Certified Cloud Security Professional CCSP CCSP Questions 76–150 | Page 2/13

Multi-Selectmedium

A cloud security team is implementing a DevSecOps pipeline. Which TWO of the following are examples of shift-left security practices? (Select two.)

Select 2 answers

A.Conducting penetration testing after deployment

B.Scanning Infrastructure as Code with Checkov before deployment

C.Performing Dynamic Application Security Testing (DAST) on a running application

D.Running Static Application Security Testing (SAST) during code commit

E.Implementing Runtime Application Self-Protection (RASP) in production

AnswersB, D

IaC scanning catches misconfigurations before resources are created.

Why this answer

Shift-left integrates security early in the SDLC. IaC scanning and SAST are performed before deployment, while DAST and RASP are later stages, and threat modeling is also early but not listed as a tool.

Full explanation →

MCQmedium

A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?

A.Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN

B.Configure the cloud service to require all API requests to go through a proxy that enforces DLP

C.Implement a conditional access policy to block non-corporate devices

D.Use tokenization to replace sensitive data before allowing API access

AnswerB

Forces all API traffic through a proxy that can apply DLP rules.

Why this answer

Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.

Exam trap

ISC2 often tests the misconception that network-level controls like VPNs or device-based conditional access are sufficient to prevent data exfiltration via APIs, when in fact only content-aware inspection at the API layer can enforce DLP on the actual data being transferred.

How to eliminate wrong answers

Option A is wrong because a VPN only encrypts traffic and provides a corporate IP address; it does not inspect API payloads for sensitive data, so DLP policies are not enforced on the content of API requests. Option C is wrong because blocking non-corporate devices via conditional access does not prevent the user from accessing data from a corporate device that is compromised or from using a different method to bypass DLP; it also does not address the core issue of API-level data exfiltration. Option D is wrong because tokenization replaces sensitive data with tokens, but if the user already has access to the original sensitive data via API calls, tokenization does not prevent them from retrieving the actual data; it is a data masking technique, not a DLP enforcement mechanism for API traffic.

Full explanation →

Multi-Selecthard

An organization is implementing automated remediation for common cloud security misconfigurations using AWS Config and Lambda. Which THREE misconfigurations can be automatically remediated using this approach?

Select 3 answers

A.S3 bucket with public read access

B.EBS volume without encryption

C.EC2 instance type not compliant with corporate standard

D.VPC with default security group allowing all traffic

E.Security group allowing SSH from 0.0.0.0/0

AnswersA, B, E

A Lambda can modify the bucket policy to remove public access.

Why this answer

AWS Config can evaluate S3 bucket public read access against a managed rule (s3-bucket-public-read-prohibited) and trigger a Lambda function to apply a bucket policy that blocks public access. This is a common automated remediation pattern because the fix is deterministic and can be applied via the AWS SDK without manual intervention.

Exam trap

Automated remediation is most suitable for deterministic fixes that do not require manual intervention or cause downtime, such as applying bucket policies or modifying security group rules, as opposed to changes that affect instance state (e.g., instance type modification) or require manual review (e.g., default security group modifications).

Full explanation →

MCQeasy

Which API Gateway security feature limits the number of requests from a client to prevent abuse or DoS attacks?

A.Rate limiting

B.JWT validation

C.WAF integration

D.Mutual TLS

AnswerA

Rate limiting throttles requests to prevent abuse.

Why this answer

Rate limiting controls the request rate per client, protecting the backend from overload.

Full explanation →

MCQmedium

A healthcare organization is migrating sensitive patient data to a public cloud. The compliance team requires that data be encrypted at rest and in transit, and that the cloud provider cannot access the encryption keys. Which cloud service model should the organization use to maintain sole control over encryption keys?

A.Software as a Service (SaaS)

B.Infrastructure as a Service (IaaS)

C.Hybrid Cloud

D.Platform as a Service (PaaS)

AnswerB

IaaS gives the customer control over the OS, storage, and encryption keys.

Why this answer

IaaS provides the customer with full control over the underlying infrastructure, including virtual machines, storage, and networking. This allows the organization to implement their own encryption mechanisms and manage their own keys using a Hardware Security Module (HSM) or a key management service (KMS) that the cloud provider cannot access. In contrast, SaaS and PaaS typically abstract away the infrastructure, limiting customer control over encryption key management.

Exam trap

ISC2 often tests the distinction between service models (IaaS, PaaS, SaaS) and deployment models (public, private, hybrid), so the trap here is that candidates mistakenly choose Hybrid Cloud (Option C) because they think it allows key control, but it is a deployment model that does not guarantee sole key management in the public cloud component.

How to eliminate wrong answers

Option A is wrong because SaaS delivers a fully managed application where the cloud provider controls the entire stack, including encryption key management, making it impossible for the customer to maintain sole control over keys. Option C is wrong because Hybrid Cloud is a deployment model (not a service model) that combines on-premises and cloud resources; it does not inherently grant sole control over encryption keys in the public cloud portion. Option D is wrong because PaaS abstracts the underlying infrastructure, and while it may offer some encryption options, the provider often retains access to the keys or manages them on behalf of the customer, violating the requirement for sole customer control.

Full explanation →

MCQhard

A multinational financial services company uses a hybrid cloud environment with workloads in AWS and Azure. They recently acquired a smaller firm and must integrate their data while maintaining compliance with GDPR and PCI DSS. The acquired firm stores customer payment data in an on-premises Oracle database and wants to migrate it to the cloud. During the migration, they must ensure that the data is encrypted at all times—at rest, in transit, and during processing. The security team has implemented TLS for data in transit and plans to use cloud-native encryption for at-rest data. However, they are concerned about data being processed in memory or temporary storage. They also need to maintain key separation so that the cloud provider cannot access the encryption keys. The CISO wants to implement a solution that minimizes performance impact while meeting compliance requirements. Which of the following is the BEST course of action?

A.Use the cloud provider's native KMS with automatic key rotation and rely on encryption at rest.

B.Implement a cloud-based HSM (Hardware Security Module) for key management and use confidential computing for processing.

C.Encrypt data with client-side encryption before upload and store keys in the cloud KMS.

D.Use tokenization for all sensitive data and store tokens in a separate cloud database.

AnswerB

HSM provides key separation; confidential computing protects data in use.

Why this answer

It addresses the requirement for data to be encrypted during processing (in memory) via confidential computing, which uses hardware-based trusted execution environments (TEEs) to protect data in use. A cloud-based HSM ensures key separation by keeping encryption keys under the customer's exclusive control, preventing the cloud provider from accessing them, and minimizes performance impact compared to software-based encryption.

Exam trap

ISC2 often tests the misconception that encryption at rest and in transit is sufficient for compliance, ignoring the requirement for data to be protected during processing, and that cloud KMS alone provides key separation when it does not prevent provider access to keys.

How to eliminate wrong answers

Option A is wrong because relying solely on cloud-native KMS and encryption at rest does not protect data during processing (in memory or temporary storage), and the cloud provider may have access to the keys, violating key separation. Option C is wrong because storing keys in the cloud KMS still gives the provider potential access to the keys, failing key separation, and client-side encryption does not protect data during processing. Option D is wrong because tokenization replaces sensitive data with tokens but does not encrypt the data during processing; the original data must still be processed somewhere, and storing tokens in a separate cloud database does not address in-memory protection or key separation.

Full explanation →

MCQeasy

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

A.Implement a multi-cloud key management system that replicates keys across providers

B.Use a single cloud provider's key management service

C.Store encryption keys in the same storage as encrypted data

D.Use hardware security modules (HSMs) in one data center

AnswerA

Replication ensures availability.

Why this answer

A multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Exam trap

ISC2 often tests the misconception that storing keys with data or using a single provider's KMS is acceptable for availability, but the trap here is that candidates overlook the need for geographic and provider-level redundancy to ensure continuous key access during an outage.

How to eliminate wrong answers

Option B is wrong because using a single cloud provider's key management service creates a single point of failure; if that provider experiences an outage, all keys become unavailable, blocking access to encrypted data. Option C is wrong because storing encryption keys in the same storage as encrypted data violates the fundamental security principle of separation of duties and key management best practices, as an attacker who compromises the storage can access both the ciphertext and the keys. Option D is wrong because using hardware security modules (HSMs) in one data center still presents a single point of failure; if that data center goes offline, keys are inaccessible, and this approach does not address multi-cloud availability requirements.

Full explanation →

MCQmedium

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

A.GitGuardian

B.tfsec

C.Checkov

D.Snyk

AnswerA

GitGuardian detects secrets in code repositories, including hardcoded cloud credentials.

Why this answer

GitGuardian is a tool that scans repositories for hardcoded secrets like API keys and credentials, helping prevent credential leakage.

Full explanation →

MCQeasy

Which of the following is the correct order of phases in the cloud data lifecycle?

A.Store, Create, Use, Share, Destroy, Archive

B.Create, Store, Use, Share, Archive, Destroy

C.Create, Use, Store, Share, Archive, Destroy

D.Create, Share, Store, Use, Archive, Destroy

AnswerB

This is the standard sequence.

