CCSP Cloud Platform and Infrastructure Security Practice Test 7 — 15 Questions

Question 1

A cloud architect is designing VPC connectivity for a global organization with multiple AWS accounts. They need a central hub for connecting many VPCs together, supporting transitive routing. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transit Gateway. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks, supporting transitive routing between all attached VPCs. It simplifies network architecture by eliminating the need for complex full-mesh VPC peering and allows scalable, hub-and-spoke connectivity. For a global organization with many VPCs across accounts, Transit Gateway is the designed solution.

Answer

Private Link

Answer

VPN Connection

Answer

VPC Peering

Question 2

A security team is hardening a Kubernetes cluster for production workloads. Which THREE measures should they implement to improve runtime container security?

Accepted Answer

Enable AppArmor or SELinux profiles. AppArmor and SELinux are Linux Security Modules (LSMs) that enforce mandatory access control (MAC) policies on containers. By applying these profiles, you restrict what processes inside a container can do—such as file access, network operations, and capability use—beyond the default discretionary access controls. This significantly reduces the attack surface and limits the impact of a container breakout.

Answer

Mount the host filesystem as read-write in containers

Answer

Use privileged containers for system daemons

Question 3

A DevOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and prevent tampering?

Accepted Answer

Sign container images using Cosign. Option A is correct because Cosign (part of the Sigstore project) cryptographically signs container images, producing a signature that can later be verified to prove the image was built by a trusted identity and has not been altered. Option B is correct because admission controllers such as Kyverno (or OPA Gatekeeper, Connaisseur) enforce policy at the Kubernetes API server, rejecting any pod whose image lacks a valid Cosign signature, thereby blocking tampered or unsigned images from running. Option E is correct because in-toto attestations capture signed, verifiable metadata about the build process (e.g., SLSA provenance), letting the team prove how and from what source an image was produced, which is central to supply-chain integrity. Option C is not appropriate because the mutable 'latest' tag provides no immutability or version pinning, making it impossible to guarantee which image is deployed and undermining tamper detection. Option D is not appropriate because a public registry exposes images to unauthorized pulls and potential tampering, whereas a private, access-controlled registry with immutable tags is the secure choice.

Answer

Use the 'latest' tag for base images

Answer

Store images in a public registry

Question 4

A company is deploying a serverless function in AWS Lambda that needs to access a private RDS database. Which TWO configurations are necessary for secure access?

Accepted Answer

Configure VPC integration for the Lambda function. Lambda functions must be attached to a VPC using VPC integration to access resources inside a private subnet, such as an RDS database. Without VPC integration, the Lambda function runs in an AWS-managed VPC and cannot reach resources in the customer’s VPC. This configuration requires the Lambda function to be associated with the same VPC, subnets, and security groups as the RDS instance.

Answer

Disable TLS for the database connection

Answer

Attach an Internet Gateway to the Lambda function

Answer

Assign a public IP address to the Lambda function

Question 5

An organization uses Azure Functions and wants to secure its API endpoints exposed via Azure API Management. Which TWO security controls should they implement at the API Gateway level?

Accepted Answer

Enable TLS enforcement. Option C (Enable TLS enforcement) is correct because enforcing TLS at the API Management gateway ensures all client-to-gateway traffic is encrypted in transit using HTTPS, protecting credentials and tokens from interception, and API Management supports configuring the minimum TLS version and cipher suites on the gateway. Option D (Implement JWT validation) is correct because API Management has a built-in validate-jwt policy that verifies the signature, issuer, audience, and expiration of OAuth 2.0/OpenID Connect bearer tokens at the gateway, so unauthenticated or tampered requests are rejected before reaching the backend Functions. Option A is not a gateway-level authentication control and whitelisting 'all users' is contradictory and impractical for public APIs. Option B is a backend configuration concern for the Function app, not a control applied at the API Gateway. Option E is wrong because disabling API keys removes a subscription-based access control rather than adding security at the gateway.

Answer

Configure IP whitelisting for all users

Answer

Store secrets in Azure Function environment variables

Answer

Disable API keys

Question 6

A cloud security architect is designing a multi-tenant IaaS deployment where tenants run untrusted workloads on shared physical hosts. The architect wants to reduce the risk of cross-tenant data remanence in the storage layer. Which control is MOST effective?

