CCSP Cloud Platform and Infrastructure Security Practice Test 9 — 15 Questions

Question 1

A healthcare organization runs a regulated workload on a public cloud. The security team must ensure that data stored in object storage remains unreadable to the cloud provider's staff even if they have physical access to the storage media. Which approach best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypt data client-side before upload and retain sole custody of the keys. When the requirement is that the cloud provider itself must be unable to read the data, the customer must control encryption end to end. Encrypting client-side before upload and keeping keys outside the provider's reach guarantees that only ciphertext ever reaches provider infrastructure. Server-side options, whether provider-managed or customer-provided per request, still involve provider systems handling keys or plaintext at some point.

Answer

Enable server-side encryption with provider-managed keys

Answer

Rely on transport-layer encryption using TLS for all uploads and downloads

Answer

Enable server-side encryption with customer-provided keys that the provider does not retain

Question 2

A startup runs a three-tier web application on cloud virtual machines. The database tier must accept connections only from the application tier and never from the internet. Which cloud network security control should the team implement to enforce this requirement with the least operational overhead?

Accepted Answer

A security group on the database instances allowing only the application tier's security group as source. Referencing the application tier's security group as the source of the database rule creates a dynamic, identity-based allow that follows instances as they scale. Because membership is managed automatically, the team avoids editing CIDR ranges or host firewalls whenever the application tier changes, meeting the segmentation goal with the least ongoing effort.

Answer

A network ACL on the database subnet denying all inbound traffic

Answer

A host-based firewall rule on each database VM allowing the application tier's public IP address

Answer

A web application firewall inspecting SQL traffic bound for the database

Question 3

A cloud security engineer is designing network isolation for a multi-tier application in a single VPC. The database tier must accept connections only from the application tier, and the application tier must accept traffic only from the web tier. Which mechanism should the engineer use to enforce this at the instance level?

Accepted Answer

Security groups that reference other security groups as allowed sources. Security groups are stateful and evaluated at the instance's elastic network interface, and they uniquely support referencing another security group as an allowed source. That lets the engineer define the database tier as reachable only from members of the application tier's group, and the application tier as reachable only from the web tier's group. This logical, identity-based rule set preserves isolation as instances scale and change IP addresses.

Answer

Network ACLs applied to the subnets hosting each tier

Answer

VPC flow logs analyzed by a security information and event management system

Answer

A route table that directs inter-tier traffic through a virtual appliance

Question 4

A cloud security team is designing the management plane for a regulated workload on a public IaaS platform. They must ensure that administrative access to the cloud console and APIs is strongly controlled. Which TWO measures best satisfy this requirement? (Choose two.)

Accepted Answer

Restrict administrative API calls to approved source networks using provider policy conditions. Protecting the management plane requires both strong authentication and contextual authorization. Phishing-resistant multifactor authentication stops credential theft, while policy conditions that restrict administrative API calls to approved source networks ensure that even a stolen credential cannot be replayed from an untrusted location. Together they address identity and context, which are the two levers tenants control over the provider's management plane.

Answer

Issue long-lived access keys to automation accounts to simplify pipeline authentication

Answer

Deploy a content delivery network in front of the provider's management console endpoints

Answer

Enable verbose object storage access logging for all buckets in the account

Question 5

A startup is designing its first cloud landing zone and wants a guardrail that prevents any principal in the organization from disabling AWS CloudTrail logging in any account, including the management account, while still allowing normal administrative work. Which control achieves this with the LEAST operational overhead?

Accepted Answer

An organization-level service control policy attached to the root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail.. An organization root service control policy denies the trail-modification API calls for all principals in every account, making the guardrail preventive rather than detective and requiring no per-account upkeep. Detection rules, permissions boundaries, and remediation automation either act after the fact or leave uncovered principals.

Answer

A CloudWatch Logs metric filter on the CloudTrail log group that triggers an AWS Lambda function to restart the trail.

Answer

An IAM permissions boundary on every administrator role that denies the CloudTrail modification actions.

Answer

An AWS Config rule that detects when a trail is stopped and sends an Amazon SNS notification to the security team.

Question 6

A company stores sensitive backups in cloud object storage. The security policy requires that backups be recoverable even if the primary cloud region suffers a catastrophic outage, and that the backup data remain encrypted with keys the company controls throughout replication. Which configuration best satisfies both requirements?

Accepted Answer

Cross-region replication with customer-managed keys replicated to the destination region. The scenario imposes two independent requirements: survive a regional outage and keep encryption keys under company control throughout replication. Cross-region replication satisfies the first, and customer-managed keys replicated to the destination region satisfy the second. Client-side encryption with keys confined to the source region fails because a regional outage would strand the keys, leaving replicated ciphertext unrecoverable.