Why this answer

The standard cloud data lifecycle is Create, Store, Use, Share, Archive, Destroy.

Full explanation →

MCQmedium

A company is required by a data sovereignty law to ensure that all data generated by its EU customers is stored and processed within the EU. The company uses a cloud provider with data centers in multiple regions. Which cloud storage configuration should they implement?

A.Enable cross-region replication to a region in the same country.

B.Select a cloud region located in the EU and disable cross-region replication.

C.Use client-side encryption for all EU data.

D.Apply data classification labels to all EU data.

AnswerB

Choosing an EU region and disabling replication ensures data stays in the EU.

Why this answer

Data residency is achieved by choosing a specific geographic region (e.g., EU) for storage and processing. Cross-region replication would copy data to other regions, potentially violating sovereignty. Data classification and encryption help protect data but do not restrict location.

Full explanation →

MCQhard

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

A.The policy allows access from any IP if the request uses HTTPS.

B.The policy allows GetObject from the internal network only when using HTTPS.

C.The policy allows access from any IP in 10.0.0.0/24, but blocks access from the VPC.

D.The policy denies all access to the bucket because of the explicit Deny statement.

AnswerB

The Allow with IP condition permits internal requests, and the Deny on non-SecureTransport blocks HTTP requests, effectively requiring HTTPS.

Why this answer

The policy includes an explicit Deny for any request that does not use HTTPS (i.e., aws:SecureTransport is false), which overrides any Allow. The Allow statement grants s3:GetObject only when the source IP is within 10.0.0.0/24. Therefore, the effective result is that GetObject is allowed only from the internal network and only over HTTPS, making option B correct.

Exam trap

ISC2 often tests the interplay between explicit Deny and Allow statements, where candidates mistakenly think a Deny only applies to the specific action listed, or they overlook that the Deny for non-HTTPS effectively blocks all requests that are not encrypted, even if the IP condition is met.

How to eliminate wrong answers

Option A is wrong because the Deny statement explicitly blocks any request that does not use HTTPS, regardless of the source IP, so access is not allowed from any IP even with HTTPS unless the IP is also in 10.0.0.0/24. Option C is wrong because the policy does not block access from the VPC; it allows access from the 10.0.0.0/24 IP range, which could include VPC resources, and there is no VPC-specific condition. Option D is wrong because the explicit Deny only applies to requests without HTTPS; requests with HTTPS from the allowed IP range are permitted, so not all access is denied.

Full explanation →

MCQmedium

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

A.Multi-region active-active

B.Backup and restore

C.Pilot light

D.Warm standby

AnswerA

Multi-region active-active provides continuous replication and instant failover, meeting both RTO and RPO.

Why this answer

Multi-region active-active is the only strategy that can meet both a 15-minute RTO and a 5-minute RPO because it maintains synchronous or near-synchronous replication between two or more regions, allowing traffic to be instantly redirected with zero or minimal data loss. This approach eliminates the recovery time needed to spin up infrastructure or restore data, as the application is already fully operational in multiple regions.

Exam trap

ISC2 often tests the distinction between RTO and RPO by presenting a scenario where candidates confuse warm standby (which can meet a low RTO but not a tight RPO) with active-active, leading them to choose warm standby despite its inability to guarantee the 5-minute RPO.

How to eliminate wrong answers

Option B (Backup and restore) is wrong because restoring from backups typically takes hours, far exceeding the 15-minute RTO, and the RPO of 5 minutes cannot be guaranteed with periodic backups. Option C (Pilot light) is wrong because while it can achieve a low RTO, the RPO is often higher than 5 minutes due to the need to replicate data and start application servers, and the failover process introduces delay. Option D (Warm standby) is wrong because even though it has a reduced recovery time compared to pilot light, the RPO of 5 minutes is difficult to achieve consistently without active-active replication, and the failover still requires time to promote the standby environment.

Full explanation →

MCQhard

A financial institution must ensure that sensitive data processed in the cloud cannot be decrypted by the cloud provider under any circumstances. They also need low latency for data operations. Which encryption model best meets these requirements?

A.HYOK

B.Client-side encryption

C.Server-side encryption with customer-managed keys

D.Server-side encryption with customer-supplied keys

AnswerB

Client-side encryption ensures data is encrypted before being sent to the cloud provider, so the provider never has access to plaintext or keys, meeting the requirement of zero provider visibility.

Why this answer

Client-side encryption ensures that only the customer holds the decryption keys; the cloud provider never has access to plaintext or keys. This provides maximum control and meets the requirement, though it may introduce some latency if not optimized. The other options involve the provider managing or using keys in a way that potentially allows access to plaintext.

Full explanation →

MCQeasy

An organization wants to classify data in the cloud and assign labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. What is the primary purpose of this classification scheme?

A.To reduce cloud storage costs by moving data to cheaper tiers

B.To enable public sharing of data

C.To comply with data localization laws

D.To apply appropriate security controls based on sensitivity

AnswerD

Classification dictates the level of protection needed (e.g., encryption, access controls).

Why this answer

Data classification helps determine appropriate security controls, such as encryption requirements, access permissions, and handling procedures. It guides policy enforcement.

Full explanation →

MCQmedium

A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?

A.Use the cloud provider's default encryption keys for all databases

B.Use a separate customer-managed key for each database, with automated key rotation

C.Disable encryption to improve performance and use network segmentation instead

D.Use one customer-managed key for all databases, but enable automatic key rotation

AnswerB

Separate keys limit blast radius and rotation reduces risk.

Why this answer

It minimizes the blast radius by ensuring that compromise of one key does not expose data in other databases, while automated key rotation reduces the window of vulnerability and operational overhead. This aligns with the principle of least privilege and the compliance requirement for customer-managed encryption keys (CMEK). Using separate keys per database is a standard security best practice for microservices architectures, especially when handling PHI.

Exam trap

ISC2 often tests the tension between operational simplicity and security blast radius, where candidates may choose a single key with rotation (Option D) thinking it balances both, but fail to recognize that rotation does not shrink the blast radius of a compromised key that has already been used to encrypt data.

How to eliminate wrong answers

Option A is wrong because using the cloud provider's default encryption keys violates the compliance requirement that encryption keys be managed by the customer (CMEK), and it does not allow the customer to control key lifecycle or rotation. Option C is wrong because disabling encryption for PHI at rest is a direct violation of compliance mandates (e.g., HIPAA) and security best practices; network segmentation alone does not protect data at rest. Option D is wrong because using a single customer-managed key for all databases creates a single point of failure and a large blast radius—if that key is compromised, all databases are exposed, and automatic rotation does not mitigate the risk of a key already being compromised.

Full explanation →

MCQmedium

During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

A.Revoke the role associated with the instance.

B.Create a snapshot of the instance volume for forensic analysis.

C.Terminate the instance immediately.

D.Modify the network security rule associated with the instance to deny all traffic.

AnswerD

This isolates the instance, stopping further malicious activity.

Why this answer

Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Exam trap

The CCSP exam often tests the distinction between containment and preservation, and the trap here is that candidates mistakenly choose snapshot creation (Option B) as the first step, confusing forensic preservation with immediate containment, or choose role revocation (Option A) thinking it stops all activity, when it only affects API calls, not network traffic.

How to eliminate wrong answers

Option A is wrong because revoking the IAM role stops API-level access but does not block network traffic to or from the instance, so ongoing malicious network activity (e.g., data exfiltration or lateral movement) continues unimpeded. Option B is wrong because creating a snapshot is a forensic preservation step that should occur after containment, not first; the snapshot captures the disk state but does not stop active malicious traffic or processes. Option C is wrong because terminating the instance immediately destroys volatile memory, running processes, and network connections, which are critical for forensic analysis and may violate chain-of-custody requirements.

Full explanation →

Multi-Selecthard

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Select 3 answers

A.Enabling privileged mode for containers that need host access

B.Running containers as root

C.Running containers as a non-root user

D.Applying AppArmor or SELinux profiles

E.Dropping all Linux capabilities and adding only required ones

AnswersC, D, E

Non-root reduces the impact of a compromise.

Why this answer

Running as non-root user, dropping unnecessary Linux capabilities, and using AppArmor/SELinux profiles are key container security best practices. Running as root defeats isolation; privileged containers grant excessive host access.

Full explanation →

MCQmedium

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

A.API keys in URLs are often logged in plaintext in server logs and browser history.

B.API keys in query strings are not encrypted, even with HTTPS.

C.API keys provide weak authentication because they are not tied to a user session.

D.API keys are not valid for use in query strings; they require a certificate.

AnswerA

Logging exposes the key to anyone with log access.

Why this answer

The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Exam trap

ISC2 often tests the misconception that HTTPS fully protects the URL from all exposure, but the trap here is that while HTTPS encrypts data in transit, it does not prevent logging, caching, or referrer leakage of the URL.

