Certified Cloud Security Professional CCSP (CCSP) — Questions 301–375

Restricting backend ingress to the API gateway's identity ensures that only the gateway can forward requests. This can be done with security groups, network ACLs, or IAM-based authentication depending on the cloud provider. It directly prevents clients from bypassing the gateway, because direct calls from other sources are denied at the network or identity layer.

Customer-managed keys in a cloud KMS allow the administrator to configure automatic rotation with a custom schedule, such as every 90 days. This meets the requirement for controlled rotation. The administrator retains control over the key lifecycle while benefiting from server-side encryption.

Bucket ACLs grant permissions directly to individual grantees, so an overly permissive ACL exposes objects to AllUsers or AuthenticatedUsers regardless of bucket policy. This directly explains the public accessibility observed, making the ACL the likely misconfiguration.

AWS Systems Manager Run Command executes a memory acquisition script directly on the running EC2 instance, preserving volatile memory contents. This avoids rebooting or stopping the instance, which would destroy the RAM evidence needed for forensic analysis.

SOAR platforms integrate security tools and execute predefined playbooks automatically, triggering containment, enrichment and notification actions when alerts fire. This orchestration and automation directly satisfies the stem's requirement to accelerate incident response beyond manual analyst triage.

Cryptographic signing by the build system establishes provenance, and an admission controller that verifies signatures before allowing pod creation enforces the policy at deploy time. Together they ensure only trusted images run in production, satisfying both the signing and admission requirements.

Hybrid cloud spans on-premises and provider networks, so inconsistent firewall rules create gaps between environments. Uniform network security policies enforce one traffic-filtering baseline across both sides, directly satisfying the stem's demand for a consistent security posture.

GDPR Article 28 requires the controller to authorise sub-processors and be notified of intended changes, so a provider engaging a third party without notification breaches the sub-processor authorisation requirement, regardless of security or breach-notification controls.

Data lifecycle management automates retention by applying policies that expire or delete objects once the legal retention period ends. This directly enforces the specified retention duration, unlike backup, classification or encryption, which address availability, sensitivity and confidentiality rather than time-bound disposal.

Spot instances (also called spot VMs or preemptible VMs) let a consumer bid on a provider's unused capacity at steep discounts, and the provider can reclaim that capacity with short notice, often around two minutes. Stateless, interruption-tolerant batch work such as video transcoding is the canonical fit, and the reclaimed capacity directly explains the lowest-cost requirement in this scenario.

Replication must be granted explicit permission to encrypt with the customer-managed key held in the secondary region's KMS; without that authorisation, cross-region writes fail because the destination key cannot be used. This satisfies the stem's constraint that replicated data be encrypted under customer-managed keys stored in the secondary region.

Cloud DLP API inspects and classifies data at rest, using built-in infoType detectors to identify SSN patterns within warehouse tables, satisfying the requirement to detect and classify stored sensitive data. Unlike encryption or access controls, it performs content-level discovery, matching the stem's classification constraint directly.

Data leaving direct control removes the customer's ability to enforce physical and logical safeguards, while shared infrastructure introduces multi-tenancy risks such as side-channel exposure and noisy-neighbour contention. These are inherent to cloud migration, satisfying the stem's focus on risks arising from the provider's model rather than contractual or operational controls.

Rapid elasticity describes capabilities that appear unlimited and can be scaled out and back in quickly, while measured service means resource usage is monitored, controlled, and reported transparently to both provider and consumer. Both appear in the standard set of essential cloud characteristics. They distinguish cloud from fixed hosting because capacity flexes with demand and consumption is metered for billing and governance.

With the service running and network path verified, the remaining likely cause is a misconfigured or failing forwarder. Inspecting its configuration and recent log files reveals errors such as changed credentials, wrong destination, or buffer failures.

Immutable infrastructure replaces running instances rather than patching them in place, so configuration drift and persistent compromise are eliminated on each deployment. This satisfies the runtime security requirement by ensuring every instance starts from a known, verified image.

The service mesh's built-in mTLS issues and rotates workload certificates, authenticating service identities via SPIFFE-style identities without application code changes. This satisfies the stem's requirement to enforce mutual TLS and verify service identities across all inter-service communication automatically.