Accepted Answer

Enable encryption at rest with per-tenant customer-managed keys and cryptographic erasure on deprovisioning.. Cryptographic erasure with per-tenant customer-managed keys is the strongest control against storage remanence in multi-tenant environments because destroying the key renders residual ciphertext unrecoverable. Provider-managed shared keys, memory scrubbing, and QoS controls do not address persistent-block reuse by other tenants, leaving confidentiality risk unresolved.

Answer

Enable server-side encryption with a single provider-managed key for the whole storage service.

Answer

Implement storage QoS and IOPS throttling to isolate tenant workloads on shared volumes.

Answer

Rely on the hypervisor's memory scrubbing between VM lifecycles to prevent data leakage.

Question 7

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Accepted Answer

Use a separate KMS customer managed key per tenant and enforce strict IAM policies that limit each tenant's application role to only its own key.. The scenario requires cryptographic isolation so that a compromised process cannot read another tenant's data. Using a separate KMS customer managed key per tenant ensures that data is encrypted with distinct keys, and strict IAM policies limit each tenant's role to only its own key. This combination creates a strong boundary. Other options are either hygiene practices or detective controls that do not prevent cross-tenant access.

Answer

Store all tenant data in a single S3 bucket with a bucket policy that restricts access by tenant ID prefix.

Answer

Enable automatic key rotation for all KMS customer managed keys.

Answer

Enable AWS CloudTrail logging for all KMS API calls and monitor for anomalous decrypt operations.

Question 8

A security engineer is hardening a Kubernetes cluster that runs multi-tenant workloads. The team wants to ensure that a compromised pod cannot reach the cloud provider's instance metadata service to steal node credentials. Which control BEST addresses this?

Accepted Answer

Enforce a NetworkPolicy that denies egress to the link-local address 169.254.169.254 from all pods.. Blocking egress to 169.254.169.254 with a NetworkPolicy directly prevents pods from reaching the instance metadata service, which is the specific vector for stealing node credentials. PodSecurity, credential rotation, and service mesh mTLS address different risks and do not stop a pod from querying the metadata endpoint.

Answer

Rotate node IAM credentials every 24 hours using the cloud provider's rotation service.

Answer

Enable PodSecurity admission with the restricted profile on all namespaces.

Answer

Use a service mesh with mutual TLS between all workloads in the cluster.

Question 9

A financial services company runs a critical workload on AWS. The security team must ensure that all data at rest in Amazon S3 is encrypted with keys that the company controls and that the keys are stored in a hardware security module (HSM) separate from the cloud provider's default HSM. The company also requires the ability to immediately revoke access to the keys. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS custom key store backed by AWS CloudHSM (SSE-KMS with custom key store).. The requirement is for customer-controlled keys stored in a dedicated HSM separate from the cloud provider's default HSM, with immediate revocation. AWS KMS custom key store backed by AWS CloudHSM provides exactly this: you control the HSM cluster, and you can revoke access by disassociating the key or deleting it. Other options either use provider-managed HSMs or lack HSM separation.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).

Answer

Use S3 client-side encryption with a customer-provided key stored in AWS Secrets Manager.

Question 10

A healthcare organization runs a critical workload on Azure virtual machines. The security team wants to ensure that the VMs are protected against rootkit and kernel-level malware that could persist across reboots. They need a solution that can detect and alert on suspicious kernel driver loads and provide file integrity monitoring. Which Azure service should they implement?

Accepted Answer

Azure Defender for Servers. Azure Defender for Servers, a component of Microsoft Defender for Cloud, provides endpoint detection and response, file integrity monitoring, and kernel-level threat detection. It can identify suspicious kernel driver loads and rootkit behavior, alerting security teams. Other services like Network Watcher focus on network diagnostics, Sentinel is a SIEM, and the outdated Security Center standard tier is superseded by Defender for Servers.

Answer

Azure Network Watcher

Answer

Azure Sentinel

Answer

Azure Security Center (standard tier)

Question 11

A cloud security team is evaluating controls for protecting data in a PaaS database service. The database must support tenant isolation, and the team wants to prevent one tenant's queries from accessing another tenant's rows. Which TWO controls BEST achieve row-level tenant isolation? (Choose two.)

Accepted Answer

Use separate database schemas per tenant with distinct database roles and grant only schema-scoped privileges.. Row-level security policies and schema-per-tenant with role-scoped grants both enforce isolation inside the database engine, so cross-tenant access is blocked regardless of application behavior. TDE, application-side filtering, and auditing do not prevent a query from reaching another tenant's rows, making them insufficient as primary isolation controls.