How to eliminate wrong answers

Option B is wrong because HTTPS does encrypt the entire HTTP request, including the query string, during transit; the issue is not lack of encryption on the wire but exposure in logs and history. Option C is wrong because API keys are a valid authentication method and can be tied to a user session or application identity; the weakness here is not about session binding but about exposure in URLs. Option D is wrong because API keys are valid for use in query strings; they do not require a certificate, and certificates are used for TLS mutual authentication, not for API key transmission.

Full explanation →

MCQmedium

A company uses a cloud-based file sharing service and wants to prevent sensitive data from being shared externally. Which cloud data security capability is most appropriate?

A.Inspecting data in use within applications

B.Monitoring network traffic for data exfiltration

C.Scanning data at rest in cloud storage with DLP

D.Encrypting data in transit

AnswerC

DLP scanning identifies sensitive data and can enforce policies to block external sharing.

Why this answer

Data Loss Prevention (DLP) scanning of data at rest in cloud storage directly identifies and blocks sensitive content (e.g., PII, PCI-DSS data) stored in files before it can be shared externally. This capability is purpose-built for preventing unauthorized sharing by inspecting the actual content of files in the cloud repository, such as Amazon S3 or Azure Blob Storage, using pattern matching and fingerprinting.

Exam trap

ISC2 often tests the distinction between preventive controls (DLP at rest) and detective/monitoring controls (network traffic analysis), leading candidates to choose network monitoring because it sounds like 'data exfiltration prevention' but fails to address the sharing action itself.

How to eliminate wrong answers

Option A is wrong because inspecting data in use within applications (e.g., via runtime application self-protection) focuses on protecting data while it is being processed in memory, not on preventing external sharing of stored files. Option B is wrong because monitoring network traffic for data exfiltration (e.g., via network DLP or IDS/IPS) detects data leaving the network after it has been shared, but does not prevent the initial sharing action at the storage layer. Option D is wrong because encrypting data in transit (e.g., TLS 1.3) protects data during transmission but does not prevent authorized users from sharing encrypted files externally or control access to the stored content.

Full explanation →

MCQmedium

A developer configures an AWS S3 bucket to allow public access by setting a bucket policy that grants 's3:GetObject' to 'Principal: *'. Which vulnerability does this introduce?

A.Mass assignment

B.SSRF vulnerability

C.Exposed S3 bucket

D.Over-permissive IAM

AnswerC

A bucket policy granting access to all principals (Principal: *) makes the bucket publicly readable.

Why this answer

Exposing an S3 bucket to anonymous access allows anyone to read objects, leading to data exposure. This is a common cloud misconfiguration.

Full explanation →

MCQhard

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

A.Create an AMI of the instance

B.Enable detailed billing reports

C.Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command)

D.Take a snapshot of the root EBS volume

AnswerC

This option directly involves obtaining a memory dump. Although the CLI command is not standard, it represents the correct intent to capture RAM.

Why this answer

To obtain a forensic memory dump from a compromised EC2 instance without rebooting or altering the disk state, you can use the AWS CLI to invoke a command that runs a memory acquisition tool, such as LiME or AVML. For example, you could send a command via AWS Systems Manager Run Command to dump memory to an S3 bucket for analysis. Options A and D capture non-volatile disk states (AMI and EBS snapshot), and Option B is unrelated to evidence collection.

Therefore, Option C is the best choice.

Full explanation →

Multi-Selectmedium

A financial institution is evaluating a community cloud deployment shared with other banks. Which TWO security considerations are MOST important for this deployment model?

Select 2 answers

A.Minimizing network bandwidth to reduce costs

B.The provider assumes full responsibility for all security controls

C.Use of dedicated physical servers for each tenant

D.Ensuring strong isolation between tenant data and workloads

E.Compliance with common regulatory standards (e.g., PCI-DSS, SOX)

AnswersD, E

Critical to prevent cross-tenant access.

Why this answer

Community clouds require strong isolation between tenants and compliance with shared regulatory standards. Shared responsibility model still applies, and dedicated hardware is not typical.

Full explanation →

Multi-Selecteasy

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

Select 2 answers

A.Use of signed certificates from a trusted CA

B.Regular penetration testing

C.Implementation of IPsec VPNs

D.Use of TLS 1.2 or higher

E.Encryption at rest using AES-256

AnswersA, D

Certificates provide authentication and enable trust in TLS connections.

Why this answer

Signed certificates from a trusted Certificate Authority (CA) are essential for authenticating the server's identity and establishing a chain of trust. Without them, a client cannot verify that it is communicating with the legitimate server, making the connection vulnerable to man-in-the-middle (MITM) attacks. This is a foundational requirement for any secure communication channel over the internet.

Exam trap

ISC2 often tests the distinction between 'essential' controls for data in transit versus 'helpful' or 'related' controls, so candidates mistakenly pick IPsec VPNs (Option C) because they associate VPNs with secure transmission, even though TLS is the standard and essential control for web-based cloud applications.

Full explanation →

Drag & Dropmedium

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with enabling replication, then IAM roles, automation templates, testing, and documentation.

Full explanation →

100

MCQhard

An incident response team is investigating a potential breach in a cloud environment. They have collected logs from various sources. Which of the following is the MOST critical factor to ensure the admissibility of digital evidence in court?

A.Maintaining a documented chain of custody for all evidence

B.Encrypting all evidence during collection and transport

C.Using automated tools for log analysis

D.Ensuring logs are in their original format

AnswerA

Chain of custody is crucial for admissibility.

Why this answer

Maintaining the chain of custody ensures evidence integrity and admissibility. Option B is wrong while important for investigation, admissibility depends on custody. Option C is wrong because logs may not be original but certified copies can be used if chain of custody is maintained.

Option D is wrong because encryption does not guarantee authenticity.

Full explanation →

101

Multi-Selectmedium

A cloud architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms are essential to prevent tenant data leakage? (Choose two.)

Select 2 answers

A.Geographic isolation

B.Network isolation (e.g., VLANs, VPCs)

C.Shared storage volume encryption

D.Logical data isolation (e.g., database per tenant)

E.Hypervisor isolation

AnswersB, D

Prevents network-level cross-tenant access.

Why this answer

Logical data isolation and network isolation are key to prevent data leakage.

Full explanation →

102

MCQeasy

A company wants to use a cloud service to store financial records. Which compliance framework most likely applies?

A.PCI DSS

B.GDPR

C.HIPAA

D.Sarbanes-Oxley Act (SOX)

AnswerD

SOX mandates controls over financial reporting and records.

Why this answer

SOX applies to financial records of publicly traded companies in the US. GDPR is for EU personal data, HIPAA for healthcare, PCI for payment card data.

Full explanation →

103

MCQeasy

Which of the following is the primary security risk associated with VM escape in a cloud environment?

A.Performance degradation of the VM

B.Loss of network connectivity

C.Data corruption within the VM

D.Unauthorized access to other tenants' VMs and the hypervisor

AnswerD

VM escape can lead to cross-tenant attacks and hypervisor compromise.

Why this answer

VM escape is a critical risk in multi-tenant clouds because it allows an attacker to break out of a VM and access the hypervisor, potentially compromising other tenants' VMs.

Full explanation →

104

MCQeasy

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

A.Security monitoring service

B.Centralized logging service

C.Policy management service

D.Recommendation service

AnswerB

Correct. The centralized logging service is designed to collect and stream logs, including audit logs, to a SIEM for analysis.

Why this answer

The centralized logging service can stream audit logs directly to the SIEM via connectors. Many cloud providers offer this native integration, allowing organizations to aggregate and analyze log data centrally.

Full explanation →

105

MCQeasy

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

A.Service level credits

B.Certificate of destruction

C.Annual penetration testing

D.Right to audit

AnswerB

Correct. A certificate of destruction provides verifiable proof that data has been securely deleted.

Why this answer

(Certificate of destruction) is the correct answer because it provides verifiable evidence that data has been securely deleted, which directly addresses the company's requirement. Option A (Service level credits) is for compensation when service levels are not met, not for deletion verification. Option C (Annual penetration testing) is a security testing measure, not related to data deletion.

Option D (Right to audit) allows the company to audit the provider, but does not guarantee verifiable deletion evidence.

Full explanation →

106

MCQmedium

A multinational corporation must store customer data in specific geographic regions to comply with data sovereignty laws. Which cloud storage feature should they configure to ensure data does not leave a designated region?

A.Signed URLs

B.Cross-region replication

C.Object versioning

D.Region selection for storage buckets

AnswerD

Choosing a specific region and blocking cross-region operations ensures data stays within that region.

Why this answer

Cloud providers allow selecting a specific region for storage resources, and data localization policies can be enforced via bucket location constraints and IAM policies restricting cross-region replication.

Full explanation →

107

MCQeasy

Which hypervisor type is most commonly deployed in production cloud data centers to host multiple tenant virtual machines?

A.Type 1 bare-metal hypervisor like VMware ESXi

B.Container runtime like Docker

C.Para-virtualization interface

D.Type 2 hosted hypervisor like VirtualBox

AnswerA

Type 1 hypervisors are industry standard for cloud infrastructure.

