964 questions total · 13pages · All types, answers revealed
A cloud application uses an IAM role with the policy "Action: s3:*" and "Resource: *". Which principle is violated?
Least privilege requires minimal necessary permissions; wildcard resources and actions violate this.
Why this answer
The policy grants full access to all S3 actions on all resources, violating the principle of least privilege. Wildcard permissions like s3:* and *:* are over-permissive.
Which THREE of the following are key considerations when designing a disaster recovery plan for a cloud-based application?
Cross-region replication ensures availability.
Why this answer
Cross-region replication ensures that critical data is asynchronously or synchronously copied to a geographically separate cloud region, providing resilience against regional outages. This design directly supports disaster recovery by enabling failover to a secondary site with minimal data loss, often leveraging cloud-native services like AWS S3 Cross-Region Replication or Azure Geo-Redundant Storage.
Exam trap
ISC2 often tests the misconception that disaster recovery planning can skip security controls or infrequent testing, but the exam emphasizes that DR must maintain security posture and be validated through regular, automated testing to meet compliance and operational requirements.
A cloud service provider (CSP) experiences a security incident affecting customer data. The contract requires notification within 72 hours, but the CSP fails to notify. What is the most likely legal consequence for the CSP?
Contractual notification obligations are enforceable, and GDPR imposes fines for non-reporting.
Why this answer
Failure to notify as required by contract constitutes a breach of contract. Additionally, if the incident involves personal data, it may also violate regulations like GDPR, leading to regulatory fines. Option B is incorrect because automatic termination of all customer contracts is not a standard consequence; termination typically requires specific contract clauses and may not be automatic for a single breach.
Option C is incorrect because criminal liability for executives usually requires proof of negligence or intent beyond mere failure to notify, and it is less common in such scenarios. Option D is incorrect because consequences exist regardless of the incident's severity; contractual obligations must be met, and non-compliance can result in legal action or fines.
A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?
HYOK keeps keys on-premises in the customer's HSM, and the cloud provider does not have access to the plaintext keys.
Why this answer
HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.
A cloud security team is evaluating DLP techniques to protect sensitive data in a cloud data warehouse. They want to replace sensitive values with realistic but fictitious data for non-production environments while preserving referential integrity. Which TWO de-identification techniques are suitable?
Correct: Pseudonymization replaces identifiers with consistent pseudonyms, preserving relationships.
Why this answer
Tokenization replaces sensitive data with a token that can be consistent across tables, preserving referential integrity. Pseudonymization replaces identifiers with consistent pseudonyms, also preserving relationships.
A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?
Enforces policies locally regardless of environment.
Why this answer
Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.
Exam trap
ISC2 often tests the distinction between network-level controls (SDP, VPC ACLs) and host-level controls (unified agents), leading candidates to mistakenly select network-centric options for workload protection that requires per-VM policy enforcement.
An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?
If the Deny statement's condition is incorrectly specified (e.g., wrong operator), the condition will not match non-HTTPS requests, and the Deny will not be applied, allowing the Allow statement to grant access.
Why this answer
The bucket policy likely contains an Allow statement granting PutObject and a Deny statement intended to block non-HTTPS requests using the aws:SecureTransport condition key. However, if the Deny statement uses an incorrect condition operator (e.g., StringEquals instead of Bool), the condition never evaluates to true for non-HTTPS requests. As a result, the Deny statement does not apply, and the Allow statement permits the upload regardless of transport.
This is a common syntax configuration error. In AWS IAM policy evaluation, an explicit Deny always overrides an Allow, but only if the Deny statement's conditions match the request. Therefore, a misconfigured condition effectively bypasses the Deny.
Exam trap
ISC2 often tests the misconception that Allow statements can override Deny statements due to evaluation order. In reality, an explicit Deny always takes precedence over any Allow. However, if a Deny statement's conditions are not met, the Deny does not apply, and an Allow may grant access.
Candidates should understand that a correctly written Deny condition is essential to enforce security constraints.
How to eliminate wrong answers
Option A is wrong because 'aws:SecureTransport' is a globally supported condition key for S3 bucket policies, and it is commonly used to enforce HTTPS-only access. Option B is wrong because bucket policies apply to all principals, including the AWS root account user, unless the policy explicitly excludes them with a 'NotPrincipal' element or a condition; the root account is not exempt from bucket policy evaluation. Option D is wrong because S3 bucket policies can combine Allow and Deny statements in the same policy; this is standard practice for implementing conditional access controls, and there is no syntax error in combining them.
A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?
Image signing ensures authenticity and integrity.
Why this answer
Image signing, vulnerability scanning, and using immutable tags are key supply chain security practices. Using the 'latest' tag is risky, and running containers as root is insecure.
Which design principle is most directly aimed at avoiding vendor lock-in and ensuring that workloads can be moved between cloud providers with minimal effort?
Correct. Portability focuses on using open standards to avoid lock-in.
Why this answer
Portability ensures that applications and data can be moved across environments using open standards and APIs, reducing dependence on a single provider.
Which practice is essential for securing cloud application secrets such as database passwords and API tokens?
Secrets managers provide secure storage, rotation, and access control.
Why this answer
Using a dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault prevents hardcoding secrets in code.
Which TWO of the following are effective measures to prevent dependency confusion attacks? (Select two.)
Scoped names (e.g., @company/package) avoid conflicts with public packages.
Why this answer
Using private registries with scoped packages and verifying package names help ensure only intended packages are used. Dependency pinning alone does not prevent confusion if the package is maliciously published with the same name.
An organization is designing a cloud storage solution for highly sensitive customer data. The data must be encrypted at rest and the encryption keys must be managed by the customer, not the cloud provider. Additionally, the solution must allow granular access control based on data classification. Which combination of services should the architect recommend?
Customer-managed keys in HSM and object-level ACLs meet both requirements.
Why this answer
Cloud HSM provides customer-managed keys for encryption at rest, ensuring the customer retains sole control over the keys. Combined with a cloud storage service that supports object-level ACLs, this allows granular access control based on data classification, meeting both requirements.
Exam trap
ISC2 often tests the distinction between server-side encryption (where the provider performs encryption) and client-side encryption (where the customer encrypts before upload), and the trap here is assuming that server-side encryption with customer-managed keys (Option A) gives the customer full control over key management, when in fact the provider still has access to the keys during encryption/decryption operations.
