CCSP Cloud Platform and Infrastructure Security Practice Test 8 — 15 Questions

Question 1

A cloud security team is using AWS Lambda functions to process sensitive data. The functions are triggered by Amazon S3 events and write to an Amazon DynamoDB table. The team wants to ensure that the Lambda functions have only the permissions they need and that any compromised function cannot access other AWS resources. Which of the following is the MOST effective approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate IAM role for each Lambda function with permissions scoped to only the specific S3 bucket and DynamoDB table it needs.. The most effective approach is to create a separate IAM role for each Lambda function with permissions scoped to only the resources that function needs. This enforces least privilege and ensures that a compromised function cannot access other AWS resources. Other options either grant excessive permissions, use insecure credential storage, or are overly permissive.

Answer

Attach a resource-based policy to the DynamoDB table that allows all Lambda functions in the account to write to it.

Answer

Use AWS Lambda environment variables to store IAM credentials and rotate them regularly.

Answer

Create a single IAM role with broad permissions to all necessary services and assign it to all Lambda functions.

Question 2

A financial services firm runs a multi-tenant SaaS platform on AWS. A penetration test reveals that a compromised container on one tenant's node was able to read environment variables belonging to another tenant's pods scheduled on the same node. The platform uses Kubernetes with default settings, and pods are not configured with any security context. Which control most directly addresses this isolation failure?

Accepted Answer

Deploy each tenant's workloads using a dedicated container runtime sandbox such as gVisor or Kata Containers, or enforce pod-level isolation with user namespaces and separate runtime classes.. When containers share a node without strong isolation, one workload can sometimes observe another's process environment or runtime metadata. Enforcing dedicated sandboxes such as gVisor or Kata Containers, or isolating with user namespaces and distinct runtime classes, creates a hard boundary between tenants. This is the control that directly addresses the cross-tenant environment variable exposure described.

Answer

Configure pod security contexts to run containers as non-root with readOnlyRootFilesystem and drop all Linux capabilities.

Answer

Encrypt all Kubernetes Secrets at rest using a KMS provider and rotate the encryption keys quarterly.

Answer

Enable Kubernetes Network Policies that deny all ingress and egress by default between namespaces.

Question 3

A financial services company runs a regulated workload on a public cloud. The security team must ensure that all data at rest in the cloud provider's block storage service is encrypted with keys that the company controls and can revoke immediately. The company also needs to prove to auditors that the cloud provider cannot access the plaintext data. Which approach BEST meets these requirements?

Accepted Answer

Implement client-side encryption before writing data to block storage, using a customer-managed key stored in an external key management system.. Client-side encryption with an externally managed key ensures the cloud provider never receives plaintext and cannot access the key. The company retains full control and can revoke the key instantly, and auditors can verify that the provider has no path to the plaintext. Other options either leave key control with the provider or do not provide provable inaccessibility, failing the regulatory requirements.

Answer

Use provider-managed encryption keys with automatic rotation enabled, and rely on the provider's attestation reports for audit evidence.

Answer

Use a cloud provider's key management service to generate a customer-managed key (CMK) and enable automatic rotation, while the provider manages the underlying HSM.

Answer

Enable server-side encryption with customer-provided keys (SSE-C), where the company supplies the key with each API request but the provider stores the encrypted data.

Question 4

A cloud operations team is configuring a virtual private cloud (VPC) and needs to control both inbound and outbound traffic at the subnet level. The team wants to ensure that any traffic leaving the subnet is explicitly allowed, and that responses to inbound requests are automatically permitted. Which VPC component should the team configure?

Accepted Answer

Network ACLs, because they are stateless and can enforce explicit allow/deny rules for both inbound and outbound traffic at the subnet boundary.. Network ACLs are stateless and operate at the subnet level, requiring explicit rules for both inbound and outbound traffic. This makes them the correct choice for controlling traffic at the subnet boundary with explicit outbound allowances. Security groups are stateful and instance-level, route tables direct traffic without filtering, and flow logs only record metadata without enforcement.

Answer

Security groups, because they are stateful and evaluate all traffic at the instance level.

Answer

VPC flow logs, because they capture metadata about traffic and can be used to enforce outbound restrictions.

Answer

Route tables, because they determine which subnet traffic is directed to and can block unauthorized destinations.

Question 5

A healthcare organization stores PHI in an Amazon S3 bucket. An auditor finds that objects are encrypted with SSE-S3, and the organization wants to demonstrate that it controls the encryption keys and can audit their use independently of AWS-managed keys. Which change best satisfies this requirement while minimizing application changes?

