Certified Cloud Security Professional CCSP (CCSP) — Questions 901–964

A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Seccomp profiles restrict the system calls a container can make, reducing the attack surface against the host kernel.

Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.

Object lock features like S3 Object Lock enable a write-once-read-many (WORM) model to prevent deletion or modification, meeting legal hold requirements.

Pre-signed URLs (or signed URLs) grant temporary access to a specific object without requiring the auditor to have cloud credentials. They can be configured with expiration times and permissions (e.g., read-only).

Asynchronous replication across regions is a valid DR strategy because it allows data to be copied to a geographically distant region without requiring an immediate acknowledgment from the target, which minimizes latency impact on the primary site. This approach is suitable for cloud environments where recovery point objectives (RPOs) of minutes to hours are acceptable, and it leverages the cloud provider's high-latency inter-region network links without stalling write operations.

Configuring data residency controls (like tagging and policies) ensures data stays within the required region. Disabling replication across regions is too restrictive and may affect availability; contract negotiation is less efficient than technical controls.

Placing the database tier in an isolated private subnet without direct internet access and with strict security group rules minimizes exposure.

The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Integrating a container image scanner into the CI/CD pipeline ensures that vulnerabilities are detected early, before the image is deployed to production. This approach automates security checks as part of the build process, aligning with DevSecOps principles by shifting security left. Tools like Trivy, Clair, or Anchore can be configured to fail the pipeline if critical vulnerabilities are found, preventing insecure images from reaching runtime.

Under GDPR, data subject rights include the right to object to processing for direct marketing (Article 21), right of access (Article 15), and right to erasure (Article 17). Options A and E are also valid rights (right to portability is a data subject right), but the question asks for three specific rights from the list, and B, C, D are the correct set as per the intended answer.

Restricted is the highest classification level, typically used for data that requires the most stringent controls, such as financial records or PII. Public is least sensitive, internal is for company-internal data, confidential is for sensitive but not critical data.

In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Logs contain IP addresses (personal data under many laws) and may be transferred abroad if the IDS vendor processes logs in another jurisdiction, violating localization requirements. Encryption does not solve localization.

The effective permission for a request from IP 10.1.2.3 is 'Access allowed only for GetObject' because the bucket policy includes an explicit allow for the s3:GetObject action when the source IP matches 10.1.2.3, and no explicit deny applies to that IP. Since there is no explicit deny for this specific request, the explicit allow grants access only to the GetObject action, not to other actions like PutObject or DeleteObject.

Running containers without the --privileged flag and with a read-only root filesystem reduces the risk of host compromise.

Infrastructure as Code (IaC) security scanning is a key component of shift-left security because it allows teams to detect misconfigurations and compliance violations in cloud templates (e.g., Terraform, CloudFormation) before any resources are provisioned. By integrating scanners like Checkov or tfsec into the development pipeline, security issues are identified and remediated during coding, not after deployment, which reduces risk and cost.

Multi-cloud strategies introduce complexity in managing different security models, increase the attack surface, and require expertise across multiple platforms. Vendor lock-in is reduced, not increased, and data sovereignty issues are not inherently worse than single-cloud.

Data sovereignty requires that data is stored and processed in specific geographic locations. Understanding where data centers are located and if they comply with local laws is crucial.

Public cloud utilizes shared infrastructure with multi-tenancy, where hypervisor isolation separates tenants. Private cloud would be dedicated; community cloud is shared by a specific group; hybrid combines models.

Signing container images provides cryptographic verification of image integrity, ensuring they have not been altered since signing.

The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

GDPR requires adequate assurances from processors. If direct audits are not possible, the customer can rely on third-party certifications like SOC 2 Type II or ISO 27001, which provide independent assurance. Waivers and data minimization do not meet audit requirements.

The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Concentration risk (vendor lock-in) arises from over-reliance on one provider, leading to potential business disruption if the provider fails.

HIPAA requires covered entities to have a Business Associate Agreement (BAA) with any business associate that creates, receives, maintains, or transmits PHI on their behalf. The cloud provider is a business associate.

Log file validation (e.g., CloudTrail log file validation) ensures cryptographic verification of log integrity. Write-once-read-many (WORM) storage, such as S3 Object Lock or Azure Immutable Blob Storage, prevents deletion or modification of logs.

Static Application Security Testing (SAST) analyzes source code at rest, allowing early detection of vulnerabilities before compilation or execution. This aligns with shift-left security principles.

Software-defined perimeter (SDP) architecture uses dynamic firewall rules that are created on-the-fly based on user identity and device posture, rather than static IP addresses. The SDP controller authenticates the user and then dynamically provisions a firewall rule to allow the user's specific IP address to access the requested application, ensuring zero-trust network access.

Broken Object Level Authorization (BOLA or IDOR) is a common API vulnerability where an attacker can access objects by modifying IDs. This is not unique to cloud but is critical in cloud APIs due to shared responsibility.

Versioning in cloud storage preserves every version of an object, allowing recovery from accidental deletions or overwrites.

Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Customer-supplied encryption keys (CSEK) allow the customer to generate and manage keys outside the cloud, giving the maximum control and ensuring the cloud provider cannot access the keys.

An SBOM lists all components (libraries, dependencies) used in a software application, helping to track vulnerabilities and ensure supply chain security.

S3 Object Lock prevents object deletion or modification for a specified period, meeting legal hold requirements.

Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

An organization-level policy can be applied to an account (or organizational unit) to restrict permissions for all users, roles, and even the account administrator. By attaching a policy that denies the action to delete a storage bucket, the security team ensures that no principal in the production account can delete the specified bucket. This provides a preventive control that overrides any allow permissions within the account.

Cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

VPC endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and VPC peering provide private connectivity without internet. Internet gateway and NAT gateway use internet; security groups are firewalls.

Using a secrets manager (like AWS Secrets Manager or Vault) avoids hardcoding credentials. Scanning for secrets in code repositories (e.g., GitGuardian) helps detect and remove any secrets that might have been committed.

Scanning Infrastructure as Code (IaC) templates with Checkov before deployment embodies the shift-left security principle by identifying and remediating misconfigurations early in the development lifecycle. This proactive approach prevents security issues from reaching production, reducing risk and cost compared to post-deployment fixes.

The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.

First integrate IdP, then create groups/roles, configure mapping, assign users with MFA, and audit.

The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

A community cloud is designed for organizations with shared concerns like compliance, security, or policy, and is more suitable than public or private cloud for this specific requirement.

Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

A private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.

Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Reversibility is the ability to cleanly exit a cloud service, including data portability and secure deletion of data from the provider's environment.

Integrating vulnerability scanning into the container registry (e.g., using tools like Trivy, Clair, or Amazon ECR scanning) combined with admission controllers (e.g., OPA/Gatekeeper or Kyverno) allows automated scanning of images at rest and blocks deployments of non-compliant images before they enter the cluster. This shift-left approach ensures that only images passing security policies are admitted, preventing vulnerable images from reaching production.

A secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

In multi-tenant cloud environments, VM escape is a critical risk where an attacker compromises a VM and attempts to break out to the hypervisor to access other VMs. Regular patching of the hypervisor mitigates this.

In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.