Certified Cloud Security Professional CCSP (CCSP) — Questions 226–300

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because daily snapshots provide an RPO of up to 24 hours, far exceeding the required 1-hour RPO, and restoring to a different region would likely exceed the 4-hour RTO due to the time needed to transfer and restore large snapshot data. Option B is wrong because synchronous replication to a secondary availability zone within the same region does not protect against a regional disaster; it only covers zone-level failures, and synchronous replication typically requires low-latency links, making it unsuitable for cross-region DR. Option D is wrong because asynchronous replication with a 1-hour lag exactly matches the RPO of 1 hour, but it does not guarantee the RTO of 4 hours; a secondary site with only replication and no pre-provisioned compute (cold standby) would require additional time to provision and start VMs, likely exceeding the RTO.

Why this answer

How to eliminate wrong answers

Option A is wrong because amortization is an accounting method that spreads the cost of an intangible asset over its useful life, not a financial model for paying for cloud resources as consumed. Option B is wrong because Capex (capital expenditure) involves upfront investment in physical assets like servers, which contradicts the goal of avoiding upfront costs. Option C is wrong because leasing typically involves fixed periodic payments for a defined term, not a consumption-based model where you pay only for what you use.

Why this answer

How to eliminate wrong answers

Option A is wrong because migrating all workloads to Azure does not address the underlying scaling issue—it merely shifts the problem to another cloud, which may also have its own quotas. Option B is wrong because a global load balancer can distribute traffic but does not resolve the AWS quota limit; the cluster will still fail to scale if it cannot launch new EC2 instances. Option C is wrong because multi-region deployment on AWS distributes load but does not increase the per-region EC2 instance quota; the cluster autoscaler would still be blocked by the same quota in each region.

Why this order

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because IPSec operates at the network layer (Layer 3) and is primarily used for establishing VPN tunnels between entire networks, not for encrypting individual application-level data transmissions between a customer's data center and a specific cloud service endpoint. Option C is wrong because SSH is designed for secure remote shell access and command execution, not for encrypting bulk data transmission between data centers and cloud services; it lacks the necessary protocol support for web-based API calls. Option D is wrong because RDP is a proprietary protocol for remote desktop connections to Windows machines, not a general-purpose encryption protocol for data in transit between on-premises and cloud environments.

Why this answer

How to eliminate wrong answers

Option A is wrong because Docker does not have a --no-root flag; the correct approach is to use the --user flag at runtime or the USER directive in the Dockerfile. Option C is wrong because securityContext.runAsNonRoot is a Kubernetes pod-level setting, not a Docker-native construct, and it only enforces a policy that the container must not run as root, but does not actually set a non-root user. Option D is wrong because --cap-drop=ALL removes all Linux capabilities but does not change the user identity; the container could still run as root with no capabilities, which violates the least privilege principle for user context.

Why this answer

How to eliminate wrong answers

Option B is wrong because it is a reactive measure that only removes unused privileges after 60 days, which does not prevent developers from initially assigning overly permissive roles; it also introduces a delay that could leave resources exposed. Option C is wrong because attaching a service control policy (SCP) at the organizational level that denies all actions unless explicitly allowed would require developers to create their own IAM policies, but SCPs alone do not prevent developers from creating overly permissive policies within the allowed actions—they lack the granular per-role cap that permission boundaries provide. Option D is wrong because restricting all users to read-only access and requiring subordinates to request specific privileges would severely impede development agility by forcing manual approval for every action, contradicting the goal of maintaining flexibility while enforcing least privilege.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because user training addresses human error but does not provide technical control over encrypted traffic, leaving the exfiltration vector open. Option B is wrong because blocking all encrypted traffic at the network perimeter would break legitimate business applications and is not a viable security design; it also violates the principle of least disruption. Option D is wrong because disabling TLS/SSL encryption for sensitive data transfers would expose data to interception and tampering, directly violating confidentiality and integrity requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because encrypting PII at rest protects data on disk but does not prevent developers from seeing plaintext when they query the database; decryption keys are typically available to authorized users, so the PII would still be exposed in query results. Option B is wrong because granting developers direct access to a copy of production data, even if it is a copy, still exposes actual PII and violates the principle of least privilege and data minimization for testing environments. Option D is wrong because tokenization with a one-way hash is irreversible and would break the ability to run meaningful queries that require relationships or pattern matching; tokenization for testing typically uses reversible tokens or format-preserving encryption, not a one-way hash.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating a manual process introduces operational overhead, risk of human error, and potential gaps in compliance, whereas cloud KMS supports automated custom rotation periods. Option B is wrong because requesting an exception ignores the auditor's explicit requirement and does not address the policy gap; default annual rotation is not sufficient per the 90-day mandate. Option D is wrong because disabling automatic rotation and rotating manually reintroduces the same risks as Option A and defeats the purpose of using a managed KMS service, which is designed to automate key lifecycle management.

