Certified Cloud Security Professional CCSP (CCSP) — Questions 151–225

Comparing the event's source IP against approved corporate ranges establishes whether the request originated from a trusted network or an external actor, directly addressing the authorisation question. CloudTrail records the sourceIPAddress field for every CreateKeyPair event, so this check reliably distinguishes legitimate administrative activity from credential compromise or misuse.

Destroy is the final lifecycle phase, using cryptographic erasure (deleting the wrapping key so ciphertext is unrecoverable) or degaussing to render media magnetically unusable. This guarantees data cannot be reconstructed, satisfying the stem's irreversibility requirement rather than merely deleting pointers or access.

Anomalous outbound traffic spikes to unknown IP addresses satisfy the exfiltration detection requirement, since CASBs monitor data flows between the organisation and cloud services, flagging volumetric deviations from established baselines. This behavioural signal directly evidences unauthorised data movement, unlike authentication or configuration events, which indicate access attempts rather than confirmed egress.

Network Policies are Kubernetes objects that select pods by label and define permitted ingress and egress rules, enforced by the CNI plugin. They satisfy the stem's label-based restriction on inter-pod traffic, unlike security groups or firewall rules that operate outside pod identity.

HIPAA requires documented incident detection, reporting and response procedures for PHI breaches; the audit found no formal process, making this the most critical gap. Encryption and backups already exist, so incident response must be addressed first.

Server-side scanning intercepts every upload before it reaches storage, catching malware the client cannot be trusted to detect. This directly satisfies the stem's constraint of preventing malicious files from compromising the server, since client-side checks are bypassable and signature-only filtering misses embedded payloads.

Schema-per-tenant with role-scoped grants limits each tenant's session to its own schema, providing a strong boundary. Combined with row-level policies or as an alternative, it prevents cross-tenant access at the privilege layer and reduces the blast radius of a compromised application credential.

Cloud Audit Logs capture administrative actions against the cluster and its resources, recording the calling identity, the API method, and the timestamp. Enabling Admin Activity and Data Access audit logs provides the attribution the team needs to trace any administrative action to a named principal.

AWS WAF attaches to API Gateway stages and inspects HTTP requests against managed or custom rules, blocking SQL injection and cross-site scripting payloads before they reach the backend. This satisfies the requirement to protect the exposed API against common web exploits.

Rotation limits the blast radius of a leaked CMK by shortening its cryptographic lifespan, while audit logging records every key use and policy change. Together they satisfy the stem's dual requirement that the customer-managed key stays uncompromised and that access remains auditable.

A right to audit clause grants the customer contractual permission to assess the provider's security controls, typically annually, either directly or via an independent third party. Without it, the customer has no enforceable means to verify controls beyond provider-supplied reports.

A public cloud is owned by a provider and offers self-service, on-demand resources to any customer over the network, with no capital purchase and pay-per-use billing. Sharing physical infrastructure with other tenants is inherent to the model and is what enables the low entry cost. Resources can be released when the product is discontinued, matching every stated requirement.

Classification tags attach sensitivity metadata to objects, enabling policy engines to enforce handling rules such as encryption, access restrictions and retention automatically. This satisfies the stem's requirement that labelling drives enforcement of data handling policies based on sensitivity.

Running the container as a non-root user removes UID 0 inside the container, so a breakout attempt lands with unprivileged rights on the host and cannot modify protected files or kernel interfaces. This directly mitigates the root-with-full-capabilities risk the auditor identified.

Portability directly addresses avoiding provider lock-in by ensuring workloads can migrate between clouds or back on-premises without re-architecture. It satisfies the stem's constraint of relocation without significant redesign, distinguishing it from interoperability, which concerns systems communicating across providers rather than moving between them.

A virtual firewall enforces segmentation and inspection.

Reporting frequency determines how quickly the consumer detects SLA breaches and holds the provider accountable. Without regular performance data, uptime guarantees and credit mechanisms cannot be verified, so this metric underpins the reliability assessment the stem requires.

A legal hold overrides the provider's contractual auto-deletion schedule, so the company must issue a preservation notice instructing the provider to suspend its 30-day deletion and retain the ESI for litigation. This satisfies the compliance constraint by preventing spoliation before the hold is lifted.

Rotating the database credentials immediately invalidates the compromised credentials, cutting off the attacker's access before further lateral movement or data exfiltration. Containment takes priority over investigation, and rotation is the fastest control given the suspected credential compromise.