How to eliminate wrong answers
Option A is wrong because server-side encryption with customer-managed keys still relies on the cloud provider's infrastructure to perform encryption, and bucket-level policies alone do not provide granular object-level access control based on data classification. Option B is wrong because cloud-managed keys mean the provider controls the keys, violating the customer-managed key requirement. Option D is wrong because client-side encryption with a cloud KMS still involves the provider in key management (the KMS is provider-managed), and bucket-level policies lack the granularity of object-level ACLs for data classification.
An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?
KMS retains previous keys to decrypt older data.
Why this answer
Cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.
Exam trap
ISC2 often tests the misconception that key rotation forces re-encryption of all existing data, but the correct understanding is that previous key versions remain available for decryption, making re-encryption optional unless the old key is deleted.
How to eliminate wrong answers
Option A is wrong because cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) fully supports key rotation, both automatic and manual. Option C is wrong because KMS does not automatically re-encrypt existing data; re-encryption requires an explicit operation by the application or storage service. Option D is wrong because existing data encrypted with the previous key can still be decrypted using the retained previous key version, so re-encryption is not mandatory for access.
Under SOX, which of the following is an IT general control that must be implemented for financial data systems in a cloud environment?
Correct. Access controls are a fundamental ITGC under SOX.
Why this answer
SOX requires IT general controls (ITGCs) such as access controls to ensure the integrity of financial data. Audit logs support monitoring but are not the only control.
A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?
Correct: Restricted is highest sensitivity, e.g., trade secrets, PII with legal constraints.
Why this answer
In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.
A cloud provider offers a service with an SLA of 99.9% availability. Which TWO of the following are likely consequences if the provider fails to meet this SLA?
Service credits are a common remedy for SLA breaches.
Why this answer
Typically, SLA violations result in service credits (refunds) and can trigger penalty clauses. Immediate termination is rare, and full refund is not standard. Legal action is possible but less direct.
An organization is adopting a cloud-based data warehouse and needs to ensure data masking is applied to personally identifiable information (PII) for analysts who should not see actual values. Which technique is most appropriate?
Dynamic masking applies policies at query runtime without altering stored data.
Why this answer
Dynamic data masking (DDM) is the correct choice because it applies masking rules at query runtime directly within the data warehouse, allowing analysts to see obfuscated PII without altering the underlying stored data. This meets the requirement for on-the-fly masking for specific users while preserving the original values for authorized roles.
Exam trap
The trap here is that candidates confuse dynamic data masking with encryption or tokenization, assuming that any technique that 'hides' data is equivalent, but CCSP emphasizes that DDM is the only method that applies masking at query time without altering the stored data or requiring a separate mapping system.
How to eliminate wrong answers
Option B is wrong because static data masking creates a separate, permanently masked copy of the source database, which introduces data staleness and storage overhead, and does not provide real-time masking for analysts querying the live warehouse. Option C is wrong because encrypting PII columns and restricting decryption keys still exposes the encrypted data to analysts (who cannot decrypt it), but encryption does not obfuscate the data format or allow partial masking (e.g., showing last four digits) — it either reveals the ciphertext or nothing, which is not data masking. Option D is wrong because tokenization replaces PII with non-reversible tokens, but this requires a separate token vault and mapping system, and it permanently transforms the data, making it unsuitable for scenarios where analysts need to perform pattern-based analysis (e.g., partial display) without seeing the original values.
An attacker exploits a cloud application to make HTTP requests to an internal metadata service and retrieve temporary credentials. Which control would be most effective in preventing this attack?
Blocking traffic to the metadata IP at the network layer prevents SSRF from reaching it.
Why this answer
The attack exploits the cloud metadata service at the link-local address 169.254.169.254 (RFC 3927). Network-level egress filtering blocks outbound traffic to this IP, preventing the attacker from reaching the metadata service even if the application is compromised. This is a fundamental defense-in-depth control for cloud workloads.
Exam trap
ISC2 often tests the distinction between inbound controls (WAF, input validation) and outbound controls (egress filtering) for SSRF attacks, and the trap here is that candidates assume a WAF or input validation can block internal requests when only network-layer egress rules can stop the outbound connection to the metadata service.
How to eliminate wrong answers
Option A is wrong because signed URLs control access to specific resources (e.g., S3 objects) but do not prevent the application from making arbitrary HTTP requests to internal IPs like the metadata service. Option B is wrong because a WAF inspects incoming HTTP traffic for common web attacks (e.g., SQLi, XSS) but does not block outbound requests from the application to internal IPs; the attacker's exploit is an outbound server-side request, not an inbound attack. Option D is wrong because input validation on URL parameters can mitigate injection attacks but does not prevent the application from making requests to 169.254.169.254 if the attacker controls the request target via other means (e.g., SSRF via redirects or protocol smuggling).
A company is deploying a new application that processes sensitive personal data. The cloud provider operates in a specific region that adheres to the EU General Data Protection Regulation (GDPR). The company requires that data never leave the region. Which combination of cloud architecture controls should be implemented?
Correct: Policy and configuration ensure data residency.
Why this answer
Data sovereignty policies explicitly enforce that data remains within a specific jurisdiction, restricting geographic deployment to the region ensures all cloud resources are provisioned only in that region, and disabling cross-region replication prevents any automated or manual data transfer to other regions. This combination directly addresses the GDPR requirement that data never leave the designated region, as it controls both resource placement and data movement at the infrastructure level.
Exam trap
ISC2 often tests the misconception that encryption alone ensures data residency, but encryption protects data confidentiality, not its geographic location, so candidates must recognize that data sovereignty requires explicit location-based controls rather than cryptographic measures.
How to eliminate wrong answers
Option A is wrong because a VPC with a NAT gateway only controls outbound internet traffic from private subnets; it does not prevent data from being stored or processed in other regions, nor does it enforce geographic boundaries for data residency. Option C is wrong because encryption at rest and in transit, even with keys in a cloud HSM, protects data confidentiality but does not control where data is stored or processed; data could still be replicated or moved to another region. Option D is wrong because a CDN caches content at edge locations, which are often distributed across multiple regions and countries, potentially causing data to leave the specified region and violating the data residency requirement.
A cloud security engineer needs to protect a storage bucket from accidental deletion and ransomware attacks. Which two features should be enabled together for maximum protection?
Versioning allows recovery of previous versions; object lock prevents deletion/overwrite during retention.
Why this answer
Versioning keeps multiple variants of an object, allowing recovery from accidental deletion or overwrite. Object lock (immutability) prevents objects from being deleted or overwritten for a specified retention period, protecting against ransomware. Combining both provides defense in depth.