Why this answer

How to eliminate wrong answers

Option A is wrong because server-side encryption with S3-managed keys (SSE-S3) uses keys managed entirely by the cloud provider, which does not satisfy the HIPAA requirement for the organization to manage the keys. Option B is wrong because server-side encryption with AWS KMS-managed keys (SSE-KMS) still delegates key management to the cloud provider's KMS service, even though the customer can control key policies; the provider retains potential access to the keys. Option C is wrong because client-side encryption with customer-supplied encryption keys (CSEKS) involves the organization managing keys on the client side, but it does not integrate with a hardware security module (HSM) for secure key storage and is not a cloud-native key management model; it also does not address the need for a dedicated HSM-based key management infrastructure that BYOK provides.

Why this answer

How to eliminate wrong answers

Option B is wrong because enforcing runtime policies is the function of a Runtime Application Self-Protection (RASP) tool or a cloud workload protection platform (CWPP), not an SCA tool which focuses on static analysis of dependencies. Option C is wrong because simulating attacks on running applications is the purpose of a dynamic application security testing (DAST) tool or a penetration testing framework, not SCA which does not execute code. Option D is wrong because identifying vulnerabilities in proprietary code is the domain of static application security testing (SAST) tools that analyze custom source code, whereas SCA specifically targets open-source and third-party components.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect with multiple VLANs does not inherently provide a DMZ or firewall inspection; it only extends the network, and PCI DSS requires a DMZ with a firewall to isolate cardholder data from untrusted networks, not just VLAN separation. Option C is wrong because VPC peering creates a direct, flat network connection between VPCs without any intermediate firewall or inspection point, violating PCI DSS Requirement 1.3 that mandates a DMZ and controlled traffic inspection. Option D is wrong because a single VPC with security groups alone cannot enforce network segmentation at the perimeter; security groups are stateful host-level filters, not network-layer firewalls, and PCI DSS requires a DMZ with a firewall appliance to separate cardholder data from untrusted networks.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because moving a resource group to another subscription does not change the provisioning state of existing VMs; the VM would remain in its current state (e.g., 'Succeeded') and continue running. Option B is wrong because a deallocated VM shows a 'ProvisioningState' of 'Succeeded' (since it was successfully provisioned) and a 'PowerState' of 'Deallocated'; the 'ProvisioningState' field specifically tracks the success or failure of the provisioning operation, not the power state. Option D is wrong because if a VM is deleted, it no longer appears in the list of VMs; the 'ProvisioningState' field is only relevant for existing resources, and a deleted VM would return a '404 Not Found' error or simply not be listed.

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy only grants s3:GetObject permission, not full administrative actions like s3:PutObject, s3:DeleteObject, or s3:* — it is read-only, not full admin. Option C is wrong because the policy uses Allow with an IpAddress condition, not a Deny statement; a Deny would require a separate Deny effect or a NotIpAddress condition to explicitly block the IP range. Option D is wrong because the policy includes a condition that restricts access to a specific IP range, so the bucket is not publicly accessible to any IP address; requests from outside the range are implicitly denied.

