Certified Cloud Security Professional CCSP (CCSP) — Questions 901–975

A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

PCI DSS allows cloud providers to be assessed by a QSA. Shared responsibility must be clearly defined. The provider may have a Responsibility Matrix as per Appendix A3.

On-demand self-service enables automatic provisioning.

Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Using a cloud secret manager (like AWS Secrets Manager or HashiCorp Vault) to inject secrets at runtime avoids hardcoding and enables rotation. Least privilege IAM and environment variables are also good but using a dedicated service is best.

Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Option D is correct because directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Option C is correct because it implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Key management is critical for data protection; BYOK and KYOK offer different levels of customer control.

Network isolation (e.g., VLANs, VPCs) and storage isolation (e.g., separate databases or encryption per tenant) are key. Data encryption at rest protects data but not isolation between tenants. Identity federation and API rate limiting are not isolation mechanisms.

Setting the S3 bucket ACL to public read allows anyone on the internet to access files, leading to data exposure.

Exposed S3 buckets are a common cloud-specific misconfiguration leading to data breaches. Other options are general security issues not unique to cloud.

Option A is correct because relying on each provider's native high-availability features (e.g., AWS Auto Scaling and Multi-AZ deployments, Azure Availability Zones) allows the architecture to leverage built-in fault tolerance and automatic failover within each cloud. This avoids reinventing the wheel and ensures that each provider handles its own infrastructure failures, which is a foundational principle for multi-cloud HA/DR design.

Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Option D is correct because data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Rapid elasticity allows resources to be provisioned and released automatically in response to demand, giving the appearance of unlimited capacity.

Checkov is an open-source IaC scanning tool that checks Terraform, CloudFormation, and Kubernetes configurations for security misconfigurations, making it ideal for blocking builds in CI/CD.

A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Seccomp profiles restrict the system calls a container can make, reducing the attack surface against the host kernel.

Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.

Object lock features like S3 Object Lock enable a write-once-read-many (WORM) model to prevent deletion or modification, meeting legal hold requirements.

Pre-signed URLs (or signed URLs) grant temporary access to a specific object without requiring the auditor to have cloud credentials. They can be configured with expiration times and permissions (e.g., read-only).

Asynchronous replication across regions is a valid DR strategy because it allows data to be copied to a geographically distant region without requiring an immediate acknowledgment from the target, which minimizes latency impact on the primary site. This approach is suitable for cloud environments where recovery point objectives (RPOs) of minutes to hours are acceptable, and it leverages the cloud provider's high-latency inter-region network links without stalling write operations.

Configuring data residency controls (like tagging and policies) ensures data stays within the required region. Disabling replication across regions is too restrictive and may affect availability; contract negotiation is less efficient than technical controls.

Placing the database tier in an isolated private subnet without direct internet access and with strict security group rules minimizes exposure.

The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Integrating a container image scanner into the CI/CD pipeline ensures that vulnerabilities are detected early, before the image is deployed to production. This approach automates security checks as part of the build process, aligning with DevSecOps principles by shifting security left. Tools like Trivy, Clair, or Anchore can be configured to fail the pipeline if critical vulnerabilities are found, preventing insecure images from reaching runtime.

Right to erasure, right to portability, and right to access are explicit rights under GDPR. Right to rectification is also a right, but the options included correct ones.

Restricted is the highest classification level, typically used for data that requires the most stringent controls, such as financial records or PII. Public is least sensitive, internal is for company-internal data, confidential is for sensitive but not critical data.

Option A is correct because it establishes an encrypted VPN tunnel between AWS and Azure through the on-premises data center, leveraging existing Direct Connect and ExpressRoute connections. This ensures end-to-end encryption (SSL from Azure app to RDS is preserved, and the VPN adds an additional layer) while keeping traffic within controlled, low-latency paths. Configuring the RDS security group to allow only the Azure VNet CIDR restricts access, and ensuring the firewall does not decrypt traffic prevents breaking the encryption chain.

In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Logs contain IP addresses (personal data under many laws) and may be transferred abroad if the IDS vendor processes logs in another jurisdiction, violating localization requirements. Encryption does not solve localization.

Option B is correct because using infrastructure as code (IaC) templates with built-in security controls ensures that all new VM deployments comply with the least-privilege policy, preventing non-compliant deployments. Options A and D are reactive or detective. Option C may miss non-compliant resources if not properly configured.

The effective permission for a request from IP 10.1.2.3 is 'Access allowed only for GetObject' because the bucket policy includes an explicit allow for the s3:GetObject action when the source IP matches 10.1.2.3, and no explicit deny applies to that IP. Since there is no explicit deny for this specific request, the explicit allow grants access only to the GetObject action, not to other actions like PutObject or DeleteObject.

