Certified Cloud Security Professional CCSP (CCSP) — Questions 826–900

In IaaS, the customer manages the guest OS, applications, data, and network traffic controls. The provider manages the physical infrastructure, hypervisor, and network.

SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Trivy is an open-source vulnerability scanner for container images, commonly used in CI/CD pipelines.

Data processing terms (DPA) and audit rights are standard CSA elements addressing legal compliance. Encryption key management and portability are more about security and operations, but not always considered 'key legal compliance' elements.

A right to audit clause gives the customer the contractual ability to assess the provider's controls, either through on-site audits or review of audit reports.

C is correct because a load balancer's access control list (ACL) is a stateless or stateful rule set that explicitly defines which source IP addresses are allowed or denied. If the malicious IP address is not listed in the ACL, the load balancer will not block the traffic, regardless of the request's content or encryption status. The security team's observation that the request was from a known malicious IP but was not blocked directly points to a missing or incomplete ACL entry.

Cloud DLP (Data Loss Prevention) APIs can scan data stores like BigQuery for sensitive data types (PII, credit card numbers, etc.) and apply de-identification transforms such as pseudonymization, masking, tokenization, etc. This is the intended service for automated discovery and protection.

CloudTrail log file validation uses SHA-256 hashing and digital signatures. The log file digest file contains the hash of the log file and is signed by a private key. To verify, the auditor uses the public key (from AWS) to verify the signature on the digest, then compares the hash of the log file to the hash in the digest.

Security groups are stateful firewalls that control traffic to instances; they only support allow rules and are stateful.

SSRF targeting cloud metadata endpoints is a critical cloud-specific threat because it can expose IAM credentials, leading to full account compromise. This is a unique cloud attack path not typically present in on-premises environments.

A community cloud can be shared by organizations with common compliance needs, such as financial regulations, and can be deployed in a specific region to meet data sovereignty.

Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.

Kubernetes is an open-source container orchestration platform that allows portability across clouds.

Enabling MFADelete on an S3 bucket requires multi-factor authentication to permanently delete an object version or to suspend versioning on the bucket. This adds a critical layer of protection against accidental or malicious deletion of object versions, ensuring that even with administrative credentials, a second factor is needed to complete the destructive operation. It does not affect encryption, overwrite prevention, or all operations—only permanent deletion and versioning suspension.

C is correct because Runtime Application Self-Protection (RASP) is a security technology that is integrated into an application's runtime environment, allowing it to monitor actual application behavior and context (e.g., input validation, SQL queries, API calls) in real time. Unlike external controls, RASP can understand the application's logic and data flow, enabling it to block attacks such as SQL injection or command injection by analyzing the specific context of each request.

Key rotation in cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) can be set to automatic rotation with a specified period. Old key versions are retained so that data encrypted with older keys can still be decrypted. The key material changes, but key ID remains the same.

Data classification can be based on both context (e.g., source, creator, location) and content (e.g., keywords, patterns, data values). This dual approach allows organizations to apply classification rules that consider the environment and the actual data, enabling more accurate and granular protection. For example, a document containing a credit card number (content) created by the finance department (context) could be classified as 'Confidential'.

Hybrid cloud offers flexibility to keep sensitive data on-premises, burst to public cloud for elasticity, and maintain consistent security policies across environments. It does not reduce SLA complexity or eliminate data sovereignty concerns.

Under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

IaaS gives customers control over the entire infrastructure stack, including encryption key management. PaaS and SaaS abstract away much of that control, limiting customer-managed key options.

TLS 1.2+ encrypts API communications, and VPN establishes an encrypted tunnel for hybrid connectivity. Both protect data in transit.

VPC endpoints (Gateway or Interface) allow private access to AWS services without internet traversal. For S3, a Gateway endpoint is commonly used.

Reversibility involves using open standards and APIs, ensuring data portability, and avoiding deep integration with proprietary services. Auto-scaling is a benefit but not a requirement for reversibility.

PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.

The bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

Running as root with privileged mode grants full host access, making container escape to the host OS highly feasible. Seccomp and AppArmor can mitigate, but the core risk is escape.

Using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.

A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

GDPR's right to erasure requires deletion of all copies, including from backups and replicas, which is technically complex due to retention policies and storage architecture.

HYOK (Hold Your Own Key) keeps the key in the customer's on-prem HSM; the cloud service sends data to be encrypted/decrypted on-prem, which can introduce latency but satisfies key location constraints.

To enforce data residency, organizations should choose cloud regions in the required geography, configure bucket policies to restrict storage location, and use IAM policies to limit access from other regions. Cross-region replication would violate data residency.

A legal hold requires preserving all relevant data, including backups and replicas. It must also prevent modification, not just deletion. Communication with the provider ensures technical enforcement.