Client-side encryption gives the consumer sole control over encryption keys.
Why this answer
Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.
Exam trap
ISC2 often tests the distinction between 'customer-provided keys' (SSE-C) and 'client-side encryption' — candidates confuse SSE-C as giving sole control, but the key is still used by the provider's infrastructure, not solely under the consumer's control.
How to eliminate wrong answers
Option B is wrong because TLS protects data in transit, not data at rest; it does not encrypt the stored archived financial records. Option C is wrong because server-side encryption with provider-managed keys means the cloud provider controls the encryption keys, violating the requirement for sole consumer control. Option D is wrong because SSE-C allows the consumer to provide the encryption key, but the key is used by the cloud provider's server-side encryption process, and the provider may retain access to the key material or metadata, potentially compromising sole control.
A company is using a cloud provider's key management service (KMS) with HSM-backed keys. They want to ensure that key material is automatically replaced periodically to limit the impact of a potential key compromise. Which KMS feature should they configure?
Correct: Key rotation automatically updates key material.
Why this answer
Key rotation automatically generates new key material at defined intervals, reducing the risk of key compromise.
A cloud architect is designing a VPC for a three-tier application. The web servers need to be accessible from the internet, while the application servers should only be reachable from the web servers, and the database servers should be isolated from all other traffic except the application servers. Which VPC design best meets these requirements?
This tiered subnet design enforces network isolation between layers.
Why this answer
Public subnets for load balancers/web servers, private subnets for app servers, and isolated subnets (no direct route to internet) for databases provide the required isolation and access control.
A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?
Private cloud is dedicated to a single organization.
Why this answer
Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.
Match each IAM term to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Trust relationship between identity providers
Single authentication for multiple systems
Multiple authentication factors
Access based on role assignments
Why these pairings
IAM concepts are fundamental to cloud security; federation enables cross-domain authentication.
A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?
Prevents privilege escalation, which is the exact requirement.
Why this answer
Setting `allowPrivilegeEscalation: false` in the pod's security context directly blocks any attempt by a container process to gain more privileges than its parent process, such as through setuid binaries or syscalls like `setuid()`. This satisfies the requirement to prevent privilege escalation within the container, aligning with the least privilege principle.
Exam trap
ISC2 often tests the distinction between preventing privilege escalation and other security controls like dropping capabilities or running as non-root, leading candidates to confuse capability removal with escalation prevention.
How to eliminate wrong answers
Option A is wrong because `runAsNonRoot: true` only ensures the container runs with a non-root user, but it does not block privilege escalation mechanisms (e.g., a non-root user could still execute a setuid binary to become root). Option B is wrong because dropping all capabilities (`capabilities: drop: ['ALL']`) removes kernel capabilities but does not prevent privilege escalation via other means like setuid binaries or file system capabilities. Option C is wrong because `readOnlyRootFilesystem: true` only makes the container's root filesystem read-only, which does not address privilege escalation at all.
Which of the following is a primary benefit of using immutable tags for container images in a production registry?
Correct: Immutable tags ensure the same tag always points to the same image, enabling reproducibility.
Why this answer
Immutable tags prevent accidental overwriting of image tags, ensuring that the same tag always refers to the same image, which aids in traceability and rollback.
In a Kubernetes cluster, a pod needs to access a cloud provider's key management service (KMS) to retrieve secrets. Which of the following RBAC configurations is the least privileged approach?
Correct: Namespace-scoped Role limited to get on secrets is least privilege.
Why this answer
The least privileged approach is to grant only the necessary API permissions to the service account used by the pod, not to users or namespaces unnecessarily.
An organization has implemented a change management process for its cloud infrastructure. During a routine change, a network security group rule is modified incorrectly, causing a critical application to become inaccessible. What is the most effective way to prevent this issue in future changes?
Automated testing can detect policy violations and misconfigurations before deployment.
Why this answer
Automated configuration validation tests catch misconfigurations before deployment, preventing issues like the incorrect network security group rule. Option A is wrong because requiring manager approval does not prevent technical errors. Option C is wrong because rollback plans are reactive, not preventive.
Option D is wrong because while peer review helps, it is manual and can miss errors, whereas automated tests are more reliable.
A cloud customer is negotiating a contract with a new cloud provider. The customer wants to ensure they can maintain control over their data and verify the provider's security posture. Which TWO contractual provisions are most critical for these purposes? (Choose two.)
This ensures the provider does not claim ownership of customer data.
Why this answer
A data ownership clause explicitly states that the customer retains all rights, title, and interest in their data, ensuring legal control even when data is stored on the provider's infrastructure. This clause is foundational for maintaining data sovereignty and preventing the provider from claiming any ownership or usage rights over the customer's data.
Exam trap
ISC2 often tests the distinction between contractual clauses that provide legal ownership (data ownership) versus operational capabilities (data portability, deletion) versus performance guarantees (SLA), and candidates frequently confuse the right to audit with a general SLA or data portability clause.
A security analyst notices that a cloud storage bucket contains objects with public read access. The organization's policy prohibits public access. What is the most efficient way to remediate this issue across all objects in the bucket?
Bucket-level policies and ACLs override object-level permissions, efficiently blocking public access.
Why this answer
Applying a bucket policy that denies public access and updating the bucket ACL to block public access will override any object-level public ACLs, providing the most efficient remediation across all objects. Option A is unnecessarily disruptive and inefficient. Option B may work but is not the most efficient.
Option D is inefficient as it requires manual updates to each object.
An organization is implementing data masking to protect sensitive data in non-production environments. Which THREE of the following are common data masking techniques? (Choose three.)
Randomly reorders values within a column.
Why this answer
Shuffling is a common data masking technique that randomly reorders values within a column to break the link between records while preserving the overall distribution and statistical properties. This ensures that sensitive data, such as names or account numbers, cannot be traced back to the original individuals, making it suitable for non-production environments where referential integrity is not required.
Exam trap
ISC2 often tests the distinction between reversible protections (encryption) and irreversible obfuscation (masking), so candidates mistakenly select encryption because they confuse data masking with data encryption, not realizing masking must prevent reverse engineering of the original values.
A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?
Open APIs and standards enhance portability and avoid lock-in.
Why this answer
SLA guarantees availability, open APIs and standards enable portability, and audit reports demonstrate security and compliance. Data center locations are important for latency but not directly for portability; support tiers are operational but not strategic for these requirements.
