CCSP Cloud Platform and Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

Accepted Answer

Private Endpoint (Service Endpoint). Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.

Answer

VPN Connection

Answer

Internet Gateway

Answer

NAT Gateway

Question 2

A serverless function needs to access a private RDS database inside a VPC. What configuration is required to enable this without using public IP addresses?

Accepted Answer

Place the Lambda function inside the VPC using VPC configuration. Serverless functions can be configured with VPC integration to access resources inside a VPC via private IP.

Answer

Store database credentials in the function code

Answer

Use a NAT Gateway to allow inbound traffic

Answer

Attach an Internet Gateway to the VPC

Question 3

Which API Gateway security feature limits the number of requests from a client to prevent abuse or DoS attacks?

Accepted Answer

Rate limiting. Rate limiting (also called throttling) caps the number of requests a client can make within a defined time window, protecting backend services from abuse, brute-force attempts, and denial-of-service floods. API gateways implement this with token bucket or leaky bucket algorithms, returning HTTP 429 Too Many Requests when the limit is exceeded. It is the primary control for request-volume abuse.

Answer

JWT validation

Answer

WAF integration

Answer

Mutual TLS

Question 4

A cloud security auditor is reviewing container runtime configurations. Which TWO practices help prevent a container from compromising the host operating system?

Accepted Answer

Using a read-only root filesystem. Option A, using a read-only root filesystem, is correct because it prevents a compromised container process from writing malicious files, modifying binaries, or persisting changes to the container's filesystem, which limits the ability to tamper with the host through mounted volumes or writable layers. Option D, dropping all Linux capabilities, is correct because Linux capabilities grant fine-grained kernel privileges (e.g., CAP_SYS_ADMIN, CAP_NET_ADMIN); dropping all of them removes the ability to perform privileged operations like mounting filesystems, loading kernel modules, or manipulating network stacks that could be leveraged to escape the container and affect the host. Option B is wrong because disabling SELinux removes a mandatory access control layer that confines container processes, weakening host protection rather than strengthening it. Option C is wrong because privileged mode gives the container nearly all host capabilities and device access, dramatically increasing the risk of host compromise. Option E is wrong because mapping the host's Docker socket into a container effectively grants control over the Docker daemon, allowing the container to launch privileged containers or access the host, which is a well-known container escape vector.

Answer

Disabling SELinux inside the container

Answer

Running containers in privileged mode

Answer

Mapping the host's Docker socket into the container

Question 5

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Option A is correct because Cosign (part of the Sigstore project) cryptographically signs container images using keyless or key-based signatures, producing a verifiable signature stored in the OCI registry that establishes provenance and integrity from build time. Option C is correct because an admission controller such as Kyverno (or OPA Gatekeeper) enforces policy at deploy time by verifying Cosign signatures before allowing a pod to be admitted, ensuring only trusted, signed images run in the cluster. Option E is correct because Trivy scans image layers against vulnerability databases (e.g., CVE feeds) and can fail CI/CD pipelines on critical findings, catching known flaws before an image is promoted. Option B is not appropriate because a private registry alone provides no integrity verification, and skipping scanning removes a key detection control. Option D is wrong because the mutable :latest tag offers no immutability or traceability, undermining supply-chain trust and reproducibility.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag

Question 6

A cloud security architect is designing a multi-tenant virtualized environment. Which type of hypervisor is considered most secure for cloud deployments due to its reduced attack surface and direct hardware control?

Accepted Answer

Type 1 bare-metal hypervisor. A Type 1 bare-metal hypervisor runs directly on the host's hardware, controlling hardware resources and managing guest VMs without an underlying operating system. This architecture reduces the attack surface because there is no general-purpose OS to exploit, and it provides direct hardware control for performance and security. It is considered the most secure for cloud deployments.

Answer

Type 2 hosted hypervisor

Answer

Emulated hypervisor (e.g., QEMU without KVM)

Answer

Container runtime (e.g., Docker)

Question 7

A security engineer is reviewing container image security. Which of the following practices best ensures that a container image has not been tampered with and originates from a trusted source?

Accepted Answer

Signing the image with Cosign and verifying it at deployment. Signing a container image with Cosign and verifying it at deployment ensures integrity and provenance by cryptographically binding the image to a trusted signer. Cosign uses public-key cryptography to sign the image digest, and verification at deployment (e.g., via admission controllers) ensures only signed images run. This directly addresses tampering and trusted source requirements.

Answer

Scanning the image with Trivy for CVEs

Answer

Using a minimal base image like Alpine

Answer

Setting the image tag to :latest

Question 8

During a security assessment of a Kubernetes cluster, you discover that a container is running as root with privileged mode enabled. Which of the following is the most critical risk associated with this configuration?

Accepted Answer

Potential for container escape to the host OS. Running a container as root with privileged mode enabled grants the container almost all the capabilities of the host's root user, including access to host devices and kernel features. This significantly increases the attack surface, making it easier for an attacker to exploit kernel vulnerabilities or misconfigurations to escape the container and gain control of the host OS. While other risks exist, container escape is the most critical because it compromises the entire node and potentially the whole cluster.

Answer

Network policy bypass allowing unauthorized pod communication

Answer

Increased memory consumption due to lack of resource limits

Answer

Inability to mount volumes for persistent storage

Question 9

A cloud architect is designing a VPC for a three-tier application. The web servers need to be accessible from the internet, while the application servers should only be reachable from the web servers, and the database servers should be isolated from all other traffic except the application servers. Which VPC design best meets these requirements?

Accepted Answer

Web servers in a public subnet, app servers in a private subnet, databases in an isolated subnet with appropriate security groups. A three-tier design requires three distinct network zones: a public subnet for internet-facing web servers, a private subnet for application servers reachable only from the web tier, and an isolated (private, no NAT/IGW route) subnet for databases reachable only from the app tier. Security groups enforce the tier-to-tier traffic rules (web SG allows 80/443 from internet; app SG allows app port from web SG; DB SG allows DB port from app SG). This layered segmentation is the canonical defense-in-depth VPC pattern.

Answer

Web servers in a public subnet, app and database servers in a single private subnet

Answer

All servers in a private subnet with a NAT gateway

Answer

All servers in a single public subnet with security groups

Question 10

Which of the following is the primary security risk associated with VM escape in a cloud environment?

Accepted Answer

Unauthorized access to other tenants' VMs and the hypervisor. VM escape occurs when an attacker breaks out of the guest VM's isolation boundary and gains access to the hypervisor or other tenants' VMs. The primary security risk is therefore unauthorized access to other tenants' workloads and the hypervisor itself, which can lead to full compromise of the multi-tenant host. This breaks the fundamental isolation guarantee that cloud providers rely on.

Answer

Performance degradation of the VM

Answer

Loss of network connectivity

Answer

Data corruption within the VM

Question 11

A security analyst is configuring an API Gateway for a cloud application. The application must handle high traffic and prevent abuse from a single client. Which feature should the analyst enable to limit the number of requests from a client within a specified time window?

Accepted Answer

Rate limiting. Rate limiting is the API Gateway feature that restricts the number of requests a client can make within a specified time window (e.g., 1000 requests per minute). It directly addresses the requirement to handle high traffic and prevent abuse from a single client by throttling or rejecting excess requests. This protects backend services from being overwhelmed and ensures fair usage.

Answer

TLS enforcement

Answer

Web Application Firewall (WAF) integration

Answer

API key authentication

Question 12

In a Kubernetes environment, a security team wants to enforce that only images signed by a trusted authority can be deployed. Which component can be used to validate image signatures at admission time?

Accepted Answer

Admission controller (e.g., OPA Gatekeeper). An admission controller such as OPA Gatekeeper can intercept requests to the Kubernetes API server before objects are persisted, allowing it to validate image signatures. By integrating with tools like Cosign or Notary, the admission controller can reject pods that use unsigned or untrusted images, enforcing the policy at deployment time.

Answer

Network policies

Answer

RBAC policies

Answer

Secrets management with Vault

Question 13

Which hypervisor technology is used to provide direct device access to a VM, improving performance and isolation for I/O operations?

Accepted Answer

IOMMU. IOMMU (Input-Output Memory Management Unit) provides direct device access to a VM by translating device DMA addresses through the hypervisor's memory mapping, enabling safe passthrough of physical devices. This improves I/O performance and maintains isolation by preventing devices from accessing memory outside their assigned VM. It is the hardware feature that underpins secure device assignment.

Answer

CPU pinning

Answer

Virtual switches

Answer

Memory ballooning

Question 14

During a security review of a serverless application, you notice that a Lambda function's execution role has permissions to delete all S3 buckets in the account. What is the most appropriate remediation to align with the principle of least privilege?

Accepted Answer

Create a custom IAM role that grants only the necessary actions on a specific S3 bucket. The correct remediation is to replace the overly permissive execution role with a custom IAM role scoped to only the specific S3 actions and the specific bucket the Lambda function actually needs. This directly enforces least privilege by eliminating the wildcard delete permissions across all buckets. AWS IAM evaluates the policy attached to the Lambda execution role on every API call, so narrowing the Resource ARN and Action list constrains the blast radius if the function is compromised.

Answer

Store S3 bucket names in environment variables instead of hardcoding

Answer

Attach the AWS managed policy 'AmazonS3ReadOnlyAccess'

Answer

Remove the Lambda function's VPC integration

Question 15

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Accepted Answer

Running containers as a non-root user. Option C is correct because running containers as a non-root user (e.g., via securityContext.runAsNonRoot: true or a USER directive in the Dockerfile) prevents processes inside the container from having UID 0, which is the primary enabler of privilege-escalation exploits and container-escape techniques. Option D is correct because AppArmor or SELinux profiles enforce mandatory access control that confines container processes to a limited set of files, paths, and operations, blocking actions that even a compromised process could otherwise attempt. Option E is correct because dropping all Linux capabilities and adding back only those explicitly required (e.g., using cap-drop: ALL with a minimal cap-add list) removes dangerous privileges such as CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE that are commonly abused for privilege escalation. Option A is incorrect because privileged mode grants the container nearly all host capabilities and device access, dramatically increasing the attack surface rather than restricting it. Option B is incorrect because running containers as root gives the process full UID 0 privileges inside the container, which is exactly the risk the hardening measures are meant to eliminate.

Answer

Enabling privileged mode for containers that need host access

Answer

Running containers as root