CCSP Cloud Platform and Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 2

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint

Question 3

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

Accepted Answer

Configure the serverless function with virtual private cloud integration. Virtual private cloud (VPC) integration allows the serverless function to be deployed inside a VPC, enabling private access to resources like a database service. Internet access is not required.

Answer

Assign a public IP to the serverless function

Answer

Enable public access on the database service

Answer

Use a network address translation gateway to route traffic

Question 4

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates with Amazon API Gateway to protect against common web exploits like SQL injection and cross-site scripting. It inspects incoming HTTP/HTTPS requests and applies rules to block malicious traffic. Enabling AWS WAF on the API Gateway stage provides the required protection.

Answer

IAM policies

Answer

Security groups on the API Gateway

Answer

Network ACLs on the VPC

Question 5

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

Accepted Answer

Role and RoleBinding in the 'dev' namespace. RBAC uses Role and RoleBinding for namespace-scoped permissions. ClusterRole and ClusterRoleBinding are cluster-scoped. A Role with permissions to create pods in the 'dev' namespace, bound via RoleBinding, achieves the goal.

Answer

ClusterRole and ClusterRoleBinding

Answer

PodSecurityPolicy (deprecated)

Answer

NetworkPolicy

Question 6

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

Accepted Answer

Regular patching of the hypervisor. VM escape attacks exploit vulnerabilities in the hypervisor to break out of a guest VM and access the host or other guests. Regularly patching the hypervisor closes known vulnerabilities (e.g., Xen, KVM, VMware ESXi CVEs) that attackers use to escape, making it the most direct and effective mitigation. Since the hypervisor is the isolation boundary, keeping it current is foundational to VM security.

Answer

Encryption of VM disks

Answer

Use of Type 2 hypervisors

Answer

Network segmentation between VMs

Question 7

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Accepted Answer

Set the container to run as a non-root user. Option A is correct because configuring the container to run as a non-root user (e.g., via securityContext.runAsUser or runAsNonRoot: true) removes the root privileges that an attacker could leverage to exploit kernel vulnerabilities or access host resources during a container escape attempt. Option D is correct because dropping all Linux capabilities and then adding back only those explicitly required (using securityContext.capabilities.drop: ["ALL"]) follows the principle of least privilege, eliminating dangerous capabilities like CAP_SYS_ADMIN, CAP_NET_ADMIN, and CAP_SYS_PTRACE that are commonly abused in container escape techniques. Option B is incorrect because enabling host networking mode actually increases risk by removing network namespace isolation, allowing the container to access host network interfaces and services directly. Option C is incorrect because privileged containers disable nearly all security mechanisms (seccomp, AppArmor, capability restrictions) and grant full access to host devices, dramatically worsening escape risk. Option E is incorrect because mounting the host filesystem as read-write gives the container direct write access to host files, enabling tampering with system binaries or configuration to facilitate escape and persistence.

Answer

Enable host networking mode

Answer

Use a privileged container

Answer

Mount the host filesystem as read-write

Question 8

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

Accepted Answer

Sign images using Cosign. Option A is correct because signing images with Cosign (part of the Sigstore project) creates verifiable cryptographic signatures that let Kubernetes admission controllers or CI/CD pipelines confirm an image's provenance and integrity before deployment, preventing tampered or unauthorized images from entering the supply chain. Option D is correct because immutable tags such as a Git commit hash or digest guarantee that the exact audited artifact is deployed and cannot be silently overwritten, unlike mutable tags that can be repointed to different content. Option E is correct because scanning images with Trivy detects known CVEs in OS packages and language dependencies, enabling vulnerabilities to be caught and remediated early in the build pipeline. Option B is not appropriate because the 'latest' tag is mutable and non-deterministic, so builds become unreproducible and can pull in unvetted or vulnerable base images. Option C is not appropriate because running containers as root violates least privilege and dramatically increases the blast radius if a container is compromised; containers should run as a non-root user.

Answer

Always use the 'latest' tag for base images

Answer

Run containers with root privileges by default

Question 9

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. Option B (AWS WAF integrated with Application Load Balancer) is correct because AWS WAF inspects HTTP/HTTPS requests at Layer 7 and can block common web exploits such as SQL injection and cross-site scripting using managed rule groups attached to an ALB, directly satisfying the requirement to protect the application layer. Option C (Security groups between application tiers) is correct because security groups are stateful, instance-level virtual firewalls whose inbound rules can reference other security groups, allowing precise tier-to-tier traffic restriction (for example, permitting only the app tier's SG to reach the database tier on port 3306). Option A is not appropriate here because PrivateLink provides private connectivity to services and endpoints, not application-layer attack filtering or inter-tier traffic control. Option D is wrong because VPC peering only connects networks for routing and does not filter or restrict traffic between application tiers. Option E is less suitable because network ACLs are stateless, subnet-level filters that cannot reference security groups or enforce granular per-tier application rules as cleanly as security groups.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 10

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 11

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Accepted Answer

Extended Page Tables (EPT). Extended Page Tables (EPT) is a hardware virtualization feature (Intel VT-x) that provides second-level address translation, isolating guest physical memory from host physical memory. It ensures that a VM's memory accesses are translated through nested page tables controlled by the hypervisor, preventing one tenant VM from accessing another tenant's memory. EPT, along with AMD's Nested Page Tables (NPT), is specifically designed for memory isolation in virtualized environments.

Answer

Seccomp profiles

Answer

CPU pinning

Answer

IOMMU

Question 12

A cloud security team is reviewing container security practices. Which of the following is the most effective way to minimize the attack surface of a container image?

Accepted Answer

Using a minimal base image such as distroless. Using a minimal base image such as distroless is the most effective way to reduce a container image's attack surface because it strips the package manager, shell, and unnecessary OS utilities, leaving only the application and its runtime dependencies. Fewer installed packages means fewer libraries that can contain exploitable CVEs, and the absence of a shell makes post-exploitation pivoting much harder. Distroless images, maintained by Google, include only the runtime (e.g., a JRE or Python interpreter) and the app itself.

Answer

Using the latest version of a base image

Answer

Using the :latest tag to ensure freshness

Answer

Scanning the image for CVEs after deployment

Question 13

A DevOps engineer is configuring a Kubernetes cluster and wants to enforce that containers cannot run as root and cannot mount host paths. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) is the built-in Kubernetes admission controller that enforces Pod Security Standards (Privileged, Baseline, Restricted) at the namespace level. The Restricted profile specifically prohibits running as root (via runAsNonRoot and allowPrivilegeEscalation: false) and blocks hostPath volume mounts, which is exactly what the engineer needs. It replaced the deprecated PodSecurityPolicy and is applied via namespace labels like pod-security.kubernetes.io/enforce=restricted.

Answer

Network policies

Answer

RBAC

Answer

Secrets management

Question 14

A security architect is designing a VPC for a three-tier web application. Which of the following VPC subnet designs provides the most secure isolation for the database tier?

Accepted Answer

Database tier in a private subnet with security group allowing only the application tier. Placing the database tier in a private subnet with a security group that only allows traffic from the application tier's security group enforces both network-layer isolation (no route to the internet) and identity-based access control (SG-to-SG referencing). This is the AWS-recommended pattern for three-tier architectures because it minimizes the attack surface and prevents lateral movement from compromised web-tier instances. The database has no public IP and no route to an internet gateway, so it cannot be reached directly from outside the VPC.

Answer

Database tier in a separate VPC with VPC peering

Answer

Database tier in a public subnet with security group allowing only the application tier

Answer

Database tier in the same subnet as the application tier

Question 15

A company uses AWS and needs to allow a Lambda function in a VPC to access an S3 bucket without traversing the internet. Which solution meets this requirement securely?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the Lambda's VPC. A VPC endpoint for S3 (gateway endpoint) allows resources in a VPC, including Lambda functions, to reach S3 privately without traversing the internet, NAT, or an internet gateway. Traffic stays on the AWS backbone and can be controlled with endpoint policies.

Answer

Configure a NAT gateway in the VPC and route traffic through it

Answer

Use VPC peering to connect to the S3 bucket's VPC

Answer

Assign a public IP to the Lambda and use an internet gateway