Certified Cloud Security Professional CCSP (CCSP) — Questions 751–825

Crypto-shredding is the most effective way to satisfy erasure requests when data is replicated and backed up immutably. By destroying the unique key for a data subject, the ciphertext becomes useless, achieving erasure without needing to locate and delete every copy. This approach is scalable and works across regions.

A cloud KMS with automatic rotation and HSM-backed keys provides automated, policy-driven key rotation at specified intervals, ensures keys are stored in hardware security modules, and generates audit logs. This satisfies all requirements: encryption at rest, automatic 90-day rotation, HSM storage, and auditability.

AWS Security Hub is purpose-built to aggregate and normalize findings from multiple AWS accounts and services (GuardDuty, Inspector, Macie, Config, Firewall Manager, and third-party tools) into a single pane of glass. Using AWS Organizations integration, a delegated administrator account can centrally view and manage findings across all member accounts, which is exactly the SIEM-ingestion pattern described.

Inherent risk is the level of risk that exists before any controls are applied, arising from the nature of the activity or environment itself. The shared infrastructure of a public cloud introduces exposure to unauthorized access due to multi-tenancy, and this exposure exists inherently before the customer implements mitigating controls — making it an inherent risk.

Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Client-side encryption with keys stored in an on-premises HSM ensures that the cloud provider never possesses the keys or the plaintext. This gives the firm exclusive control and the ability to revoke access instantly by withholding the key. Other methods leave key management with the provider or do not fully prevent provider access.

Using a minimal base image such as distroless is the most effective way to reduce a container image's attack surface because it strips the package manager, shell, and unnecessary OS utilities, leaving only the application and its runtime dependencies. Fewer installed packages means fewer libraries that can contain exploitable CVEs, and the absence of a shell makes post-exploitation pivoting much harder. Distroless images, maintained by Google, include only the runtime (e.g., a JRE or Python interpreter) and the app itself.

The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Continuous configuration evaluation against CIS controls across an organization is delivered by AWS Config conformance packs, which package standards-mapped rules and support multi-account deployment through a delegated administrator. Automatic remediation of noncompliant resources is delivered by AWS Config remediation actions that invoke AWS Systems Manager Automation runbooks. Security Hub and Trusted Advisor provide visibility or advice but do not perform the configuration recording and automated remediation this design requires.

The requirement is for a FIPS 140-2 Level 3 validated HSM with minimal operational overhead and keys that never leave the HSM. A managed HSM service provides dedicated, validated hardware while the provider handles maintenance and availability, satisfying both security and operational needs. Alternatives either lack hardware validation, export keys outside the boundary, or add unnecessary management burden.

A cloud-native DLP service integrated with the storage API can inspect data in real time, enforce policies to block exfiltration, and provide granular reporting. It is designed for cloud environments and can monitor both data at rest and in transit within the cloud, making it the most effective solution for detecting and preventing sensitive data loss.

With object versioning enabled, the previous unencrypted versions of the objects still exist in the bucket as noncurrent versions, so the most efficient recovery is to delete the current (encrypted) versions or simply access the previous versions directly. This avoids any external restore process and leverages the versioning feature exactly as designed. The recovery is fast, in-place, and requires no provider intervention or cross-region transfer.

Preventing deployment of vulnerable images requires a preventive control at admission that verifies images were scanned and approved. Signing images after a CI vulnerability scan and enforcing signature verification in the admission controller creates a cryptographic gate. Detection, private registries, and network controls do not evaluate image contents before scheduling, so they cannot block vulnerable workloads.

Security groups are stateful and can reference other security groups as sources, which is the most precise way to allow only instances with a specific application security group to reach the database. Network ACLs are stateless and subnet-level; they cannot reference security group IDs and should generally be left at default allow unless additional subnet-level controls are needed. Allowing the application security group ID on the database security group meets the requirement exactly.

Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.

For non-sensitive data with a simple encryption-at-rest requirement and a desire to minimize operational overhead, provider-managed server-side encryption is the most appropriate. It is automatic, requires no key management, and meets compliance. Customer-managed or client-side options add unnecessary complexity and cost without providing additional value for this use case.

Enforcing MFA for human users is best achieved through federation with an identity provider that applies MFA, such as SAML 2.0, which issues temporary console sessions. For programmatic access, assuming IAM roles via AWS STS provides temporary credentials that rotate automatically, eliminating long-term access keys. Together these practices enforce MFA and short-lived credentials, aligning with cloud security best practices.

Client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

The handshake failure occurs at the transport layer (TLS/SSL), which is independent of client-side encryption using a key vault key. The most likely cause is a mismatch in TLS versions or cipher suites between the client and server, as HTTPS relies on a successful TLS handshake. Options A, B, and D relate to the key vault key's availability or configuration, which would not cause a TLS handshake failure.

