CCSP Cloud Platform and Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A financial services company is deploying a new cloud-native application on AWS. The security team needs to ensure that all data stored in Amazon S3 is encrypted at rest using a key that the company controls and can rotate independently of the cloud provider. The company also requires an audit trail of every time the key is used to encrypt or decrypt data. Which AWS service should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. The requirement is for customer-controlled encryption keys with independent rotation and audit logging. AWS KMS customer managed keys provide this by allowing the customer to create and manage keys, set key policies, enable automatic rotation, and log all key usage in CloudTrail. Other services like ACM, Secrets Manager, or CloudHSM do not offer the same integrated functionality for S3 data-at-rest encryption with the required audit capabilities.

Answer

AWS Certificate Manager (ACM) with imported certificates

Answer

AWS Secrets Manager with automatic rotation

Answer

AWS CloudHSM with a custom key store

Question 2

A cloud security architect is designing a secure architecture for a multi-tier web application on Google Cloud. The application consists of a web tier, an application tier, and a database tier. The architect needs to implement network segmentation to limit lateral movement in case of a breach. Which TWO of the following Google Cloud features should be used to achieve micro-segmentation and enforce least privilege at the network layer? (Choose two.)

Accepted Answer

VPC firewall rules with service accounts. VPC firewall rules with service accounts allow identity-based segmentation, ensuring only specific service accounts can communicate between tiers. VPC Service Controls add a security perimeter around services, preventing unauthorized access and data exfiltration. Together, they enforce least privilege and micro-segmentation. Shared VPC, Cloud Armor, and Cloud VPN do not provide the necessary internal segmentation controls for this scenario.

Answer

Cloud Armor security policies

Answer

Cloud VPN with dynamic routing

Answer

Shared VPC with separate projects per tier

Question 3

A cloud security engineer is reviewing the security configuration of an Amazon EC2 instance that hosts a web application. The instance is in a public subnet and must be accessible from the internet on ports 80 and 443. The engineer needs to ensure that the instance is protected from unauthorized access. Which TWO of the following are the MOST effective security controls to implement? (Choose two.)

Accepted Answer

Use an Application Load Balancer (ALB) with a security group that allows only 80 and 443, and place the EC2 instance in a private subnet with a security group that allows traffic only from the ALB.. The most effective controls are to restrict inbound traffic using a security group that allows only ports 80 and 443, and to place the instance behind an ALB in a private subnet with tight security group rules. These network-level controls reduce the attack surface and prevent direct access. Other options either provide no additional protection or are less effective than managed network controls.

Answer

Enable AWS Shield Advanced to protect the instance from DDoS attacks.

Answer

Assign an Elastic IP to the instance and use a host-based firewall to block all traffic except 80 and 443.

Answer

Configure a network ACL on the subnet that allows all inbound traffic and relies on the security group for protection.

Question 4

A company is migrating its on-premises Oracle database to Oracle Cloud Infrastructure (OCI). The security team is concerned about protecting the data at rest and in transit. They want to ensure that the database is encrypted using keys managed by OCI, and that all connections to the database use TLS. Which OCI service should they use to manage the encryption keys?

Accepted Answer

OCI Key Management. OCI Key Management is the dedicated service for creating and managing encryption keys used by OCI services to encrypt data at rest. It supports key rotation, auditing, and integration with OCI Database. OCI Certificates handles TLS certificates, OCI Vault manages secrets, and OCI Data Safe focuses on database security assessment. Only Key Management provides the necessary key management for data-at-rest encryption.

Answer

OCI Vault

Answer

OCI Data Safe

Answer

OCI Certificates

Question 5

A company is migrating a legacy application to Microsoft Azure. The application requires a fixed public IP address and must be protected from volumetric DDoS attacks. The security team also wants to ensure that only HTTP and HTTPS traffic reaches the application. Which Azure service should they use to meet these requirements?

Accepted Answer

Azure Front Door with a Web Application Firewall (WAF) policy and Azure DDoS Protection Standard.. Azure Front Door provides a static anycast IP and integrates with WAF to filter HTTP/HTTPS traffic. Enabling Azure DDoS Protection Standard on the Front Door profile adds volumetric DDoS protection. This combination satisfies the requirements for a fixed public IP, DDoS protection, and HTTP/HTTPS-only access. Other services either lack layer 7 filtering or do not provide a static public IP.

Answer

Azure Traffic Manager with a public IP address and Azure DDoS Protection Standard.

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Load Balancer with a public IP address and Azure DDoS Protection Standard.

Question 6

A cloud security team is designing a landing zone for a new multi-account environment on a public cloud. The team must implement network segmentation, centralized logging, and least privilege access. Which TWO of the following design elements are MOST appropriate to meet these requirements? (Choose two.)

Accepted Answer

A central log archive account that receives logs from all accounts and is immutable, with access restricted to a small security team.. A central immutable log archive account and a shared services account for security tooling are both standard landing zone elements. The log archive centralizes and protects logs, while the shared services account centralizes security controls and connects via VPC peering. Together they support centralized logging, network segmentation, and least privilege. Flat networks, full admin rights, and single-account designs all undermine these goals.

Answer

Granting all accounts full administrator privileges to a central identity provider to simplify access management.

Answer

A single flat network across all accounts to simplify connectivity and reduce the number of VPCs to manage.

Answer

Using a single account for all workloads to reduce complexity and consolidate billing.

