escape.

Answer

Using the latest kernel version

Answer

Mounting the host filesystem as read-only

Answer

Running containers in privileged mode

Question 15

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

Accepted Answer

Regular patching of the hypervisor. Hypervisor patching is the primary defense against VM escape, as these attacks exploit vulnerabilities in the hypervisor. Network segmentation and encryption do not prevent the attack itself.

Answer

Encryption of VM disks

Answer

Use of Type 2 hypervisors

Answer

Network segmentation between VMs