Cosign signs container images with cryptographic keys, producing a signature stored alongside the image in the registry. This gives verifiable provenance, satisfying the supply-chain integrity requirement by letting downstream systems confirm the image was not tampered with after signing.

Embedding scanning directly in the pipeline enforces a fail-closed gate: the build job inspects the image layers and aborts before the artefact reaches the cluster, satisfying the requirement to prevent vulnerable images from being deployed rather than merely detecting them post-deployment.

Centralised logging depends on the agent forwarding events; if that agent stops, no records reach the collector even though the application keeps running. Missing logs for exactly the past hour, with no other change, points to the local forwarder failing rather than a pipeline or storage issue.

A data deletion clause contractually obliges the provider to permanently erase all customer data, including backups, on termination. It directly satisfies the requirement for assured destruction of residual copies rather than merely returning primary data.

In SaaS, the provider secures the application and underlying infrastructure, but the tenant retains control of its own user accounts, roles, and authentication configuration. Managing user access and identity therefore sits with the customer, satisfying the shared responsibility split the question tests.

SSE-KMS with a customer managed key gives the organization control over key policy, rotation, and usage auditing via CloudTrail, which directly satisfies the auditor's requirement. Applications continue to use the standard S3 API; only IAM permissions for the KMS key are added. This minimizes code changes while providing independent key control and auditability.

Both customer (defines rules) and provider (enforces them) share this.

SAST scans source code within the CI/CD pipeline, catching injection and insecure coding flaws before artefacts are built or deployed. This shifts detection left, satisfying the requirement to enhance security throughout the DevSecOps lifecycle rather than only at runtime.

A right to audit clause contractually grants the customer the ability to inspect the provider's security controls and evidence, satisfying the stem's goal of visibility into those controls. Without it, the customer relies solely on provider assertions or third-party reports.

Storing credentials in Systems Manager Parameter Store with KMS encryption keeps secrets encrypted at rest, while IAM roles let Lambda retrieve them without embedded static keys. This satisfies the scenario's constraint of protecting database credentials in a serverless environment, since no long-lived secrets reside in function code or environment variables.

Removing the public ACL immediately closes the anonymous read exposure, satisfying the audit's urgent remediation requirement. Updating the bucket policy to least privilege then addresses the over-broad account-wide read/write grant, since S3 evaluates ACLs and bucket policies independently — both must be corrected to eliminate unintended access.

Cryptographic erasure renders data unreadable by destroying the keys, which is effective across replicas and backups that tenants cannot directly purge. It addresses logical remanence in a multi-tenant environment where physical media is shared and managed by the provider. This gives the tenant a direct, verifiable destruction mechanism independent of provider deletion processes.

A Right to Audit clause directly grants the customer contractual authority to examine the provider's security controls and certifications, satisfying the requirement for periodic assessment of the provider's operations. Without this clause, the customer relies solely on the provider's self-reported attestations, losing independent verification rights.

Checkov is a static analysis tool that parses Terraform plans and flags misconfigured resources, including S3 buckets permitting public read access. This satisfies the stem's requirement to block deployment of publicly readable buckets before apply, unlike runtime or cloud-native posture tools.

CMEK lets the provider's KMS generate and hold the key material while the customer retains control over key lifecycle and permissions, satisfying the requirement for self-managed keys generated inside the cloud KMS rather than imported or provider-owned.

Masking and tokenisation replace or substitute sensitive values so the data lake retains analytical utility while Social Security and medical record numbers are no longer exposed. This directly satisfies the stem's requirement to transform detected sensitive data, complementing scanning and classification rather than duplicating them.

Logical segmentation through virtual private networks, security groups, and distinct identity domains keeps one tenant's workloads from reaching another's even when they share physical infrastructure. These controls constrain east-west traffic and administrative reachability, which are the primary paths exploited when isolation is weak. They are standard, effective mitigations for the risks introduced by pooled multi-tenant compute and network resources.

SCCs are pre-approved contractual terms adopted by the European Commission that provide an Article 46 transfer safeguard when personal data leaves the EEA. Because the provider's US support staff can access EU personal data, the controller needs a valid transfer tool, and SCCs are the most common and directly applicable mechanism for controller-to-processor transfers in a cloud engagement.

The CCM is a cybersecurity control framework specifically for cloud computing, developed by the CSA. It is a foundational component of the STAR program, providing the controls against which providers are assessed. The CCM helps customers understand necessary controls and is integral to STAR.

SOC 2 Type II reports on the design and operating effectiveness of controls across security, availability, processing integrity, confidentiality and privacy over an audit period. This matches the stem's five trust services criteria, unlike point-in-time reports.

Dynamic data masking applies masking at query time, so administrators querying the database see redacted SSN and diagnosis values while privileged roles retain full data. This satisfies the constraint that DBAs must not view sensitive columns, unlike static masking, which would alter stored data permanently.

A signed URL embeds a cryptographic signature and expiry timestamp, granting temporary read access to that single object. The 24-hour expiration satisfies the automatic revocation requirement without granting the auditor broader bucket permissions or requiring an account.

Client-side encryption encrypts data before it leaves the customer's environment, and keys are stored on-premises, outside the provider's control. Thus, the cloud provider only stores ciphertext and cannot decrypt without the customer's keys. If an attacker gains access to the bucket, they obtain only encrypted data, satisfying both requirements.

Pre-commit hooks run secret scanning locally before a commit is finalised, blocking credentials from ever entering repository history. This directly satisfies the stem's prevention requirement, unlike detection tools that only flag secrets after they have already been committed.

Permission denied errors when writing to the bucket point to identity or resource-policy authorisation, so verifying the service account's IAM roles and bucket ACLs satisfies the stem's access-failure constraint before any retry or code change.

Tagging resources with classification labels is the operational mechanism that actually applies the scheme to data at scale. Without an enforced tagging process, labels remain theoretical and cannot drive protection, access, or retention controls, so the classification scheme is never realised across the cloud estate.

A WAF inspects HTTP traffic and applies rate limiting plus IP blacklisting, throttling or dropping the abusive source before requests reach the API. This blocks automated token-guessing floods more effectively than host-level or identity controls.

IPsec VPNs encrypt packets at the network layer, protecting data as it traverses untrusted networks between sites or to the cloud. This directly satisfies the confidentiality-in-transit constraint by preventing interception or eavesdropping on traffic flows, independent of application-level controls.

Under the shared responsibility model, the cloud provider secures the infrastructure, while the customer owns identity and access management configuration. The customer defines and maintains IAM policies, so ensuring a policy correctly restricts access remains the customer's responsibility, not the provider's.

Using a cloud HSM or KMS with customer-managed keys allows the company to create, rotate, and disable keys according to its own policies. The cloud provider manages the hardware but cannot access key material. This meets both encryption at rest and customer control over rotation.

The consumer is responsible for managing user identities and access within their application, including creating user accounts, assigning roles, and enforcing least privilege. While the provider may offer identity services, the consumer must configure and manage them for their specific application. This is a key consumer responsibility in PaaS.

VPC Flow Logs capture IP-level metadata for traffic traversing elastic network interfaces, including source and destination addresses, ports, protocol and bytes transferred. This directly satisfies the requirement to identify exfiltration destinations and quantify transferred volume, which CloudTrail management events cannot provide.

An independent audit report, such as a SOC 2 report, is produced by a qualified auditor and describes the design and operating effectiveness of controls against defined criteria over a specific period. It gives the architect evidence that controls exist and were tested, along with any exceptions noted. This is direct, verifiable evidence rather than a self-declaration, making it one of the strongest artifacts for pre-contract assessment.

PKCE binds the authorization code to the client via a dynamically generated code verifier, so a public mobile client cannot protect a static secret. Removing client_secret eliminates a credential that could be extracted from the app bundle, satisfying the goal of reducing unnecessary attack surface.

The Azure Monitor activity log captures subscription-level control plane operations, including resource group deletions. Exporting to a storage account with immutable blob storage (using time-based retention policies) ensures logs cannot be altered or deleted for the specified period. Azure Monitor alerts can trigger on specific events from the activity log, such as Delete Resource Group, providing real-time notification.

Tokenization is widely used for PCI DSS compliance.

GDPR Article 33 requires controllers to notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in risk to individuals' rights and freedoms.

Customers often need to delete specific data before contract end, such as when a data subject exercises the right to erasure or when data is no longer needed. A defined process with confirmation ensures the provider acts on these requests and provides auditability. This supports compliance with GDPR and other privacy laws that require timely deletion. It also helps manage storage costs and reduce risk.

Automatic rotation limits the useful lifetime of a compromised secret and reduces the window of exposure. When rotation is coupled with dynamic retrieval from the secrets manager, applications pick up new values without redeployment, maintaining availability while improving security.