Why this answer

How to eliminate wrong answers

Option A is wrong because VPC endpoints do not inherently encrypt data in transit; encryption (e.g., TLS) is a separate configuration on the client side or service side, not a feature of the endpoint itself. Option C is wrong because VPC endpoints do not provide an additional layer of authentication; they rely on IAM policies and endpoint policies for access control, but the endpoint itself does not authenticate users or services beyond standard AWS authentication. Option D is wrong because VPC endpoints are used for private connectivity within a region or to a specific service, not for cross-region replication; cross-region replication is handled by services like S3 replication or RDS cross-region read replicas, not by VPC endpoints.

Why this answer

How to eliminate wrong answers

Option B is wrong because TLS encrypts data in transit, not at rest; the question specifically requires encryption at rest, so TLS does not address that requirement. Option E is wrong because while a key management system is important for managing encryption keys, it is not a direct control for encrypting data at rest or logging access; the question asks for controls that ensure PII is encrypted at rest and access is logged, and key management is a supporting process, not a primary control.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because verifying the absence of a public IP address checks network exposure, not the security posture of the AMI itself; an instance can be vulnerable regardless of public IP assignment. Option B is wrong because security groups control network traffic rules, not the underlying AMI's software vulnerabilities; they do not reveal if the AMI is outdated. Option C is wrong because AWS Systems Manager Patch Manager is used to patch running instances, not to check an AMI ID for known vulnerabilities; it operates on instances, not on AMI metadata or security bulletins.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because physically destroying hard drives is impractical for a multi-tenant database, as it would destroy data for all customers, not just former ones, and violates the principle of shared infrastructure. Option B is wrong because marking data as deleted and excluding it from query results only hides the data logically; the underlying data remains on the storage medium and could be recovered through forensic tools, failing the regulation's requirement for complete erasure. Option C is wrong because overwriting data with zeros using a secure delete tool is not feasible in a multi-tenant database environment where data is stored in shared blocks and may be subject to wear-leveling, snapshots, or copy-on-write mechanisms that prevent guaranteed overwrite of all copies.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because bearer tokens without additional protection are inherently vulnerable to replay and reuse, which is exactly the problem described in the scenario. Option B is wrong because short token expiration times reduce the window of opportunity but do not prevent token reuse across applications during the token's lifetime; an attacker can still replay the token within that window. Option D is wrong because audience restriction limits which application can accept the token based on the 'aud' claim, but it does not prevent the token from being reused across different applications if the attacker can present it to the intended audience; it controls scope, not binding to a specific session.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because server-side encryption with customer-provided keys (SSE-C) still involves the cloud provider performing the encryption/decryption on its servers, meaning the provider temporarily accesses the plaintext key and data during processing. Option C is wrong because Transport Layer Security (TLS) protects data in transit but does not protect data at rest; once the data reaches the cloud provider's servers, it is decrypted and stored in plaintext unless additional encryption is applied. Option D is wrong because a key management service (KMS) with auto-rotation typically stores the master key in the cloud provider's infrastructure, giving the provider potential access to the key material and thus the plaintext data.

Why this answer

How to eliminate wrong answers

Option A is wrong because multi-factor authentication (MFA) is an identity verification mechanism for user access, not a method to securely store or manage application-level database credentials. Option B is wrong because input validation prevents injection attacks (e.g., SQL injection) by sanitizing user-supplied data, but it does not address the storage or retrieval of hard-coded passwords. Option C is wrong because encryption at rest protects data stored on disk (e.g., database files) from unauthorized access, but it does not prevent the exposure of credentials hard-coded in application code or configuration.