During a security audit, it is discovered that a cloud application's API endpoints are vulnerable to injection attacks. Which defense in depth measure would be most effective in preventing such attacks?
Prepared statements ensure user input is never interpreted as code, preventing injection.
Why this answer
Prepared statements (parameterized queries) are the most effective defense against injection attacks because they separate SQL logic from user input, ensuring that input is treated as data only, never as executable code. This prevents attackers from manipulating query syntax, regardless of the input content. In cloud applications, this is a foundational secure coding practice that addresses the root cause of injection vulnerabilities at the application layer.
Exam trap
ISC2 often tests the misconception that a WAF or input validation is sufficient for injection prevention, but the exam emphasizes that only prepared statements (or parameterized queries) address the root cause by enforcing strict separation of code and data at the database layer.
How to eliminate wrong answers
Option A is wrong because a Web Application Firewall (WAF) operates at the network or HTTP layer and can only detect and block known injection patterns via signatures or heuristics; it cannot prevent novel or obfuscated injection payloads that bypass its rules, and it does not fix the underlying insecure code. Option C is wrong because rate limiting controls the frequency of API requests to mitigate denial-of-service or brute-force attacks, but it has no effect on the content of individual requests and cannot prevent injection attacks. Option D is wrong because regular expression input validation is a blacklisting or whitelisting approach that can be bypassed by carefully crafted payloads (e.g., using encoding, comments, or alternative syntax), and it is not a reliable defense against injection; prepared statements are the only option that guarantees separation of code and data.
A company is required to retain logs for 7 years per regulation. The cloud provider's default retention is 90 days. What is the most effective approach?
Customer-controlled retention meets the requirement.
Why this answer
The customer is responsible for compliance. Configuring log export to an external storage with 7-year retention ensures data is preserved. Relying on provider's default violates regulation, disabling retention breaks compliance, and encryption doesn't affect retention duration.
An organization wants to encrypt data at rest in a cloud object storage service. Which control is appropriate?
Server-side encryption encrypts data at rest.
Why this answer
Server-side encryption with a customer-managed key (SSE-C) allows the cloud provider to encrypt data at rest in object storage using a key that the customer controls and manages. This ensures that the encryption process is handled by the service itself, but the customer retains control over key rotation, access, and revocation, which is appropriate for meeting compliance and security requirements for data at rest.
How to eliminate wrong answers
Option A is wrong because a web application firewall (WAF) protects against application-layer attacks (e.g., SQL injection, XSS) and does not provide encryption for data at rest. Option C is wrong because a VPN secures data in transit over the network but does not encrypt data stored in the object storage service. Option D is wrong because TLS encrypts data in transit between the client and the service, not data at rest within the storage infrastructure.
Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)
Rate limiting prevents DDoS and brute force.
Why this answer
Rate limiting is a critical best practice for securing cloud application APIs because it prevents abuse by limiting the number of requests a client can make within a specific time window. This mitigates brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion. By enforcing rate limits, the API maintains availability and protects backend services from being overwhelmed.
Exam trap
ISC2 often tests the misconception that disabling HTTPS improves performance for cloud APIs, but the correct priority is always encryption for data in transit, even at the cost of slight latency.
A cloud customer needs to comply with PCI DSS for a cardholder data environment (CDE) hosted on an IaaS platform. According to PCI DSS Appendix A3, which document is critical to define the security responsibilities between the customer and the cloud provider?
This matrix is specifically mandated by PCI DSS for cloud environments.
Why this answer
PCI DSS Appendix A3 requires cloud customers and providers to clearly define and document their respective security responsibilities for the cardholder data environment (CDE). The Cloud Provider Responsibility Matrix (often called a Shared Responsibility Matrix) is the critical document that delineates which party is responsible for each security control, such as firewall management, patch management, and access controls, ensuring compliance with PCI DSS requirements.
Exam trap
ISC2 often tests the distinction between compliance-specific documents (like the Responsibility Matrix for PCI DSS) and general operational or regulatory documents (like SOC 2, BAA, or DPA), leading candidates to confuse a broad audit report or a different regulation's agreement with the precise shared responsibility definition required by PCI DSS Appendix A3.
How to eliminate wrong answers
Option B is wrong because a Service Organization Control (SOC) 2 report provides an independent auditor's assessment of a service provider's controls relevant to security, availability, processing integrity, confidentiality, or privacy, but it does not define the specific division of security responsibilities between the customer and the provider for PCI DSS compliance. Option C is wrong because a Business Associate Agreement (BAA) is specific to HIPAA compliance for protected health information (PHI) and has no relevance to PCI DSS or cardholder data environments. Option D is wrong because a Data Processing Agreement (DPA) is used under GDPR to govern the processing of personal data by a data processor, not to define security responsibilities for PCI DSS compliance in a cloud CDE.
A multinational corporation must ensure that customer data from the European Union is stored and processed only within EU regions to comply with GDPR. They are using a cloud provider with data centers globally. What is the primary mechanism to enforce this requirement?
Correct: Region selection ensures data is stored and processed in designated geographic areas.
Why this answer
Cloud providers allow customers to select specific geographic regions for resource deployment, ensuring data residency compliance.
A cloud security team wants to automatically detect and remediate S3 buckets that are publicly accessible. Which combination of AWS services can achieve this?
Config evaluates rules and can invoke Lambda for auto-remediation.
Why this answer
AWS Config continuously evaluates S3 bucket configurations against rules (e.g., s3-bucket-public-read-prohibited) and can trigger an AWS Lambda function via Amazon EventBridge when a non-compliant change is detected. The Lambda function then automatically applies a remediation action, such as removing the public access block or updating the bucket policy, achieving automated detection and remediation without manual intervention.
Exam trap
This question tests the distinction between detection-only services (like Inspector, GuardDuty, CloudTrail) and services that can both detect and trigger automated remediation (Config + Lambda), leading candidates to pick a service that only detects but cannot remediate.
How to eliminate wrong answers
Option A is wrong because Amazon Inspector is a vulnerability assessment service for EC2 instances and container workloads, not for S3 bucket configuration monitoring; Security Hub aggregates findings from other services but does not directly detect or remediate S3 public access. Option B is wrong because AWS WAF is a web application firewall that protects against web exploits at the application layer (HTTP/HTTPS), not for S3 bucket-level access controls; Route 53 is a DNS service and has no role in S3 bucket policy evaluation. Option D is wrong because AWS CloudTrail records API activity (e.g., PutBucketPolicy) but does not evaluate current bucket configurations for public access, and Amazon GuardDuty detects threats like suspicious API calls or compromised credentials, not misconfigured bucket permissions.
