CCNA Security Questions

Pod Security Standards enforce security contexts that limit pod capabilities.

AWS Secrets Manager natively stores and encrypts secrets, and its built-in rotation schedules Lambda functions to change credentials automatically. This directly satisfies the stem's 90-day rotation requirement, which AWS Systems Manager Parameter Store cannot perform without custom automation.

To use customer-managed encryption keys (CMEK) with Cloud Storage, you must create a Cloud KMS key and grant the Cloud Storage service account permission to use it. The cryptoKeyEncrypterDecrypter role allows the service to encrypt and decrypt data with the key. This is a required step for enabling CMEK on buckets.

Geo-blocking inspects the source IP's geographic origin and denies requests from specified countries or regions, directly satisfying the requirement to drop traffic from regions that generate no customers. It filters at the WAF layer before requests reach the application, unlike rate limiting or signature-based rules.

Azure RBAC assignments are inherited by every child scope, so a Contributor role granted at subscription level flows down to all resource groups and resources inside that subscription. This satisfies the stem's subscription-scope constraint, rather than limiting access to a single resource group or resource.

An IAM policy is the JSON document that defines which actions are allowed or denied on specified resources, and attaching a read-only policy to the developer's identity or the bucket grants exactly that scoped access. Roles, groups and ACLs alone cannot express this permission set.

Pod Security Admission enforces pod security standards at admission time and the restricted profile blocks root execution, privilege escalation, and other unsafe capabilities. Applying it to the namespace enforces the policy without editing individual deployment manifests, and violations are rejected before the pod is created. This directly satisfies the auditor's enforcement and non-modification requirements.

Conditional Access in Microsoft Entra ID evaluates sign-in signals and enforces MFA tenant-wide, covering every Azure subscription because subscriptions inherit directory-level authentication. This satisfies the central management constraint: one policy applies to all administrative users across all cloud apps, rather than per-subscription configuration.

Least privilege grants each service account only the IAM roles its task requires, nothing broader. Applied through predefined or custom roles on GCP, it directly satisfies the stem's constraint that service accounts hold only the permissions necessary for their work.

Security groups are stateful virtual firewalls attached directly to EC2 elastic network interfaces, so rules are evaluated per instance rather than per subnet. Allowing only TCP ports 80 and 443 inbound satisfies the instance-level constraint, with return traffic automatically permitted regardless of outbound rules.

The OWASP rule set supplies preconfigured signatures that detect and block SQL injection patterns in inbound requests, directly satisfying the requirement to protect the web application. Unlike generic rate limiting or IP reputation, these rules inspect payload syntax against known injection techniques, so enabling the OWASP core rule set on the WAF mitigates the attack class named in the stem.

HashiCorp Vault is cloud-agnostic, running centrally to issue and audit secrets across AWS, Azure and Google Cloud through one API. This satisfies the multi-cloud centralisation constraint, whereas native secret managers such as Azure Key Vault remain scoped to their own provider.

CloudTrail records API activity in an AWS account, capturing the identity of the caller, timestamp, source IP and request parameters for every call. Enabling it satisfies the requirement to audit all API calls, since CloudWatch monitors metrics and Config tracks resource state rather than API events.

SAML is the federation standard that Microsoft Entra ID uses to exchange authentication assertions with cloud applications, enabling SSO for users synced from on-premises Active Directory via Azure AD Connect. It satisfies the requirement for authenticated on-premises users accessing cloud resources without separate credentials.

Securing the physical data centre falls entirely to the cloud provider, satisfying the shared responsibility model's division where the provider always owns physical security. Customers cannot access or harden buildings, racks, or hardware, so this control never transfers to them, unlike patching, identity, or data classification.

A Kubernetes service account mapped to a cloud role grants pods only the permissions that role defines, satisfying least privilege for API access. Unlike node-wide instance profiles, which expose every pod on that node to the same credentials, this binds permissions to the workload identity itself, so each pod receives solely its required scope.

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie and other accounts into one view, and runs automated compliance checks against standards including CIS AWS Foundations Benchmark. This satisfies the requirement to centralise security monitoring and compliance across multiple accounts.

SSE-KMS with a customer-managed key lets the organization define key policies, control rotation, and audit key usage via CloudTrail. Setting it as the bucket default ensures new objects are encrypted automatically without application changes. This satisfies the audit requirement for customer-managed keys while minimizing disruption.

Cloud KMS allows organizations to create and manage customer-managed encryption keys (CMEK) for Cloud Storage and other services. It supports automatic rotation schedules (e.g., every 90 days) and provides granular IAM controls to revoke access instantly. The key material is stored in a hardware security module (HSM) or software, and the customer retains full control, meeting all requirements.

HIPAA, the Health Insurance Portability and Accountability Act, governs protected health information held by US covered entities and business associates. It specifies administrative, physical and technical safeguards plus breach notification, making it the framework specifically designed for US healthcare data handling.

IAM controls access to KMS keys.

Security groups are a customer-configurable network security control.

Pod Security Standards enforce security constraints at the pod level.

SAML exchanges signed assertions between the partner's identity provider and the cloud application, letting partners authenticate with existing corporate credentials. It is the established browser-based federation standard for external access, avoiding separate accounts for each partner.

