CCSP Cloud Platform and Infrastructure Security — 20 Questions

Question 1

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

Accepted Answer

AMD SEV (Secure Encrypted Virtualization). AMD Secure Encrypted Virtualization (SEV) encrypts the memory of each VM with a unique key, preventing a malicious VM from reading another VM's memory. This hardware-assisted technology isolates VM memory at the hardware level, making it the correct choice for this scenario. IOMMU (Input-Output Memory Management Unit) controls device DMA access, not CPU memory accesses between VMs. Intel TXT ensures trusted boot, and Intel SGX protects application enclaves, neither of which prevent cross-VM memory reads.

Answer

IOMMU (Input-Output Memory Management Unit)

Answer

Intel TXT (Trusted Execution Technology)

Answer

Intel SGX (Software Guard Extensions)

Question 2

An organization uses a multi-cloud strategy and wants to connect their on-premises data center to multiple cloud providers with a single private, low-latency connection. Which solution should they consider?

Accepted Answer

Software-defined cloud interconnect (e.g., Megaport). A dedicated software-defined cloud interconnect, like Megaport or Equinix Fabric, allows connecting to multiple cloud providers from a single port. Direct connections to a single provider would require separate connections for each provider.

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Question 3

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

Accepted Answer

Private Endpoint (Service Endpoint). Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.

Answer

VPN Connection

Answer

Internet Gateway

Answer

NAT Gateway

Question 4

A company uses serverless functions to process sensitive data. The functions need to access a database in a private subnet. What is the most secure way to enable this access without exposing the database to the internet?

Accepted Answer

Use a VPC endpoint for the database and attach the serverless function to the VPC. Placing the serverless function inside a virtual private cloud (VPC) via VPC integration and using a VPC endpoint or private connectivity allows secure, private access to the database instance without internet traversal.

Answer

Store database credentials in environment variables with encryption

Answer

Configure a database proxy and connect via a NAT gateway

Answer

Assign a public IP to the serverless function and allow its IP in the database firewall rule

Question 5

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 6

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag grants all capabilities and disables most security mechanisms, making container escape trivial. Other options like Seccomp or AppArmor would restrict actions, and read-only root filesystem would prevent writes, but the privileged mode is the most direct enabler.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 7

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies, removing package managers, shells, and other utilities that could be exploited. This reduces the attack surface significantly.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 8

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool for signing and verifying container images. It integrates with admission controllers like Kyverno or OPA Gatekeeper to enforce that only signed images are deployed.

Answer

Clair

Answer

Trivy

Answer

Snyk Container

Question 9

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 10

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint

Question 11

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

Accepted Answer

Configure the serverless function with virtual private cloud integration. Virtual private cloud (VPC) integration allows the serverless function to be deployed inside a VPC, enabling private access to resources like a database service. Internet access is not required.

Answer

Assign a public IP to the serverless function

Answer

Enable public access on the database service

Answer

Use a network address translation gateway to route traffic

Question 12

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) integrates with API Gateway to filter and monitor HTTP requests for common web exploits. Security groups operate at the network layer, not application layer.

Answer

IAM policies

Answer

Security groups on the API Gateway

Answer

Network ACLs on the VPC

Question 13

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

Accepted Answer

Role and RoleBinding in the 'dev' namespace. RBAC uses Role and RoleBinding for namespace-scoped permissions. ClusterRole and ClusterRoleBinding are cluster-scoped. A Role with permissions to create pods in the 'dev' namespace, bound via RoleBinding, achieves the goal.

Answer

ClusterRole and ClusterRoleBinding

Answer

PodSecurityPolicy (deprecated)

Answer

NetworkPolicy

Question 14

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

Accepted Answer

Regular patching of the hypervisor. Hypervisor patching is the primary defense against VM escape, as these attacks exploit vulnerabilities in the hypervisor. Network segmentation and encryption do not prevent the attack itself.

Answer

Encryption of VM disks

Answer

Use of Type 2 hypervisors

Answer

Network segmentation between VMs

Question 15

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Accepted Answer

Set the container to run as a non-root user. Dropping all Linux capabilities and setting the container to run as a non-root user are effective. Running with a read-only root filesystem also helps, but the question asks for two measures: dropping capabilities and using a non-root user are the most direct.

Answer

Enable host networking mode

Answer

Use a privileged container

Answer

Mount the host filesystem as read-write

Question 16

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

Accepted Answer

Sign images using Cosign. Image signing, vulnerability scanning, and using immutable tags are key supply chain security practices. Using the 'latest' tag is risky, and running containers as root is insecure.

Answer

Always use the 'latest' tag for base images

Answer

Run containers with root privileges by default

Question 17

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. AWS WAF protects the application from web exploits, and security groups act as instance-level firewalls to control traffic between tiers. NACLs are subnet-level and less granular.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 18

A security architect is designing a multi-tenant cloud environment. Which hypervisor type provides the strongest isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

VMware ESXi (Type 1). Type 1 hypervisors run directly on hardware, minimizing the attack surface and providing strong isolation. Type 2 hypervisors run on top of an OS, adding extra layers of vulnerability.

Answer

VMware Workstation (Type 2)

Answer

KVM (Type 2)

Answer

VirtualBox (Type 2)

Question 19

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 20

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Accepted Answer

Extended Page Tables (EPT). Memory isolation is enforced by the hypervisor using Extended Page Tables (EPT) or similar technologies. EPT ensures that each VM's memory mappings are isolated, preventing one VM from accessing another's memory.

Answer

Seccomp profiles

Answer

CPU pinning

Answer

IOMMU