CCSP Cloud Platform and Infrastructure Security Practice Test 2 — 15 Questions

Question 1

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Accepted Answer

CreateAccessKey. The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.

Answer

DeleteAccessKey

Answer

CreateUser

Answer

UpdateAccessKey

Question 2

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Accepted Answer

Apply a service control policy (SCP) that denies the services.. Service Control Policies (SCPs) are the correct mechanism because they operate at the organizational level in AWS Organizations, allowing you to centrally define a whitelist or blacklist of services for all member accounts. Unlike IAM policies, SCPs set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Answer

Configure each account's IAM policy to deny the services.

Answer

Enable AWS Config rules to detect and disable non-approved services.

Answer

Use resource-based policies on each resource to restrict usage.

Question 3

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises data center and a cloud VPC using IPsec (IKEv1/IKEv2) to protect all data in transit. This directly meets the requirement for encryption, as traffic traverses the public internet or a Direct Connect connection with encryption enabled.

Answer

AWS Transit Gateway

Answer

AWS Route 53 Resolver

Answer

AWS Direct Connect

Question 4

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

Accepted Answer

Review the security group inbound rules and restrict the source IP to only the required application servers.. Option B is correct because the immediate priority is to restrict network-level access to the database. Since the database is only accessible from a specific security group, reviewing and tightening the inbound rules to allow traffic only from the required application servers' IP addresses directly reduces the attack surface by eliminating unnecessary exposure. This is a fundamental network segmentation principle in cloud security, as it prevents any unauthorized host within the security group from attempting authentication.

Answer

Enable multi-factor authentication for the database user accounts.

Answer

Change the database port to a non-standard port.

Answer

Delete the database instance and restore from backup.

Question 5

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

Accepted Answer

Apply a service control policy (SCP) to deny s3:DeleteBucket on the production account.. Option D is correct because a service control policy (SCP) is an AWS Organizations policy that can be applied to an account (or OU) to restrict permissions for all IAM users, roles, and even the root user of that account. By attaching an SCP that denies the s3:DeleteBucket action, the security team ensures that no principal in the production account, including the root user, can delete the specified S3 bucket. This provides a preventive control that overrides any allow permissions within the account.

Answer

Use S3 event notifications to alert when a delete is attempted.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable AWS CloudTrail to log any deletion attempt.

Question 6

A cloud security team is designing a defense-in-depth strategy for a web application. Which TWO of the following are effective network-level security controls? (Choose two.)

Accepted Answer

Network ACLs. Network ACLs (Option B) are a stateless, subnet-level firewall that filters traffic based on rules evaluating source/destination IP, protocol, and port. They operate at Layer 3/4 of the OSI model, making them an effective network-level security control for defense-in-depth by providing a first line of perimeter defense.

Answer

CloudTrail

Answer

IAM policies

Answer

Web Application Firewall (WAF)

Question 7

An organization is migrating critical workloads to the cloud and must ensure data confidentiality. Which THREE of the following practices help protect data in transit? (Choose three.)

Accepted Answer

Implementing IPsec VPNs. IPsec VPNs encrypt IP packets at the network layer, providing end-to-end confidentiality and integrity for all traffic between sites or between a remote user and the cloud. This is a standard practice for securing data in transit across untrusted networks like the internet.

Answer

Applying service control policies (SCPs)

Answer

Enabling server-side encryption (SSE) for data at rest

Question 8

Which TWO of the following are recommended practices for securing cloud storage buckets? (Choose two.)

Accepted Answer

Block public read/write access. Blocking public access and enabling encryption are key practices. Versioning and logging are good but not as primary. Deleting buckets is not a security practice.

Answer

Enable bucket versioning

Answer

Delete unused buckets immediately

Answer

Enable access logging

Question 9

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. What does this policy accomplish?

Accepted Answer

It denies all requests to the bucket that are not using HTTPS.. The bucket policy uses a `Condition` block with `aws:SecureTransport` set to `false` and an explicit `Deny` effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit. The `NotPrincipal` and `NotAction` elements are used to apply the denial broadly, but the core effect is to block non-HTTPS requests.

