CCSP Cloud Platform and Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

Accepted Answer

Sign images using Cosign. Image signing, vulnerability scanning, and using immutable tags are key supply chain security practices. Using the 'latest' tag is risky, and running containers as root is insecure.

Answer

Always use the 'latest' tag for base images

Answer

Run containers with root privileges by default

Question 2

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. AWS WAF protects the application from web exploits, and security groups act as instance-level firewalls to control traffic between tiers. NACLs are subnet-level and less granular.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 3

A security architect is designing a multi-tenant cloud environment. Which hypervisor type provides the strongest isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

VMware ESXi (Type 1). Type 1 hypervisors run directly on hardware, minimizing the attack surface and providing strong isolation. Type 2 hypervisors run on top of an OS, adding extra layers of vulnerability.

Answer

VMware Workstation (Type 2)

Answer

KVM (Type 2)

Answer

VirtualBox (Type 2)

Question 4

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 5

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Accepted Answer

Extended Page Tables (EPT). Memory isolation is enforced by the hypervisor using Extended Page Tables (EPT) or similar technologies. EPT ensures that each VM's memory mappings are isolated, preventing one VM from accessing another's memory.

Answer

Seccomp profiles

Answer

CPU pinning

Answer

IOMMU

Question 6

A cloud security team is reviewing container security practices. Which of the following is the most effective way to minimize the attack surface of a container image?

Accepted Answer

Using a minimal base image such as distroless. Distroless images contain only the application and its runtime dependencies, eliminating unnecessary packages and reducing the attack surface.

Answer

Using the latest version of a base image

Answer

Using the :latest tag to ensure freshness

Answer

Scanning the image for CVEs after deployment

Question 7

A DevOps engineer is configuring a Kubernetes cluster and wants to enforce that containers cannot run as root and cannot mount host paths. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) allows enforcing predefined security policies (privileged, baseline, restricted) at the pod level, covering controls like running as root and host path mounts.

Answer

Network policies

Answer

RBAC

Answer

Secrets management

Question 8

A security architect is designing a VPC for a three-tier web application. Which of the following VPC subnet designs provides the most secure isolation for the database tier?

Accepted Answer

Database tier in a private subnet with security group allowing only the application tier. Placing the database tier in an isolated private subnet without direct internet access and with strict security group rules minimizes exposure.

Answer

Database tier in a separate VPC with VPC peering

Answer

Database tier in a public subnet with security group allowing only the application tier

Answer

Database tier in the same subnet as the application tier

Question 9

A company uses AWS and needs to allow a Lambda function in a VPC to access an S3 bucket without traversing the internet. Which solution meets this requirement securely?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the Lambda's VPC. VPC endpoints (Gateway or Interface) allow private access to AWS services without internet traversal. For S3, a Gateway endpoint is commonly used.

Answer

Configure a NAT gateway in the VPC and route traffic through it

Answer

Use VPC peering to connect to the S3 bucket's VPC

Answer

Assign a public IP to the Lambda and use an internet gateway

Question 10

A cloud security professional is evaluating container runtime security. Which Linux capability should be dropped from a container to prevent it from loading kernel modules?

Accepted Answer

CAP_SYS_MODULE. The CAP_SYS_MODULE capability allows loading/unloading kernel modules, which is a common vector for container escape. Dropping it reduces risk.

Answer

CAP_DAC_OVERRIDE

Answer

CAP_CHOWN

Answer

CAP_NET_RAW

Question 11

An organization uses Azure Functions and needs to ensure that the function can securely access a database in a private VNet. What is the recommended approach?

Accepted Answer

Enable VNet integration for the function app and configure the function to use the private IP of the database. VNet integration allows Azure Functions to access resources in a virtual network without exposing them to the internet, using a private IP.

Answer

Place the function in the same VNet as the database without any additional configuration

Answer

Use a VPN connection from the function to the database VNet

Answer

Store database credentials in environment variables and use a public endpoint with IP whitelisting

Question 12

A cloud security engineer is implementing API Gateway security for a public-facing API. Which combination of controls best protects against both injection attacks and excessive usage?

Accepted Answer

WAF integration and rate limiting. WAF integration protects against injection and other web attacks, while rate limiting prevents abuse by limiting requests per client.

Answer

IAM authentication and VPC endpoint

Answer

JWT validation and WAF integration

Answer

API keys and TLS enforcement

Question 13

A security team is reviewing container image supply chain security. Which tool is specifically designed for signing container images to ensure integrity and provenance?

Accepted Answer

Cosign. Cosign is a tool for signing container images and verifying signatures, ensuring the image has not been tampered with.

Answer

Kube-bench

Answer

Clair

Answer

Trivy

Question 14

In a cloud VPC, what is the difference between security groups and network ACLs (NACLs)?

Accepted Answer

Security groups are stateful and support allow rules only; NACLs are stateless and support allow and deny rules. Security groups are stateful and support allow rules only, while NACLs are stateless and support both allow and deny rules.

Answer

Security groups support allow and deny rules; NACLs support only allow

Answer

Security groups are stateless and NACLs are stateful

Answer

Security groups and NACLs are both stateless

Question 15

A cloud security engineer is hardening container runtime environments. Which TWO of the following are effective measures to prevent container escape?

Accepted Answer

Dropping all Linux capabilities except those required. Seccomp profiles restrict system calls, and dropping unnecessary Linux capabilities reduces the attack surface, both of which help prevent container escape.

Answer

Using the latest kernel version

Answer

Mounting the host filesystem as read-only

Answer

Running containers in privileged mode