The exhibit shows a policy applied to a cloud storage bucket. After applying this policy, the security team notices that objects in the bucket are publicly accessible. Which additional condition should be added to restrict access to only authorized applications?
Conditions like 'aws:SourceIp' restrict access to authorized network locations.
Why this answer
The bucket policy already grants public access via 'Principal': '*', so removing that principal or changing actions won't fix the underlying exposure. By adding a condition that restricts access to specific IP addresses or virtual network endpoints, you ensure that only requests originating from authorized network sources can access the bucket, effectively overriding the broad principal wildcard.
Exam trap
ISC2 often tests the misconception that removing the principal wildcard or changing the action alone is sufficient to secure a bucket, when in fact network-level restrictions via conditions (e.g., source IP address or virtual network endpoint) are necessary to enforce access control for authorized applications.
How to eliminate wrong answers
Option B is wrong because simply removing the 'Principal': '*' statement would not automatically make the bucket private; the bucket policy might still have other statements granting access, or the bucket's ACLs could allow public access. Option C is wrong because changing the Action to s3:PutObject only restricts the type of operation (e.g., uploads), but the bucket would still be publicly readable if other actions like s3:GetObject are allowed. Option D is wrong because requiring MFA only adds an authentication factor for the request, but if the principal is '*', any unauthenticated user can still access the bucket without MFA; MFA conditions only apply to requests that include a valid session token from AWS STS.
A multinational corporation operates a cloud-based application that stores customer data across multiple regions to comply with local data residency laws. The application is deployed on virtual machines in a Infrastructure as a Service (IaaS) environment. Recently, the compliance team discovered that some user data from the European region was accidentally stored in a storage bucket located in the United States due to a misconfigured storage class. The company needs to immediately ensure that no further data breaches occur and that all future data storage actions comply with regional restrictions. The cloud architect proposes implementing a data loss prevention (DLP) solution, but the compliance team wants a more preventative approach. Which of the following is the BEST course of action to prevent this issue?
An organization policy can centrally deny creation of storage resources in unauthorized regions, preventing data placement outside approved regions.
Why this answer
An organization policy can centrally deny creation of storage resources in unauthorized regions across the entire organization, providing a preventative control that cannot be overridden by users.
A cloud architect is designing a data classification scheme for a SaaS application. Data must be classified based on sensitivity and regulatory requirements. Which of the following is the PRIMARY reason to classify data?
Classification guides security control selection.
Why this answer
The primary reason to classify data in a cloud environment is to enable the application of appropriate security controls based on data sensitivity. Classification drives the selection of encryption standards, access control policies, and data loss prevention (DLP) rules, ensuring that sensitive data receives stronger protection while lower-sensitivity data is handled with less restrictive measures. Without classification, security controls would be applied uniformly, leading to either over-protection of trivial data or under-protection of critical data.
Exam trap
ISC2 often tests the misconception that compliance is the primary reason for classification, but the trap is that compliance is a downstream requirement—classification is the foundational step to identify which data is subject to which regulation, and the primary goal is always to apply appropriate security controls based on sensitivity.
How to eliminate wrong answers
Option A is wrong because reducing storage costs by identifying obsolete data is a secondary benefit of data lifecycle management, not the primary driver for classification; classification focuses on sensitivity and regulatory requirements, not storage optimization. Option B is wrong because while compliance with a specific data protection regulation (e.g., GDPR, HIPAA) is a common use case, it is not the primary reason—classification must occur first to determine which data falls under which regulation, and the core purpose is to map sensitivity to controls, not to comply with a single regulation. Option C is wrong because improving data access speeds for high-priority data is a performance optimization concern, typically addressed through caching, CDN, or storage tiering, not through data classification; classification does not inherently affect access latency.
A cloud security architect is designing a DevSecOps pipeline for a multi-cloud environment. Which THREE practices should be included to ensure security is integrated early? (Select THREE)
Dependency scanning early prevents vulnerable libraries from being used.
Why this answer
Scanning dependencies for known vulnerabilities (e.g., using OWASP Dependency-Check or Snyk) in the CI pipeline catches vulnerable libraries before they are built into artifacts. This is a 'shift-left' practice that prevents insecure components from reaching later stages, aligning with DevSecOps principles of early security integration.
Exam trap
The CCSP exam often tests the concept of 'shift-left' by including late-stage security activities (like post-deployment scanning or production DAST) as distractors, tempting candidates who confuse 'security testing' with 'early integration'.
Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct order starts with creating the CMK, then enabling rotation, setting permissions, configuring application integration, and finally monitoring usage.
A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)
CloudWatch Logs can forward log events to a central account via subscription filters.
Why this answer
Amazon CloudWatch Logs supports cross-account subscription filters, which allow you to stream log data from log groups in multiple source accounts to a single destination (e.g., a Kinesis stream or Lambda function) in a central security account. This enables real-time aggregation of logs across accounts. Amazon S3 with cross-account bucket policies allows you to write logs from multiple accounts to a central S3 bucket by granting write permissions to source accounts via bucket policies.
Both services can aggregate logs across accounts, while AWS Config, Security Hub, and GuardDuty aggregate configuration items and security findings, not raw logs.
Exam trap
A common trap is mixing up services that aggregate raw logs (CloudWatch Logs, S3) with those that aggregate security findings or metadata (Security Hub, GuardDuty). Candidates may incorrectly select Security Hub or GuardDuty for log aggregation.
A cloud security architect is designing a key management strategy for a multi-cloud environment. They want to ensure that encryption keys are generated and stored on-premises but can be used by cloud services for encryption operations. Which two key management models meet these requirements? (Choose two.)
HYOK keeps keys on-premises and cloud services use them remotely.
Why this answer
BYOK allows generating keys on-premises and importing them into cloud KMS. HYOK keeps keys on-premises and cloud services call back to the on-premises HSM for operations. Both involve keys originating on-premises.
An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)
DLP can apply transforms to obscure sensitive data.
Why this answer
Cloud DLP services can scan data for sensitive patterns (like credit card numbers) and apply de-identification transforms to redact or mask data. They do not manage encryption keys or automate backup.
An API allows users to access their own profile data by providing a user ID. However, an attacker can change the user ID parameter to access another user's data. Which OWASP API Security vulnerability is this?
BOLA/IDOR allows unauthorized access to objects by manipulating identifiers.
Why this answer
Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), occurs when an API fails to verify that the user is authorized to access the object identified by the parameter.
A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?
Automated scanning can block insecure code from progressing.
Why this answer
Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.
Exam trap
ISC2 often tests the misconception that any security activity after deployment (like penetration testing or manual review) can serve as a preventive gate, when in fact only automated checks with failure conditions integrated into the pipeline can block insecure code before it reaches production.
How to eliminate wrong answers
Option B is wrong because running penetration testing after release does not prevent insecure code from being deployed; it only identifies vulnerabilities post-deployment, which violates the principle of shifting security left. Option C is wrong because dependency scanning only on a weekly basis introduces a significant delay, allowing vulnerable dependencies to be deployed before they are detected, whereas real-time scanning in the pipeline is needed. Option D is wrong because manual code review after deployment cannot block insecure code from reaching production; it is a reactive measure that does not serve as a pipeline gate.
A cloud security professional is designing network security for a VPC hosting a three-tier application. The database tier must be isolated from direct internet access and only accessible from the application tier. Which TWO AWS services can be used together to achieve this?
Security Groups can allow inbound traffic only from the application tier's security group.
Why this answer
Security Groups act as instance-level firewalls and can restrict traffic to the database tier from only the application tier. NACLs provide subnet-level stateless filtering as an additional layer.
Refer to the exhibit. A security engineer attaches this bucket policy to a cloud storage bucket. What does this policy accomplish?
It denies all requests to the bucket that are not using HTTPS. Correct. The policy explicitly denies requests that do not meet the secure transport condition.
Why this answer
The bucket policy uses a condition that checks for HTTPS usage (secure transport) and an explicit Deny effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit.
Exam trap
The trap is that candidates may confuse the HTTPS condition with IP-based or virtual network endpoint conditions, or mistakenly think the policy denies all requests because of the Deny effect, without reading the condition that limits the denial to non-HTTPS traffic.
How to eliminate wrong answers
Option A is wrong because the policy does not reference `aws:SourceVpce` or any VPC endpoint condition; it only checks `aws:SecureTransport`. Option C is wrong because the policy does not use `aws:SourceIp` or any IP address condition; it only checks the transport protocol. Option D is wrong because the policy does not deny all requests; it only denies requests where `aws:SecureTransport` is `false`, so HTTPS requests are still allowed.
Which of the following is a key requirement for data portability under the General Data Protection Regulation (GDPR)?
This is the core requirement of the right to data portability.
Why this answer
GDPR Article 20 gives data subjects the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. This includes the cloud provider providing export functionality.
In a cloud VPC, what is the difference between security groups and network ACLs (NACLs)?
Correct; this is the key difference.
Why this answer
Security groups are stateful and support allow rules only, while NACLs are stateless and support both allow and deny rules.
During a security audit, a cloud security architect discovers that a cloud storage bucket is configured with a bucket policy that allows read access to objects from any principal. What is the most likely risk?
Public read access allows anyone to download objects, leading to data exfiltration.
Why this answer
A storage bucket policy that allows read access from any principal effectively makes the bucket publicly readable, exposing data to anyone on the internet. This is a common misconfiguration leading to data breaches.
A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)
A VPN encrypts all traffic between on-premises and cloud.
A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?
SCCs are approved by the European Commission for legitimizing cross-border data transfers.
Why this answer
Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated.
Consent is not generally practical for all data subjects.
An API endpoint returns user profile details including email, phone, and address. The response includes fields that are not needed for the client application. Which OWASP API Security risk does this represent?
The API returns more data than needed, violating the principle of least disclosure.
Why this answer
Excessive data exposure occurs when an API returns more data than necessary, increasing the risk of sensitive information leakage.
A multinational corporation uses a hybrid cloud model with on-premises data centers and the AWS cloud. They have implemented a Cloud Access Security Broker (CASB) to enforce security policies. Recently, the security team noticed that users are accessing cloud applications from unusual geographic locations and downloading large volumes of data. The CASB logs show that the users authenticated using single sign-on (SSO) with valid credentials. The company has not enabled multi-factor authentication (MFA) for all users due to a previous pushback from the user community. The security team suspects a credential theft incident. What is the BEST course of action to mitigate the risk and respond to the potential incident?
This immediately stops the ongoing threat and enforces a stronger authentication method for future access.
Why this answer
Immediately revoking the suspicious sessions stops the potential attack, and requiring MFA re-authentication adds an essential layer of security to prevent further unauthorized access. Option B is insufficient because password changes alone do not address the lack of MFA, leaving accounts vulnerable to future credential theft. Option C is too disruptive and assumes all users are compromised, which is not indicated by the evidence.
Option D would severely disrupt business operations and does not enforce stronger authentication; it only bypasses SSO without addressing the root cause.
A healthcare organization stores patient records in a cloud object storage service. They require that all data be encrypted at rest using keys that they generate and manage on-premises, but they want to minimize operational overhead. Which encryption approach should they choose?
CSEK allows the customer to supply their own key for server-side encryption, balancing control and minimal overhead.
Why this answer
CSEK (customer-supplied encryption keys) allows the customer to provide their own encryption key for each operation, giving them full control while the cloud provider handles the encryption/decryption. This minimizes overhead compared to client-side encryption.
A multinational corporation collects personal data of EU residents and uses a cloud provider with data centers in the US and Asia. Under GDPR, which mechanism is appropriate for transferring data from the EU to the US data center, assuming no adequacy decision exists?
Correct. SCCs are a common transfer mechanism for data transfers to non-adequate countries.
Why this answer
Standard Contractual Clauses (SCCs) are a GDPR-approved mechanism for lawful data transfers to countries without an adequacy decision, provided the parties contractually commit to GDPR protections.
A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?
Service mesh provides encryption, identity, and policy enforcement at the application layer.
Why this answer
A service mesh with mutual TLS (mTLS) provides both encryption and identity-based authorization for inter-service communication. mTLS ensures that each service presents a valid certificate, proving its identity, and the mesh's control plane enforces fine-grained access policies (e.g., which services can call which endpoints). This directly meets the requirement for authorized, encrypted communication in a cloud-native microservices architecture.
Exam trap
A common misconception is that network-layer controls (like NSGs or VPC peering) are sufficient for service-to-service security, but the CCSP emphasizes that cloud-native architectures require identity-based authentication and encryption at the application or transport layer, which only a service mesh with mTLS provides.