Running containers without the --privileged flag and with a read-only root filesystem reduces the risk of host compromise.

Infrastructure as Code (IaC) security scanning is a key component of shift-left security because it allows teams to detect misconfigurations and compliance violations in cloud templates (e.g., Terraform, CloudFormation) before any resources are provisioned. By integrating scanners like Checkov or tfsec into the development pipeline, security issues are identified and remediated during coding, not after deployment, which reduces risk and cost.

Multi-cloud strategies introduce complexity in managing different security models, increase the attack surface, and require expertise across multiple platforms. Vendor lock-in is reduced, not increased, and data sovereignty issues are not inherently worse than single-cloud.

Data sovereignty requires that data is stored and processed in specific geographic locations. Understanding where data centers are located and if they comply with local laws is crucial.

Public cloud utilizes shared infrastructure with multi-tenancy, where hypervisor isolation separates tenants. Private cloud would be dedicated; community cloud is shared by a specific group; hybrid combines models.

Signing container images provides cryptographic verification of image integrity, ensuring they have not been altered since signing.

Option C is correct because the S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

GDPR requires adequate assurances from processors. If direct audits are not possible, the customer can rely on third-party certifications like SOC 2 Type II or ISO 27001, which provide independent assurance. Waivers and data minimization do not meet audit requirements.

The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Concentration risk (vendor lock-in) arises from over-reliance on one provider, leading to potential business disruption if the provider fails.

HIPAA requires covered entities to have a Business Associate Agreement (BAA) with any business associate that creates, receives, maintains, or transmits PHI on their behalf. The cloud provider is a business associate.

Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Static Application Security Testing (SAST) analyzes source code at rest, allowing early detection of vulnerabilities before compilation or execution. This aligns with shift-left security principles.

Option B is correct because software-defined perimeter (SDP) architecture uses dynamic firewall rules that are created on-the-fly based on user identity and device posture, rather than static IP addresses. The SDP controller authenticates the user and then dynamically provisions a firewall rule to allow the user's specific IP address to access the requested application, ensuring zero-trust network access.

Broken Object Level Authorization (BOLA or IDOR) is a common API vulnerability where an attacker can access objects by modifying IDs. This is not unique to cloud but is critical in cloud APIs due to shared responsibility.

Versioning in cloud storage preserves every version of an object, allowing recovery from accidental deletions or overwrites.

Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Customer-supplied encryption keys (CSEK) allow the customer to generate and manage keys outside the cloud, giving the maximum control and ensuring the cloud provider cannot access the keys.

AWS Security Hub is a cloud security posture management (CSPM) service that aggregates security findings from multiple AWS services and third-party tools, and it can continuously monitor AWS workloads against CIS AWS Foundations Benchmarks. It provides automated compliance checks, consolidated dashboards, and remediation guidance specifically designed for detecting configuration drift from benchmark standards.

An SBOM lists all components (libraries, dependencies) used in a software application, helping to track vulnerabilities and ensure supply chain security.

S3 Object Lock prevents object deletion or modification for a specified period, meeting legal hold requirements.

Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

CloudTrail logs contain detailed records of all API calls, including the identity, timestamp, and source IP. Analyzing these logs helps establish the timeline of when the key was used.

Option D is correct because a service control policy (SCP) is an AWS Organizations policy that can be applied to an account (or OU) to restrict permissions for all IAM users, roles, and even the root user of that account. By attaching an SCP that denies the s3:DeleteBucket action, the security team ensures that no principal in the production account, including the root user, can delete the specified S3 bucket. This provides a preventive control that overrides any allow permissions within the account.

VPC endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and VPC peering provide private connectivity without internet. Internet gateway and NAT gateway use internet; security groups are firewalls.

Using a secrets manager (like AWS Secrets Manager or Vault) avoids hardcoding credentials. Scanning for secrets in code repositories (e.g., GitGuardian) helps detect and remove any secrets that might have been committed.

Option B is correct because scanning Infrastructure as Code (IaC) templates with Checkov before deployment embodies the shift-left security principle by identifying and remediating misconfigurations early in the development lifecycle. This proactive approach prevents security issues from reaching production, reducing risk and cost compared to post-deployment fixes.

The correct answer is D because the scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Option B is correct because the first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in CloudTrail logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with AWS's incident response best practices for IAM credential compromise.

AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Option B is correct because the second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Option C is correct because HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

A community cloud is designed for organizations with shared concerns like compliance, security, or policy, and is more suitable than public or private cloud for this specific requirement.