Question 7

A financial services firm runs a regulated workload on EC2 instances in a single AWS Region. The compliance team mandates that the encryption keys protecting the EBS volumes must be generated and stored in hardware that the firm controls, must never leave the firm's premises, and must be usable by AWS services over a dedicated link. Which AWS service configuration meets these requirements?

Accepted Answer

AWS Key Management Service with a customer managed key backed by a custom key store in AWS CloudHSM.. Only a KMS customer managed key backed by a custom key store places key generation and storage inside CloudHSM hardware the customer owns, while still letting EBS and other AWS services perform encryption transparently. The alternative designs either leave key custody with AWS, break the EBS integration, or confuse secret storage with key management.

Answer

AWS Key Management Service with an AWS managed key and automatic annual rotation enabled.

Answer

AWS Secrets Manager with a customer managed key and resource-based policies restricting access to the instance role.

Answer

AWS CloudHSM with the keys generated in the cluster and used directly by the application through the PKCS#11 library.

Question 8

A cloud security team is implementing a zero-trust network architecture for their AWS environment. They want to ensure that all access to resources is authenticated and authorized based on multiple factors, and that network segmentation is enforced. Which TWO of the following AWS services or features should be used to achieve these goals? (Choose two.)

Accepted Answer

AWS PrivateLink. Zero-trust architecture requires continuous authentication and authorization of every request, plus network segmentation to prevent lateral movement. IAM policies enforce identity-based access control with conditions, and AWS PrivateLink enables private, segmented connectivity that does not rely on network perimeter trust. Direct Connect, Network Firewall, and Shield Advanced provide connectivity or protection but do not fulfill the identity and segmentation requirements of zero trust.

Answer

AWS Direct Connect

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 9

A cloud security architect is designing a solution to protect sensitive data stored in Amazon S3. The data must be encrypted at rest, and the organization must retain control over the encryption keys, including the ability to rotate them and audit their usage. The keys must be stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated FIPS 140-2 Level 3 validated hardware security modules, giving the organization full control over encryption keys, including rotation and auditing. It can be used to encrypt S3 data directly or as a custom key store for AWS KMS. KMS uses Level 2 HSMs, Secrets Manager is for secrets, and ACM is for certificates, so none meet the specific requirement.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Key Management Service (KMS) with customer managed keys

Answer

AWS Secrets Manager

Question 10

A cloud operations team is hardening a Google Cloud environment that hosts a regulated workload in a shared VPC. The security lead requires that all outbound traffic from a specific set of compute instances be inspected by a third-party next-generation firewall appliance before reaching the internet, and that the instances be unable to bypass the appliance even if an administrator accidentally adds a permissive rule. Which TWO controls should the team implement? (Choose two.)

Accepted Answer

Custom static routes in the VPC that direct the instances' default route to the next hop of the firewall appliance's internal load balancer. Forcing egress through a third-party appliance requires two things: a firewall rule that denies direct internet egress above any permissive rule, and custom static routes that send the default route to the appliance's internal load balancer as the next hop. Together they prevent bypass even if a permissive rule is added. Cloud NAT and VPC Service Controls address different problems and do not provide traffic inspection or forced tunneling.

Answer

A VPC firewall rule with a low-priority allow to 0.0.0.0/0 that permits direct egress from the instances

Answer

Cloud NAT configured on the instances' subnet to translate source addresses for outbound internet access

Answer

VPC Service Controls perimeter around the project to restrict data exfiltration to approved services

Question 11

A healthcare company is migrating patient records to a public cloud. The compliance officer insists that the cloud provider's staff must never be able to access the plaintext of the data, and that the company alone must hold the keys. The company wants to use envelope encryption for objects stored in the provider's object storage service. Which key management approach best satisfies the requirement that the provider never holds the plaintext data encryption keys?

Accepted Answer

Use customer-managed keys in the provider's key management service, with the customer generating and importing the root key material. The requirement is that the provider never holds the plaintext keys. Importing customer-generated root key material into the provider's key management service keeps the original material with the customer and allows policy controls that restrict provider use. Envelope encryption then wraps data keys with that root key. Provider-managed keys, storing keys with ciphertext, and relying only on transport security all fail to keep key custody with the customer.

Answer

Store the data encryption keys alongside the encrypted objects in the same bucket for simplicity

Answer

Rely on transport layer security for data in transit and skip encryption at rest to reduce key management overhead

Answer

Use the provider's default server-side encryption with provider-managed keys for all objects

Question 12

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). A Type 1 bare-metal hypervisor (e.g., VMware ESXi) runs directly on the hardware without an underlying host operating system, providing the most robust isolation between tenant VMs. This architecture reduces the attack surface and ensures that each VM is isolated from others and from the hypervisor management layer.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 13

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag disables container isolation and gives the container almost all capabilities of the host, including access to host devices and kernel. This allows an attacker who compromises the container to easily escape and access the host kernel, as seen in the scenario.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 14

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies — no package manager, shell, or OS utilities — which dramatically reduces the attack surface and the number of exploitable CVEs. Because there is no shell or package manager, attackers who gain code execution have far fewer tools to pivot or escalate with. This makes distroless the strongest choice when the explicit goal is minimizing vulnerabilities in a container image.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 15

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool from the Sigstore project that signs and verifies container images. It integrates with Kubernetes admission controllers (e.g., via Kyverno or OPA Gatekeeper policies) to enforce that only images with valid signatures from a trusted registry are deployed. This directly addresses the requirement to enforce signed images at admission time.

Answer

Clair

Answer

Trivy

Answer

Snyk Container