How to eliminate wrong answers
Option A is wrong because network security groups (NSGs) operate at the network layer (IP/port) and cannot authenticate service identities or provide encryption; they only filter traffic based on source/destination IPs and ports, which is insufficient for service-level authorization in a dynamic microservices environment. Option C is wrong because VPC peering connects entire virtual networks and does not inherently enforce service-level authorization or mutual authentication; while encryption in transit can be enabled (e.g., IPsec), it lacks the fine-grained, identity-based access control that mTLS provides. Option D is wrong because an API gateway is designed for external traffic management and routing, not for internal service-to-service communication; routing all internal traffic through a single gateway creates a bottleneck, adds latency, and does not provide per-service mutual authentication or encryption at the transport layer.
A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?
CreateAccessKey is the correct API event for creating access keys.
Why this answer
The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.
Exam trap
ISC2 often tests the distinction between API actions that create versus modify versus delete resources, and the trap here is confusing 'CreateAccessKey' with 'UpdateAccessKey' because both involve access keys, but only 'CreateAccessKey' generates a new credential.
How to eliminate wrong answers
Option B (DeleteAccessKey) is wrong because it logs the deletion of an access key, not its creation, and would not alert on the described activity. Option C (CreateUser) is wrong because it logs the creation of a new IAM user, not the creation of an access key for an existing user. Option D (UpdateAccessKey) is wrong because it logs changes to an existing access key's status (e.g., Active/Inactive), not the creation of a new key.
A company is migrating healthcare data to the cloud and must comply with HIPAA. They need to sign a Business Associate Agreement (BAA) with the CSP. What key element must be included in the BAA?
The BAA must state how the CSP can use and disclose PHI.
Why this answer
A Business Associate Agreement (BAA) must specify the permitted uses and disclosures of protected health information (PHI) by the business associate, which is a fundamental requirement under HIPAA. Option A is wrong because while encryption requirements are often included in a BAA, they are not the key element; permitted uses are more essential. Option B is wrong because audit log retention period is an operational detail, not a core element.
Option C is wrong because breach notification timeframe is important but secondary to defining permitted uses and disclosures.
A cloud operations team has a process for making changes to production environments. Which change management practice is MOST important for reducing the risk of service disruption?
Staging testing catches issues early.
Why this answer
Testing all changes in a staging environment before production deployment is the most important practice because it validates the change's behavior, performance, and compatibility in an isolated replica of production. This directly reduces the risk of service disruption by catching configuration errors, resource conflicts, or software defects that could cause outages. Without staging validation, even well-intentioned changes can introduce silent failures or cascading issues.
Exam trap
ISC2 often tests the misconception that a documented rollback plan is sufficient to reduce risk, but the trap is that a rollback plan is reactive and cannot prevent the initial disruption, whereas staging testing proactively prevents the disruption from occurring in the first place.
How to eliminate wrong answers
Option A is wrong because allowing all changes to be made immediately with no approval process bypasses change advisory board (CAB) review and automated gating, leading to unvalidated modifications that frequently cause production incidents. Option C is wrong because notifying the security team after the change is completed provides no opportunity for pre-deployment security review or compensating controls, leaving vulnerabilities exploitable during the change window. Option D is wrong because ensuring a rollback plan is documented after the change is made defeats its purpose; a rollback plan must be prepared and tested before the change to be effective, as post-change documentation cannot reverse an ongoing disruption.
In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?
The customer manages the guest OS, including patching.
Why this answer
In IaaS, the customer is responsible for managing the operating system, applications, and data. The provider manages the physical infrastructure.
A financial services company deploys a containerized application on Amazon ECS with Fargate. The application needs to access an encrypted RDS database. The security policy mandates that database credentials must never be stored in the application code or configuration files and must be rotated automatically every 90 days. Which solution should the DevOps team implement to satisfy these requirements?
Secrets Manager supports rotation and integrates with ECS, meeting all requirements.
Why this answer
AWS Secrets Manager is the correct choice because it is designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 90 days) without storing them in code or configuration. By granting the ECS task role (via IAM) permission to access the secret, the Fargate task can retrieve the credentials at runtime using the AWS SDK or CLI, ensuring they are never hardcoded. This satisfies both the no-storage-in-code and automatic rotation requirements mandated by the security policy.
Exam trap
ISC2 often tests the distinction between AWS Secrets Manager and Systems Manager Parameter Store, where candidates mistakenly choose Parameter Store because it is cheaper, but they overlook that Secrets Manager provides native automatic rotation for RDS credentials, which is explicitly required by the policy.
How to eliminate wrong answers
Option B is wrong because passing encrypted credentials as environment variables in the task definition still embeds them in the container's environment, which violates the policy of never storing credentials in code or configuration files, and it does not provide automatic rotation. Option C is wrong because AWS Systems Manager Parameter Store (SecureString) can store encrypted secrets but does not natively support automatic rotation of RDS database credentials; it requires custom Lambda functions or additional services to implement rotation, making it less suitable for the 90-day rotation requirement. Option D is wrong because deploying Hashicorp Vault on EC2 adds operational overhead, requires managing the EC2 instances and Vault cluster, and does not integrate natively with ECS Fargate's task role for seamless credential retrieval; it also does not automatically rotate RDS credentials without additional configuration.
A cloud customer is negotiating a contract and wants to ensure they have the right to verify the cloud provider's security controls. Which contractual provision is most important?
This clause explicitly permits the customer to audit the provider's security controls.
Why this answer
A right to audit clause gives the customer the ability to review the provider's security measures, often through independent reports or on-site assessments.
A financial organization is migrating a critical application to a cloud environment. The application processes sensitive customer data and must comply with PCI DSS. The security architect proposes using serverless functions for the compute layer. Which security control is essential to protect the application from injection attacks?
Parameterized queries prevent injection by separating SQL code from user input.
Why this answer
Injection attacks (e.g., SQL injection) exploit untrusted input that is concatenated into database queries. Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is treated as data only, not executable code. This is the foundational control for preventing injection in serverless functions that interact with databases, as required by PCI DSS Requirement 6.5.1.
Exam trap
ISC2 often tests the misconception that a WAF is a universal injection defense, but in serverless architectures, injection can occur through non-HTTP triggers (e.g., S3 events, DynamoDB Streams) where a WAF has no visibility, making parameterized queries the essential control.
