CCSP Cloud Platform and Infrastructure Security — Timed 50 Questions

Question 1

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

Accepted Answer

AMD SEV (Secure Encrypted Virtualization). AMD SEV (Secure Encrypted Virtualization) is a hardware feature that encrypts the memory of individual VMs with unique keys, preventing the hypervisor or other VMs from reading the memory. This directly addresses the requirement to prevent a malicious VM from reading another VM's memory. Intel SGX protects specific application enclaves, not entire VMs, and IOMMU and Intel TXT address different aspects of security.

Answer

IOMMU (Input-Output Memory Management Unit)

Answer

Intel TXT (Trusted Execution Technology)

Answer

Intel SGX (Software Guard Extensions)

Question 2

An organization uses a multi-cloud strategy and wants to connect their on-premises data center to multiple cloud providers with a single private, low-latency connection. Which solution should they consider?

Accepted Answer

Software-defined cloud interconnect (e.g., Megaport). A dedicated software-defined cloud interconnect, like Megaport or Equinix Fabric, allows connecting to multiple cloud providers from a single port. Direct connections to a single provider would require separate connections for each provider.

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Answer

Dedicated physical connection to a single cloud provider

Question 3

A security architect is designing a multi-tenant cloud environment. Which hypervisor type provides the strongest isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

VMware ESXi (Type 1). A Type 1 hypervisor runs directly on the host hardware without an underlying host operating system, giving it direct control over hardware resources and providing stronger isolation between guest VMs. VMware ESXi is a Type 1 (bare-metal) hypervisor, making it the correct choice for the strongest isolation in a multi-tenant environment. Type 2 hypervisors run on top of a host OS, adding an extra layer that can introduce vulnerabilities and weaker isolation.

Answer

VMware Workstation (Type 2)

Answer

KVM (Type 2)

Answer

VirtualBox (Type 2)

Question 4

In a cloud VPC design, which component acts as a stateful firewall at the instance level, allowing only inbound rules?

Accepted Answer

Security group. A security group is a stateful, instance-level virtual firewall that controls inbound and outbound traffic; return traffic for allowed inbound connections is automatically permitted regardless of outbound rules. It supports allow rules only (no deny), and is attached to ENIs/instances.

Answer

Network ACL (NACL)

Answer

Internet gateway

Answer

Route table

Question 5

A company has multiple virtual private clouds in the same region and wants to enable direct IP connectivity between them using private IP addresses. However, they do not need transitive routing across multiple VPCs. Which solution should they use?

Accepted Answer

Virtual network peering. Virtual network peering (VPC peering) creates a direct, private network connection between two VPCs, allowing resources in each to communicate using private IP addresses as if they were on the same network. It is non-transitive by design, meaning if VPC A is peered with VPC B, and VPC B with VPC C, A cannot reach C through B. This exactly matches the requirement of direct connectivity without transitive routing. It is the native, low-latency, and cost-effective solution for same-region VPC-to-VPC private communication.

Answer

VPN Gateway

Answer

Private connectivity

Answer

Transit routing hub

Question 6

An organization is designing a VPC with multiple tiers. Which TWO network components are used to restrict traffic between subnets?

Accepted Answer

Network ACL (NACL). Network ACLs (option B) are stateless subnet-level firewalls that evaluate allow/deny rules for inbound and outbound traffic crossing a subnet boundary, so they directly restrict traffic between subnets. Security Groups (option E) are stateful instance-level virtual firewalls whose inbound/outbound rules control which traffic can reach or leave resources in a subnet, making them the other component used to restrict inter-subnet traffic. VPC Peering (option A) only establishes private connectivity between two VPCs and does not filter traffic. An Internet Gateway (option C) merely provides a target for internet-routable traffic and performs no filtering. A Route Table (option D) only directs where packets are sent based on CIDR destinations and cannot allow or deny traffic.

Answer

VPC Peering

Answer

Internet Gateway

Answer

Route Table

Question 7

A company uses serverless functions to process sensitive data. The functions need to access a database in a private subnet. What is the most secure way to enable this access without exposing the database to the internet?

Accepted Answer

Use a VPC endpoint for the database and attach the serverless function to the VPC. Placing the serverless function inside a virtual private cloud (VPC) via VPC integration and using a VPC endpoint or private connectivity allows secure, private access to the database instance without internet traversal.

Answer

Store database credentials in environment variables with encryption

Answer

Configure a database proxy and connect via a NAT gateway

Answer

Assign a public IP to the serverless function and allow its IP in the database firewall rule

Question 8

A cloud security architect is designing network connectivity between multiple virtual networks in the same region. The requirement is to allow full mesh connectivity with centralized management and the ability to apply network policies. Which service should be used?

Accepted Answer

Transit gateway. A transit gateway acts as a central hub for multiple virtual networks, enabling transitive peering and centralized routing and policy management. Virtual network peering is point-to-point and does not support transitive routing, requiring a full mesh of connections for multiple virtual networks.

Answer

Internet gateway

Answer

Virtual network peering

Answer

Virtual network endpoint

Question 9

A cloud security team is implementing container runtime security. Which of the following measures is most effective at preventing a container from breaking out to the host OS?

Accepted Answer

Applying a Seccomp profile that whitelists only necessary syscalls. A Seccomp profile that whitelists only necessary syscalls restricts the container's ability to invoke dangerous system calls that could be used to escape to the host. By limiting the syscall surface, it directly mitigates kernel exploits and breakout techniques. This is the most effective measure among the options for preventing container escape.

Answer

Setting the container's root filesystem to read-only

Answer

Using a non-root user inside the container

Answer

Dropping all Linux capabilities except those required

Question 10

A cloud security architect is evaluating options for private connectivity to cloud services without traversing the internet. Which TWO services can be used to achieve this? (Select two.)

Accepted Answer

VPC peering. VPC peering (A) is correct because it establishes a private, one-to-one network route between two VPCs using private IPv4/IPv6 addresses, so traffic between them never traverses the public internet. VPC endpoint (C) is correct because it provides private connectivity to supported AWS services (Interface endpoints via ENIs using PrivateLink, or Gateway endpoints for S3/DynamoDB) by keeping traffic within the AWS network instead of going over the internet. Security group (B) is only a stateful virtual firewall controlling inbound/outbound traffic; it does not create connectivity. Internet gateway (D) is the component that enables internet access for a VPC, which is the opposite of the stated goal. NAT gateway (E) allows instances in private subnets to initiate outbound traffic to the internet, so it also traverses the internet and does not meet the requirement.

Answer

Security group

Answer

Internet gateway

Answer

NAT gateway

Question 11

In a Kubernetes cluster, a pod needs to access a cloud provider's key management service (KMS) to retrieve secrets. Which of the following RBAC configurations is the least privileged approach?

Accepted Answer

Create a Role in the pod's namespace that allows get on secrets and bind it to the pod's service account. The least privileged approach is to create a namespaced Role that grants only 'get' on secrets and bind it to the pod's service account via a RoleBinding, scoping permissions to the namespace and the minimum verb needed. This avoids cluster-wide access and avoids unnecessary verbs like 'list', which can enumerate all secrets. Namespaced Roles plus RoleBindings are the standard Kubernetes RBAC mechanism for least privilege.

Answer

Bind a ClusterRole with get and list on secrets to the pod's service account

Answer

Grant the pod's service account cluster-admin rights

Answer

Use a PodSecurityPolicy that allows privileged containers

Question 12

A company is using AWS Lambda functions that need to access a private RDS database. Which configuration allows the Lambda function to connect securely without traversing the internet?

Accepted Answer

Configure the Lambda function to use a VPC with private subnets and a VPC endpoint for RDS. Placing the Lambda function in a VPC with private subnets and configuring a VPC endpoint (Interface endpoint powered by AWS PrivateLink) for RDS allows the function to reach the database entirely over the AWS private network, never traversing the public internet. The Lambda execution role also needs the AWSLambdaVPCAccessExecutionRole policy to create ENIs in the subnets. This is the standard secure pattern for Lambda-to-RDS connectivity.

Answer

Assign an Elastic IP to the Lambda function

Answer

Use a Lambda environment variable to store the database endpoint and credentials

Answer

Place the Lambda function in a public subnet with an internet gateway

Question 13

A cloud architect is securing a serverless application that uses serverless functions and an API gateway. Which TWO practices help protect against injection attacks?

Accepted Answer

Parameterized queries for database access. Option A (Parameterized queries for database access) is correct because parameterized queries separate SQL code from user-supplied data, so injected payloads are treated as data rather than executable SQL, which is the primary defense against SQL injection in serverless functions that query databases. Option D (Input validation) is correct because validating and sanitizing input at the API gateway or function boundary rejects or neutralizes malicious characters and patterns (e.g., SQL metacharacters, command separators) before they reach interpreters, directly mitigating injection attacks. Option B (Using environment variables for secrets) is not correct here because it addresses secret management and credential exposure, not injection prevention. Option C (Using a custom domain name) is unrelated to injection; it only affects DNS/branding and TLS presentation. Option E (Enabling API caching) is also unrelated to injection and can even introduce caching-related risks, but it does not protect against injection attacks.

Answer

Using environment variables for secrets

Answer

Using a custom domain name

Answer

Enabling API caching

Question 14

A cloud security professional is designing network security for a VPC hosting a three-tier application. The database tier must be isolated from direct internet access and only accessible from the application tier. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Security Groups. Security Groups (C) are correct because they are stateful, instance-level virtual firewalls that can be attached to the database tier and configured to allow inbound traffic only from the application tier's security group, thereby restricting access to that source. Network ACLs (E) are correct because they are stateless, subnet-level controls that can deny or allow traffic at the subnet boundary, adding a layer of defense that can block direct internet access to the database subnet. Together, security groups enforce least-privilege access between tiers while NACLs provide subnet-level filtering to isolate the database tier. VPC Peering (A) is not needed because it connects separate VPCs, not tiers within one VPC. An Internet-facing Application Load Balancer (B) would expose the application to the internet and is not used to isolate a database tier. An Internet Gateway (D) provides internet connectivity to a VPC and would not help isolate the database tier from direct internet access.

Answer

VPC Peering

Answer

Internet-facing Application Load Balancer

Answer

Internet Gateway

Question 15

A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?

Accepted Answer

CPU Pinning. CPU Pinning (A) is correct because it dedicates specific physical CPU cores to a given VM, preventing the hypervisor from co-scheduling vCPUs across tenants and thereby blocking side-channel attacks such as cache-timing leaks between guests. IOMMU (B) is correct because it provides hardware-enforced DMA remapping, so a VM's devices can only access the physical memory pages assigned to that VM, preventing a tenant from reading or writing another tenant's memory via direct memory access. Hypervisor Introspection (C) is not a hardware isolation mechanism; it is a monitoring technique that inspects VM memory from outside for malware or policy violations. Security Groups (D) and Network ACLs (E) are logical network filtering controls (stateful instance-level and stateless subnet-level respectively) that restrict traffic but do not enforce hardware-level memory or CPU isolation between tenants.

Answer

Hypervisor Introspection

Answer

Security Groups

Answer

Network ACLs

Question 16

A financial services company is deploying a new cloud-native application on AWS. The security team needs to ensure that all data stored in Amazon S3 is encrypted at rest using a key that the company controls and can rotate independently of the cloud provider. The company also requires an audit trail of every time the key is used to encrypt or decrypt data. Which AWS service should they use to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS) with customer managed keys. The requirement is for customer-controlled encryption keys with independent rotation and audit logging. AWS KMS customer managed keys provide this by allowing the customer to create and manage keys, set key policies, enable automatic rotation, and log all key usage in CloudTrail. Other services like ACM, Secrets Manager, or CloudHSM do not offer the same integrated functionality for S3 data-at-rest encryption with the required audit capabilities.

Answer

AWS Certificate Manager (ACM) with imported certificates

Answer

AWS Secrets Manager with automatic rotation

Answer

AWS CloudHSM with a custom key store

Question 17

A cloud security architect is designing a secure architecture for a multi-tier web application on Google Cloud. The application consists of a web tier, an application tier, and a database tier. The architect needs to implement network segmentation to limit lateral movement in case of a breach. Which TWO of the following Google Cloud features should be used to achieve micro-segmentation and enforce least privilege at the network layer? (Choose two.)

Accepted Answer

VPC firewall rules with service accounts. VPC firewall rules with service accounts allow identity-based segmentation, ensuring only specific service accounts can communicate between tiers. VPC Service Controls add a security perimeter around services, preventing unauthorized access and data exfiltration. Together, they enforce least privilege and micro-segmentation. Shared VPC, Cloud Armor, and Cloud VPN do not provide the necessary internal segmentation controls for this scenario.

Answer

Cloud Armor security policies

Answer

Cloud VPN with dynamic routing

Answer

Shared VPC with separate projects per tier

Question 18

A cloud security engineer is reviewing the security configuration of an Amazon EC2 instance that hosts a web application. The instance is in a public subnet and must be accessible from the internet on ports 80 and 443. The engineer needs to ensure that the instance is protected from unauthorized access. Which TWO of the following are the MOST effective security controls to implement? (Choose two.)

Accepted Answer

Use an Application Load Balancer (ALB) with a security group that allows only 80 and 443, and place the EC2 instance in a private subnet with a security group that allows traffic only from the ALB.. The most effective controls are to restrict inbound traffic using a security group that allows only ports 80 and 443, and to place the instance behind an ALB in a private subnet with tight security group rules. These network-level controls reduce the attack surface and prevent direct access. Other options either provide no additional protection or are less effective than managed network controls.

Answer

Enable AWS Shield Advanced to protect the instance from DDoS attacks.

Answer

Assign an Elastic IP to the instance and use a host-based firewall to block all traffic except 80 and 443.

Answer

Configure a network ACL on the subnet that allows all inbound traffic and relies on the security group for protection.

Question 19

A company is migrating its on-premises Oracle database to Oracle Cloud Infrastructure (OCI). The security team is concerned about protecting the data at rest and in transit. They want to ensure that the database is encrypted using keys managed by OCI, and that all connections to the database use TLS. Which OCI service should they use to manage the encryption keys?

Accepted Answer

OCI Key Management. OCI Key Management is the dedicated service for creating and managing encryption keys used by OCI services to encrypt data at rest. It supports key rotation, auditing, and integration with OCI Database. OCI Certificates handles TLS certificates, OCI Vault manages secrets, and OCI Data Safe focuses on database security assessment. Only Key Management provides the necessary key management for data-at-rest encryption.

Answer

OCI Vault

Answer

OCI Data Safe

Answer

OCI Certificates

Question 20

A company is migrating a legacy application to Microsoft Azure. The application requires a fixed public IP address and must be protected from volumetric DDoS attacks. The security team also wants to ensure that only HTTP and HTTPS traffic reaches the application. Which Azure service should they use to meet these requirements?

Accepted Answer

Azure Front Door with a Web Application Firewall (WAF) policy and Azure DDoS Protection Standard.. Azure Front Door provides a static anycast IP and integrates with WAF to filter HTTP/HTTPS traffic. Enabling Azure DDoS Protection Standard on the Front Door profile adds volumetric DDoS protection. This combination satisfies the requirements for a fixed public IP, DDoS protection, and HTTP/HTTPS-only access. Other services either lack layer 7 filtering or do not provide a static public IP.

Answer

Azure Traffic Manager with a public IP address and Azure DDoS Protection Standard.

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Load Balancer with a public IP address and Azure DDoS Protection Standard.