CCSP Cloud Platform and Infrastructure Security Practice Test 4 — 15 Questions

Question 1

An organization is designing a VPC with multiple tiers. Which TWO network components are used to restrict traffic between subnets?

Accepted Answer

Network ACL (NACL). Network ACLs (stateless) and Security Groups (stateful) can be applied at subnet and instance level to control traffic.

Answer

VPC Peering

Answer

Internet Gateway

Answer

Route Table

Question 2

A cloud security architect is designing a multi-tenant virtualized environment. Which type of hypervisor is considered most secure for cloud deployments due to its reduced attack surface and direct hardware control?

Accepted Answer

Type 1 bare-metal hypervisor. Type 1 (bare-metal) hypervisors run directly on hardware without an underlying OS, reducing attack surface and improving isolation. Type 2 hypervisors run on a host OS, adding complexity and potential vulnerabilities.

Answer

Type 2 hosted hypervisor

Answer

Emulated hypervisor (e.g., QEMU without KVM)

Answer

Container runtime (e.g., Docker)

Question 3

A security engineer is reviewing container image security. Which of the following practices best ensures that a container image has not been tampered with and originates from a trusted source?

Accepted Answer

Signing the image with Cosign and verifying it at deployment. Image signing using tools like Cosign provides cryptographic verification of image integrity and authenticity. Scanning for CVEs identifies vulnerabilities but does not verify origin.

Answer

Scanning the image with Trivy for CVEs

Answer

Using a minimal base image like Alpine

Answer

Setting the image tag to :latest

Question 4

During a security assessment of a Kubernetes cluster, you discover that a container is running as root with privileged mode enabled. Which of the following is the most critical risk associated with this configuration?

Accepted Answer

Potential for container escape to the host OS. Running as root with privileged mode grants full host access, making container escape to the host OS highly feasible. Seccomp and AppArmor can mitigate, but the core risk is escape.

Answer

Network policy bypass allowing unauthorized pod communication

Answer

Increased memory consumption due to lack of resource limits

Answer

Inability to mount volumes for persistent storage

Question 5

A cloud architect is designing a VPC for a three-tier application. The web servers need to be accessible from the internet, while the application servers should only be reachable from the web servers, and the database servers should be isolated from all other traffic except the application servers. Which VPC design best meets these requirements?

Accepted Answer

Web servers in a public subnet, app servers in a private subnet, databases in an isolated subnet with appropriate security groups. Public subnets for load balancers/web servers, private subnets for app servers, and isolated subnets (no direct route to internet) for databases provide the required isolation and access control.

Answer

Web servers in a public subnet, app and database servers in a single private subnet

Answer

All servers in a private subnet with a NAT gateway

Answer

All servers in a single public subnet with security groups

Question 6

Which of the following is the primary security risk associated with VM escape in a cloud environment?

Accepted Answer

Unauthorized access to other tenants' VMs and the hypervisor. VM escape is a critical risk in multi-tenant clouds because it allows an attacker to break out of a VM and access the hypervisor, potentially compromising other tenants' VMs.

Answer

Performance degradation of the VM

Answer

Loss of network connectivity

Answer

Data corruption within the VM

Question 7

A security analyst is configuring an API Gateway for a cloud application. The application must handle high traffic and prevent abuse from a single client. Which feature should the analyst enable to limit the number of requests from a client within a specified time window?

Accepted Answer

Rate limiting. Rate limiting throttles requests from a client to prevent abuse and ensure fair usage. API keys authenticate but do not limit rate; WAF filters malicious traffic; TLS enforces encryption.

Answer

TLS enforcement

Answer

Web Application Firewall (WAF) integration

Answer

API key authentication

Question 8

In a Kubernetes environment, a security team wants to enforce that only images signed by a trusted authority can be deployed. Which component can be used to validate image signatures at admission time?

Accepted Answer

Admission controller (e.g., OPA Gatekeeper). Admission controllers like OPA Gatekeeper or Kyverno can verify image signatures before a pod is created. RBAC controls access, not image validity; network policies manage traffic; secrets management handles credentials.

Answer

Network policies

Answer

RBAC policies

Answer

Secrets management with Vault

Question 9

Which hypervisor technology is used to provide direct device access to a VM, improving performance and isolation for I/O operations?

Accepted Answer

IOMMU. IOMMU (Input-Output Memory Management Unit) allows direct device assignment to VMs, enabling high performance and strong isolation by preventing the VM from accessing other devices' memory.

Answer

CPU pinning

Answer

Virtual switches

Answer

Memory ballooning

Question 10

A cloud security architect is designing network connectivity between multiple virtual networks in the same region. The requirement is to allow full mesh connectivity with centralized management and the ability to apply network policies. Which service should be used?

Accepted Answer

Transit gateway. A transit gateway acts as a central hub for multiple virtual networks, enabling transitive peering and centralized routing and policy management. Virtual network peering is point-to-point and does not support transitive routing, requiring a full mesh of connections for multiple virtual networks.

Answer

Internet gateway

Answer

Virtual network peering

Answer

Virtual network endpoint

Question 11

During a security review of a serverless application, you notice that a Lambda function's execution role has permissions to delete all S3 buckets in the account. What is the most appropriate remediation to align with the principle of least privilege?

Accepted Answer

Create a custom IAM role that grants only the necessary actions on a specific S3 bucket. Creating a custom role with only the specific actions needed (e.g., s3:PutObject for a specific bucket) reduces blast radius. Using managed policies may grant excessive permissions; environment variables and VPC integration are unrelated.

Answer

Store S3 bucket names in environment variables instead of hardcoding

Answer

Attach the AWS managed policy 'AmazonS3ReadOnlyAccess'

Answer

Remove the Lambda function's VPC integration

Question 12

A cloud security team is implementing container runtime security. Which of the following measures is most effective at preventing a container from breaking out to the host OS?

Accepted Answer

Applying a Seccomp profile that whitelists only necessary syscalls. Seccomp profiles restrict system calls available to containers, significantly reducing the attack surface for container escape vulnerabilities. Dropping capabilities and read-only root filesystem are important but not as comprehensive as seccomp.

Answer

Setting the container's root filesystem to read-only

Answer

Using a non-root user inside the container

Answer

Dropping all Linux capabilities except those required

Question 13

A cloud security architect is evaluating options for private connectivity to cloud services without traversing the internet. Which TWO services can be used to achieve this? (Select two.)

Accepted Answer

VPC peering. VPC endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and VPC peering provide private connectivity without internet. Internet gateway and NAT gateway use internet; security groups are firewalls.

Answer

Security group

Answer

Internet gateway

Answer

NAT gateway

Question 14

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Accepted Answer

Running containers as a non-root user. Running as non-root user, dropping unnecessary Linux capabilities, and using AppArmor/SELinux profiles are key container security best practices. Running as root defeats isolation; privileged containers grant excessive host access.

Answer

Enabling privileged mode for containers that need host access

Answer

Running containers as root

Question 15

Which TWO of the following are characteristics of security groups compared to network ACLs in a cloud VPC? (Select two.)

Accepted Answer

Stateful – return traffic is automatically allowed. Security groups are stateful (return traffic allowed) and support only allow rules. NACLs are stateless and support both allow and deny rules.

Answer

Operate at the subnet level

Answer

Stateless – each packet is evaluated independently

Answer

Support both allow and deny rules