Certified Cloud Security Professional CCSP (CCSP) — Questions 376–450

Object versioning in cloud storage (e.g., AWS S3) retains both current and previous versions of objects. A lifecycle policy that immediately expires both current and noncurrent versions upon user deletion ensures that all copies of the data are permanently removed, satisfying the 30-day compliance requirement. Without explicitly targeting previous versions, the default lifecycle policy only deletes current versions, leaving older versions accessible indefinitely.

Client-side encryption ensures that data is encrypted before it leaves the organization's control, and the customer retains sole possession of the encryption key. This satisfies the compliance requirement that the cloud provider never has access to the key, as the provider only stores the encrypted ciphertext. In contrast, server-side encryption options (like SSE-S3) involve the provider managing or having access to the key material.

Storing session state in encrypted server-side storage ensures that session data is never exposed to the client, mitigating risks of tampering, replay, or information disclosure. Encryption at rest (e.g., using AES-256) protects against unauthorized access to the storage layer, while server-side control prevents client-side manipulation of session tokens or data. This approach aligns with the principle of least privilege and is recommended by OWASP for secure session management in cloud applications.

Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

The Decrypt call failed because the key policy attached to the cloud key management service (KMS) key explicitly denied the cloud identity making the request. Audit logs show the error code 'AccessDenied' or 'UnauthorizedOperation', which indicates that the key policy did not grant the necessary decrypt permission to the principal. Even if the key is enabled and the ciphertext is valid, a restrictive key policy will block the operation.

The S3 bucket policy includes an Allow statement that grants s3:GetObject access only to the VPC endpoint vpc-12345678, using the aws:SourceVpce condition key. This means only requests originating from that specific VPC endpoint are permitted to retrieve objects. The Deny statement with a NotPrincipal condition is redundant or misconfigured, but the Allow statement's condition effectively restricts access to the VPC endpoint, making option A correct.

TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Creating tags based on classification levels, applying them automatically using DLP or policy, and using IAM conditions to enforce access based on tags are key steps.

RASP operates within the application runtime to detect and block attacks in real-time. Blocking an SQL injection attempt during execution is a typical RASP function.

KICS (Keeping Infrastructure as Code Secure) is an open-source tool specifically designed to scan IaC files for security misconfigurations, vulnerabilities, and compliance violations before deployment. It supports multiple IaC formats including Terraform, Kubernetes manifests, Dockerfiles, and CloudFormation, making it a strong choice for a DevSecOps pipeline targeting Kubernetes-based applications.

The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Automated SAST during code commit is a key component of a secure software development lifecycle (SSDLC) in a cloud environment because it enables early detection of vulnerabilities (e.g., injection flaws, buffer overflows) by scanning source code as it is committed to the repository. This shift-left approach integrates security directly into the CI/CD pipeline, preventing flaws from progressing to later stages where remediation is more costly and complex.

Lambda functions must be attached to a VPC using VPC integration to access resources inside a private subnet, such as an RDS database. Without VPC integration, the Lambda function runs in an AWS-managed VPC and cannot reach resources in the customer’s VPC. This configuration requires the Lambda function to be associated with the same VPC, subnets, and security groups as the RDS instance.

Cloud environments often lack physical access, and data may be distributed across multiple servers and jurisdictions. Ensuring the collection methodology preserves integrity and metadata is challenging without provider cooperation.

NIST SP 800-145 defines private cloud as provisioned for exclusive use by a single organization with multiple consumers (e.g., business units).

Rehost (lift and shift) moves applications to the cloud without any code changes. Options A (Refactor), B (Repurchase), and C (Replatform) all involve modifying the application or acquiring a new solution, which contradicts the requirement of no code changes.

CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

A data portability clause ensures the customer has the right to export data in a machine-readable format, often with provider assistance.

Network ACLs (stateless) and Security Groups (stateful) can be applied at subnet and instance level to control traffic.

Serverless functions can be configured with VPC integration to access resources inside a VPC via private IP.