Accepted Answer

Switch the bucket to SSE-KMS using a customer managed key in AWS KMS, and grant the application role kms:Decrypt and kms:GenerateDataKey permissions.. SSE-KMS with a customer managed key allows the organization to define the key policy, control rotation, and audit every cryptographic operation through CloudTrail. Applications continue to use the standard S3 API with only additional IAM permissions on the KMS key, so code changes are minimal. This is the cleanest way to demonstrate independent key control and usage auditing.

Answer

Configure SSE-C with a customer-provided key sent on every request via the x-amz-server-side-encryption-customer-key header.

Answer

Keep SSE-S3 but enable S3 Object Lock in compliance mode and versioning to prevent unauthorized key access.

Answer

Enable client-side encryption in the application using a locally stored AES-256 key and upload the encrypted objects to S3.

Question 6

A cloud security engineer is responsible for securing a serverless application built on AWS Lambda. The application processes sensitive customer data and writes results to an Amazon S3 bucket. The engineer must ensure that the Lambda function has only the permissions it needs to write to that specific bucket, and that the credentials are not hardcoded. Which approach should the engineer take?

Accepted Answer

Create an IAM role with a policy granting s3:PutObject to the specific bucket and attach it to the Lambda function.. The best practice for granting permissions to AWS Lambda is to use an IAM role with a narrowly scoped policy. The role provides temporary credentials that are automatically rotated, and the policy grants only the required s3:PutObject permission to the specific bucket. This adheres to least privilege and eliminates the need for hardcoded or stored long-term credentials. Other options involve long-term credentials or insecure storage, which are not recommended.

Answer

Use an IAM user with an inline policy for S3 access and configure the Lambda function to use those credentials via the AWS SDK.

Answer

Embed the access keys in the Lambda function's environment variables.

Answer

Store IAM user access keys in AWS Secrets Manager and retrieve them in the Lambda function code.

Question 7

A financial services company runs sensitive workloads on a public IaaS cloud. The security team wants to cryptographically prove to auditors that the virtual machine hosting their data booted an unmodified, approved hypervisor and firmware image. Which cloud infrastructure security capability should they require from the provider?

Accepted Answer

Measured boot with attestation using a virtual TPM. Measured boot combined with remote attestation uses a virtual TPM to hash each stage of the boot chain and expose those measurements for verification. Because the auditor needs cryptographic proof that firmware and hypervisor code were unmodified, this is the only listed control that observes the platform boot itself rather than the guest workload or network perimeter.

Answer

Full-disk encryption of the guest operating system volumes

Answer

Security groups restricting inbound management ports

Answer

Immutable infrastructure with golden VM images

Question 8

A cloud operations team is deploying a three-tier application across two AWS Availability Zones. The database tier must not be reachable from the internet, and the web tier must accept HTTPS from the public. The security architect wants defense in depth at both the subnet and instance levels. Which combination of controls BEST aligns with a layered network security design?

Accepted Answer

Place the web tier in a public subnet with a security group allowing 443 from 0.0.0.0/0 and a network ACL allowing 443 inbound; place the database tier in a private subnet with a security group allowing 3306 only from the web tier security group and a network ACL denying all internet CIDR ranges.. A layered VPC design uses network ACLs at the subnet boundary and security groups at the instance level, giving two independent enforcement points. Referencing the web tier's security group as the database source restricts access to authorized instances rather than broad CIDRs. Keeping the database in a private subnet and denying internet CIDRs at the network ACL completes the defense-in-depth model.

Answer

Place both tiers in public subnets and use network ACLs to restrict the database tier to the web tier's CIDR block, with security groups allowing all traffic within the VPC.

Answer

Use AWS WAF in front of the web tier and AWS Shield Advanced for the database tier, with security groups allowing 3306 from the VPC CIDR.

Answer

Place both tiers in private subnets, use a NAT gateway for web tier egress, and rely on security groups alone to control inbound traffic.

Question 9

A company is migrating a legacy application to a cloud provider's infrastructure as a service (IaaS) platform. The security team must ensure that the hypervisor layer is patched and secured, and that tenants cannot access each other's memory or storage. According to the shared responsibility model, which party is responsible for securing the hypervisor and preventing cross-tenant access?

Accepted Answer

The cloud provider, because the hypervisor and underlying infrastructure are part of the provider's managed security scope.. The cloud provider is responsible for securing the hypervisor and preventing cross-tenant access because these are part of the provider's managed infrastructure. Customers cannot access or patch the hypervisor in IaaS. The shared responsibility model always assigns the hypervisor, physical hosts, and network fabric to the provider, while the customer secures the guest OS, applications, and data.

Answer

A third-party auditor, because independent verification is required to ensure tenant isolation in multi-tenant environments.

Answer

The customer, because they are responsible for all security controls in IaaS.

Answer

Both parties share equal responsibility, with the customer patching the hypervisor and the provider monitoring for cross-tenant attacks.