Why this answer

Type 1 (bare-metal) hypervisors run directly on hardware and are used in cloud environments for better performance and isolation.

Full explanation →

108

MCQmedium

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

A.Defender for Databases

B.Defender for Containers

C.Defender for Servers

D.Defender for Key Vault

AnswerD

Specifically protects Key Vault.

Why this answer

Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Exam trap

A common trap is that candidates may assume a general plan like Defender for Servers covers all Azure services, but each Defender plan is scoped to a specific service category, such as Defender for Key Vault for Key Vault security.

How to eliminate wrong answers

Option A is wrong because Defender for Databases protects Azure SQL, SQL Server on VMs, and other database services, not Key Vault. Option B is wrong because Defender for Containers secures containerized environments like AKS, ACR, and Kubernetes workloads, not Key Vault. Option C is wrong because Defender for Servers provides threat detection for virtual machines and on-premises servers, not for Key Vault.

Full explanation →

109

MCQmedium

A healthcare organization is migrating electronic health records (EHR) to the cloud and must comply with HIPAA. They want to use cloud-native encryption but retain the ability to immediately revoke access to all encrypted data. Which key management strategy best meets this requirement?

A.Customer-managed encryption keys (CMEK)

B.Hold your own key (HYOK)

C.Bring your own key (BYOK)

D.Cloud provider default server-side encryption

AnswerA

CMEK enables the customer to control key lifecycle and revoke access by disabling the key in KMS.

Why this answer

Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in the cloud KMS. The cloud service is authorized to use the key, but the customer can revoke access at any time by disabling the key, effectively rendering the data inaccessible. This provides control without the complexity of client-side encryption.

Full explanation →

110

MCQeasy

A development team is working with production-like data in a non-production cloud environment. To comply with data privacy regulations, sensitive fields must be obscured without being retrievable. Which technique should they apply?

A.Format-preserving encryption

B.Reversible masking

C.Irreversible masking

D.Tokenization

AnswerC

Irreversible masking prevents reconstruction.

Why this answer

Irreversible masking (C) is correct because it transforms sensitive data into a non-reversible format, ensuring that the original values cannot be retrieved. This meets the requirement of obscuring production-like data in a non-production environment while complying with data privacy regulations that prohibit reversible transformations. Unlike encryption or tokenization, irreversible masking does not provide any decryption or mapping mechanism, making it suitable for scenarios where data must be permanently de-identified.

Exam trap

ISC2 often tests the distinction between reversible and irreversible data protection methods, and the trap here is that candidates confuse 'masking' (which can be reversible or irreversible) with 'encryption' or 'tokenization,' assuming any transformation that hides data is sufficient, without recognizing the critical requirement of non-retrievability.

How to eliminate wrong answers

Option A is wrong because format-preserving encryption (FPE) is a reversible cryptographic technique that allows the original data to be recovered with the correct key, which violates the requirement that sensitive fields must be obscured without being retrievable. Option B is wrong because reversible masking, by definition, includes a method to restore the original data (e.g., via a lookup table or deterministic algorithm), which does not satisfy the 'not retrievable' condition. Option D is wrong because tokenization replaces sensitive data with a token that is mapped back to the original value in a secure vault, providing reversibility and thus failing the requirement for irreversible obscuration.

Full explanation →

111

MCQhard

A healthcare organization uses a cloud-based electronic health record (EHR) system that stores protected health information (PHI). They recently enabled direct API access for a new mobile application. Shortly after, the security team detected that a large volume of PHI was being exfiltrated through the API by an attacker who obtained valid API keys from a compromised developer workstation. The organization has data loss prevention (DLP) tools but they were not inspecting API traffic. The EHR system supports attribute-based access control (ABAC) and has logging for all API calls. The organization needs to prevent similar incidents while maintaining the functionality of the mobile app. Which course of action should be taken first?

A.Rotate all API keys and implement key management best practices such as regular rotation and short-lived keys

B.Enable DLP on API gateway to inspect outgoing data

C.Restrict API access to specific IP addresses used by the mobile app's backend

D.Implement ABAC policies to limit which data each API key can access

AnswerA

Stops current exfiltration and reduces future risk.

Why this answer

The immediate priority is to revoke the compromised API keys and prevent further unauthorized access. Rotating all keys and implementing key management best practices, such as short-lived keys and regular rotation, directly addresses the root cause—the attacker's possession of valid keys from a compromised workstation. This action stops the exfiltration immediately while preserving the mobile app's functionality, as new keys can be issued to legitimate clients.

Exam trap

The trap here is that candidates often choose a long-term preventive control (like DLP or ABAC) first, failing to recognize that the immediate, critical step is to invalidate the compromised credentials to stop the active breach.

How to eliminate wrong answers

Option B is wrong because enabling DLP on the API gateway is a detective control that would inspect outgoing data but does not stop the ongoing exfiltration using already compromised keys; it also requires time to configure and tune, leaving the attack active. Option C is wrong because restricting API access to specific IP addresses used by the mobile app's backend is ineffective if the attacker can spoof those IPs or if the mobile app communicates directly from user devices with dynamic IPs, and it does not address the compromised key issue. Option D is wrong because implementing ABAC policies to limit data access per API key is a preventive measure that should be applied after key rotation, but it does not revoke the already stolen keys, so the attacker can continue exfiltration until the keys are invalidated.

Full explanation →

112

MCQhard

A cloud security operations team is evaluating SIEM solutions. They need to minimize false positives while ensuring critical security events are not missed. Which of the following is the MOST effective technique to achieve this balance?

A.Implement context-aware correlation and tune rules based on feedback loops

B.Aggregate all security events into a single correlation rule

C.Increase the alert threshold for all event types to reduce noise

D.Rely exclusively on signature-based detection

AnswerA

Balances false positives and detection.

Why this answer

Context-aware correlation leverages environmental context (e.g., asset value, user behavior) to reduce false positives while maintaining sensitivity. Feedback loops allow continuous tuning based on actual incidents. Option B is incorrect because aggregating all events into a single rule increases noise and makes analysis difficult.

Option C is incorrect because increasing thresholds may cause true positives to be missed. Option D is incorrect because signature-based detection alone cannot detect novel attacks and may miss critical events.

Full explanation →

113

MCQmedium

A security team is implementing Data Loss Prevention (DLP) for a SaaS application that stores customer PII. They want to detect when sensitive data is shared externally via email. Which is the best approach?

A.Implement database DLP to monitor queries to the PII database

B.Install endpoint DLP agents on all user devices

C.Use the SaaS application's API DLP rules to scan email content and attachments

D.Deploy network DLP at the cloud provider's network perimeter

AnswerC

Content-based scanning effectively detects sensitive data.

Why this answer

SaaS application API DLP rules can inspect email content and attachments directly within the application, effectively detecting sensitive data shared externally via email. Option A is wrong because database DLP monitors queries to the database, not email communications. Option B is wrong because endpoint DLP agents on user devices may not be able to inspect cloud-based email traffic that is accessed via browser.

Option D is wrong because network DLP at the cloud provider's perimeter cannot inspect encrypted email traffic (e.g., TLS) and is less effective for SaaS-based email.

Full explanation →

114

MCQmedium

You are a cloud security engineer for a financial services company. The company has developed a cloud-native application that processes credit card transactions and stores sensitive financial data. The application is deployed on a Kubernetes cluster in a public cloud provider. The compliance team requires that all data at rest be encrypted using a customer-managed key (CMK) with automatic rotation. The application uses a managed database service (e.g., Amazon RDS) and object storage (e.g., Amazon S3) for storing transaction logs. The current configuration uses cloud-provider-managed keys for both services. The development team is concerned that enabling CMK with automatic rotation might cause application downtime due to key rotation latency. Additionally, the security team wants to ensure that access to the keys is auditable. Which course of action BEST addresses the compliance requirement while minimizing risk?

A.Create a CMK with automatic rotation enabled, grant the database and storage service access via IAM roles, and validate the rotation process in a staging environment before production deployment.

B.Continue using cloud-provider-managed keys and implement additional logging to meet audit requirements.

C.Use a CMK with manual rotation to have full control over the rotation schedule and avoid any potential downtime.

D.Implement client-side encryption with a key stored in a secure vault and disable server-side encryption.

AnswerA

This meets compliance using CMK, ensures auditable access via IAM, and mitigates risk by testing rotation in staging.

Why this answer

It directly satisfies the compliance requirement for customer-managed keys (CMK) with automatic rotation, while mitigating the risk of downtime by validating the rotation process in a staging environment. Using IAM roles to grant the database and storage service access to the CMK ensures that key access is auditable via CloudTrail, meeting the security team's audit requirement. This approach allows the development team to test and confirm that key rotation latency does not cause application downtime before production deployment.

Exam trap

ISC2 often tests the misconception that manual rotation gives more control and avoids downtime, but the requirement explicitly states 'automatic rotation,' and manual rotation introduces operational risk and does not guarantee zero downtime.

How to eliminate wrong answers

Option B is wrong because continuing with cloud-provider-managed keys does not meet the compliance requirement for customer-managed keys (CMK) with automatic rotation, and additional logging does not address the encryption key ownership mandate. Option C is wrong because manual rotation of a CMK introduces operational overhead and risk of human error, and it does not satisfy the 'automatic rotation' requirement; it also does not inherently avoid downtime, as key rotation latency can still occur. Option D is wrong because implementing client-side encryption with a key stored in a secure vault and disabling server-side encryption would require significant application changes, increase complexity, and may not integrate seamlessly with managed services like Amazon RDS and S3, potentially causing more downtime risk than server-side CMK rotation.

Full explanation →

115

Multi-Selectmedium

A cloud security team is deploying a web application with an API Gateway. Which TWO mechanisms should be implemented to protect against API abuse and unauthorized access?

Select 2 answers

A.Rate limiting

B.TLS enforcement

C.Resource tagging

D.VPC peering

E.Authentication (e.g., JWT validation)

AnswersA, E

Correct: Rate limiting mitigates brute-force and DDoS attacks.

Why this answer

Rate limiting prevents abuse by throttling requests, and authentication (e.g., JWT, API keys) ensures only authorized clients can access the API.

Full explanation →

116

MCQeasy

Which legal concept allows customers to retain ownership of data stored in the cloud regardless of where it is physically stored?

A.Data localization

B.Data portability

C.Data sovereignty

D.Data minimization

AnswerC

Data sovereignty holds that data is subject to the laws of the country where it is collected.

Why this answer

Data sovereignty is the legal concept that data is subject to the laws and governance structures of the nation where it is collected or owned, regardless of physical storage location. This allows customers to retain ownership rights and control over their data even when stored in the cloud across different jurisdictions. Option A (Data localization) is incorrect because it mandates that data be physically stored within specific geographic boundaries, which actually restricts where data can be stored.

Option B (Data portability) is incorrect because it refers to the ability to transfer data between service providers, not ownership retention. Option D (Data minimization) is incorrect because it is a privacy principle limiting data collection to what is necessary, unrelated to ownership or location.

Full explanation →

117

MCQmedium

An organization uses cloud object storage with versioning enabled. After a ransomware attack, they discover that many objects were encrypted by the attacker. How does versioning help in this scenario?

A.It allows restoration of the previous unencrypted version of each object

B.It replicates objects to a different region for disaster recovery

C.It prevents any object from being overwritten or deleted

D.It automatically encrypts all objects with customer-managed keys

AnswerA

Correct: Previous versions are preserved and can be restored.

Why this answer

Versioning retains previous versions of objects, so if the current version is encrypted or modified, the last unmodified version can be restored, provided the attacker did not delete versions.

Full explanation →

118

MCQhard

An organization is designing a multi-cloud strategy using containers to avoid vendor lock-in. Which of the following approaches BEST ensures portability of containerized applications across different cloud providers?

A.Use cloud provider-specific container services like Amazon ECS with proprietary APIs.

B.Use nested containers to abstract the underlying cloud provider.

C.Standardize on Docker images and Kubernetes orchestration with open-source tooling.

D.Deploy containers directly on virtual machines without an orchestration layer.

AnswerC

Open standards ensure containers can run across any Kubernetes-compatible environment.

Why this answer

Using open standards like Kubernetes and Docker ensures portability, while using proprietary APIs or nested containers can create lock-in or complexity.

Full explanation →

119

MCQhard

An organization is migrating a legacy application to the cloud and must comply with PCI DSS. The application currently logs credit card numbers in plaintext. Which data security control should be implemented FIRST?

A.Implement tokenization for credit card numbers

B.Deploy a data loss prevention (DLP) solution

C.Encrypt the database at rest

D.Perform data discovery and classification

AnswerD

First step is to find and classify sensitive data to understand scope.

Why this answer

Before any remediation can be applied, the organization must first perform data discovery and classification to locate where all credit card numbers (PANs) are stored, including logs, databases, and backups. PCI DSS Requirement 3.1 mandates that cardholder data be identified and classified before implementing controls like tokenization or encryption. Without discovery, subsequent controls may miss critical data stores, leaving plaintext PANs exposed.

Exam trap

ISC2 often tests the principle that security controls must be preceded by a discovery and classification phase, trapping candidates who jump to a technical solution like encryption or tokenization without first understanding the full scope of data exposure.

How to eliminate wrong answers

Option A is wrong because tokenization is a remediation step that cannot be correctly applied until the organization knows where all PANs reside; implementing it first risks missing data in logs or other unindexed locations. Option B is wrong because deploying a DLP solution without first discovering and classifying the data would result in poorly tuned policies that may fail to detect PANs in legacy log formats or generate excessive false positives. Option C is wrong because encrypting the database at rest does not address PANs stored in plaintext logs, application memory, or backup files, and PCI DSS requires protection of cardholder data wherever it exists, not just in the database.

Full explanation →

120

MCQhard

During a threat modeling session for a cloud application, the team identifies a risk where an attacker could trick the application into making HTTP requests to the cloud metadata endpoint (e.g., http://169.254.169.254). What is the most critical impact of this attack?

A.Denial of service to the metadata service

B.Modification of the cloud instance's configuration

C.Retrieval of temporary IAM credentials for the instance

D.Exposure of the application's source code

AnswerC

Correct. SSRF to the metadata endpoint can return IAM role credentials.

Why this answer

Server-Side Request Forgery (SSRF) to the cloud metadata endpoint can retrieve IAM credentials, granting the attacker access to cloud resources.

Full explanation →

121

MCQeasy

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

A.Implement data classification labels

B.Enable immutable storage (WORM) on the bucket

C.Enable versioning on the storage bucket

D.Encrypt data with customer-managed keys

AnswerB

Immutable storage prevents any deletion or overwrite until hold expires.

Why this answer

Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Exam trap

ISC2 often tests the misconception that versioning alone provides legal hold protection, but versioning only preserves previous versions and does not block deletion of the current version or all versions via a lifecycle policy.

How to eliminate wrong answers

Option A is wrong because data classification labels only tag data with metadata (e.g., sensitivity level) but do not enforce any retention or deletion prevention; they are a governance tool, not a technical control. Option C is wrong because versioning retains overwritten or deleted object versions but still allows deletion of the current version and does not prevent permanent deletion of all versions; it is not a legal hold mechanism. Option D is wrong because encryption with customer-managed keys protects data confidentiality but does not prevent deletion of the encrypted objects; the storage system can still delete the ciphertext and keys.

Full explanation →

122

MCQmedium

A cloud architect is designing a cost-optimized architecture for a batch processing job that runs once per day. The job requires high compute capacity for approximately 5 hours. Which cloud service model is most suitable?

A.Reserved instances

B.On-demand instances

C.Spot instances

D.Dedicated hosts

AnswerC

Correct: Cost-effective for fault-tolerant, short-lived workloads.

Why this answer

Spot instances are the most suitable for this batch processing job because they offer significant cost savings (up to 90% compared to on-demand) and are ideal for fault-tolerant, stateless workloads that can handle interruptions. The job runs once per day for only 5 hours, so it can easily be designed to checkpoint progress and resume if a spot instance is reclaimed, making the cost-optimized choice clear.

Exam trap

ISC2 often tests the misconception that spot instances are unreliable and unsuitable for any production workload, but the trap here is that they are perfectly appropriate for fault-tolerant, short-lived batch jobs where cost optimization is the primary goal.

How to eliminate wrong answers

Option A is wrong because Reserved instances require a 1- or 3-year commitment and are designed for steady-state, predictable workloads, not a short 5-hour daily batch job, leading to wasted cost for unused hours. Option B is wrong because On-demand instances provide full pricing flexibility but are the most expensive option, making them suboptimal for a cost-optimized architecture when spot instances can handle the same workload at a fraction of the cost. Option D is wrong because Dedicated hosts are physical servers dedicated to a single tenant, used for compliance or licensing needs, and are the most expensive option, offering no cost benefit for a batch processing job that does not require physical isolation.

Full explanation →

123

Drag & Dropmedium

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First classify data, then define retention, configure lifecycle, enable immutability, and test.

Full explanation →

124

Multi-Selecteasy

An organization wants to ensure compliance with industry regulations by implementing data classification in the cloud. Which two actions should the organization take? (Choose two.)

Select 2 answers

A.Implement auditing of access to sensitive data.

B.Store all data in a single repository for easy management.

C.Define data sensitivity levels and apply labels.

D.Encrypt all data regardless of classification.

E.Automatically tag all data as it is created.

AnswersA, C

Correct: Provides tracking and accountability.

Why this answer

Auditing access to sensitive data is a fundamental compliance requirement under regulations like GDPR, HIPAA, and PCI DSS. It provides a verifiable record of who accessed what data, when, and from where, enabling detection of unauthorized access and supporting forensic investigations. Without auditing, an organization cannot demonstrate compliance with data protection mandates that require monitoring and reporting of access to classified data.

Exam trap

ISC2 often tests the misconception that encryption alone satisfies compliance requirements, but the trap here is that encryption is a control, not a classification mechanism, and without auditing and defined sensitivity levels, compliance cannot be proven.

Full explanation →

125

Multi-Selecthard

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Select 2 answers

A.Immediately notify all users to change passwords.

B.Revoke IAM credentials associated with the compromised access.

C.Take a snapshot of the S3 bucket using AWS Backup.

D.Enable VPC Flow Logs for the VPC where the bucket is accessed.

E.Delete the S3 bucket to prevent further access.

AnswersB, D

Stops further API calls.

Why this answer

For containment, revoking the IAM credentials used by the attacker stops further access. For evidence, enabling VPC Flow Logs (if not already enabled) captures network traffic for analysis.

Full explanation →

126

MCQeasy

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

A.Public cloud

B.Hybrid cloud

C.Private cloud

D.Community cloud

AnswerC

Private cloud is dedicated to a single organization, providing maximum isolation.

Why this answer

Private cloud (Option C) is correct because it is a single-tenant environment where the cloud infrastructure is dedicated exclusively to one organization, providing the highest level of isolation between tenants. In a private cloud, network segmentation is achieved through technologies such as VLANs (IEEE 802.1Q), VXLANs (RFC 7348), and dedicated hypervisor-level resource pools, ensuring that no other tenant's workloads share the same physical or virtual resources. This eliminates the multi-tenancy risks inherent in public and community clouds, where isolation relies on shared infrastructure and logical separation mechanisms like hypervisor-enforced memory isolation and network overlays.

Exam trap

ISC2 often tests the misconception that hybrid cloud provides the highest isolation because it includes a private component, but the trap is that hybrid cloud still incorporates a public cloud element, which inherently introduces multi-tenancy and reduces overall isolation compared to a fully private cloud.

How to eliminate wrong answers

Option A is wrong because public cloud deployments rely on multi-tenant architectures where multiple customers share the same physical infrastructure, with isolation achieved through logical controls such as hypervisor memory isolation, network ACLs, and tenant-specific encryption keys; this inherently provides lower isolation compared to a dedicated private cloud. Option B is wrong because hybrid cloud combines private and public cloud resources, and while the private portion offers high isolation, the public cloud component introduces multi-tenancy, reducing the overall isolation level across the deployment. Option D is wrong because community cloud is a multi-tenant model shared among several organizations with common concerns (e.g., regulatory compliance), and while it offers some isolation via policy-based segmentation, it does not achieve the dedicated, single-tenant isolation of a private cloud.

Full explanation →

127

MCQmedium

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

A.Network-based vulnerability scanning

B.Agentless scanning using cloud API-based assessment

C.Agent-based scanning using a cloud-specific vulnerability scanner

D.Container image scanning in a registry

AnswerB

Agentless scanning leverages cloud APIs to assess vulnerabilities without an agent.

Why this answer

Agentless scanning leverages cloud provider APIs (e.g., for configuration and asset inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Exam trap

The trap here is that candidates often confuse 'agentless scanning' with 'network-based scanning,' assuming that any scan without an OS agent must be network-based, but the CCSP exam specifically tests the cloud-native API-driven assessment model as the correct agentless approach for cloud workloads.

How to eliminate wrong answers

Option A is wrong because network-based vulnerability scanning (e.g., Nmap, Nessus) requires network connectivity and often relies on OS fingerprinting or banner grabbing, but it cannot reliably assess internal OS-level vulnerabilities (e.g., missing patches, registry misconfigurations) without agent-based or authenticated access, and it still does not avoid the need for some form of OS interaction. Option C is wrong because agent-based scanning using AWS Inspector explicitly requires installing an agent on the EC2 instance to collect OS-level telemetry, which contradicts the requirement to avoid agents. Option D is wrong because container image scanning in a registry (e.g., Amazon ECR scanning, Trivy) only analyzes static images at rest, not running cloud workloads, and does not address vulnerabilities in the OS of running instances or virtual machines.

Full explanation →

128

MCQeasy

A security architect is designing a multi-tenant cloud environment. Which type of hypervisor provides the strongest isolation for tenant virtual machines by running directly on the hardware without a host operating system?

A.Type 1 hypervisor

B.Type 2 hypervisor

C.Virtual machine monitor in user space

D.Container runtime

AnswerA

Correct: Type 1 hypervisors run directly on hardware and provide strong isolation.

Why this answer

Type 1 (bare-metal) hypervisors run directly on hardware, reducing the attack surface and improving isolation compared to Type 2 hypervisors that run on an OS.

Full explanation →

129

Multi-Selecthard

Which THREE components are essential for establishing a secure baseline configuration for a cloud virtual machine? (Choose three.)

Select 3 answers

A.Running applications as a service account.

B.Removing unnecessary software and services from the OS.

C.Configuring network security groups at the subnet level.

D.Implementing least privilege for local user accounts.

E.Enabling a host-based firewall to restrict inbound and outbound traffic.

AnswersB, D, E

Hardening by disabling unused services reduces attack surface.

Why this answer

Removing unnecessary software and services from the OS reduces the attack surface by eliminating potential vulnerabilities and backdoors. A secure baseline configuration must minimize the number of running components to only those required for the VM's intended function, following the principle of least functionality.

Exam trap

ISC2 often tests the distinction between OS-level hardening (baseline) and network-level controls (like NSGs), so candidates may mistakenly include subnet-level security groups as part of the VM's baseline configuration.

Full explanation →

130

MCQhard

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

A.Misconfigured storage buckets exposing data

B.Insider threats from cloud provider employees

C.SQL injection vulnerabilities in the application

D.Side-channel attacks on shared physical hardware

AnswerB

CMEK prevents provider access to customer data without the key.

Why this answer

A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Exam trap

ISC2 often tests the misconception that encryption alone prevents all data exposure, but the trap here is that candidates confuse data-at-rest encryption with access control or application security, failing to recognize that CMEK specifically addresses the insider threat from the cloud provider's staff who might otherwise access raw storage.

How to eliminate wrong answers

Option A is wrong because misconfigured storage buckets expose data through incorrect access control policies (e.g., public read/write ACLs), which encryption does not prevent—encryption protects data at rest but does not enforce access controls. Option C is wrong because SQL injection is an application-layer attack that exploits improper input validation in the application code, and encryption of data at rest does not prevent injection or protect data while it is being processed in memory. Option D is wrong because side-channel attacks on shared physical hardware exploit timing, power consumption, or electromagnetic leaks to infer data; encryption keys managed by the customer do not prevent these physical-layer attacks, which target the compute or memory operations rather than the stored encrypted data.

Full explanation →

131

MCQmedium

A cloud customer receives a legal hold notice for pending litigation. The data resides in multi-tenant storage. What is the most appropriate initial action?

A.Do nothing until the provider issues a notice

B.Rely on the provider's backup retention cycle

C.Alert all other tenants about the hold

D.Preserve the relevant data using customer-accessible tools

AnswerD

The customer must preserve its own data; tools like snapshot or legal hold features should be used.

Why this answer

Preserving all relevant data from the customer's tenant is required. Alerting other tenants violates privacy; relying solely on provider backup may be insufficient as backups might not be retained indefinitely; doing nothing is non-compliant.

Full explanation →

132

MCQmedium

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

A.Use long-lived bearer tokens

B.Implement mutual TLS with unique certificates per service

C.Assign IAM roles with broad permissions

D.Use a shared API key across all services

AnswerB

Mutual TLS with unique certificates enforces service identity and least privilege.

Why this answer

Mutual TLS (mTLS) with unique certificates per service enforces least privilege by ensuring each microservice authenticates with a distinct identity, and access can be scoped to specific certificates. This prevents a compromised service from impersonating others, as each service has its own private key and certificate, and the TLS handshake requires both sides to present and validate certificates.

Exam trap

ISC2 often tests the misconception that shared secrets or broad IAM roles are acceptable for service-to-service communication, but the trap is that candidates overlook the need for per-service identity and cryptographic proof of identity, which mTLS uniquely provides.

How to eliminate wrong answers

Option A is wrong because long-lived bearer tokens, such as static OAuth2 tokens, increase the risk of token theft and reuse; they lack the per-request cryptographic binding of mTLS and violate least privilege by providing persistent access without rotation. Option C is wrong because assigning IAM roles with broad permissions (e.g., wildcard actions or resources) grants excessive privileges, directly contradicting the principle of least privilege by allowing a service to access more than necessary. Option D is wrong because a shared API key across all services creates a single point of failure and common credential; if the key is compromised, all services are exposed, and there is no way to isolate or revoke access per service.

Full explanation →

133

Multi-Selecteasy

Which THREE of the following are typical data privacy principles found in most regulations?

Select 3 answers

A.Data minimization

B.Accountability

C.Data retention

D.Purpose limitation

E.Data monetization

AnswersA, B, D

Data minimization is a core privacy principle requiring collection of only necessary data.

Why this answer

Data minimization, purpose limitation, and accountability are common principles in privacy regulations like GDPR. Data retention is a practice derived from principles, and data monetization is not a privacy principle but a business activity.

Full explanation →

134

MCQeasy

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

A.Configure a site-to-site VPN between on-premises and cloud to extend the existing network.

B.Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.

C.Implement an intrusion detection and prevention system (IDPS) to monitor traffic.

D.Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.

AnswerB

VPCs and security groups directly replicate network segmentation and firewall controls.

Why this answer

VPCs with subnets and security groups provide native, software-defined network segmentation and stateful firewall rules that directly replicate on-premises network segmentation and ACLs. Security groups act as virtual firewalls at the instance level, while network ACLs provide subnet-level stateless filtering, together enabling granular control without extending the on-premises network.

Exam trap

The trap here is that candidates often confuse extending the network via VPN (Option A) with replicating segmentation, not realizing that VPNs merge networks rather than isolating them, while virtual private clouds (VPCs) provide the necessary logical isolation and granular firewall controls.

How to eliminate wrong answers

Option A is wrong because a site-to-site VPN extends the on-premises network into the cloud, which does not replicate segmentation and firewall rules but instead merges the networks, potentially breaking isolation and requiring additional routing and firewall policies. Option C is wrong because an IDPS monitors and alerts on malicious traffic but does not enforce network segmentation or firewall rules; it is a detection control, not a preventive control for segmentation. Option D is wrong because SD-WAN optimizes traffic routing and bandwidth across WAN links but does not provide network segmentation or firewall rule enforcement within the cloud environment.

Full explanation →

135

MCQhard

A cloud security architect is designing a forensics capability for a multi-tenant infrastructure-as-a-service (IaaS) environment. Which of the following is the MOST significant challenge when performing forensic acquisition of virtual machine (VM) memory?

A.High performance overhead caused by memory acquisition

B.Inability to access the hypervisor-level memory of other tenants due to isolation

C.Memory content is not available after the VM is powered off

D.Lack of tools that can capture memory from a running VM in the cloud

AnswerB

Multi-tenancy prevents cross-tenant memory access.

Why this answer

In a multi-tenant IaaS environment, the most significant challenge for forensic acquisition of VM memory is the inability to access the hypervisor-level memory of other tenants due to the strong isolation boundaries enforced by the cloud provider. Option A is not the most significant because memory acquisition overhead is typically manageable and can be performed with tools. Option C is true that memory content is volatile, but the primary challenge for acquisition is access, not volatility.

Option D is less significant because tools for capturing memory from running VMs (e.g., LiME) do exist; the real constraint is that the cloud provider restricts tenant access to hypervisor-level memory for security and multi-tenancy isolation.

Full explanation →

136

MCQeasy

In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?

A.Rapid elasticity

B.Resource pooling

C.Broad network access

D.Measured service

AnswerA

Rapid elasticity allows quick scaling of resources.

Why this answer

Rapid elasticity is the defined characteristic. Measured service is about metering, resource pooling is about sharing, broad network access is about network availability.

Full explanation →

137

MCQmedium

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

A.Cloud provider default encryption

B.Customer-managed encryption keys (CMEK)

C.Customer-supplied encryption keys (CSEK)

D.Bring your own key (BYOK)

AnswerB

CMEK allows customers to manage keys in KMS, including rotation and access policies.

Why this answer

Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in cloud KMS, enabling automatic rotation and fine-grained access policies.

Full explanation →

138

MCQmedium

A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?

A.Using proprietary APIs from the cloud provider

B.Subscribing to a single cloud provider's managed services

C.Using proprietary data formats

D.Adopting open standards and open-source APIs like Kubernetes and Terraform

AnswerD

Open standards facilitate portability and interoperability.

Why this answer

Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.

Full explanation →

139

Multi-Selecthard

A financial services company is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. They need to identify and classify data containing personally identifiable information (PII) such as credit card numbers and social security numbers. Which three capabilities should the DLP solution provide? (Choose three.)

Select 3 answers

A.Encryption at rest using AES-256

B.Classification of data based on content

C.De-identification transforms such as masking and tokenization

D.Blocking public access to buckets

E.Automated scanning for sensitive data patterns

AnswersB, C, E

Classification labels data according to sensitivity.

Why this answer

Cloud DLP solutions typically include discovery (scanning for sensitive data), classification (labeling data types), and de-identification transforms (masking, tokenization) to protect data.

Full explanation →

140

MCQhard

A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?

A.Overwrite the data with multiple patterns of zeros and ones

B.Encrypt the data and then destroy the encryption keys (cryptographic erasure)

C.Tokenize the data and retain the token mapping

D.Delete the data using the cloud provider's API and remove pointers

AnswerB

Cryptographic erasure renders data unreadable without keys.

Why this answer

Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.

Exam trap

ISC2 often tests the misconception that simply deleting data via the cloud provider's API or overwriting data is sufficient for irrecoverable destruction, but the trap is that cloud storage systems maintain multiple copies, snapshots, and version histories that are not addressed by these methods, making cryptographic erasure the only practical option for compliance.

How to eliminate wrong answers

Option A is wrong because overwriting data with multiple patterns of zeros and ones (e.g., DoD 5220.22-M) is impractical in a cloud data warehouse where data is stored on distributed, shared, and often versioned storage systems; the cloud provider may retain snapshots, replicas, or previous versions that are not overwritten, leaving residual data recoverable. Option C is wrong because tokenization replaces sensitive data with tokens but retains the token mapping, which does not destroy the original data; the mapping can be reversed, and the original data remains stored elsewhere, failing to achieve irrecoverable deletion. Option D is wrong because deleting data via the cloud provider's API and removing pointers only removes logical references; the underlying data blocks remain on physical media and can be recovered through forensic techniques or provider-side snapshots, making it insufficient for compliance with irrecoverable destruction requirements.

Full explanation →

141

MCQeasy

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

A.Encrypt the database connection

B.Implement rate limiting on the login endpoint

C.Enforce strong password policies

D.Use parameterized SQL queries

AnswerD

Parameterized queries prevent injection by treating input as data.

Why this answer

SQL injection attacks exploit unsanitized user input that is concatenated into SQL queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders, ensuring that user input is always treated as data, not executable code. This prevents an attacker from injecting malicious SQL commands, regardless of the input content.

Exam trap

ISC2 often tests the distinction between network-layer controls (like encryption) and application-layer controls (like input validation), and the trap here is that candidates confuse encryption of the connection with prevention of injection, thinking encrypted traffic cannot carry malicious payloads.

How to eliminate wrong answers

Option A is wrong because encrypting the database connection (e.g., using TLS/SSL) protects data in transit from eavesdropping but does not prevent the execution of malicious SQL statements; the injection still occurs at the application layer. Option B is wrong because rate limiting on the login endpoint only mitigates brute-force or credential-stuffing attacks by restricting request frequency; it has no effect on the content of a single request that contains SQL injection payload. Option C is wrong because enforcing strong password policies (e.g., complexity, length) reduces the risk of credential compromise but does not address the vulnerability of unsanitized input in SQL queries; an attacker can still inject SQL without needing valid credentials.

Full explanation →

142

MCQmedium

An administrator configured the above key policy for a KMS key used to encrypt S3 backup data. The backup role 'BackupRole' is in the same account. However, when the backup service attempts to use the key to decrypt objects, the operation fails. What is the most likely cause?

A.The principal ARN is incorrect because the role name contains uppercase letters

B.The 'kms:ViaService' condition restricts calls to those originating from S3, but the backup service uses direct KMS API

C.The key policy requires a grant token that is not being provided

D.The action list does not include 'kms:Decrypt' for S3

AnswerB

The condition prevents direct KMS calls.

Why this answer

The 'kms:ViaService' condition key restricts KMS API calls to those that originate from a specific AWS service, in this case S3. However, the backup service is likely making direct KMS API calls (e.g., Decrypt) rather than having S3 proxy the request, so the condition fails. The key policy explicitly denies access unless the call comes via S3, which is why decryption fails.

Exam trap

ISC2 often tests the nuance that 'kms:ViaService' only applies when the request is made through the specified service's integration, not when the client calls KMS directly, leading candidates to overlook the direct API call scenario.

How to eliminate wrong answers

Option A is wrong because principal ARNs in AWS IAM are case-sensitive but role names can contain uppercase letters; the ARN format uses the role name exactly as defined, so uppercase letters are valid and not the cause of failure. Option C is wrong because grant tokens are used with KMS grants, not key policies; the key policy here does not require a grant token, and the error is unrelated to grants. Option D is wrong because the action list includes 'kms:Decrypt' for the backup role (as shown in the policy snippet), so the missing action is not the issue.

Full explanation →

143

MCQeasy

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

A.Store all customer data on-premises and only use the cloud for non-sensitive data.

B.Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

C.Implement a process to request immediate deletion from the provider and verify completion within 30 days.

D.Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

AnswerC

This directly ensures compliance with the 30-day GDPR requirement through active management and verification.