Why this answer

How to eliminate wrong answers

Option B is wrong because API keys with IP whitelisting only authenticate the client application, not the user or the request context, and IP whitelisting can be bypassed via spoofing or compromised networks; it lacks granular authorization. Option C is wrong because basic authentication over HTTPS sends credentials (username/password) in every request, which is vulnerable to credential leakage if the client or server is compromised, and it does not support scoped authorization. Option D is wrong because shared secrets with HMAC provide message integrity and authentication but do not offer a standardized way to enforce fine-grained authorization scopes; managing shared secrets at scale is also a security risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because encrypting all files in the file-sharing application does not prevent sharing; encryption protects data at rest but does not control who can access or share the decrypted content. Option B is wrong because revoking access for all employees is an overly drastic measure that disrupts business operations and does not address the need for granular, policy-based control over specific data labels. Option C is wrong because training employees on data handling policies is a preventive administrative control, but it does not provide a technical enforcement mechanism to automatically block sharing of 'Confidential' documents in real time, leaving the organization reliant on human compliance.

Why this answer

How to eliminate wrong answers

Option A is wrong because performing daily full backups and retaining all for 7 years incurs excessive storage costs and is operationally inefficient, as it does not leverage incremental or differential backup strategies or tiered storage to reduce expenses. Option C is wrong because replicating all backups to a secondary region with snapshots kept for 7 years provides geographic redundancy but does not inherently optimize costs; it duplicates storage costs across regions without a tiered retention policy, leading to unnecessary expense. Option D is wrong because a grandfather-father-son rotation scheme is a tape-based backup rotation method that defines retention cycles (e.g., daily, weekly, monthly) but does not specify storage tier optimization or cold storage transition, and it may not meet a strict 7-year retention requirement without additional configuration; it is a legacy concept not directly tied to cloud cost optimization.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because data retention periods are typically defined in a separate data retention policy or contract clause, not the DPA; the DPA focuses on processing instructions and compliance, not specific retention schedules. Option B is wrong because encryption algorithms are a technical security measure specified in a Security Addendum or SLA, not the DPA; the DPA addresses legal and contractual roles, not cryptographic implementation details. Option C is wrong because backup and recovery procedures are operational controls documented in a Business Continuity Plan or Disaster Recovery Plan, not the DPA; the DPA governs data processing boundaries and liability, not specific recovery steps.

Why this answer

How to eliminate wrong answers

Option A is wrong because input validation to block malicious URLs is easily bypassed by attackers using URL encoding, redirects, or alternative representations of the metadata endpoint (e.g., decimal IP, DNS rebinding), and it does not address the root cause of the application making unauthorized outbound requests. Option C is wrong because a web application firewall (WAF) inspects incoming HTTP requests, not outgoing requests from the application; it cannot block the outbound SSRF traffic that originates from the application server itself. Option D is wrong because disabling IMDSv1 and requiring IMDSv2 tokens only protects the metadata service from unauthorized access via token-based authentication, but it does not prevent the application from making SSRF requests to other internal endpoints or external systems; the attacker could still exploit the application to make outbound requests to arbitrary targets.

Why this answer

How to eliminate wrong answers

Option B (Format-preserving encryption) is wrong because FPE produces ciphertext that preserves the original format but is still encrypted, meaning it does not eliminate the risk of exposing sensitive data if the encryption key is compromised, and it may not be suitable for all cloud environments where key management is complex. Option C (Dynamic data masking) is wrong because it only hides data from unauthorized users at query time without changing the underlying stored data, so it does not protect the data at rest and cannot prevent access to the original values if the masking rules are bypassed. Option D (Deterministic encryption) is wrong because while it allows exact match searches by always producing the same ciphertext for a given plaintext, it is vulnerable to frequency analysis attacks and does not provide the same level of security as tokenization, as the encrypted values are still mathematically reversible with the key.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because deleting only from the application layer while leaving data in archives violates the GDPR erasure principle, as the data remains accessible and recoverable, and the controller remains responsible for complete deletion. Option B is wrong because accepting the 90-day timeline and merely informing the data subject does not fulfill the contractual obligation of 30-day deletion, and GDPR does not allow the controller to unilaterally extend the erasure deadline based on the processor's limitations. Option D is wrong because rejecting the request as impractical ignores the controller's duty to use contractual leverage or technical measures (e.g., encryption key destruction) to meet the 30-day deadline, and GDPR does not permit refusal solely due to archive retention policies.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Condition block syntax is valid; the policy uses standard AWS IAM policy language with IpAddress condition key, and there is no syntax error indicated. Option B is wrong because there is no implicit deny overriding the explicit allow; the issue is that the condition does not match CloudFront's source IP, not a deny override. Option C is wrong because the policy explicitly allows the s3:GetObject action for the specified IP range, so the action is permitted when the condition is met.