Answer

It allows only requests from a specific VPC endpoint.

Answer

It denies requests from IP addresses outside a specific range.

Answer

It denies all requests to the bucket.

Question 10

Refer to the exhibit. A CloudFormation template defines a security group as shown. What is the security concern with this configuration?

Accepted Answer

It allows inbound traffic from all IP addresses on port 443, which is overly permissive.. Option D is correct because the security group rule allows inbound traffic on port 443 (HTTPS) from 0.0.0.0/0, which means any IP address on the internet can reach the resource. This is overly permissive and violates the principle of least privilege, as it exposes the service to potential attacks from any source without restriction.

Answer

It allows SSH access on port 22.

Answer

It allows HTTP traffic on port 80, not HTTPS.

Answer

It does not allow outbound traffic.

Question 11

Refer to the exhibit. A security analyst reviews this CloudTrail log entry. What is the most immediate concern?

Accepted Answer

A security group rule was added that allows unrestricted SSH access.. Option C is correct because the CloudTrail log entry shows an AuthorizeSecurityGroupIngress API call that added a rule allowing SSH (port 22) from source 0.0.0.0/0, which grants unrestricted internet access. This is a critical security misconfiguration that exposes the EC2 instance to potential brute-force attacks or unauthorized access, making it the most immediate concern.

Answer

A user named john.doe is not authorized to modify security groups.

Answer

An EC2 instance was launched without approval.

Answer

The user john.doe failed to authenticate.

Question 12

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

Accepted Answer

Create a hardened baseline image and store it in a secure repository.. Option D is correct because creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Answer

Use a golden image from the cloud provider's marketplace.

Answer

Rely on host-based firewalls to protect instances.

Answer

Perform vulnerability scanning on running instances only.

Question 13

A cloud administrator notices that a storage bucket containing sensitive data is publicly accessible. What is the most likely misconfiguration?

Accepted Answer

The bucket's ACLs are too permissive.. The most likely misconfiguration is that the bucket's ACLs are too permissive, granting public read or write access to the storage bucket. In cloud platforms like AWS S3 or Azure Blob Storage, bucket ACLs or bucket policies can be set to allow public access, which directly exposes sensitive data. Disabling logging, using server-side encryption, or enabling versioning do not inherently make a bucket publicly accessible.

Answer

The bucket has logging disabled.

Answer

The bucket is using server-side encryption.

Answer

The bucket is versioned.

Question 14

A financial services firm uses a hybrid cloud architecture with a VPN connection to AWS. They need to comply with PCI DSS requirements for network segmentation. Which design is best?

Accepted Answer

Implement a DMZ with a firewall appliance in a transit VPC.. Option B is correct because a DMZ with a firewall appliance in a transit VPC provides a controlled, inspectable boundary between the on-premises network and AWS, enabling network segmentation that meets PCI DSS Requirement 1 (firewall configuration) and Requirement 1.3 (DMZ to isolate cardholder data from untrusted networks). The transit VPC design allows centralized egress/ingress inspection and prevents direct lateral movement between environments, which is critical for compliance.

Answer

Use AWS Direct Connect with multiple VLANs to separate traffic.

Answer

Create separate VPCs for cardholder data and corporate systems, connected via VPC peering.

Answer

Use a single VPC with security groups to isolate workloads.

Question 15

A cloud security engineer is designing a disaster recovery plan for a critical application running on virtual machines. The RTO is 4 hours and RPO is 1 hour. Which approach meets these requirements?

Accepted Answer

Keep a warm standby in another region with continuous data replication.. Option C meets both the RTO of 4 hours and RPO of 1 hour by maintaining a warm standby in another region with continuous data replication. Continuous replication ensures data is synchronized with minimal lag (well under 1 hour), and the warm standby VM can be activated quickly to meet the 4-hour RTO. This approach balances cost and recovery speed, as a warm standby is partially running and can be promoted to production faster than a cold standby.

Answer

Take daily snapshots and restore to a different region.

Answer

Use synchronous replication to a secondary availability zone.

Answer

Use asynchronous replication with a 1-hour lag to a secondary site.