CCNA Clp Security Questions

SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key in each request, and AWS discards the key after the operation, ensuring the cloud provider never stores the key. This meets the requirement that keys be managed by the organization, not the cloud provider.

Cloud-managed keys (CMK) are generated and managed by the cloud provider but stored in the customer's account, giving the customer control over key usage. Cloud provider-managed keys (SSE-S3) are fully managed by the provider.

AWS CloudTrail records API activity for governance, compliance, and auditing.

SAML (Security Assertion Markup Language) is the correct federation standard because it enables browser-based single sign-on (SSO) by exchanging authentication and authorization assertions between an identity provider (on-premises Active Directory via Azure AD Connect) and a service provider (cloud applications). SAML 2.0 is specifically designed for federated identity scenarios where users authenticate on-premises and gain access to cloud resources without re-entering credentials.

Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.

The cloud provider is responsible for physical infrastructure, hypervisor, and global network. Customer manages OS, apps, IAM, data, and network security groups.

Using a service account with a role that has minimal permissions and attaching it to the pod ensures least privilege for pod-to-cloud API access.

AWS Security Hub aggregates security alerts from various AWS services and third-party tools, and provides compliance checks against standards like CIS, PCI DSS, and AWS Foundational Security Best Practices.

HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting sensitive patient data. PCI DSS is for payment card data, SOC 2 is for service organizations, ISO 27001 is for information security management.

A Condition element in an IAM policy can require MFA by checking the aws:MultiFactorAuthPresent key.

Option A is correct because IAM policies are essential for enforcing the principle of least privilege in cloud KMS. By restricting who can use (encrypt/decrypt) and manage (rotate/disable/destroy) customer-managed keys, the security team ensures that only authorized principals can access the key material. This prevents unauthorized users or services from compromising data at rest, which is a core requirement for compliance frameworks like PCI DSS or HIPAA.

Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

Pod Security Standards (formerly PSP) define security contexts, including runAsNonRoot and readOnlyRootFilesystem, to enforce these policies.

Enabling default encryption only affects new objects. Existing objects must be re-encrypted by copying them, which applies the new encryption settings.

SAML is a standard federation protocol that enables single sign-on using existing identity providers.

AES-256 is the industry standard for encrypting data at rest in cloud environments.

Under the shared responsibility model, the customer is responsible for securing the operating system, applications, and data within the VM. The cloud provider secures the physical host and hypervisor.

WAF can inspect HTTP requests for SQL injection and XSS, and also provide geo-blocking. DDoS protection is for volumetric attacks, not application-layer threats. Network ACLs and Security Groups do not inspect application payloads.

CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Pod Security Standards define policies like 'restricted' that prevent privileged containers.

WAFs protect web applications from common attacks like SQL injection, cross-site scripting, and other OWASP Top 10 threats by filtering and monitoring HTTP/HTTPS traffic.

A Web Application Firewall (WAF) inspects HTTP traffic and blocks web exploits like SQL injection and XSS.

NSGs are stateful; allowing inbound traffic automatically allows the corresponding outbound response traffic.

The Effect element in an IAM policy specifies whether the policy allows or denies the requested action.

The cloud provider is responsible for the physical infrastructure, hypervisor, and global network, while the customer is responsible for OS patching, IAM, data encryption, etc.

Least privilege means granting only the permissions necessary for a task and periodically reviewing access.

The principle of least privilege dictates that users should only have the minimum permissions necessary to perform their job functions. Granting full access to all services violates this principle.

CASBs provide visibility and control over SaaS applications, including shadow IT discovery.

PCI DSS Level 1 is the highest level of compliance for organizations handling credit card data. Cloud providers offer PCI DSS attestations to support customer compliance.

CASBs provide visibility into shadow IT, enforce data loss prevention policies, and control access to SaaS applications.

TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

A Web Application Firewall (WAF) is specifically designed to filter and monitor HTTP traffic, blocking common web exploits like SQL injection and XSS. Cloud providers offer WAF services (e.g., AWS WAF, Azure WAF, Cloud Armor).

Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.