Why this answer

How to eliminate wrong answers

Option A is wrong because allowing containers to run as root and relying solely on host-based intrusion detection (HIDS) does not prevent the violation of the least privilege principle; root access in containers can still lead to container breakout or privilege escalation before any alert is triggered. Option B is wrong because granting developers SSH access to host nodes undermines the security boundary, as it exposes the underlying host OS and potentially other containers, violating the principle of isolation and increasing the attack surface. Option D is wrong because maintaining two separate clusters (production and debugging) introduces operational complexity, configuration drift, and does not enforce least privilege in production; developers might still need root access in production for debugging, which the separate cluster does not address without additional controls.

Why this answer

How to eliminate wrong answers

Option A is wrong because deploying VMs with known vulnerabilities and relying on post-deployment vulnerability scans introduces a window of exposure where the VMs could be compromised before patches are applied, and it violates the principle of secure-by-default. Option B is wrong because the cloud provider is responsible for the hypervisor and infrastructure, not the OS image; asking them to provide a hardened OS image shifts responsibility that the customer must own under the shared responsibility model, and providers typically offer only generic base images. Option D is wrong because manually patching and removing services after deployment is error-prone, time-consuming, and leaves the VMs exposed during the time between deployment and remediation, which is especially risky in automated scaling scenarios.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because SSE-KMS uses AWS KMS keys, which are still managed by the cloud provider but offer additional control (e.g., key rotation policies, audit trails) and are not the default 'provider-managed' model; the question explicitly asks for keys managed by the cloud provider, and SSE-S3 is the simplest provider-managed option. Option C is wrong because Client-Side Encryption (CSE) requires the customer to encrypt data before uploading, meaning the customer manages the keys, not the cloud provider. Option D is wrong because SSE-C requires the customer to provide their own encryption keys, which the cloud provider uses temporarily but does not manage or store; the customer retains full key management responsibility.

Why this answer

How to eliminate wrong answers

Option B is wrong because regularly updating base images is a good security hygiene practice but does not prevent already-built vulnerable images from being deployed; it only reduces future vulnerabilities. Option D is wrong because network segmentation isolates production containers at the network layer to limit lateral movement, but it does not prevent a vulnerable image from being deployed in the first place. Option E is wrong because running containers as non-root users reduces the blast radius of a compromise but does not stop a vulnerable image from being deployed to production.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Basic authentication with API keys transmits the API key in plaintext (Base64-encoded) with every request, offering no cryptographic protection and requiring the API key to be stored and sent repeatedly, which increases exposure risk and lacks the token expiration and scoping capabilities of OAuth 2.0. Option C is wrong because SAML 2.0 is an XML-based federated identity protocol designed for browser-based single sign-on (SSO) with user authentication, not for direct API access from third-party applications; it is heavy, not optimized for RESTful APIs, and does not provide a simple client credentials flow. Option D is wrong because X.509 certificates are used for mutual TLS (mTLS) authentication, which is more complex to manage (certificate issuance, renewal, revocation) and is typically reserved for high-security environments or regulatory compliance, not as a standard mechanism for third-party API integrations where OAuth 2.0 is the industry norm.