A hybrid cloud combines a private cloud (or on-premises infrastructure) with public cloud resources, letting the institution keep regulated data and physical control in its private environment while bursting to public cloud for peak loads. This satisfies data residency and physical control requirements while providing elasticity. Private cloud alone cannot burst to public capacity, and public/community clouds do not give the required physical control.

Kyverno is a Kubernetes-native policy engine that functions as a validating admission controller. It can enforce policies that check container image signatures (e.g., using Cosign) at deploy time by validating the image's signature against a public key before allowing the pod to be created. This directly satisfies the requirement to only allow signed images.

VPC interface endpoints (AWS PrivateLink) and S3 gateway endpoints let resources in private subnets reach AWS services entirely over the AWS private network, with no internet gateway, NAT, or public IP required. This satisfies the no-internet constraint, supports both patch retrieval and secret access, and requires minimal ongoing operational effort compared to firewall or NAT-based designs.

Session Manager provides keyless, auditable interactive access that inherits the federated IAM identity, so every session is attributable to a named administrator and no standing SSH keys exist. The other designs either retain long-lived key material or produce only network-level telemetry that cannot identify the human operator, which fails the auditors' attribution and key-elimination requirements.

SOC 2 Type II reports provide assurance over the design AND operating effectiveness of controls across a defined audit period (typically 3–12 months), covering the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. This period-based testing makes it the most comprehensive assurance option for evaluating a cloud provider's sustained control environment.

Exposed S3 buckets with public read access are a cloud-specific misconfiguration vulnerability because they rely on the AWS S3 bucket policy or ACL settings that grant unauthenticated access to objects. Unlike traditional on-premises vulnerabilities, this arises from improper cloud resource configuration, allowing attackers to enumerate and download sensitive data directly via HTTP/HTTPS requests without any authentication.

A SOC 2 Type II report gives independent, period-based assurance over control design and operating effectiveness, including physical security, which directly satisfies auditor evidence requirements. Whitepapers, ISO certificates, and penetration test reports either lack independent testing, lack control-effectiveness detail, or address different scopes.

In the IaaS shared responsibility model, the cloud provider secures the physical facilities, network backbone, and hypervisor, while the customer is responsible for everything from the guest OS upward — including patching the guest operating system, middleware, and applications. Managing VM guest OS patches is therefore a customer responsibility.

A cloud-native DLP service integrated with the storage service can automatically scan objects as they are uploaded, detect PII, and enforce policies in near real-time. Other options either do not inspect content, prevent inspection, or use inappropriate tools. Thus, the integrated DLP service is the most effective approach.

Blocking egress to 169.254.169.254 with a NetworkPolicy directly prevents pods from reaching the instance metadata service, which is the specific vector for stealing node credentials. PodSecurity, credential rotation, and service mesh mTLS address different risks and do not stop a pod from querying the metadata endpoint.

SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Trivy is an open-source vulnerability scanner specifically designed to scan container images, filesystems, and Git repositories for CVEs and misconfigurations. It integrates directly with container registries and CI/CD pipelines, making it the go-to tool for image security in cloud-native environments. Unlike the other options, Trivy's core function is vulnerability detection, not access control or runtime enforcement.

A right to audit clause is essential because it contractually grants the customer the ability to independently verify the provider's security controls, either through direct audits or by accepting third-party audit reports. This clause ensures transparency and accountability, which is critical for compliance and risk management in cloud services.

Cloud Data Loss Prevention (DLP) API is designed to discover, classify, and protect sensitive data such as PII across cloud storage and data warehouses. It can automatically scan tables, identify PII using built-in infoType detectors, and apply de-identification transformations like pseudonymization (e.g., replacing values with surrogate tokens) directly. This matches the requirement to automatically scan and pseudonymize sensitive columns without manual intervention.

A valid Chapter V transfer needs a legal mechanism, such as an adequacy decision or Standard Contractual Clauses, plus a documented transfer impact assessment that evaluates destination-country laws and any supplementary measures. Certifications and registrations may support due diligence but are not transfer mechanisms. When data is replicated across several countries, both elements must cover every jurisdiction where personal data resides or is accessible.

SSRF targeting cloud metadata endpoints is a critical cloud-specific threat because it can expose IAM credentials, leading to full account compromise. This is a unique cloud attack path not typically present in on-premises environments.

A community cloud hosted within the required geography is provisioned for exclusive use by a specific community of organizations that share concerns (here, regulatory compliance), and it can be located in the mandated jurisdiction while still offering elastic, multi-tenant-style scalability. This satisfies data sovereignty because the infrastructure and data reside within the geographic boundary, and it provides scalability through shared community resources rather than a single organization bearing the full cost.

Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.

Client-side encryption with keys held exclusively by the customer in an on-premises HSM ensures that the cloud provider never has access to the plaintext or the key material, which is essential when even provider administrators must be excluded. Short-lived data keys enable immediate revocation of a compromised user without re-encrypting the entire data set, meeting both the confidentiality and agility requirements.

Kubernetes is an open-source container orchestration platform that runs on any cloud or on-premises infrastructure, providing a consistent API and workload abstraction that makes containers portable across providers. Because it is not tied to a single vendor, workloads packaged as Kubernetes manifests or Helm charts can be moved between AWS EKS, Azure AKS, Google GKE, or self-managed clusters with minimal changes, directly addressing vendor lock-in and portability.

Enabling MFADelete on an S3 bucket requires multi-factor authentication to permanently delete an object version or to suspend versioning on the bucket. This adds a critical layer of protection against accidental or malicious deletion of object versions, ensuring that even with administrative credentials, a second factor is needed to complete the destructive operation. It does not affect encryption, overwrite prevention, or all operations—only permanent deletion and versioning suspension.

C is correct because Runtime Application Self-Protection (RASP) is a security technology that is integrated into an application's runtime environment, allowing it to monitor actual application behavior and context (e.g., input validation, SQL queries, API calls) in real time. Unlike external controls, RASP can understand the application's logic and data flow, enabling it to block attacks such as SQL injection or command injection by analyzing the specific context of each request.

Automatic key rotation with version retention is the correct KMS feature because it enables the system to generate a new cryptographic key version on a defined schedule (e.g., every 90 days) while preserving all previous versions. The old versions remain available for decrypting data that was encrypted under them, ensuring backward compatibility. This directly satisfies both requirements: automatic rotation and retention of older key versions for decryption.

Data classification can be based on both context (e.g., source, creator, location) and content (e.g., keywords, patterns, data values). This dual approach allows organizations to apply classification rules that consider the environment and the actual data, enabling more accurate and granular protection. For example, a document containing a credit card number (content) created by the finance department (context) could be classified as 'Confidential'.

Under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

IaaS gives customers control over the entire infrastructure stack, including encryption key management. PaaS and SaaS abstract away much of that control, limiting customer-managed key options.

An automated patch management tool ensures that patches are deployed consistently and within the required timeframe across all instances, reducing human error and providing centralized control. This is the best approach to enforce the 30-day patching requirement because it can schedule and apply patches automatically, and provide reporting on compliance.

A VPC endpoint for S3 (gateway endpoint) allows resources in a VPC, including Lambda functions, to reach S3 privately without traversing the internet, NAT, or an internet gateway. Traffic stays on the AWS backbone and can be controlled with endpoint policies.

PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.

The bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

HttpOnly instructs the browser to hide the cookie from client-side scripts, so a cross-site scripting vulnerability cannot directly exfiltrate the session token. Secure, SameSite, and Domain attributes address transport, cross-site request behaviour, and scope respectively, but none prevents script access.

Running a container as root with privileged mode enabled grants the container almost all the capabilities of the host's root user, including access to host devices and kernel features. This significantly increases the attack surface, making it easier for an attacker to exploit kernel vulnerabilities or misconfigurations to escape the container and gain control of the host OS. While other risks exist, container escape is the most critical because it compromises the entire node and potentially the whole cluster.

Using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.

A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

HYOK (Hold Your Own Key) keeps the master key material inside the customer's on-premises HSM and never exports it to the cloud provider. The cloud service sends cryptographic operations (encrypt/decrypt) to the on-prem HSM via a secure channel, so keys never leave the customer's control while still enabling encryption of cloud data at rest. This satisfies the regulatory mandate that keys remain on-premises.

In IaaS, the provider secures the physical hosts, hypervisor, and network fabric, but the customer retains responsibility for the guest OS, middleware, applications, and data — including patching, hardening, and encryption choices. For a healthcare workload, that means the customer must secure the OS and application layer even though the provider owns the hardware.

IaaS provides virtualized compute, storage, and networking where the customer controls the OS and middleware but does not manage physical hardware, matching the requirement for minimal re-architecture with OS-level control. It is the lowest-level cloud service model that still abstracts hardware.

NIST SP 800-145 defines PaaS as the model where the consumer deploys applications onto cloud infrastructure but does not manage the underlying network, servers, operating systems, or storage. The consumer controls the deployed applications and possibly application-hosting environment configurations — exactly matching the question's description. This is the canonical PaaS definition.

In every cloud service model, the customer retains responsibility for its own data governance and access management. With SaaS, the provider covers the stack from physical facilities through the application, but identity lifecycle, entitlement decisions, and authentication configuration require knowledge of the customer's personnel and business roles, so those tasks cannot be delegated to the provider.

Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.

AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.