HIPAA directly regulates protected health information held by covered entities and their business associates, imposing privacy, security and breach-notification duties. It therefore governs this patient-data migration, unlike broader frameworks such as GDPR or PCI DSS that address different data categories.

Masking replaces detected credit card values with a placeholder character, such as a hash or asterisk, so the sensitive digits are irreversibly removed from the log records while the surrounding analytics fields remain intact and queryable.

Correct. Isolation reduces impact of a key compromise.

HSM-backed KMS implementations are designed so that key material never leaves the HSM in plaintext, even for administrators. FIPS validation provides assurance that the cryptographic module enforces this boundary. This directly answers the auditor's concern about an insider exporting keys, because administrative rights do not translate into the ability to extract raw key bytes.

The log records an AuthorizeSecurityGroupIngress action opening port 22 to 0.0.0.0/0, exposing SSH on the instance to the entire internet. That unrestricted inbound rule is the immediate risk, enabling brute-force or exploitation attempts from any source.

Scanning images before pushing to the registry blocks vulnerable artefacts from ever entering the pipeline, satisfying the shift-left constraint. Vulnerabilities are detected at build time, so compromised layers never reach Amazon ECR or production. This pre-push gate enforces image security earlier than post-registry scanning, which only detects flaws after distribution.

A 99.99% availability guarantee permits 0.01% annual downtime. Applied to 525,600 minutes per year, that equals 52.56 minutes, the exact threshold the SLA specifies. Any outage exceeding this figure breaches the agreement, making it the maximum allowable downtime the stem requests.

BOLA arises when the API validates that a user is authenticated but omits an ownership check on the requested object. Substituting another user's ID in the request succeeds because authorisation is enforced at the endpoint level, not per object.

Cloud storage access logs capture per-request records for object operations, including the GET method, requester identity, source IP address and timestamp. This granular detail satisfies the requirement to identify who downloaded the data and from where during the exfiltration investigation.

A service level agreement states the measurable service levels the provider commits to, such as a monthly uptime percentage, and defines the remedies, typically service credits, when those levels are missed. It is the contractual artifact that turns an availability expectation into an enforceable commitment. Auditors can examine the stated targets and the remedy terms directly, which is exactly what the agency needs.

Active-passive replicates to another region for failover.

Differential privacy injects calibrated statistical noise into query outputs, so aggregated results no longer disclose individual transactions. This directly closes the inference path the penetration test exploited while still permitting analytical queries, satisfying the requirement to preserve analytics.

Managed Redis services often support encryption at rest and IAM-based authentication, which issues temporary credentials tied to the workload's identity. This eliminates static passwords in code and satisfies both encryption and credential management requirements. It aligns with cloud security best practices for secretless authentication and data protection.

SaaS delivers a complete provider-managed application stack, so the customer manages only its data and user access while the provider handles infrastructure, operating system and application. This exactly satisfies the stem's stated division of responsibility.

Workload identity federation lets the build service exchange its own identity for short-lived cloud credentials, eliminating stored long-lived keys. If a credential is compromised, it expires quickly and is scoped to the build workload. This reduces the blast radius of credential theft while preserving automated deployments, directly addressing the audit finding.

Sensitive data stays private while anonymised analytics run publicly, so the split architecture's core risk is drift between the two domains. Consistent security policies plus secure connectivity (VPN or dedicated link) prevent the public environment becoming a weaker path into private data, satisfying the hybrid model's boundary constraint.

A Type 1 hypervisor runs directly on bare metal, so each tenant VM's isolation boundary is enforced by the hypervisor kernel itself rather than a general-purpose host OS. That removes the host operating system's larger attack surface, satisfying the requirement for the most robust isolation between tenants.

Under GDPR Article 12(3), the controller must respond to a data subject access request without undue delay and in any event within one month of receipt, extendable by two further months for complex requests. The processor's role does not alter this controller deadline.

AWS Security Hub aggregates findings across accounts and Regions via a single pane, then forwards them to third-party SIEMs such as Splunk through native integrations or EventBridge. This satisfies the requirement to centralise findings from multiple AWS accounts before onward delivery.