Answer

Enable database auditing and alert on queries that return more than a threshold number of rows.

Answer

Enable transparent data encryption on the database so that rows are encrypted at rest with a service-managed key.

Answer

Configure the application to append a tenant_id filter to every generated SQL statement.

Question 12

A cloud operations team is deploying a web application behind a load balancer in a VPC. The application servers must be reachable only from the load balancer, never directly from the internet. Which configuration achieves this?

Accepted Answer

Place the application servers in a private subnet and attach a security group that allows inbound traffic only from the load balancer's security group.. Private subnets eliminate the internet route, and referencing the load balancer's security group as the allowed source ensures only that balancer can reach the application servers. Public subnets, host firewalls, and elastic IPs all leave direct internet reachability in place, so they fail the isolation requirement.

Answer

Place the application servers in a public subnet and attach a network ACL that denies inbound traffic from 0.0.0.0/0.

Answer

Keep the application servers in a public subnet but enable a host-based firewall on each instance.

Answer

Assign elastic IP addresses to the application servers and restrict access using a VPN.

Question 13

A cloud security team needs to ensure that an Amazon EC2 instance hosting a regulated workload cannot communicate with the public internet, but the instance must still be able to download OS patches from an internal repository and retrieve secrets from AWS Secrets Manager. The workload runs in a private subnet with no NAT gateway or internet gateway route. Which combination of configurations will meet these requirements with the LEAST operational overhead?

Accepted Answer

Create VPC interface endpoints (AWS PrivateLink) for Secrets Manager and an S3 gateway endpoint for the patch repository, and associate the endpoints with the private subnet's route table and security group.. VPC interface endpoints (AWS PrivateLink) and S3 gateway endpoints let resources in private subnets reach AWS services entirely over the AWS private network, with no internet gateway, NAT, or public IP required. This satisfies the no-internet constraint, supports both patch retrieval and secret access, and requires minimal ongoing operational effort compared to firewall or NAT-based designs.

Answer

Attach an internet gateway to the VPC and use a security group that allows only outbound HTTPS to the patch server and Secrets Manager endpoints.

Answer

Place the instance in a public subnet and use an AWS Network Firewall policy to block all outbound traffic except the patch server and Secrets Manager IP ranges.

Answer

Deploy a NAT gateway in a public subnet and update the private subnet route table to direct 0.0.0.0/0 through the NAT gateway, then restrict outbound traffic using network ACLs.

Question 14

A cloud security architect is designing a workload that must store encryption keys in a hardware security module (HSM) that is validated to FIPS 140-2 Level 3. The workload runs on a major public cloud provider. The architect wants to minimize operational overhead while ensuring the keys never leave the HSM boundary. Which cloud service model should the architect select?

Accepted Answer

A cloud provider's managed Hardware Security Module (HSM) service offering dedicated, tamper-resistant HSM appliances.. The requirement is for a FIPS 140-2 Level 3 validated HSM with minimal operational overhead and keys that never leave the HSM. A managed HSM service provides dedicated, validated hardware while the provider handles maintenance and availability, satisfying both security and operational needs. Alternatives either lack hardware validation, export keys outside the boundary, or add unnecessary management burden.

Answer

A software-based key management service that uses a shared, multi-tenant key store with encryption at rest.

Answer

A cloud provider's virtual private cloud (VPC) with a customer-managed encryption key stored in the provider's object storage.

Answer

An on-premises HSM connected to the cloud via a VPN tunnel, with keys replicated to the cloud provider's key vault.

Question 15

A financial services firm runs a regulated workload on a public cloud. Auditors require evidence that the cloud provider's physical security controls meet the firm's requirements. Which artifact provides the MOST direct evidence?

Accepted Answer

The cloud provider's SOC 2 Type II report covering the relevant data center and service scope.. A SOC 2 Type II report gives independent, period-based assurance over control design and operating effectiveness, including physical security, which directly satisfies auditor evidence requirements. Whitepapers, ISO certificates, and penetration test reports either lack independent testing, lack control-effectiveness detail, or address different scopes.

Answer

A penetration test report commissioned by the cloud provider for its data centers.

Answer

The cloud provider's marketing security whitepaper describing data center protections.

Answer

The provider's ISO 27001 certificate displayed on its trust portal.