CCSP Cloud Platform and Infrastructure Security — Timed 10 Questions

Question 1

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

Accepted Answer

AMD SEV (Secure Encrypted Virtualization). AMD Secure Encrypted Virtualization (SEV) encrypts the memory of each VM with a unique key, preventing a malicious VM from reading another VM's memory. This hardware-assisted technology isolates VM memory at the hardware level, making it the correct choice for this scenario. IOMMU (Input-Output Memory Management Unit) controls device DMA access, not CPU memory accesses between VMs. Intel TXT ensures trusted boot, and Intel SGX protects application enclaves, neither of which prevent cross-VM memory reads.

Answer

IOMMU (Input-Output Memory Management Unit)

Answer

Intel TXT (Trusted Execution Technology)

Answer

Intel SGX (Software Guard Extensions)

Question 2

An organization uses a multi-cloud strategy and wants to connect their on-premises data center to multiple cloud providers with a single private, low-latency connection. Which solution should they consider?

Accepted Answer

Software-defined cloud interconnect (e.g., Megaport). A dedicated software-defined cloud interconnect, like Megaport or Equinix Fabric, allows connecting to multiple cloud providers from a single port. Direct connections to a single provider would require separate connections for each provider.

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Question 3

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

Accepted Answer

Private Endpoint (Service Endpoint). Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.

Answer

VPN Connection

Answer

Internet Gateway

Answer

NAT Gateway

Question 4

A company uses serverless functions to process sensitive data. The functions need to access a database in a private subnet. What is the most secure way to enable this access without exposing the database to the internet?

Accepted Answer

Use a VPC endpoint for the database and attach the serverless function to the VPC. Placing the serverless function inside a virtual private cloud (VPC) via VPC integration and using a VPC endpoint or private connectivity allows secure, private access to the database instance without internet traversal.

Answer

Store database credentials in environment variables with encryption

Answer

Configure a database proxy and connect via a NAT gateway

Answer

Assign a public IP to the serverless function and allow its IP in the database firewall rule

Question 5

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 6

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag grants all capabilities and disables most security mechanisms, making container escape trivial. Other options like Seccomp or AppArmor would restrict actions, and read-only root filesystem would prevent writes, but the privileged mode is the most direct enabler.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 7

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies, removing package managers, shells, and other utilities that could be exploited. This reduces the attack surface significantly.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 8

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool for signing and verifying container images. It integrates with admission controllers like Kyverno or OPA Gatekeeper to enforce that only signed images are deployed.

Answer

Clair

Answer

Trivy

Answer

Snyk Container

Question 9

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 10

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint