CCSP Cloud Platform and Infrastructure Security — All Questions With Answers

Question 1

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

Accepted Answer

Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.. Option B is correct because VPCs with subnets and security groups provide native, software-defined network segmentation and stateful firewall rules that directly replicate on-premises network segmentation and ACLs. Security groups act as virtual firewalls at the instance level, while network ACLs provide subnet-level stateless filtering, together enabling granular control without extending the on-premises network.

Answer

Configure a site-to-site VPN between on-premises and cloud to extend the existing network.

Answer

Implement an intrusion detection and prevention system (IDPS) to monitor traffic.

Answer

Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.

Question 2

A cloud architect is designing a multi-tier application in a public cloud. The web tier must be accessible from the internet, while the application and database tiers must only be reachable from the web tier. The architect needs to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which architecture BEST meets this requirement?

Accepted Answer

Place the web tier in a public subnet with a security group allowing HTTP/HTTPS from 0.0.0.0/0, and place the app and database tiers in private subnets with security groups allowing traffic only from the web tier's security group.. Option C is correct because it implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Answer

Place all tiers in the same subnet and use a single security group to control inbound traffic.

Answer

Place all tiers in the same VPC but different subnets, and use network ACLs to restrict traffic.

Answer

Use a VPN to connect the tiers and rely on IPsec policies for segmentation.

Question 3

During a cloud migration, a company discovers that its existing virtual machine images contain embedded credentials and proprietary software that must not be exposed to the cloud provider's administrators. Which of the following is the BEST strategy to protect this sensitive data while maintaining the ability to create new instances?

Accepted Answer

Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.. Option C is correct because encrypting the virtual machine images with a customer-provided key (CMK) integrated with the cloud provider's key management service ensures that the cloud provider's administrators cannot access the embedded credentials and proprietary software. The encryption is performed client-side or using envelope encryption where the CMK wraps a data encryption key, and only the customer holds the master key material. This allows the customer to create new instances from the encrypted image while maintaining full control over access to the sensitive data.

Answer

Use a VPN to encrypt data in transit between the on-premises environment and the cloud.

Answer

Use a cryptographic hash of the image to ensure integrity, and store the image in object storage with access controls.

Answer

Tokenize the embedded credentials and replace them with placeholders in the image.

Question 4

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

Accepted Answer

Enable automatic key rotation and configure detailed audit logging for the key management service.. Option A is correct because enabling automatic key rotation reduces the risk of key compromise by limiting the exposure window of any single key, while detailed audit logging for the key management service (e.g., AWS CloudTrail for KMS, Azure Monitor for Key Vault) provides an immutable record of all key usage and administrative actions. This combination ensures that even if a CMK is exposed, the window of vulnerability is minimized, and any unauthorized access or misuse is detectable through logs. Without these controls, the customer-managed key could remain static for long periods, increasing risk, and access events would not be auditable, violating the policy requirement.

Answer

Implement a VPN for all management traffic to the cloud provider's API.

Answer

Enable multi-factor authentication (MFA) for all cloud console users.

Answer

Use encryption in transit (TLS) for all data transfers to and from the cloud.

Question 5

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 6

A multinational corporation is deploying a containerized microservices application on a public cloud Kubernetes cluster. The cluster spans three availability zones in a single region. The application consists of a front-end service, a payment service, and a database service. The security team requires that the payment service must not be directly accessible from the internet, but must be accessible from the front-end service. The database must only be accessible from the payment service. Additionally, all inter-service communication must be encrypted, and the cluster must be able to scale up to 500 nodes during peak load. The cloud provider's container orchestration service is used. After deployment, the security team discovers that the payment service is still reachable from the internet via a public load balancer that was configured for testing. The team needs to remediate this issue immediately without disrupting the front-end service. Which of the following actions should the team take FIRST?

Accepted Answer

Implement a Kubernetes NetworkPolicy that denies ingress to the payment service pods from all sources except the front-end service's pod label.. Option B is correct because a Kubernetes NetworkPolicy can enforce fine-grained ingress rules at the pod level, allowing only traffic from the front-end service's pod label to reach the payment service pods. This directly addresses the requirement to block internet access while preserving front-end-to-payment communication, without modifying the service type or disrupting the front-end service. NetworkPolicies operate at Layer 3/4 and are native to Kubernetes, making them the immediate and precise remediation.

Answer

Change the payment service type from LoadBalancer to ClusterIP and update the front-end configuration.

Answer

Delete the public load balancer that was used for testing.

Answer

Apply a security group to the node instances to block inbound traffic on the payment service port.

Question 7

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 8

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Accepted Answer

The second Allow statement does not include the IP restriction, allowing any IP to read objects. Option C is correct because the second Allow statement in the IAM policy grants s3:GetObject access to all principals without any condition, effectively overriding the IP restriction in the first statement. AWS IAM policy evaluation is explicit deny by default, but when multiple statements apply, an Allow without conditions will permit the action even if another statement restricts it. Since the second statement has no aws:SourceIp condition, any IP address, including those outside 10.0.0.0/8, can download objects.

Answer

The condition key 'aws:SourceIp' does not apply to S3 operations

Answer

The first statement's condition explicitly denies access to IPs outside 10.0.0.0/8

Answer

The policy document has a syntax error that causes the first statement to be ignored

Question 9

A large financial institution hosts a critical application in a multi-cloud environment using AWS and Azure. The application processes sensitive customer data and requires low-latency access to a shared database. The database is deployed as a MySQL instance in AWS RDS, and the Azure application instances connect to it over the public internet using SSL. Recently, the security team discovered that the database connection traffic is being routed through an unencrypted proxy, exposing the data in transit. The network architect must redesign the connectivity to ensure encryption end-to-end and minimize latency. The current setup includes an AWS Direct Connect and an Azure ExpressRoute that both terminate at the same on-premises data center. The on-premises network has a firewall that inspects all traffic. The architect proposes using the on-premises data center as an intermediary to route traffic between clouds. Which of the following solutions best addresses the security and latency requirements?

Accepted Answer

Create an AWS VPC peering connection to the Azure VNet through the on-premises data center using VPN tunnels, and configure the RDS security group to allow traffic only from the Azure VNet CIDR. Ensure the firewall does not decrypt the traffic.. Option A is correct because it establishes an encrypted VPN tunnel between AWS and Azure through the on-premises data center, leveraging existing Direct Connect and ExpressRoute connections. This ensures end-to-end encryption (SSL from Azure app to RDS is preserved, and the VPN adds an additional layer) while keeping traffic within controlled, low-latency paths. Configuring the RDS security group to allow only the Azure VNet CIDR restricts access, and ensuring the firewall does not decrypt traffic prevents breaking the encryption chain.

Answer

Configure the Azure application to use a TLS termination proxy in the on-premises data center that forwards traffic to RDS over SSL, and allow the firewall to inspect traffic.

Answer

Use AWS Direct Connect and Azure ExpressRoute to connect directly to each other without going through the on-premises data center by establishing a cross-cloud direct connection.

Answer

Deploy a third-party SD-WAN appliance in both AWS and Azure to create an encrypted overlay network between the two clouds, bypassing the on-premises data center entirely.

Question 10

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Question 11

Match each key management solution to its characteristic.

Question 12

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that requires tags on resource creation.. Option C is correct because AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.

Answer

Use AWS Resource Groups to create a group that filters tagged instances.

Answer

Enable CloudTrail to monitor instance launches and alert on missing tags.

Answer

Configure AWS Config rules to automatically tag untagged instances.

Question 13

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

Accepted Answer

Use server-side encryption with a customer-provided key (SSE-C).. Server-side encryption with customer-provided keys (SSE-C) allows the organization to encrypt data at rest in the cloud while retaining full control of the encryption keys on-premises. With SSE-C, the customer provides the encryption key with each API request, and the cloud service uses it to encrypt/decrypt the data server-side, but the key is never stored by the provider. This meets the requirement of keeping the key entirely on-premises and never exposed to the cloud provider.

Answer

Use server-side encryption with a key stored in the cloud provider's key management service (KMS).

Answer

Use server-side encryption with a cloud-managed key (SSE-S3).

Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.

Question 14

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

Accepted Answer

In the database security group, add an inbound rule allowing TCP/3306 from the security group ID of the web servers.. The most secure approach is to allow inbound traffic to the database security group from the web server security group by referencing its ID (security group ID). This ensures that only instances in the web server security group can reach the database, regardless of IP changes. Option A is less secure because any instance in the CIDR range could connect. Option B is correct. Options C and D involve network ACLs or routing, which are not instance-level.

Answer

Configure a VPN connection between VPCs and use route tables to direct traffic.

Answer

In the network ACL for VPC B's subnet, add an inbound rule allowing TCP/3306 from VPC A CIDR.

Answer

In the database security group, add an inbound rule allowing TCP/3306 from the VPC A CIDR.

Question 15

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

Accepted Answer

Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.. Option B is correct because IAM policies can enforce preventive controls by denying the ec2:AuthorizeSecurityGroupIngress action when the CIDR is 0.0.0.0/0, which blocks the action at the API level before any rule is created. This is a preventive control because it stops the insecure configuration from being applied, rather than detecting or remediating it after the fact. By attaching this policy to developer roles, the team ensures that even if a developer attempts to add an overly permissive SSH rule, the request is denied by AWS IAM.

Answer

Grant developers full access to EC2 and rely on training.

Answer

Use AWS Systems Manager to automatically remediate open SSH rules.

Answer

Enable AWS Config rules to detect and alert on open SSH.

Question 16

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Accepted Answer

CreateAccessKey. The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.

Answer

DeleteAccessKey

Answer

CreateUser

Answer

UpdateAccessKey

Question 17

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Accepted Answer

Apply a service control policy (SCP) that denies the services.. Service Control Policies (SCPs) are the correct mechanism because they operate at the organizational level in AWS Organizations, allowing you to centrally define a whitelist or blacklist of services for all member accounts. Unlike IAM policies, SCPs set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Answer

Configure each account's IAM policy to deny the services.

Answer

Enable AWS Config rules to detect and disable non-approved services.

Answer

Use resource-based policies on each resource to restrict usage.

Question 18

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises data center and a cloud VPC using IPsec (IKEv1/IKEv2) to protect all data in transit. This directly meets the requirement for encryption, as traffic traverses the public internet or a Direct Connect connection with encryption enabled.

Answer

AWS Transit Gateway

Answer

AWS Route 53 Resolver

Answer

AWS Direct Connect

Question 19

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

Accepted Answer

Review the security group inbound rules and restrict the source IP to only the required application servers.. Option B is correct because the immediate priority is to restrict network-level access to the database. Since the database is only accessible from a specific security group, reviewing and tightening the inbound rules to allow traffic only from the required application servers' IP addresses directly reduces the attack surface by eliminating unnecessary exposure. This is a fundamental network segmentation principle in cloud security, as it prevents any unauthorized host within the security group from attempting authentication.

Answer

Enable multi-factor authentication for the database user accounts.

Answer

Change the database port to a non-standard port.

Answer

Delete the database instance and restore from backup.

Question 20

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

Accepted Answer

Apply a service control policy (SCP) to deny s3:DeleteBucket on the production account.. Option D is correct because a service control policy (SCP) is an AWS Organizations policy that can be applied to an account (or OU) to restrict permissions for all IAM users, roles, and even the root user of that account. By attaching an SCP that denies the s3:DeleteBucket action, the security team ensures that no principal in the production account, including the root user, can delete the specified S3 bucket. This provides a preventive control that overrides any allow permissions within the account.

Answer

Use S3 event notifications to alert when a delete is attempted.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable AWS CloudTrail to log any deletion attempt.

CCSP Cloud Platform and Infrastructure Security — All Questions With Answers

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Exhibit

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Match each key management solution to its characteristic.

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

A cloud security team is designing a defense-in-depth strategy for a web application. Which TWO of the following are effective network-level security controls? (Choose two.)

An organization is migrating critical workloads to the cloud and must ensure data confidentiality. Which THREE of the following practices help protect data in transit? (Choose three.)

Which TWO of the following are recommended practices for securing cloud storage buckets? (Choose two.)

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. What does this policy accomplish?

Exhibit

Refer to the exhibit. A CloudFormation template defines a security group as shown. What is the security concern with this configuration?

Exhibit

Refer to the exhibit. A security analyst reviews this CloudTrail log entry. What is the most immediate concern?

Exhibit

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

A cloud administrator notices that a storage bucket containing sensitive data is publicly accessible. What is the most likely misconfiguration?

A financial services firm uses a hybrid cloud architecture with a VPN connection to AWS. They need to comply with PCI DSS requirements for network segmentation. Which design is best?

A cloud security engineer is designing a disaster recovery plan for a critical application running on virtual machines. The RTO is 4 hours and RPO is 1 hour. Which approach meets these requirements?

An organization wants to encrypt data at rest in a cloud object storage service. Which control is appropriate?

A DevOps team is deploying containers in a Kubernetes cluster. They need to ensure that container images are scanned for vulnerabilities before deployment. Which is the most effective approach?

A company uses a cloud provider's key management service. They want to rotate keys automatically every 90 days. What is the correct way to achieve this?

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

A cloud security team is auditing a cloud environment and needs to ensure compliance with logging requirements. Which TWO actions are essential? (Choose two.)

A company is implementing a software-defined perimeter (SDP) for their cloud environment. Which THREE characteristics are typical of an SDP? (Choose three.)

Refer to the exhibit. A security analyst finds this IAM policy attached to an S3 bucket. What is the primary security issue?

Exhibit

Refer to the exhibit. A cloud administrator sees this error when trying to provision an EC2 instance. Which is the best course of action?

Exhibit

A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?

Refer to the exhibit. A cloud security administrator is reviewing the following security group configuration associated with a web server instance. What security best practice is being violated?

Exhibit

CCSP Cloud Platform and Infrastructure Security — All Questions With Answers

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Exhibit

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Match each key management solution to its characteristic.

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

A cloud security team is designing a defense-in-depth strategy for a web application. Which TWO of the following are effective network-level security controls? (Choose two.)

An organization is migrating critical workloads to the cloud and must ensure data confidentiality. Which THREE of the following practices help protect data in transit? (Choose three.)

Which TWO of the following are recommended practices for securing cloud storage buckets? (Choose two.)

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. What does this policy accomplish?

Exhibit

Refer to the exhibit. A CloudFormation template defines a security group as shown. What is the security concern with this configuration?

Exhibit

Refer to the exhibit. A security analyst reviews this CloudTrail log entry. What is the most immediate concern?

Exhibit

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

A cloud administrator notices that a storage bucket containing sensitive data is publicly accessible. What is the most likely misconfiguration?

A financial services firm uses a hybrid cloud architecture with a VPN connection to AWS. They need to comply with PCI DSS requirements for network segmentation. Which design is best?

A cloud security engineer is designing a disaster recovery plan for a critical application running on virtual machines. The RTO is 4 hours and RPO is 1 hour. Which approach meets these requirements?

An organization wants to encrypt data at rest in a cloud object storage service. Which control is appropriate?

A DevOps team is deploying containers in a Kubernetes cluster. They need to ensure that container images are scanned for vulnerabilities before deployment. Which is the most effective approach?

A company uses a cloud provider's key management service. They want to rotate keys automatically every 90 days. What is the correct way to achieve this?

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

A cloud security team is auditing a cloud environment and needs to ensure compliance with logging requirements. Which TWO actions are essential? (Choose two.)

A company is implementing a software-defined perimeter (SDP) for their cloud environment. Which THREE characteristics are typical of an SDP? (Choose three.)

Refer to the exhibit. A security analyst finds this IAM policy attached to an S3 bucket. What is the primary security issue?

Exhibit

Refer to the exhibit. A cloud administrator sees this error when trying to provision an EC2 instance. Which is the best course of action?

Exhibit

A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?