CCSP Practice Test 23 — 15 Questions

Question 1

An organization uses Azure Functions and needs to ensure that the function can securely access a database in a private VNet. What is the recommended approach?

Accepted Answer

Enable VNet integration for the function app and configure the function to use the private IP of the database. VNet integration allows Azure Functions to access resources in a virtual network without exposing them to the internet, using a private IP.

Answer

Place the function in the same VNet as the database without any additional configuration

Answer

Use a VPN connection from the function to the database VNet

Answer

Store database credentials in environment variables and use a public endpoint with IP whitelisting

Question 2

A cloud architect is designing a multi-tenant environment. To ensure that a tenant's virtual machine cannot access another tenant's memory, which resource isolation technique should be enforced at the hypervisor level?

Accepted Answer

Memory isolation via hardware-enforced page tables. Memory isolation prevents cross-VM memory access; hypervisors enforce this by allocating dedicated memory pages.

Answer

IOMMU for device isolation

Answer

CPU pinning

Answer

Network segmentation with VLANs

Question 3

Which TWO of the following are characteristics of security groups compared to network ACLs in a cloud VPC? (Select two.)

Accepted Answer

Stateful – return traffic is automatically allowed. Security groups are stateful (return traffic allowed) and support only allow rules. NACLs are stateless and support both allow and deny rules.

Answer

Operate at the subnet level

Answer

Stateless – each packet is evaluated independently

Answer

Support both allow and deny rules

Question 4

A financial services company must comply with a regulation that requires encryption keys used for cloud services to be generated and stored on-premises in a Hardware Security Module (HSM). The cloud provider must not have any access to the keys. Which key management approach should the company adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) ensures the key never leaves the on-premises HSM, providing the highest level of control and preventing cloud provider access.

Answer

Cloud KMS with HSM-backed keys

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

Bring Your Own Key (BYOK)

Question 5

During a security review of a serverless application, you notice that a Lambda function's execution role has permissions to delete all S3 buckets in the account. What is the most appropriate remediation to align with the principle of least privilege?

Accepted Answer

Create a custom IAM role that grants only the necessary actions on a specific S3 bucket. Creating a custom role with only the specific actions needed (e.g., s3:PutObject for a specific bucket) reduces blast radius. Using managed policies may grant excessive permissions; environment variables and VPC integration are unrelated.

Answer

Store S3 bucket names in environment variables instead of hardcoding

Answer

Attach the AWS managed policy 'AmazonS3ReadOnlyAccess'

Answer

Remove the Lambda function's VPC integration

Question 6

A cloud security team is reviewing container security practices. Which of the following is the most effective way to minimize the attack surface of a container image?

Accepted Answer

Using a minimal base image such as distroless. Distroless images contain only the application and its runtime dependencies, eliminating unnecessary packages and reducing the attack surface.

Answer

Using the latest version of a base image

Answer

Using the :latest tag to ensure freshness

Answer

Scanning the image for CVEs after deployment

Question 7

A company has enabled object versioning on its cloud storage bucket to protect against accidental deletion. A ransomware attack encrypts all objects and creates new versions. To recover the data, the company needs to restore the previous unencrypted versions. What is the most efficient recovery method?

Accepted Answer

Delete the current versions or use the previous versions directly. Since versioning is enabled, the company can delete the current (encrypted) versions or use the previous versions directly, effectively reverting to the state before the attack.

Answer

Use the object lifecycle policy to delete current versions

Answer

Request the cloud provider to restore from their backups

Answer

Restore from a backup stored in a different region

Question 8

A cloud security team wants to enforce that only signed container images are deployed in their Kubernetes cluster. Which admission controller can validate image signatures at deploy time?

Accepted Answer

Kyverno. Admission controllers like OPA Gatekeeper or Kyverno can enforce policies to only allow images signed by trusted authorities.

Answer

HashiCorp Vault

Answer

Consul

Answer

Trivy

Question 9

A healthcare organization is storing patient records in a cloud object storage service. They must encrypt data at rest with keys they control and rotate regularly, but they do not want to manage the encryption process themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows the customer to create and manage keys in the cloud KMS, while the cloud service performs encryption/decryption using those keys, providing control without operational burden.

Answer

Server-side encryption with cloud provider default keys

Answer

Customer-supplied encryption keys (CSEK)

Answer

Client-side encryption

Question 10

A security engineer is reviewing container security practices. Which tool is specifically designed to scan container images for Common Vulnerabilities and Exposures (CVEs)?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, commonly used in CI/CD pipelines.

Answer

Kubernetes RBAC

Answer

Seccomp

Answer

OPA Gatekeeper

Question 11

In a cloud VPC design, which component acts as a stateful firewall at the instance level, allowing only inbound rules?

Accepted Answer

Security group. Security groups are stateful firewalls that control traffic to instances; they only support allow rules and are stateful.

Answer

Network ACL (NACL)

Answer

Internet gateway

Answer

Route table

Question 12

A company uses AWS and needs to allow a Lambda function in a VPC to access an S3 bucket without traversing the internet. Which solution meets this requirement securely?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the Lambda's VPC. VPC endpoints (Gateway or Interface) allow private access to AWS services without internet traversal. For S3, a Gateway endpoint is commonly used.

Answer

Configure a NAT gateway in the VPC and route traffic through it

Answer

Use VPC peering to connect to the S3 bucket's VPC

Answer

Assign a public IP to the Lambda and use an internet gateway

Question 13

During a security assessment of a Kubernetes cluster, you discover that a container is running as root with privileged mode enabled. Which of the following is the most critical risk associated with this configuration?

Accepted Answer

Potential for container escape to the host OS. Running as root with privileged mode grants full host access, making container escape to the host OS highly feasible. Seccomp and AppArmor can mitigate, but the core risk is escape.

Answer

Network policy bypass allowing unauthorized pod communication

Answer

Increased memory consumption due to lack of resource limits

Answer

Inability to mount volumes for persistent storage

Question 14

A cloud security professional is evaluating container runtime security. Which Linux capability should be dropped from a container to prevent it from loading kernel modules?

Accepted Answer

CAP_SYS_MODULE. The CAP_SYS_MODULE capability allows loading/unloading kernel modules, which is a common vector for container escape. Dropping it reduces risk.

Answer

CAP_DAC_OVERRIDE

Answer

CAP_CHOWN

Answer

CAP_NET_RAW

Question 15

A security engineer is concerned about a scenario where a malicious process inside a VM breaks out of the virtualized environment to compromise the hypervisor. What is this attack called and what is the primary mitigation?

Accepted Answer

VM escape; regularly patch the hypervisor. VM escape occurs when code inside a VM accesses the hypervisor. Patching the hypervisor closes known vulnerabilities.

Answer

VM sprawl; use resource limits

Answer

Side-channel attack; disable hyperthreading

Answer

Privilege escalation; enable SELinux inside VM