hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A cloud security engineer is responsible for a…
A cloud security engineer is responsible for a SaaS application hosted on a public cloud provider. The application uses a relational database to store customer data. The security team recently conducted a vulnerability assessment and discovered that the database can be accessed over the internet without any network restrictions. Additionally, the database admin user has the same password as the root account, and the password has not been changed in 18 months. The company is subject to GDPR and PCI DSS compliance requirements. The engineer needs to remediate these issues immediately. Which of the following actions should be taken FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the database security group to allow traffic only from the application server's IP address range.
Restricting network access to authorized sources only is the most immediate way to reduce the attack surface and prevent unauthorized access over the internet. Option A is wrong because changing the password is important but should follow the network restriction to ensure the database is not exposed during the change. Option B is wrong because upgrading the database might not be immediately available and does not address the access issue. Option D is wrong because enabling encryption does not prevent an attacker from connecting directly to the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the database admin password to a complex new password immediately.
Why it's wrong here
Changing the password is important but should be done after network restrictions are in place to prevent exposure during the change.
- ✗
Upgrade the database to the latest version with all security patches applied.
Why it's wrong here
Upgrading the database does not address the immediate issue of internet accessibility and is not the first step.
- ✓
Configure the database security group to allow traffic only from the application server's IP address range.
Why this is correct
Restricting network access via security groups is the most immediate way to prevent unauthorized access over the internet.
- ✗
Enable encryption at rest for the database to protect the data if it is stolen.
Why it's wrong here
Encryption at rest protects data if stolen but does not prevent an attacker from connecting directly to the database.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.