BYOK allows the company to generate and manage its own encryption keys while using the cloud provider's key management service for storage and lifecycle operations. This gives the company control over the keys and satisfies the requirement for encryption at rest with customer-controlled keys.

ISMS requires ongoing improvement based on monitoring.

Client-side encryption ensures data is encrypted before it reaches the cloud provider, so the provider never sees plaintext. Storing the key in an external KMS that the company controls allows immediate revocation and provides audit evidence that the provider cannot access the key. This directly satisfies all stated requirements: customer control, immediate revocation, and provable provider inaccessibility.

Data loss prevention policies inspect content in transit to cloud services and block uploads matching credit card number patterns. This satisfies the requirement to prevent sensitive data exfiltration to cloud storage, which generic access controls or encryption cannot achieve.

FIPS 140-2 validation is specific to the cryptographic module. The organization must ensure that the module used for encryption has a valid certificate from a NIST-accredited lab. This directly confirms that the encryption meets the regulatory requirement. The certificate should cover the exact module version and configuration used.

A processor handles personal data only on documented instructions from the controller, which is precisely the cloud provider's position here. The controller determines purposes and means; the processor bears no such determination, matching the stem's solely-on-behalf wording.

Under HIPAA, a covered entity must ensure that its business associates, including CSPs, implement appropriate safeguards to protect ePHI. The BAA itself is a contractual requirement, but the most critical factor is verifying that the CSP actually has the necessary administrative, physical, and technical safeguards in place. This includes access controls, encryption, audit controls, and integrity controls, which are essential to comply with the HIPAA Security Rule.

Admission controllers that verify cryptographic signatures on container images can block any pod whose image lacks a valid signature from the trusted public key. This directly enforces the policy before the pod is scheduled, ensuring only images from the internal pipeline are admitted. It works with the existing KMS-held private key because the corresponding public key is what the controller checks.

A community cloud is provisioned for exclusive use by a specific community of consumers from organizations that share common concerns such as mission, security requirements, policy, and compliance considerations. The scenario explicitly describes multiple agencies with similar missions and obligations jointly using a governed environment while retaining control over their own data, which is the textbook community cloud arrangement.

A hybrid cloud combines a private cloud with public cloud services and enables workloads to move or burst between them. Here, the private cloud can remain the primary editing environment while public cloud resources absorb peak compute and storage demands, which matches the requirement to keep existing workflows and avoid a full migration.

Self-signed certificates lack a trusted certificate authority, so services cannot reliably verify each other's identity during the mutual TLS handshake. An attacker positioned between pods could present their own self-signed certificate and impersonate a legitimate service, intercepting gRPC traffic. This directly enables man-in-the-middle attacks, satisfying the scenario's mutual authentication requirement.

Argon2id is purpose-built for password storage, combining a tunable cost parameter with per-user salting to make offline guessing expensive and rainbow tables useless. The memory-hard design blunts GPU and ASIC attacks. This directly satisfies the architect's requirement for a tunable work factor and a per-user random salt while remaining a one-way function suitable for verification.

HTTP-only cookies are inaccessible to JavaScript, so cross-site scripting cannot read the token, while Secure restricts transmission to HTTPS and SameSite blocks cross-site request forgery. This satisfies secure browser storage, unlike localStorage, which script can freely exfiltrate.

A single identity plane spanning on-premises and cloud lets one directory govern authentication and authorisation everywhere. Microsoft Entra ID provides this, satisfying the hybrid requirement for consistent access control rather than duplicated, divergent credential stores.

Elasticity directly satisfies the changing-demand constraint by automatically provisioning and deprovisioning resources through auto-scaling groups, matching capacity to real-time workload. Unlike scalability, which addresses growth in fixed increments, elasticity handles fluctuating demand dynamically, including scale-in, making it the precise principle described in the stem.

Server-side request forgery tricks an application into requesting the cloud instance metadata endpoint, which returns temporary IAM credentials to any process that reaches it. This satisfies the stem's cloud-specific requirement: the metadata service is unique to cloud platforms, and SSRF is the documented vector for credential exposure.

Rate limiting and throttling cap request volume per client or key, mitigating brute-force, credential-stuffing and denial-of-service abuse against REST endpoints. This directly satisfies the stem's requirement for an effective control protecting cloud-hosted APIs from volumetric and enumeration attacks.