CCSP Cloud Platform and Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A company is deploying a microservices architecture on Kubernetes and wants to implement supply chain security. Which THREE of the following practices should be adopted?

Accepted Answer

Signing container images with Cosign. Image signing ensures integrity, scanning for CVEs identifies vulnerabilities, and using admission controllers to verify signatures enforces policy.

Answer

Allowing all images from public registries

Answer

Using the :latest tag for all images

Question 2

A cloud security team is designing network security for a multi-VPC architecture in AWS. Which TWO of the following are valid considerations for VPC peering?

Accepted Answer

VPC peering is a one-to-one relationship. VPC peering is a direct, non-transitive connection between two VPCs, and transitive routing is not supported without additional components.

Answer

VPC peering can be used to connect on-premises networks

Answer

VPC peering requires an internet gateway for communication

Answer

VPC peering supports transitive routing across multiple VPCs

Question 3

Which hypervisor type is most commonly deployed in production cloud data centers to host multiple tenant virtual machines?

Accepted Answer

Type 1 bare-metal hypervisor like VMware ESXi. Type 1 (bare-metal) hypervisors run directly on hardware and are used in cloud environments for better performance and isolation.

Answer

Container runtime like Docker

Answer

Para-virtualization interface

Answer

Type 2 hosted hypervisor like VirtualBox

Question 4

A security engineer is concerned about a scenario where a malicious process inside a VM breaks out of the virtualized environment to compromise the hypervisor. What is this attack called and what is the primary mitigation?

Accepted Answer

VM escape; regularly patch the hypervisor. VM escape occurs when code inside a VM accesses the hypervisor. Patching the hypervisor closes known vulnerabilities.

Answer

VM sprawl; use resource limits

Answer

Side-channel attack; disable hyperthreading

Answer

Privilege escalation; enable SELinux inside VM

Question 5

A cloud architect is designing a multi-tenant environment. To ensure that a tenant's virtual machine cannot access another tenant's memory, which resource isolation technique should be enforced at the hypervisor level?

Accepted Answer

Memory isolation via hardware-enforced page tables. Memory isolation prevents cross-VM memory access; hypervisors enforce this by allocating dedicated memory pages.

Answer

IOMMU for device isolation

Answer

CPU pinning

Answer

Network segmentation with VLANs

Question 6

Which container image security practice is most effective at reducing the attack surface by removing unnecessary components and lowering the number of CVEs?

Accepted Answer

Using distroless base images. Distroless images contain only the application and its runtime dependencies, minimizing the attack surface.

Answer

Using the :latest tag for base images

Answer

Adding security agents inside the image

Answer

Scanning images only at build time

Question 7

A container runtime is configured to drop all Linux capabilities, use a read-only root filesystem, and apply a Seccomp profile. Which primary security goal does this configuration achieve?

Accepted Answer

Prevention of container escape. These measures restrict container permissions and system calls, making container escape much harder.

Answer

Image integrity verification

Answer

Ensuring immutability of containers

Answer

Network segmentation between pods

Question 8

In a Kubernetes cluster, which resource should be used to restrict network traffic between pods based on source and destination labels?

Accepted Answer

Network Policies. Network policies in Kubernetes act as a firewall for pods, allowing or denying traffic based on selectors.

Answer

Pod Security Admission

Answer

Secrets management with Vault

Answer

Role-Based Access Control (RBAC)

Question 9

A cloud security team wants to enforce that only signed container images are deployed in their Kubernetes cluster. Which admission controller can validate image signatures at deploy time?

Accepted Answer

Kyverno. Admission controllers like OPA Gatekeeper or Kyverno can enforce policies to only allow images signed by trusted authorities.

Answer

HashiCorp Vault

Answer

Consul

Answer

Trivy

Question 10

In a cloud VPC design, which component acts as a stateful firewall at the instance level, allowing only inbound rules?

Accepted Answer

Security group. Security groups are stateful firewalls that control traffic to instances; they only support allow rules and are stateful.

Answer

Network ACL (NACL)

Answer

Internet gateway

Answer

Route table

Question 11

A company has multiple virtual private clouds in the same region and wants to enable direct IP connectivity between them using private IP addresses. However, they do not need transitive routing across multiple VPCs. Which solution should they use?

Accepted Answer

Virtual network peering. Virtual network peering provides direct one-to-one connectivity without transitive routing.

Answer

VPN Gateway

Answer

Private connectivity

Answer

Transit routing hub

Question 12

A serverless function needs to access a private RDS database inside a VPC. What configuration is required to enable this without using public IP addresses?

Accepted Answer

Place the Lambda function inside the VPC using VPC configuration. Serverless functions can be configured with VPC integration to access resources inside a VPC via private IP.

Answer

Store database credentials in the function code

Answer

Use a NAT Gateway to allow inbound traffic

Answer

Attach an Internet Gateway to the VPC

Question 13

Which API Gateway security feature limits the number of requests from a client to prevent abuse or DoS attacks?

Accepted Answer

Rate limiting. Rate limiting controls the request rate per client, protecting the backend from overload.

Answer

JWT validation

Answer

WAF integration

Answer

Mutual TLS

Question 14

A cloud security auditor is reviewing container runtime configurations. Which TWO practices help prevent a container from compromising the host operating system?

Accepted Answer

Using a read-only root filesystem. Running containers without the --privileged flag and with a read-only root filesystem reduces the risk of host compromise.

Answer

Disabling SELinux inside the container

Answer

Running containers in privileged mode

Answer

Mapping the host's Docker socket into the container

Question 15

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Image signing, vulnerability scanning, and using admission controllers to verify signatures ensure integrity and trust.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag