CCSP Cloud Platform and Infrastructure Security Practice Test 5 — 15 Questions

Question 1

A security architect is designing a multi-tenant cloud environment. Which type of hypervisor provides the strongest isolation for tenant virtual machines by running directly on the hardware without a host operating system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Type 1 hypervisor. Type 1 (bare-metal) hypervisors run directly on hardware, reducing the attack surface and improving isolation compared to Type 2 hypervisors that run on an OS.

Answer

Type 2 hypervisor

Answer

Virtual machine monitor in user space

Answer

Container runtime

Question 2

During an audit of a containerized application, you notice that containers are running with the --privileged flag. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Container escape to the host. Privileged containers have nearly all capabilities of the host, significantly increasing the risk of container escape and host compromise.

Answer

Increased memory consumption

Answer

Inability to use secure base images

Answer

Excessive network bandwidth usage

Question 3

A cloud security engineer is configuring network security for a multi-tier application in AWS. The web servers must be accessible from the internet on port 443, the application servers should only receive traffic from the web servers, and the database servers should only accept traffic from the application servers on port 3306. Which combination of security controls should be used?

Accepted Answer

Security groups with source referencing the web server security group for app tier, and app server security group for DB tier. Security groups are stateful and allow return traffic automatically. For inbound control, security groups with source references provide the required micro-segmentation.

Answer

NACLs on each subnet with rules referencing source IP ranges

Answer

A single NACL applied to all subnets with layer 7 filtering

Answer

Route tables with deny rules to restrict inter-subnet traffic

Question 4

Which of the following is a primary risk specific to virtual machine escape attacks in cloud environments?

Accepted Answer

Unauthorized access to other tenant VMs. VM escape allows an attacker to break out of a VM and interact with the hypervisor, potentially compromising other tenants.

Answer

Data corruption within the same VM

Answer

Increased latency in virtual networking

Answer

Denial of service to the attacker's own VM

Question 5

A company uses Azure Functions for serverless data processing. To securely access an Azure SQL database, which of the following is the most secure method for managing the database connection string?

Accepted Answer

Reference the connection string from Azure Key Vault using a managed identity. Using managed identities and Azure Key Vault removes hardcoded secrets and provides automatic rotation and access control.

Answer

Embed the connection string in the function code and encrypt the code file

Answer

Store the connection string as an environment variable in the function app settings

Answer

Use Azure Policy to enforce encryption of the connection string at rest

Question 6

In a Kubernetes cluster, a pod needs to access a cloud provider's key management service (KMS) to retrieve secrets. Which of the following RBAC configurations is the least privileged approach?

Accepted Answer

Create a Role in the pod's namespace that allows get on secrets and bind it to the pod's service account. The least privileged approach is to grant only the necessary API permissions to the service account used by the pod, not to users or namespaces unnecessarily.

Answer

Bind a ClusterRole with get and list on secrets to the pod's service account

Answer

Grant the pod's service account cluster-admin rights

Answer

Use a PodSecurityPolicy that allows privileged containers

Question 7

A cloud security team is implementing VPC peering between two VPCs in the same region. Which statement about VPC peering is correct?

Accepted Answer

VPC peering enables private IP connectivity across VPCs without internet. VPC peering allows direct routing using private IP addresses, but it is not transitive: if VPC A peers with VPC B and VPC B peers with VPC C, traffic cannot flow from A to C via B.

Answer

VPC peering requires VPN gateways to establish connectivity

Answer

VPC peering automatically encrypts all traffic between VPCs

Answer

VPC peering supports transitive routing through intermediate VPCs

Question 8

Which of the following is a primary benefit of using immutable tags for container images in a production registry?

Accepted Answer

Consistent and reproducible deployments. Immutable tags prevent accidental overwriting of image tags, ensuring that the same tag always refers to the same image, which aids in traceability and rollback.

Answer

Improved build performance

Answer

Automatic vulnerability scanning

Answer

Reduced storage cost

Question 9

A company is using AWS Lambda functions that need to access a private RDS database. Which configuration allows the Lambda function to connect securely without traversing the internet?

Accepted Answer

Configure the Lambda function to use a VPC with private subnets and a VPC endpoint for RDS. Attaching the Lambda function to a VPC and placing it in private subnets with a VPC endpoint for RDS or a NAT gateway allows private connectivity.

Answer

Assign an Elastic IP to the Lambda function

Answer

Use a Lambda environment variable to store the database endpoint and credentials

Answer

Place the Lambda function in a public subnet with an internet gateway

Question 10

During a supply chain security review, a team discovers that container images are not being verified at admission time. Which Kubernetes-native tool should be implemented to ensure only signed images are deployed?

Accepted Answer

Admission controller (e.g., Kyverno) with image signature verification. An admission controller like OPA Gatekeeper or Kyverno can enforce policies that verify image signatures before allowing pod creation.

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Answer

ResourceQuota

Question 11

Which of the following is a key difference between a security group and a network ACL in a VPC?

Accepted Answer

Security groups are stateful, while NACLs are stateless. Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules. NACLs are stateless, requiring explicit inbound and outbound rules.

Answer

Security groups are stateless, while NACLs are stateful

Answer

Security groups are applied at the subnet level, while NACLs are applied at the instance level

Answer

Security groups support both allow and deny rules

Question 12

A security architect is designing a container runtime security strategy. Which of the following controls is most effective at preventing a container from compromising the host kernel?

Accepted Answer

Seccomp profile. Seccomp profiles restrict the system calls a container can make, reducing the attack surface against the host kernel.

Answer

Read-only root filesystem

Answer

Resource limits (CPU/memory)

Answer

Image vulnerability scanning

Question 13

A cloud security team is deploying a web application with an API Gateway. Which TWO mechanisms should be implemented to protect against API abuse and unauthorized access?

Accepted Answer

Rate limiting. Rate limiting prevents abuse by throttling requests, and authentication (e.g., JWT, API keys) ensures only authorized clients can access the API.

Answer

TLS enforcement

Answer

Resource tagging

Answer

VPC peering

Question 14

A company is adopting a microservices architecture on Kubernetes and needs to ensure least privilege for pod-to-pod communication. Which THREE controls should be implemented?

Accepted Answer

Service accounts with minimal permissions. Network policies restrict pod communication, RBAC controls pod permissions, and service accounts with limited permissions enforce least privilege.

Answer

Pod Security Admission to enforce that containers run as root

Answer

Horizontal Pod Autoscaler

Question 15

A cloud architect is securing a serverless application that uses serverless functions and an API gateway. Which TWO practices help protect against injection attacks?

Accepted Answer

Parameterized queries for database access. Input validation and parameterized queries prevent injection attacks such as SQL injection or command injection.

Answer

Using environment variables for secrets

Answer

Using a custom domain name

Answer

Enabling API caching