Why this answer

The bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Exam trap

ISC2 often tests the misconception that an SLA can override technical limitations or regulatory obligations, but the trap here is that candidates may choose D without realizing that SLAs cannot guarantee deletion within 30 days for archived data due to inherent storage architecture constraints, and the bank must instead implement a process to handle expedited deletion requests.

How to eliminate wrong answers

Option A is wrong because storing all customer data on-premises defeats the purpose of cloud migration and does not address the bank's need to use cloud services for customer data while remaining compliant. Option B is wrong because accepting the 90-day timeline and relying on a contractual liability shift does not absolve the bank from its regulatory obligation to delete data within 30 days; GDPR holds the data controller (the bank) ultimately responsible. Option D is wrong because negotiating an SLA for 30-day deletion on all data may not be feasible or enforceable for archived data due to technical constraints like tape-based storage or immutable snapshots, and the provider's standard process may still take 90 days for such data.

Full explanation →

144

MCQeasy

A financial services company uses a hybrid cloud environment with an on-premises data center and AWS. They have deployed a Cloud Access Security Broker (CASB) to enforce data loss prevention (DLP) policies for SaaS applications. Recently, the security team noticed that sensitive customer data is being exfiltrated via encrypted traffic to a sanctioned cloud storage application. The CASB logs show the traffic is identified as HTTPS, but the DLP policy is not blocking it. The team verifies that the CASB is configured with a forward proxy and SSL inspection is enabled. Which action should the security team take to prevent this exfiltration?

A.Block all HTTPS traffic to the cloud storage application

B.Ensure the CASB's SSL certificate is deployed to all endpoint devices

C.Configure the CASB to log only metadata for encrypted traffic

D.Disable HTTPS for the cloud storage application and force HTTP

AnswerB

Without the CASB’s certificate trusted by clients, SSL inspection fails, and DLP cannot inspect encrypted content.

Why this answer

The CASB is configured as a forward proxy with SSL inspection enabled, but for SSL inspection to work, the CASB's certificate must be trusted by the endpoint devices. Without the CASB's certificate deployed to the endpoints, the SSL inspection fails (the CASB cannot decrypt the traffic), so the DLP policy cannot inspect the payload of HTTPS traffic, allowing sensitive data to be exfiltrated. Deploying the CASB's certificate to all endpoint devices ensures that the endpoints trust the CASB's man-in-the-middle decryption, enabling the CASB to decrypt, inspect, and enforce DLP policies on encrypted traffic.

Exam trap

The trap here is that candidates assume SSL inspection is automatically effective once enabled in the CASB configuration, overlooking the critical prerequisite that the CASB's certificate must be trusted by the endpoints for decryption to occur.

How to eliminate wrong answers

Option A is wrong because blocking all HTTPS traffic to the cloud storage application is an overly broad and disruptive measure that would break legitimate business use of the sanctioned application, and it does not address the root cause of the DLP policy not being enforced on encrypted traffic. Option C is wrong because logging only metadata for encrypted traffic would reduce visibility and prevent the CASB from inspecting the payload, making it impossible to enforce DLP policies on the content of the traffic. Option D is wrong because disabling HTTPS and forcing HTTP would expose the data in transit to interception and tampering, violating security best practices and potentially regulatory compliance requirements, and it does not leverage the existing SSL inspection capability of the CASB.

Full explanation →

145

MCQmedium

A cloud application allows users to upload profile pictures. The application stores the files in an S3 bucket with public read access. An attacker uploads a malicious script that executes when other users view the image. Which type of attack is this?

A.SQL Injection

B.Mass Assignment

C.Stored Cross-Site Scripting (XSS)

D.Server-Side Request Forgery (SSRF)

AnswerC

Malicious script stored in S3 and served to users is stored XSS.

Why this answer

This is a stored cross-site scripting (XSS) attack where malicious content is uploaded and later served to other users. The public bucket enables the attacker to host the script and deliver it to victims.

Full explanation →

146

Multi-Selectmedium

A cloud application uses AWS Lambda functions in a serverless architecture. The security team wants to enforce least privilege access for these functions. Which THREE practices should be implemented?

Select 3 answers

A.Use AWS Parameter Store or Secrets Manager for sensitive data

B.Store secrets in Lambda environment variables encrypted with KMS

C.Assign a dedicated IAM role to each Lambda function

D.Grant permissions based on the principle of minimal necessary access

E.Use a single IAM role for all Lambda functions for simplicity

AnswersA, C, D

External secrets management reduces exposure.

Why this answer

AWS Parameter Store or Secrets Manager are correct because they provide secure, auditable storage for sensitive data like database credentials and API keys. Lambda functions can retrieve these values at runtime via the AWS SDK, avoiding hard-coded secrets in code or environment variables. This aligns with the principle of least privilege by granting the Lambda IAM role only the specific permissions needed to access the secret, not the secret value itself in plaintext.

Exam trap

ISC2 often tests the misconception that encrypting environment variables with KMS is a sufficient substitute for using a dedicated secrets management service, but the trap is that environment variables are still visible in plaintext to anyone with console access or CloudTrail logs of the function configuration.

Full explanation →

147

MCQeasy

A financial services company is migrating a critical application to the cloud. They must ensure that the cloud provider supports the ability to conduct forensic investigations in case of a security incident. Which of the following is the MOST important requirement to include in the contract?

A.The provider must guarantee 99.999% uptime for all cloud services used.

B.The provider must automatically patch all virtual machines within 24 hours of patch release.

C.The provider must grant the customer access to raw logs and the ability to perform memory captures on virtual instances.

D.The provider must store data only in data centers located within the country of operation.

AnswerC

Access to raw logs and memory captures is critical for forensic analysis.

Why this answer

Forensic investigations require access to raw logs and the ability to capture memory from virtual instances to analyze incidents. Option A is incorrect because uptime guarantees (99.999%) relate to availability, not forensic capability. Option B is incorrect because automatic patching is a security measure but not specific to forensics.

Option D is incorrect because data residency restrictions address data sovereignty, not forensic access.

Full explanation →

148

MCQeasy

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

A.Restrict access to the backup files using IAM roles.

B.Use a virtual private cloud (VPC) to isolate the database from the internet.

C.Enable transparent data encryption (TDE) with customer-managed keys for the database and its backups.

D.Implement data tokenization for all sensitive fields.

AnswerC

Data is encrypted at rest; keys are separate.

Why this answer

Transparent Data Encryption (TDE) with customer-managed keys encrypts the database at rest and, when properly configured, also encrypts backup files. This ensures that even if backup files are stolen, the data remains unreadable without the decryption keys, providing a strong defense against data breaches involving physical or logical theft of backups.

Exam trap

The trap here is that candidates often confuse network-level controls (VPC isolation) or access controls (IAM) with data-at-rest encryption, failing to recognize that backup files are a separate attack surface requiring encryption specifically applied to the backup media.

How to eliminate wrong answers

Option A is wrong because restricting access with IAM roles protects against unauthorized access to the backup files but does not encrypt the data within them; if the files are stolen (e.g., via physical theft or a compromised storage layer), the data is still readable. Option B is wrong because using a VPC isolates the database from the internet but does not encrypt backup files; a VPC controls network traffic, not data at rest, so stolen backups remain unprotected. Option D is wrong because data tokenization replaces sensitive data with tokens, but it requires an external tokenization service and does not inherently protect backup files; if the token mapping is compromised or the backup contains tokens, the original data may still be exposed, and tokenization is not a direct backup encryption mechanism.

Full explanation →

149

MCQhard

A cloud architect is designing a secure data sharing mechanism for a third-party partner. The partner needs temporary access to download a specific object from a private cloud storage bucket, but should not have broader access to the bucket. Which approach should be used?

A.Make the object publicly readable

B.Use cross-region replication to the partner's account

C.Grant the partner a role with read access to the bucket

D.Use a time-limited access URL for the specific object

AnswerD

Correct: Pre-signed URL provides time-limited access to a specific object.

Why this answer

A time-limited access URL grants temporary access to a specific object without requiring the partner to have cloud credentials or bucket-level permissions.

Full explanation →

150

Multi-Selectmedium

Which TWO of the following are valid methods to protect data at rest in a cloud environment?

Select 2 answers

A.Client-side encryption

B.Data loss prevention (DLP) policies

C.Tokenization

D.Server-side encryption

E.Transport Layer Security (TLS)

AnswersA, D

Encrypts data before sending to cloud.

Why this answer

Client-side encryption (A) is a valid method to protect data at rest because the data is encrypted by the client before being transmitted to the cloud provider. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, which remain under the customer's control. It is a strong approach for maintaining data confidentiality and compliance with regulatory requirements.

Exam trap

ISC2 often tests the distinction between data at rest and data in transit, so the trap here is that candidates may incorrectly select TLS (Option E) as a method for protecting data at rest, confusing it with encryption of data in transit.

Full explanation →

Certified Cloud Security Professional CCSP (CCSP) — Questions 76–150