Answer

Single-region storage with versioning and object lock enabled

Answer

Cross-region replication with client-side encryption using keys held only in the source region

Answer

Cross-region replication with provider-managed encryption keys in both regions

Question 7

A cloud security architect is designing a multi-tenant SaaS platform hosted on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application instance in one tenant's environment cannot decrypt another tenant's data. The architect wants to use AWS Key Management Service (KMS) to manage encryption keys. Which approach BEST meets this requirement?

Accepted Answer

Create a separate AWS KMS customer managed key per tenant, with a key policy that grants decrypt permission only to that tenant's application role, and store the tenant's data encrypted under its own key.. Cryptographic isolation in a multi-tenant cloud environment requires that each tenant's data be protected by a distinct key whose usage is governed by least-privilege policies. Per-tenant AWS KMS customer managed keys with narrowly scoped key policies ensure that a compromised application instance can only decrypt its own tenant's data. Shared keys, even with rotation or application-level checks, do not prevent cross-tenant decryption if credentials are compromised.

Answer

Use AWS KMS with a single customer managed key, but enable automatic key rotation every 90 days and require all tenants to use the same key alias for encryption and decryption.

Answer

Use a single AWS KMS customer managed key with a key policy that grants decrypt permissions to all tenant application roles, and rely on application-level tenant ID checks before decryption.

Answer

Store all tenant data in a single Amazon S3 bucket encrypted with SSE-S3, and use S3 bucket policies to restrict each tenant's application role to its own prefix.

Question 8

A healthcare company is migrating a legacy three-tier application to AWS. The security team must ensure that the database tier is reachable only from the application tier, that the rule follows the application instances automatically as they scale, and that no rule permits a broader source. Which mechanism should the team use?

Accepted Answer

A security group on the database instances whose inbound rule references the security group ID of the application tier.. A security group rule that names the application tier's security group as its source gives an identity-based, stateful permission that tracks instances through scaling events and excludes every other resource in the VPC. CIDR-based subnet filters and VPC-wide rules are broader than needed, and PrivateLink does not address intra-VPC tier isolation.

Answer

A network ACL on the database subnet that allows inbound traffic only from the application subnet CIDR range.

Answer

A security group on the database instances that allows inbound traffic from the VPC CIDR range on the database port.

Answer

AWS PrivateLink endpoint policies that restrict which application-tier principals may open connections to the database.

Question 9

A cloud operations team is hardening the management plane of a production VPC. The security architect wants to reduce the risk of credential compromise and lateral movement through management interfaces. Which TWO measures best address this goal? (Choose two.)

Accepted Answer

Enforce least privilege on management roles and require multi-factor authentication for privileged sessions. Reducing management plane risk centers on making credentials short-lived and limiting what they can do. Federated identity with temporary credentials removes static keys that can be stolen and reused, while least privilege plus multi-factor authentication constrains the impact of any single compromised session. Together these directly attack credential compromise and lateral movement, whereas logging is detective and password length and bastion placement are secondary hardening steps.

Answer

Enable verbose API logging and forward all management events to a central log repository

Answer

Place management interfaces behind a bastion host reachable only from a corporate IP range

Answer

Increase the password complexity policy for all administrative accounts to twenty characters

Question 10

A cloud security architect is hardening the metadata service on a fleet of EC2 instances that host a customer-facing web application. The team wants to reduce the risk of server-side request forgery leading to credential theft, while keeping the application's legitimate ability to retrieve instance role credentials. Which TWO measures should the architect implement? (Choose two.)

Accepted Answer

Set the instance metadata service hop limit to 1 so responses cannot traverse additional network hops.. Requiring IMDSv2 forces token-based requests that SSRF payloads generally cannot produce, and a hop limit of 1 stops metadata responses from being relayed through proxies or container layers. Together they harden the endpoint while preserving legitimate role credential retrieval. The remaining choices either fail to block the retrieval path or break required functionality.

Answer

Enable AWS CloudTrail data events on the S3 bucket that stores application logs.

Answer

Attach an IAM role with a permissions boundary that denies all actions except those the application needs.

Answer

Disable the instance metadata service entirely on all web application instances.

Question 11

A security team is deploying a Kubernetes cluster on a cloud platform and wants to harden the worker nodes against container breakout and privilege escalation. They are reviewing kubelet and container runtime configurations. Which TWO of the following measures are MOST effective at reducing the attack surface and preventing a compromised container from gaining node-level privileges? (Choose two.)

Accepted Answer

Run containers with a read-only root filesystem and drop all Linux capabilities except those explicitly required.. Hardening worker nodes against container breakout requires preventive controls that limit what a compromised container can do. Running with a read-only root filesystem and dropping unnecessary Linux capabilities removes the tools and privileges needed for escalation. Enforcing the restricted Pod Security Standard via Pod Security Admission ensures workloads cannot run as root, cannot escalate privileges, and must meet seccomp and capability restrictions. Together these measures significantly reduce the attack surface and block common escape techniques.

Answer

Enable the kubelet read-only port and disable anonymous authentication to the kubelet API.

Answer

Configure the container runtime to use the overlay2 storage driver with a dedicated volume for each container.

Answer

Enable audit logging on the Kubernetes API server and ship logs to a central SIEM for alerting.

Question 12

A cloud security engineer is configuring an Amazon S3 bucket that must store sensitive financial data. The requirement is that all data must be encrypted at rest with keys that the organization controls and can rotate, and that access to the keys must be auditable and separable from the data access permissions. Which S3 encryption option BEST meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS, with a key policy that grants decrypt permissions only to specific roles and enables automatic key rotation.. The requirement calls for customer-controlled keys, rotation, and auditable, separable key access. SSE-KMS with a customer managed key in AWS KMS satisfies all three: the organization creates and controls the key, can enable automatic rotation, and uses key policies and IAM to separate key access from S3 data access. CloudTrail logs every KMS operation, providing the needed audit trail. Other options either use AWS-managed keys or shift key management outside AWS, failing at least one requirement.

Answer

SSE-C where the customer provides the encryption key with each request, and the key is stored in AWS Secrets Manager for automatic retrieval.

Answer

SSE-S3 with default bucket encryption enabled and S3 Block Public Access turned on.

Answer

Client-side encryption using the AWS Encryption SDK with a master key stored in an on-premises HSM, and uploading the encrypted objects to S3.

Question 13

A cloud security architect is designing the network segmentation for a three-tier web application hosted in a single Amazon VPC. The database tier must accept connections only from the application tier, and the application tier must accept connections only from the web tier. The architect wants the enforcement to be stateful, evaluated per elastic network interface, and independent of subnet CIDR ranges so that instances can be replaced without rewriting rules. Which control should the architect use to enforce this segmentation?

Accepted Answer

Security groups attached to each tier's instances, referencing other security groups as sources. Security groups provide stateful, interface-level filtering and allow other security groups to be referenced as sources, which decouples the rules from subnet addressing. That combination satisfies the stateful, per-interface, CIDR-independent requirement and survives instance replacement. Subnet-level ACLs, route tables, and PrivateLink endpoints do not deliver group-based, stateful enforcement within a single VPC.

Answer

A VPC peering connection between the three tier subnets with route table entries restricting traffic

Answer

AWS PrivateLink endpoints published by each tier and consumed by the tier above it

Answer

Network ACLs on each subnet, with rules that allow only the CIDR range of the adjacent tier's subnet

Question 14

A cloud provider offers a virtual private cloud (VPC) with a subnet that hosts a database. A security architect must ensure that only instances in a specific application security group can connect to the database on port 3306, and that no other traffic from the internet or other subnets can reach it. The architect is configuring security groups and network ACLs. Which combination of rules BEST achieves this?

Accepted Answer

Configure the database security group to allow inbound TCP 3306 from the application security group ID, and leave the network ACL at its default allow-all state.. Security groups are stateful and can reference other security groups as sources, which is the most precise way to allow only instances with a specific application security group to reach the database. Network ACLs are stateless and subnet-level; they cannot reference security group IDs and should generally be left at default allow unless additional subnet-level controls are needed. Allowing the application security group ID on the database security group meets the requirement exactly.

Answer

Configure the database security group to allow inbound TCP 3306 from 0.0.0.0/0, and configure the network ACL to deny all traffic except from the application subnet CIDR.

Answer

Configure the database security group to allow inbound TCP 3306 from the application subnet CIDR, and configure the network ACL to allow inbound TCP 3306 from the application security group ID.

Answer

Configure the database security group to allow inbound TCP 3306 from the application security group ID, and configure the subnet's network ACL to allow inbound TCP 3306 from the application subnet CIDR only.

Question 15

A financial services firm runs regulated workloads on Microsoft Azure. Auditors require that disk encryption keys for IaaS virtual machines remain under the firm's exclusive control, that the keys never leave a hardware security module, and that the firm can revoke access to the keys at any time, rendering the disks unreadable. The firm does not want Microsoft to be able to decrypt the disks without an explicit grant. Which Azure disk encryption configuration meets these requirements?

Accepted Answer

Azure Disk Encryption with BitLocker keys wrapped by a customer key held in Azure Key Vault Managed HSM. The auditors require customer-exclusive key custody in a hardware security module plus the ability to revoke access and render disks unreadable. Azure Key Vault Managed HSM supplies single-tenant, hardware-backed key storage, and Azure Disk Encryption wraps the volume keys with a customer key from that HSM. Disabling or revoking the key-encryption key effectively crypto-shreds the disks, which platform-managed or software-protected keys cannot achieve.

Answer

Server-side encryption with customer-managed keys stored in Azure Key Vault, using software-protected keys

Answer

Azure Storage Service Encryption with infrastructure encryption enabled on the managed disks

Answer

Azure Disk Encryption with BitLocker keys stored in an Azure Key Vault that uses platform-managed keys