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy does not specify a particular KMS key ARN or ID in the Condition block; it only requires the encryption type to be `aws:kms`, not a specific key. Option C is wrong because the policy does not deny unencrypted uploads outright—it denies uploads that do not have the `x-amz-server-side-encryption` header set to `aws:kms`, meaning an upload with no encryption header would be denied, but the statement is too broad because it implies any object without encryption is denied, which is true only if the header is absent; however, the policy also denies uploads with SSE-S3 or other encryption types, so the core issue is that the policy enforces SSE-KMS, not just 'no encryption'. Option D is wrong because the policy explicitly requires `aws:kms`, not `AES256` (SSE-S3), so objects encrypted with SSE-S3 would be denied.

Why this answer

How to eliminate wrong answers

Option A is wrong because cloud provider marketplace images are generic and may not meet the organization's specific security requirements; they can contain unnecessary software or default configurations that introduce vulnerabilities. Option B is wrong because host-based firewalls only control network traffic and do not detect or remove malware already present in the virtual machine image; they are a perimeter control, not a secure image creation practice. Option C is wrong because vulnerability scanning on running instances only identifies issues after deployment, leaving the initial image potentially compromised; it does not prevent the deployment of a malicious or unhardened image.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy explicitly restricts access to a specific IP range via the `aws:SourceIp` condition, so it does not allow s3:GetObject from any source. Option C is wrong because while the policy does restrict s3:GetObject to the specific bucket (via the Resource ARN), this is not a security concern—it is a correct scoping of permissions. Option D is wrong because the policy does not require authenticated users; it grants access to all users (Principal: "*") within the IP range, which is the actual security concern, not the lack of authentication restriction.

Why this answer

How to eliminate wrong answers

Option A is wrong because an SSL certificate on a web server only protects HTTP traffic (Layer 7) and does not secure other protocols or the entire data stream between the data center and VPC. Option B is wrong because implementing TLS for each application is application-specific, requires individual configuration per service, and does not provide a unified, network-level security boundary for all traffic between the two sites. Option D is wrong because Direct Connect without encryption leaves all data in transit unencrypted, exposing it to potential interception or tampering, and does not meet the requirement to protect data in transit.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling encryption entirely violates HIPAA's Security Rule requirement to implement encryption as an addressable implementation specification for ePHI at rest, and relying solely on access controls and auditing does not provide the necessary confidentiality protection. Option C is wrong because using the provider's default encryption with a BAA does not give the covered entity exclusive control over the keys; the provider still generates and stores the keys, which the auditor has identified as non-compliant. Option D is wrong because implementing a third-party KMS that stores keys in the cloud but is controlled by the customer still exposes the keys to the cloud provider's infrastructure, potentially allowing the provider to access them via hypervisor or storage layers, and introduces additional latency and cost without guaranteeing exclusive control.

Why this answer

How to eliminate wrong answers

Option A is wrong because truncation (showing only the last 4 digits) still leaves the full PAN stored elsewhere in the system, and the truncated value cannot be reversed to recover the original PAN, so it does not meet the requirement for a reversible surrogate value. Option B is wrong because dynamic data masking only hides data at query time from unauthorized users, but the original PAN remains stored in the database, so it does not remove the PAN from databases or reduce PCI DSS scope. Option D is wrong because symmetric encryption with a key stored in the database keeps the key co-located with the ciphertext, violating the principle of separation of duties and failing to reduce PCI DSS scope, as the encrypted data is still considered cardholder data under PCI DSS requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because Cloud KMS with software keys stores keys within the cloud provider's infrastructure, and the provider can potentially access them, especially if the keys are managed by the provider's software. Option B is wrong because Cloud KMS with hardware keys still stores keys in the cloud provider's HSM, meaning the provider has logical access and control over the key management process, even if the keys are in hardware. Option C is wrong because Cloud HSM, while providing dedicated hardware security modules, is still managed by the cloud provider, and the provider retains administrative access to the HSMs, which could allow them to access keys if they chose to.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because moving to client-side encryption with on-premises keys does not prevent bulk decryption if the attacker compromises the client application or the key management system; it also introduces key availability and latency issues for a cloud-based EHR system. Option C is wrong because restricting decryption to a specific IP range or VPC endpoint does not stop an attacker who uses compromised credentials from a legitimate IP or VPC; it only limits the network path, not the authorization of the request. Option D is wrong because automatic key rotation does not prevent an attacker from using compromised credentials to decrypt data with the current key; rotation only limits the window of exposure for future data, not the ability to decrypt already-encrypted records.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling logging and monitoring detects exposures after they occur but does not prevent recurrence; it is a detective control, not a preventive one. Option B is wrong because assigning a dedicated security team to manually approve all policy changes is impractical at scale, introduces delays, and still relies on human review which can miss subtle misconfigurations like a missing condition key in an S3 bucket policy. Option C is wrong because reviewing all existing bucket policies is a one-time remediation step that does not prevent future misconfigurations; it lacks the automated, continuous enforcement needed to stop recurrence.

Why this answer

How to eliminate wrong answers

Option A is wrong because ignoring a risk with high impact violates the fundamental risk management principle of proactive mitigation; waiting for materialization could lead to catastrophic data loss and regulatory penalties. Option B is wrong because accepting a risk solely due to low likelihood ignores the high impact; risk acceptance requires a formal decision based on risk appetite, not just probability, and low likelihood does not negate the need for controls when impact is severe. Option D is wrong because transferring the risk (e.g., via cyber insurance) does not eliminate the vulnerability; the organization remains liable for the breach and must still implement technical controls to meet compliance requirements like GDPR or HIPAA.

Why this answer

How to eliminate wrong answers

Option A is wrong because bucket policies can restrict deletion but do not prevent a user with administrative access (like the former employee) from modifying the policy or bypassing it, and lifecycle policies manage temporary files but do not prevent deletion. Option C is wrong because MFA Delete only requires multi-factor authentication for delete operations, but a former employee with administrative credentials could still authenticate and delete objects if they have MFA access, and it does not prevent folder deletion. Option D is wrong because disabling versioning and implementing a backup process would remove the ability to restore previous versions and does not prevent deletion; backups are reactive, not preventive.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because security groups act as a stateful virtual firewall that filters traffic based on rules (e.g., source IP, port), but they do not capture or mirror traffic for analysis; they only permit or deny packets. Option C is wrong because VPC peering connects two separate virtual networks, allowing traffic between them, but it does not provide visibility into traffic within a single virtual network. Option D is wrong because network access control lists (NACLs) are stateless packet filters applied at the subnet boundary, not a mechanism for copying or monitoring traffic flows between VMs inside the same subnet.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because completely disabling snapshot creation would break critical operational processes such as automated backups, point-in-time recovery, and disaster recovery, making it an impractical and overly restrictive control. Option C is wrong because database activity monitoring (DAM) only provides alerting after the fact; it does not prevent a rogue DBA from successfully exfiltrating data via unencrypted snapshots, as the DBA could still create and move the snapshot before the alert is acted upon. Option D is wrong because enabling automatic snapshot encryption does not prevent the DBA from creating a snapshot that is encrypted with a key they can access (e.g., the default AWS managed key), and restricting access to only the database service role does not stop a DBA with elevated IAM permissions from assuming that role or using their own permissions to copy the snapshot to another account.

Why this answer

How to eliminate wrong answers

Option A is wrong because IP address binding for session tokens is a server-side binding that can help prevent token reuse from different IPs, but it does not prevent the initial interception of the token over HTTP; the token can still be stolen in transit. Option C is wrong because switching from OAuth 2.0 to SAML does not change the transport security issue; both protocols can be used over HTTP and are equally vulnerable to interception if HTTPS is not enforced. Option D is wrong because shortening the session token expiration time reduces the window of opportunity for an attacker to use a stolen token, but it does not prevent the token from being intercepted in the first place over an HTTP connection.