Question 10

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is logically isolated and that a compromised tenant cannot access another tenant's resources. The architect decides to use separate AWS accounts per tenant and wants to centralize security management. Which AWS service should be used to manage these accounts and apply security policies centrally?

Accepted Answer

AWS Organizations. AWS Organizations is designed to centrally manage multiple AWS accounts, apply service control policies (SCPs) to enforce security boundaries, and simplify billing. It enables logical isolation by placing each tenant in a separate account while allowing centralized security governance. The other services provide access management, governance automation, or resource sharing but do not fulfill the core requirement of central account management and policy enforcement.

Answer

AWS IAM Identity Center

Answer

AWS Resource Access Manager (RAM)

Answer

AWS Control Tower

Question 11

A cloud operations team runs a web tier on 40 Amazon EC2 instances behind an Application Load Balancer. Auditors require that administrators never hold long-lived SSH keys and that every login to an instance is logged with the identity of the human who initiated it. The team already uses an external SAML 2.0 identity provider for console access. Which approach BEST satisfies the auditors' requirements?

Accepted Answer

Enable AWS Systems Manager Session Manager with the instances managed by SSM Agent, and grant access through the federated IAM role.. Session Manager provides keyless, auditable interactive access that inherits the federated IAM identity, so every session is attributable to a named administrator and no standing SSH keys exist. The other designs either retain long-lived key material or produce only network-level telemetry that cannot identify the human operator, which fails the auditors' attribution and key-elimination requirements.

Answer

Deploy a bastion host with SSH certificate authority signing and rotate host certificates every 24 hours.

Answer

Store a shared PEM key pair in AWS Secrets Manager and issue it to administrators through a break-glass runbook.

Answer

Move the instances into a private subnet, restrict port 22 to the corporate CIDR range, and enable VPC Flow Logs on the subnet.

Question 12

A healthcare cloud tenant must ensure that when a physical host is decommissioned, residual data in storage cannot be reconstructed. The provider offers self-encrypting drives. Which property most directly guarantees that cryptographic erasure is effective?

Accepted Answer

The media encryption key is wrapped by a key-encryption key that is destroyed on decommission. Cryptographic erasure depends entirely on the irrecoverability of the key material protecting the drive. Only destroying the wrapping key that protects the media encryption key ensures that ciphertext on retired media can never be decrypted, which is precisely the guarantee a healthcare tenant needs for decommissioned storage.

Answer

The drive firmware performs a multi-pass overwrite of all sectors

Answer

The drive is physically shredded at an approved destruction facility

Answer

The storage array keeps redundant copies of the data on mirrored volumes

Question 13

A cloud security engineer is configuring network security for a web application hosted on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The engineer needs to allow HTTP and HTTPS traffic from the internet to the ALB and restrict direct access to the EC2 instances. Which AWS service should be used to control inbound traffic to the ALB?

Accepted Answer

Security groups. Security groups are stateful virtual firewalls that control inbound and outbound traffic for AWS resources such as ALBs and EC2 instances. They are the correct tool to allow HTTP/HTTPS to an ALB and to restrict EC2 instances to only accept traffic from the ALB. Network ACLs operate at the subnet level and are stateless, AWS WAF is for layer 7 protection, and AWS Shield is for DDoS mitigation, so none of these fulfill the basic network access control requirement.

Answer

AWS Shield

Answer

Network ACLs

Answer

AWS WAF

Question 14

A financial services company is migrating its cardholder data environment to a public cloud IaaS platform. The security team must determine which controls remain the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility in this IaaS deployment?

Accepted Answer

Patching the guest operating system and its installed applications. Under the shared responsibility model for IaaS, the provider owns security of the cloud, including facilities, hardware, and the hypervisor, while the customer owns security in the cloud. That includes the guest operating system, runtime, applications, and data. Because the question concerns a cardholder data environment, the customer must demonstrate patch management for the guest OS and applications as part of PCI DSS compliance obligations.

Answer

Maintaining the physical security controls of the data center housing the hosts

Answer

Managing the redundancy of the physical network switches that interconnect racks

Answer

Applying firmware and microcode updates to the underlying hypervisor hosts

Question 15

A DevOps team deploys workloads on a public cloud using infrastructure as code. A security review finds that a developer's pipeline credentials can both modify production network security groups and read secrets from the key management service. Which cloud infrastructure security principle is most directly violated?

Accepted Answer

Separation of duties enforced through least-privilege IAM roles. The pipeline identity combines the power to weaken production network controls with the power to read protected secrets, so a single compromised credential can both disable defenses and steal data. Enforcing separation of duties through least-privilege IAM roles splits these capabilities across distinct identities, removing the toxic combination the review uncovered.

Answer

Immutable infrastructure with version-controlled deployment artifacts

Answer

Data residency controls restricting where tenant data is stored

Answer

Defense in depth using layered network and host controls