In IaaS, the customer is responsible for securing the OS, applications, and data, while the provider secures the physical infrastructure. Data encryption and access control are customer responsibilities.

IaaS provides virtualized computing resources where the customer manages OS, apps, and data, but not the underlying infrastructure.

GDPR applies to any organization processing personal data of EU data subjects, regardless of where the processing occurs. The company is a data controller and must comply with all GDPR requirements, including data subject rights and breach notification.

This is the definition of Platform as a Service (PaaS) per NIST SP 800-145. The consumer manages applications and data, while the provider manages everything else.

Image signing, vulnerability scanning, and using admission controllers to verify signatures ensure integrity and trust.

Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.

AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

The correct architecture is a single region with multiple Availability Zones (AZs) in an active-active configuration. This ensures that if one AZ fails, the application continues to serve traffic from the remaining AZs without any manual intervention, as all AZs are actively handling requests. AWS Availability Zones are physically separate data centers within a region, and an active-active pattern distributes the workload across them to achieve high availability and fault tolerance.

The shared responsibility matrix (SRM) is the definitive contractual document that delineates which security controls are managed by the cloud service provider (CSP) and which are the customer's obligation. In a breach caused by misconfiguration, the SRM specifies whether the configuration of the affected resource (e.g., an S3 bucket ACL or a security group rule) falls under the customer's responsibility. Without reviewing the SRM, liability cannot be determined because the matrix explicitly maps each control layer (e.g., network, compute, data) to the responsible party.

The CAP_SYS_MODULE capability allows loading/unloading kernel modules, which is a common vector for container escape. Dropping it reduces risk.

The immediate priority in a cloud security incident is to contain the breach and prevent lateral movement, which preserves the integrity of the evidence by stopping further compromise. Isolating compromised systems (e.g., via network security groups or virtual network segmentation) ensures that volatile data, such as memory contents and active connections, is not altered by ongoing attacker activity. This step aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before evidence collection.

HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

A cloud DLP service (e.g., AWS Macie, Microsoft Purview) can inspect data in transit by analyzing API calls or traffic patterns, and encryption at rest (e.g., AES-256) protects stored data. This combination directly addresses both inspection of data in transit and protection of data at rest, which is the core requirement of the question.

VM escape occurs when code inside a VM accesses the hypervisor. Patching the hypervisor closes known vulnerabilities.

Financial stability, certifications, and incident response plans are standard vendor risk assessment items. Pricing comparison is procurement, not risk; marketing materials are irrelevant.

Synchronous replication ensures that data is written to both the primary and secondary sites before acknowledging the write, achieving near-zero RPO (typically sub-second). Enabling TLS for replication traffic encrypts data in transit, directly addressing the compliance requirement. This approach meets the application's mission-critical need for zero data loss and encryption without changing the underlying hybrid architecture.

The role assignment 'Storage Blob Data Contributor' grants full read, write, and delete permissions on blob data within the scope, without any Azure attribute-based access control (ABAC) conditions. This violates the principle of least privilege, as it allows unconstrained access to all blob containers and blobs in the storage account, which is a compliance concern under frameworks like SOC 2 or ISO 27001 that require fine-grained access controls.

The customer is responsible for securing the operating system, applications, and data they deploy. The provider secures the physical infrastructure, network, and hypervisor.

A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

PCI DSS allows cloud providers to be assessed by a QSA. Shared responsibility must be clearly defined. The provider may have a Responsibility Matrix as per Appendix A3.

On-demand self-service enables automatic provisioning.

Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Using a cloud secret manager (like AWS Secrets Manager or HashiCorp Vault) to inject secrets at runtime avoids hardcoding and enables rotation. Least privilege IAM and environment variables are also good but using a dedicated service is best.

Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

It implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Key management is critical for data protection; BYOK and KYOK offer different levels of customer control.

Network isolation (e.g., VLANs, VPCs) and storage isolation (e.g., separate databases or encryption per tenant) are key. Data encryption at rest protects data but not isolation between tenants. Identity federation and API rate limiting are not isolation mechanisms.

Setting the S3 bucket ACL to public read allows anyone on the internet to access files, leading to data exposure.

Exposed S3 buckets are a common cloud-specific misconfiguration leading to data breaches. Other options are general security issues not unique to cloud.

Relying on each provider's native high-availability features (e.g., AWS Auto Scaling and Multi-AZ deployments, Azure Availability Zones) allows the architecture to leverage built-in fault tolerance and automatic failover within each cloud. This avoids reinventing the wheel and ensures that each provider handles its own infrastructure failures, which is a foundational principle for multi-cloud HA/DR design.

Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Rapid elasticity allows resources to be provisioned and released automatically in response to demand, giving the appearance of unlimited capacity.

Checkov is an open-source IaC scanning tool that checks Terraform, CloudFormation, and Kubernetes configurations for security misconfigurations, making it ideal for blocking builds in CI/CD.