IAM roles for service accounts (IRSA) allows Kubernetes pods to assume an IAM role and obtain temporary credentials. The pod can then retrieve the database secret from AWS Secrets Manager using those credentials, avoiding hardcoded secrets. This provides short-lived credentials and fine-grained access control, directly meeting the security team's requirements for the EKS application.

AES-256 is the symmetric block cipher overwhelmingly adopted for cloud data-at-rest encryption, offering 256-bit keys resistant to brute force. It satisfies the stem's requirement for the encryption standard most commonly used by cloud storage services.

Azure Storage supports customer-managed keys by referencing a key in Key Vault or Managed HSM. Setting the account's encryption key source to the Key Vault key makes the customer control rotation and revocation, and Key Vault diagnostic logs record key operations for audit, satisfying the regulated-data requirement.

SSE-KMS with customer managed keys allows the organization to create and control the KMS keys used for S3 encryption. The customer can define key policies, enable automatic rotation, and disable or revoke keys when needed. This satisfies the requirement for full control over key management, including rotation and revocation, while still using S3 server-side encryption.

In IaaS, the provider secures the physical hosts, hypervisor and network fabric, while the customer owns everything above it, including the guest operating system. Patching that guest OS therefore falls to the customer, satisfying the shared responsibility split for this deployment.

Protects data in storage.

A CASB sits between users and SaaS providers, discovering unsanctioned applications and enforcing data-loss prevention, encryption and access policies. This directly delivers the visibility and control over Shadow IT and data protection that the question asks for as the SaaS benefit.

A distinct customer-managed key per tenant provides cryptographic isolation, so a compromised key affects only one tenant. Managed KMS services such as AWS KMS, Azure Key Vault, or Cloud KMS log key usage to CloudTrail, Azure Monitor, or Cloud Audit Logs, giving the auditor the required evidence. This directly satisfies both the isolation and auditability requirements.

Pod Security Standards define the privileged, baseline and restricted profiles enforced via pod security admission, blocking containers that request privileged mode. This directly satisfies the constraint that containers cannot run with privileged access, unlike RBAC, which governs API permissions rather than pod capabilities.

AWS WAF is a managed web application firewall that inspects HTTP(S) requests at Layer 7 and can block SQL injection and cross-site scripting using AWS Managed Rules. It integrates directly with Application Load Balancer, CloudFront, and API Gateway, and can be deployed quickly with preconfigured rule groups, matching the startup's need for minimal configuration.

A WAF inspects inbound HTTP/HTTPS requests at layer 7, applying rule sets to block SQL injection, cross-site scripting and similar payloads before they reach the web server. This directly satisfies the stem's requirement to filter malicious web traffic rather than merely logging or rate-limiting it.

A WAF inspects HTTP/S traffic at the application layer, filtering injection and scripting payloads via managed rule sets. Network firewalls and security groups operate at lower layers and cannot parse request content, so they miss these attacks. This directly satisfies the requirement to protect the web application.

Network security groups are stateful, so return traffic for an allowed inbound connection is automatically permitted regardless of outbound rules. Because the inbound TCP 443 rule already establishes the flow, replies from the web server reach clients without any additional outbound rule.

The Effect element specifies whether a matching statement results in Allow or Deny, making it the axis that determines the policy outcome. With the action and resource already scoped to s3:GetObject on the named bucket, Effect supplies the explicit Allow the stem requires.

Under the shared responsibility model, the cloud provider owns security of the cloud: datacentre facilities, hardware, networking and physical access controls. The customer remains responsible for security in the cloud, covering guest OS patching, application configuration and identity management.

Regularly reviewing and revoking unused permissions enforces least privilege by continuously shrinking each IAM role's effective permissions. This satisfies the stem's constraint because stale, unused grants are removed rather than left accumulating, limiting the blast radius if credentials are compromised.

Granting a user create and delete permissions across all services exceeds what their role requires, breaching least privilege, which limits rights to the minimum needed. The other principles address separation of duties, defence in depth and need to know, not excessive permission scope.

A CASB provides shadow IT discovery, identifying cloud applications in use that fall outside sanctioned policy. It then enforces controls such as blocking or restricting those unsanctioned services, satisfying the requirement to both discover and control unauthorised cloud application usage.

CASBs provide discovery of unsanctioned SaaS usage, identifying shadow IT across the organisation, then enforce granular controls such as blocking or restricting those applications. This visibility and control capability directly matches the stem's SaaS-focused CASB deployment.

Eliminating unneeded services, packages, and open ports directly shrinks the attack surface of the operating system, which is exactly the first goal. Every extra daemon is a potential entry point and patch burden, so removing them reduces exploitable vulnerabilities. This is a foundational hardening step that pairs well with integrity monitoring to cover both reduction and detection objectives.

A Web Application Firewall inspects HTTP/S requests at layer 7 and blocks signatures matching SQL injection and XSS payloads before they reach the application. Network firewalls and load balancers operate at lower layers and cannot parse request content to detect these attacks.

HIPAA requires audit controls to record access to ePHI.