How to eliminate wrong answers
Option A is wrong because function-level logging provides audit trails for compliance and incident response, but does not prevent injection attacks; it only records events after the fact. Option C is wrong because encrypting data in transit (e.g., TLS) protects against eavesdropping and tampering during transmission, but does not address injection vulnerabilities within the application logic itself. Option D is wrong because a WAF can detect and block some injection patterns at the HTTP layer, but serverless functions often receive events from multiple sources (e.g., queues, storage triggers) that bypass the WAF, and WAFs cannot prevent injection in non-HTTP contexts or when input is already inside the function; parameterized queries are the definitive defense.
A security team wants to detect when the root user account is used in a cloud environment. Which service can generate an alert for this activity?
A threat detection service continuously monitors for malicious behavior, including root user activity, and can generate alerts directly.
Why this answer
A threat detection service is designed to continuously monitor for malicious or unauthorized behavior, including the use of the root user account. It uses machine learning and integrated threat intelligence to generate findings for such activities, which can then trigger alerts via event notification services. This makes it the correct choice for detecting root user usage.
Exam trap
The trap here is that candidates often confuse an activity logging service’s logging capability with alerting, assuming it can directly generate alerts, when in fact it only records events and requires integration with other services for notification.
How to eliminate wrong answers
Option A is wrong because AWS CloudTrail is a logging service that records API calls, but it does not natively generate alerts; it requires additional services like CloudWatch Alarms or EventBridge to create alerts for root user activity. Option B is wrong because AWS Config is a configuration management and compliance service that evaluates resource configurations against rules, not a threat detection service, and it cannot directly detect root user login events. Option C is wrong because AWS Security Hub aggregates findings from multiple services (like GuardDuty) and provides a centralized view, but it does not generate its own alerts for root user activity; it relies on other services to produce those findings.
A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?
Automated security testing as part of CI/CD ensures security checks are performed with every build.
Why this answer
Automated security testing in the CI/CD pipeline (Option C) is the correct practice because it embeds security checks—such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA)—directly into the build and deployment process. This ensures that vulnerabilities are detected and remediated early, aligning with the DevSecOps principle of 'shifting left' and enabling continuous security validation without slowing down development velocity.
Exam trap
ISC2 often tests the misconception that manual or periodic security activities (like annual pen tests or pre-release code reviews) are sufficient for DevSecOps, when the core requirement is continuous, automated security integration within the CI/CD pipeline itself.
How to eliminate wrong answers
Option A is wrong because security awareness training, while important for culture, is a people-focused activity that does not integrate automated, code-level security checks into the development lifecycle; it lacks the technical enforcement needed for continuous security in CI/CD. Option B is wrong because annual penetration testing is a point-in-time, manual assessment that occurs long after code is deployed, failing to provide the continuous, automated feedback required in a DevSecOps pipeline to catch vulnerabilities during development. Option D is wrong because manual code review before release is a gate-based, human-dependent process that introduces delays and inconsistency, and it does not scale or integrate with automated CI/CD workflows, whereas DevSecOps demands automated, frequent security validation.
Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?
SSRF allows an attacker to trick the server into making requests to internal resources like metadata endpoints.
Why this answer
Server-Side Request Forgery (SSRF) attacks can target cloud metadata endpoints to obtain IAM credentials.
A cloud architect is designing a disaster recovery (DR) solution for a critical application with a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 5 minutes. The application runs on virtual machines in a private cloud. The architect is considering using a colocation facility as the DR site. Which replication method will meet the RPO requirement?
Correct: Provides RPO of 5 minutes if snapshots are taken every 5 minutes.
Why this answer
Synchronous replication can achieve an RPO of zero, which surpasses the 5-minute requirement, but it may not be suitable for this scenario due to network latency or cost constraints over a WAN link to a colocation facility. Periodic snapshots every 5 minutes exactly match the RPO and are more practical for a private cloud to colocation DR setup, capturing the VM state at the required interval without the complexity or latency constraints of synchronous replication.
Exam trap
ISC2 often tests the misconception that synchronous replication is always the best choice for low RPO, but the trap here is that RPO is not the only constraint—RTO and network latency must also be considered, and periodic snapshots can meet a 5-minute RPO without the performance penalties of synchronous replication over a WAN link.
How to eliminate wrong answers
Option A is wrong because synchronous replication requires the primary and DR sites to have extremely low latency (typically <1-2 ms) and high bandwidth to avoid impacting application performance; over a colocation facility link, this is rarely achievable and would likely violate the RTO by causing application slowdowns. Option B is wrong because periodic snapshots every 15 minutes would allow up to 15 minutes of data loss, exceeding the 5-minute RPO requirement. Option D is wrong because asynchronous replication with a 10-minute delay means the DR site could be up to 10 minutes behind the primary, which exceeds the 5-minute RPO and does not guarantee recovery within the specified data loss window.
Which hypervisor technology is used to provide direct device access to a VM, improving performance and isolation for I/O operations?
IOMMU enables direct device assignment with secure isolation.
Why this answer
IOMMU (Input-Output Memory Management Unit) allows direct device assignment to VMs, enabling high performance and strong isolation by preventing the VM from accessing other devices' memory.
A financial services company is migrating a critical database to the cloud. The database contains columns with PII that must be encrypted. Performance is the highest priority, and the system must support queries on encrypted data. Which technique should be used?
Application-level encryption can be implemented with deterministic encryption algorithms that support equality queries on ciphertext, meeting the requirement for querying encrypted data with minimal performance overhead.
Why this answer
Application-level encryption is the correct technique because it can encrypt PII columns using deterministic encryption (e.g., AES-SIV) that allows equality queries on ciphertext without decryption, maintaining high performance with proper indexing. Tokenization is not encryption—it replaces data with tokens, and the original data is not encrypted. TDE decrypts data on access, so queries run on plaintext, not encrypted data.
Hashing is one-way and not reversible.
Exam trap
A common trap is thinking TDE supports queries on encrypted data, but TDE decrypts data during queries, failing the requirement. Another trap is confusing tokenization with encryption; tokenization does not encrypt the data itself.
How to eliminate wrong answers
Option A is wrong because hashing is a one-way function that does not support direct queries on the original data (e.g., range queries, pattern matching) and is not reversible for decryption. Option B is wrong because application-level encryption requires decrypting data in the application layer for each query, introducing significant latency and performance degradation, which conflicts with the performance priority. Option C is wrong because Transparent Data Encryption (TDE) encrypts data at rest but does not support queries on encrypted data; it decrypts data on-the-fly during reads, which adds overhead and still exposes plaintext in memory.
Practice CCSP by domain
Target a specific domain to shore up weak areas.