The policy statement includes "Principal": "*" and "Effect": "Allow" without any condition restricting access, which grants public read access to all objects in the cloud storage bucket. This violates the principle of least privilege and exposes sensitive data to anyone on the internet, making it a critical security misconfiguration.

eDiscovery in the cloud poses jurisdictional conflicts, data access limitations, and data preservation challenges.

Incident response in cloud requires adaptation to shared responsibility and ephemeral resources.

The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Hardcoded database credentials in application code create a severe security risk because they are exposed in version control, logs, and static analysis. Using a secrets management service (e.g., AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) allows credentials to be stored securely, rotated automatically, and accessed at runtime via API calls, eliminating the need to embed secrets in code. This aligns with the principle of least privilege and secure credential management in cloud application security.

WAF integration protects against injection and other web attacks, while rate limiting prevents abuse by limiting requests per client.

SOC 2 Type II reports evaluate the effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6-12 months).

The log shows a large volume of outbound data transfers from a cloud storage bucket to an external IP address, which is characteristic of data exfiltration. In cloud environments, such activity often involves unauthorized copying of sensitive data to an attacker-controlled location, bypassing normal access controls.

The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Modifying the security group to deny all outbound traffic is the fastest way to cut communication between the compromised EC2 instance and the external C2 server without destroying volatile data. Security groups act as a stateful virtual firewall at the instance level, and changing the outbound rule to deny all traffic immediately blocks any existing or new connections to the C2 IP. This preserves the instance's runtime state for later forensic analysis while containing the threat.

Serverless functions like AWS Lambda are directly invoked by event payloads, and without input validation and sanitization, an attacker can inject malicious code (e.g., SQL, NoSQL, OS commands) that the function executes. This is the most effective mitigation as it addresses the root cause at the application layer, regardless of any perimeter controls.

SCA (Software Composition Analysis) is specifically designed to identify known vulnerabilities in third-party libraries and dependencies by comparing their versions against public vulnerability databases like the National Vulnerability Database (NVD) or OWASP Dependency-Check. SAST (Static Application Security Testing) analyzes custom source code for security flaws but cannot inspect external libraries that are often pulled in via package managers (e.g., npm, Maven, pip). Including SCA ensures that the organization addresses supply chain risks, which is a primary goal in DevSecOps pipelines.

Resource pooling is correct because NIST SP 800-145 defines it as one of the five essential characteristics, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. This enables economies of scale and location independence, as the customer generally has no control or knowledge over the exact location of the provided resources.

Object lock (retention mode) enforces a retention period on objects, preventing deletion or modification. Versioning allows recovery in case of accidental deletion of lock or creation of delete markers. Together they provide a comprehensive retention solution, though object lock alone may suffice if versioning is not required.

AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Kubernetes is an open-source container orchestration platform that enables portability of containerized applications across different cloud providers and on-premises environments.

Wildcard permissions can lead to privilege escalation and data exfiltration. DoS and cost overruns are possible but not direct risks of over-permissive IAM; logging impact is indirect.

Dependency confusion occurs when a package manager (e.g., npm, pip, Maven) resolves a package name to a public registry instead of a private one, because the public registry has a package with the same or similar name. In this scenario, the developer accidentally published a package with a similar name to the public registry, so internal builds may fetch that malicious public package instead of the intended internal one, leading to arbitrary code execution in the build pipeline.

The cloud data lifecycle is: Create, Store, Use, Share, Archive, Destroy. After sharing, data is typically archived for long-term retention before eventual destruction.

PaaS abstracts away middleware, runtime, and OS management, allowing developers to focus on code rather than patching or configuring these layers. This reduces operational overhead compared to IaaS, where you must manage the OS, runtime, and middleware yourself. Option E is correct because PaaS platforms typically include built-in load balancing, auto-scaling, and redundancy features, whereas in IaaS you must architect and implement these capabilities manually.

First assess, then set up target, replicate, transfer data, and finally test and cut over.

NIST SP 800-53 provides security and privacy controls; each family addresses a specific domain.

Hold Your Own Key (HYOK) allows the customer to retain the key in their on-premises HSM, and the cloud service must call back to the on-premises HSM for each encryption/decryption operation. This provides maximum control but introduces latency.

Start with policy definition, then deploy, configure, test, and finally full rollout.

Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Data at rest (C) must be encrypted because compliance frameworks like PCI DSS, HIPAA, and GDPR require protection of stored data against unauthorized access. Encryption at rest typically uses AES-256 or similar algorithms to secure data on disks, databases, or object storage, ensuring that even if physical media is compromised, the data remains unreadable.

Cross-region read replicas with synchronous replication can provide a standby database in another region with an RPO of effectively zero (synchronous replication ensures no data loss) and an RTO measured in minutes (promote the replica to primary), meeting both the 4-hour RTO and 1-hour RPO. Using a customer-managed key (CMK) replicated to the DR region satisfies the compliance requirement for customer-managed encryption keys, as the key can be controlled and audited independently of the cloud provider.

The Data Processing Agreement (DPA) outlines data handling obligations, including deletion requirements. SLAs cover performance, BAAs are for HIPAA, and MOUs are high-level.

Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Reviewing a SOC 2 Type II report provides an independent assessment of a provider's controls over time. On-site audits are costly and time-consuming. Vulnerability scanning and penetration test reports may not be available or comprehensive.

HIPAA requires encryption of ePHI at rest in all data stores. The S3 bucket containing unencrypted database backups and the CloudWatch Logs that may contain patient data both need encryption enabled via KMS to meet compliance. AWS RDS encryption protects the live database, but backups and logs are separate storage locations that must also be encrypted.

A cloud security posture management (CSPM) tool provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from various security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

SOC 2 Type II, ISO 27001, and CSA STAR are well-known cloud security certifications/audit reports. FedRAMP is US government specific, and PCI DSS is for payment card industry, not a general cloud security audit.

Rapid elasticity is the ability to scale quickly.

Regular expression matching (option D) is the most appropriate technique because credit card numbers follow well-defined, predictable patterns (e.g., 16 digits, specific starting digits for each issuer like 4 for Visa, 5 for MasterCard, and Luhn algorithm validation). This allows the DLP solution to detect credit card numbers in outbound traffic without requiring a pre-populated list or prior training, making it ideal for real-time monitoring of unknown or new card numbers.

On-demand self-service is one of the essential characteristics defined by NIST, enabling users to provision resources automatically.

Using secrets management tools like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault to dynamically retrieve credentials at runtime avoids hardcoding them in code.

Kubernetes admission controllers can enforce policies such as rejecting pods that use unsigned images, ensuring only images with verified signatures are deployed. This directly addresses the requirement to deploy only approved images by validating image integrity at admission time.

Meets both the RTO of 4 hours and RPO of 1 hour by maintaining a warm standby in another region with continuous data replication. Continuous replication ensures data is synchronized with minimal lag (well under 1 hour), and the warm standby VM can be activated quickly to meet the 4-hour RTO. This approach balances cost and recovery speed, as a warm standby is partially running and can be promoted to production faster than a cold standby.

Cosign is a tool for signing container images and verifying signatures, ensuring the image has not been tampered with.

The operating expenditure (Opex) model allows a company to pay for cloud resources on a consumption basis without any upfront capital investment. This aligns with the goal of reducing capital expenditures (Capex) by shifting costs to variable, pay-as-you-go operational expenses.

The root cause is a hard AWS service quota for EC2 instances, which prevents the cluster autoscaler from launching new nodes. Requesting a quota increase removes this bottleneck, while pod priority classes ensure that critical microservices are scheduled first when resources are constrained, preventing latency spikes during flash sales.

First isolate, then capture forensics, terminate, analyze, and finally remediate and restore.

The EDPB guidelines mandate that a processor may only process personal data on documented instructions from the controller. This ensures the processor’s actions are strictly controlled and auditable, preventing unauthorized processing that could violate GDPR Article 28(3)(a).

A site-to-site VPN (IPsec VPN) provides an encrypted tunnel over the public internet between on-premises and cloud VPC. For higher throughput and reliability, dedicated connections like AWS Direct Connect or Azure ExpressRoute can be used with optional encryption. However, the question specifies 'encrypted tunnel', which VPN provides.

Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.