CCSP Cloud Platform and Infrastructure Security Practice Test 1 — 15 Questions

Question 1

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

Accepted Answer

AMD SEV (Secure Encrypted Virtualization). AMD Secure Encrypted Virtualization (SEV) encrypts the memory of each VM with a unique key, preventing a malicious VM from reading another VM's memory. This hardware-assisted technology isolates VM memory at the hardware level, making it the correct choice for this scenario. IOMMU (Input-Output Memory Management Unit) controls device DMA access, not CPU memory accesses between VMs. Intel TXT ensures trusted boot, and Intel SGX protects application enclaves, neither of which prevent cross-VM memory reads.

Answer

IOMMU (Input-Output Memory Management Unit)

Answer

Intel TXT (Trusted Execution Technology)

Answer

Intel SGX (Software Guard Extensions)

Question 2

An organization uses a multi-cloud strategy and wants to connect their on-premises data center to multiple cloud providers with a single private, low-latency connection. Which solution should they consider?

Accepted Answer

Software-defined cloud interconnect (e.g., Megaport). A dedicated software-defined cloud interconnect, like Megaport or Equinix Fabric, allows connecting to multiple cloud providers from a single port. Direct connections to a single provider would require separate connections for each provider.

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Question 3

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

Accepted Answer

Private Endpoint (Service Endpoint). Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.

Answer

VPN Connection

Answer

Internet Gateway

Answer

NAT Gateway

Question 4

A company uses serverless functions to process sensitive data. The functions need to access a database in a private subnet. What is the most secure way to enable this access without exposing the database to the internet?

Accepted Answer

Use a VPC endpoint for the database and attach the serverless function to the VPC. Placing the serverless function inside a virtual private cloud (VPC) via VPC integration and using a VPC endpoint or private connectivity allows secure, private access to the database instance without internet traversal.

Answer

Store database credentials in environment variables with encryption

Answer

Configure a database proxy and connect via a NAT gateway

Answer

Assign a public IP to the serverless function and allow its IP in the database firewall rule

Question 5

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 6

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag grants all capabilities and disables most security mechanisms, making container escape trivial. Other options like Seccomp or AppArmor would restrict actions, and read-only root filesystem would prevent writes, but the privileged mode is the most direct enabler.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 7

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies, removing package managers, shells, and other utilities that could be exploited. This reduces the attack surface significantly.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 8

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool for signing and verifying container images. It integrates with admission controllers like Kyverno or OPA Gatekeeper to enforce that only signed images are deployed.

Answer

Clair

Answer

Trivy

Answer

Snyk Container

Question 9

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 10

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint

Question 11

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

Accepted Answer

Configure the serverless function with virtual private cloud integration. Virtual private cloud (VPC) integration allows the serverless function to be deployed inside a VPC, enabling private access to resources like a database service. Internet access is not required.

Answer

Assign a public IP to the serverless function

Answer

Enable public access on the database service

Answer

Use a network address translation gateway to route traffic

Question 12

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) integrates with API Gateway to filter and monitor HTTP requests for common web exploits. Security groups operate at the network layer, not application layer.

Answer

IAM policies

Answer

Security groups on the API Gateway

Answer

Network ACLs on the VPC

Question 13

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

Accepted Answer

Role and RoleBinding in the 'dev' namespace. RBAC uses Role and RoleBinding for namespace-scoped permissions. ClusterRole and ClusterRoleBinding are cluster-scoped. A Role with permissions to create pods in the 'dev' namespace, bound via RoleBinding, achieves the goal.

Answer

ClusterRole and ClusterRoleBinding

Answer

PodSecurityPolicy (deprecated)

Answer

NetworkPolicy

Question 14

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

Accepted Answer

Regular patching of the hypervisor. Hypervisor patching is the primary defense against VM escape, as these attacks exploit vulnerabilities in the hypervisor. Network segmentation and encryption do not prevent the attack itself.

Answer

Encryption of VM disks

Answer

Use of Type 2 hypervisors

Answer

Network segmentation between VMs

Question 15

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Accepted Answer

Set the container to run as a non-root user. Dropping all Linux capabilities and setting the container to run as a non-root user are effective. Running with a read-only root filesystem also helps, but the question asks for two measures: dropping capabilities and using a non-root user are the most direct.

Answer

Enable host networking mode

Answer

Use a privileged container

Answer

Mount the host filesystem as read-write