Some cloud providers offer secure deletion APIs that perform cryptographic erasure on volumes or objects. This directly addresses the need for irrecoverable deletion and can be integrated into the application's deletion workflow. It is an effective measure for secure data disposal in the cloud.

Broad network access is one of the five essential NIST SP 800-145 characteristics: capabilities are available over the network through standard mechanisms that promote use by heterogeneous thin or thick client platforms, satisfying the definition's accessibility requirement.

Hybrid cloud combines distinct on-premises and public cloud environments bound by technology enabling data and application portability. This lets the organisation retain sensitive data on its private infrastructure while running less sensitive workloads cost-effectively in the public cloud, satisfying both control and scalability needs.

This design places the application in two independent regions, replicates the database asynchronously to bound latency impact, replicates object storage across regions, and uses DNS failover to shift traffic. It directly addresses a full region outage while keeping operational complexity manageable compared with active-active multi-master database designs.

Cross-region replication to a second EU region keeps data within the European Union while providing geographic redundancy, satisfying both the residency mandate and the disaster recovery requirement. Replicating to a non-EU region would breach residency, so the paired EU region is the decisive constraint.

SAST analyses source code, bytecode or binaries without executing the application, so it runs on every commit inside the CI/CD pipeline and flags injection, insecure deserialisation and similar flaws before build or deployment. This satisfies the constraint of early analysis without executing the application.

The limitation of liability clause contractually caps the provider's financial exposure for a breach, directly defining the extent of its liability. Other contract terms, such as the shared responsibility model, allocate duties but do not quantify the provider's monetary responsibility.

A public cloud is owned and operated by a third-party provider and offers rapid elasticity and broad geographic reach. The retailer can deploy the inventory system without owning infrastructure and scale during seasonal promotions, which directly satisfies the stated requirements for global access, elasticity, and outsourced management.

SaaS delivers a complete application managed by the provider, including the runtime and infrastructure, and users access it through a browser or thin client. This matches the scenario where the business consumes email and productivity software without managing any underlying layers, leaving only limited user-specific configuration to the customer.

GitGuardian is a dedicated secrets-detection platform that scans repositories and commit history for exposed credentials such as AWS access keys. It directly matches the stem's requirement for a tool specifically designed to find secrets in code repositories.

Node affinity rules in the pod spec use node labels as match expressions, so only nodes carrying the required hardened baseline label will be eligible. This directly enforces the placement requirement on GKE without needing a custom scheduler, and it can be made mandatory with requiredDuringSchedulingIgnoredDuringExecution.

Regular expressions can identify structured ePHI such as Social Security numbers, medical record numbers, and dates of birth in text files. This is a common technique in data discovery tools to flag potential ePHI. It is effective for known patterns but may produce false positives, so it is often combined with other methods.

Correct. The customer must ensure ePHI is encrypted at rest, as they control the data.

Allowing GetObject to anonymous users makes all objects publicly readable.

Classification labels only deliver value when enforced; integrating them with DLP and access control policies ensures restricted and confidential data is actually protected in the cloud. Labels alone, without enforcement, leave sensitive data exposed regardless of how accurately it is categorised.

An SBOM enumerates every direct and transitive component with versions and identifiers, so when a new CVE such as Log4Shell is published you can query the inventory and immediately identify affected builds rather than scanning or guessing. This enables rapid identification of vulnerable components.

Correct. Deletion is the final stage of the lifecycle.

Restricted classification fits because the stem specifies severe organisational damage plus strict regulatory obligations, which demand the highest confidentiality controls, encryption, and least-privilege access. Unlike Confidential, Restricted typically enforces need-to-know access, formal authorisation, and audit logging, satisfying the financial regulator's requirements.

The --privileged flag grants the container all Linux capabilities and unrestricted device access, disabling the namespace and cgroup barriers that normally confine it. An attacker inside can then mount the host filesystem or manipulate kernel interfaces to escape onto the host.

Broken Object Level Authorization occurs when an API trusts a client-supplied object identifier without verifying the caller owns it, so manipulating a parameter exposes another user's data. It is the OWASP API Security Top 1 risk.

Cryptographic signing lets the admission controller verify image provenance against a trusted key before deployment, rejecting tampered or unsigned artefacts. This directly enforces the stem's constraint that only signed images reach production, binding image integrity to the registry-to-runtime supply chain.

SAST scans source code without executing it, detecting vulnerabilities such as injection flaws during coding. Automating it in the CI pipeline satisfies the SSDLC constraint of finding defects early, before deployment, when remediation is cheapest and least disruptive.

Containers bundle the application with its libraries and dependencies into a single image, so the same artefact runs identically on any container host. This dependency packaging, rather than hypervisor abstraction, delivers the portability across cloud environments.

A dedicated secrets management service centralises storage, access control and auditing, removing hard-coded credentials from source and configuration. It enforces least-privilege retrieval and enables automated rotation, directly satisfying the best-practice requirement for controlling secret sprawl across cloud applications.

Data classification and mapping identifies what personal data exists, where it resides and how it flows, which is the prerequisite for every subsequent GDPR control. Without this inventory, lawful basis, retention and subject-rights obligations cannot be scoped or evidenced.

A centralized policy engine can evaluate identity attributes, resource tags, and contextual factors like time of day to make fine-grained authorization decisions. It provides consistent, auditable enforcement across the bucket and scales as identities and resources grow. This directly satisfies the need for explicit business-need-based, condition-aware access control.

Rotation is a key lifecycle phase.

TLS 1.2 provides authenticated, encrypted transport with modern cipher suites, satisfying the minimum encryption standard for data in transit between on-premises systems and cloud services. Earlier versions such as TLS 1.0 and 1.1 are deprecated due to known vulnerabilities, so TLS 1.2 is the baseline best practice.

RASP instruments the running application and inspects calls as they execute, so it can terminate a malicious query mid-flight. Blocking an SQL injection attempt during execution demonstrates this in-process interception, which distinguishes RASP from perimeter controls such as a web application firewall.

A WAF inspects incoming HTTP requests and can block or sanitize malicious payloads that target vulnerabilities like SQL injection and XSS. Deploying a WAF at the API gateway provides a centralized enforcement point for all microservices, reducing the need to implement protections in each service. It can be configured with rule sets such as OWASP Core Rule Set to detect and mitigate common attacks, thus protecting the APIs from exploitation.

The description of tests and results details the auditor's procedures and findings across the review period, evidencing whether controls operated effectively throughout. This satisfies the requirement to assess control effectiveness over a period, unlike a point-in-time opinion or management assertion alone.

VPC integration allows Lambda to access resources in a VPC.

Collecting via API or provider tooling bypasses physical seizure, so forensic soundness hinges on verifiable integrity and an unbroken chain of custody. Provider-mediated exports may omit metadata, alter timestamps, or lack cryptographic hashes, undermining admissibility under eDiscovery rules. Microsoft Entra ID access logs and immutable audit trails help evidence who accessed the export.

NIST SP 800-145 defines the private cloud as infrastructure provisioned for exclusive use by a single organisation comprising multiple consumers, whether business units or employees. Exclusivity plus multi-consumer tenancy within one organisation is the precise axis separating it from public, community and hybrid models.

Rehosting redeploys the legacy application onto cloud infrastructure without modifying its code, directly satisfying the no-code-changes constraint. Unlike refactoring or replatforming, which require code or configuration alterations, lift and shift preserves the existing artefact, making it the fastest migration path.

CSPM continuously assesses cloud resource configurations against benchmarks such as CIS and identifies misconfigurations, drift and compliance gaps. This directly satisfies the stem's focus on the primary purpose: evaluating and hardening the security posture of provisioned cloud resources, rather than runtime workload protection or identity governance.

Spot instances sell unused provider capacity at a steep discount and can be reclaimed with a short notice period, which matches the requirement to minimize cost using spare capacity. Because the transcoding jobs checkpoint every 30 seconds and can resume on another host, interruption is tolerable. IaaS also gives the team full control over the runtime needed to install and tune the transcoding software.

Digital signatures provide integrity, authentication, and non-repudiation. If the private key is securely held by the log producer, any modification to the log file will invalidate the signature, and the signer cannot deny having signed it. This directly meets the requirements for tamper detection and non-repudiation.

A data portability clause contractually obliges the provider to return customer data in a structured, commonly used, machine-readable format on termination, enabling migration to another provider. This satisfies the stem's requirement for export in a usable format.