Knowledge + Practice

Certified Cloud Security Professional CCSP (CCSP) — Questions 526–600

964 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 13

526

MCQhard

An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?

A.Elasticity

B.Multitenancy isolation

C.Reversibility

D.Portability

AnswerD

Using open standards like Kubernetes and containers enhances workload portability across clouds.

Why this answer

Portability focuses on avoiding vendor lock-in by using open standards and technologies like Kubernetes and Docker that can run across different cloud providers.

Full explanation →

527

MCQmedium

A cloud customer is migrating a legacy application to a cloud platform. The application currently runs on physical servers and uses local storage. The migration plan involves rehosting the application on virtual machines (VMs) in the cloud. The security team wants to ensure that the VMs are properly hardened before deployment. During the migration testing, the team discovers that the base image used for the VMs contains several unnecessary services and default credentials. The team is concerned that these vulnerabilities could be exploited. The cloud provider offers a shared responsibility model where the customer is responsible for securing the OS. Which of the following is the BEST course of action to address this issue?

A.Deploy the VMs and run vulnerability scans to identify and fix issues after deployment

B.Ask the cloud provider to provide a hardened OS image

C.Create a custom golden image with necessary hardening and approved software only

D.Deploy the VMs and manually apply security patches and remove services after deployment

AnswerC

Ensures consistent and secure base.

Why this answer

Creating a custom golden image allows the customer to enforce a hardened baseline that removes unnecessary services, disables default credentials, and includes only approved software before any VM is deployed. This aligns with the shared responsibility model, where the customer controls OS-level security, and prevents vulnerabilities from ever reaching production. Pre-hardening the image is more secure and efficient than fixing issues post-deployment, as it eliminates the window of exposure during initial boot and configuration.

Exam trap

The trap here is that candidates may choose Option D (manual patching after deployment) because it seems practical, but they overlook that this approach leaves VMs vulnerable during the initial boot and configuration phase, whereas pre-hardening the image eliminates that risk entirely.

How to eliminate wrong answers

Option A is wrong because deploying VMs with known vulnerabilities and relying on post-deployment vulnerability scans introduces a window of exposure where the VMs could be compromised before patches are applied, and it violates the principle of secure-by-default. Option B is wrong because the cloud provider is responsible for the hypervisor and infrastructure, not the OS image; asking them to provide a hardened OS image shifts responsibility that the customer must own under the shared responsibility model, and providers typically offer only generic base images. Option D is wrong because manually patching and removing services after deployment is error-prone, time-consuming, and leaves the VMs exposed during the time between deployment and remediation, which is especially risky in automated scaling scenarios.

Full explanation →

528

MCQeasy

Under the General Data Protection Regulation (GDPR), if a cloud service provider (acting as a data processor) suffers a personal data breach, what is the provider's obligation regarding notification?

A.The processor must notify the data controller without undue delay upon becoming aware of the breach.

B.The processor must notify the supervisory authority within 72 hours.

C.The processor does not have any notification obligation under GDPR.

D.The processor must notify the affected data subjects directly within 72 hours.

AnswerA

This is correct per GDPR Article 33(2).

Why this answer

GDPR Article 33 requires the data processor to notify the data controller without undue delay after becoming aware of a breach. The controller then has 72 hours to notify the supervisory authority.

Full explanation →

529

MCQhard

A company needs to export data from a cloud service in a machine-readable format to comply with a data subject's right to data portability under GDPR. Which format is most appropriate?

A.HTML

B.PDF

C.CSV (Comma-Separated Values)

D.JPEG

AnswerC

CSV is machine-readable and commonly used for data portability.

Why this answer

GDPR requires data to be provided in a structured, commonly used, machine-readable format; CSV is widely accepted.

Full explanation →

530

MCQhard

An organization must implement encryption for data in transit between its on-premises data center and a cloud provider. The data is sensitive and the organization requires a dedicated, encrypted tunnel. Which solution should be used?

A.Client-side encryption before upload

B.TLS 1.2 for API communication

C.VPN connection

D.Cloud KMS for key exchange

AnswerC

VPN creates an encrypted tunnel over the internet for secure connectivity.

Why this answer

A VPN (Virtual Private Network) provides a dedicated, encrypted tunnel for hybrid connectivity between on-premises and cloud.

Full explanation →

531

MCQhard

In a Kubernetes environment, a security team wants to enforce that only images signed by a trusted authority can be deployed. Which component can be used to validate image signatures at admission time?

A.Network policies

B.Admission controller (e.g., OPA Gatekeeper)

C.RBAC policies

D.Secrets management with Vault

AnswerB

Admission controllers can enforce policies such as requiring signed images.

Why this answer

Admission controllers like OPA Gatekeeper or Kyverno can verify image signatures before a pod is created. RBAC controls access, not image validity; network policies manage traffic; secrets management handles credentials.

Full explanation →

532

MCQhard

A cloud security team needs to implement a logging strategy that captures user activity, API calls, and resource changes across multiple cloud services. The logs must be tamper-proof and retained for at least one year. Which combination of actions best meets these requirements?

A.Stream all logs to a Security Information and Event Management (SIEM) system and retain raw logs for one year on standard storage.

B.Enable logging for all services, encrypt logs at rest, and store them in a centralized log management system.

C.Use separate logging accounts for each cloud service and retain logs in their native format.

D.Centralize logs into a dedicated log archive account with write-once-read-many (WORM) storage and enable anomaly detection alerts.

AnswerD

Centralizing logs in a dedicated account with WORM storage ensures immutability and meets the tamper-proof requirement; anomaly detection provides monitoring.

Why this answer

Centralizing logs into a dedicated log archive account with WORM (write-once-read-many) storage ensures tamper-proof retention for at least one year, and enabling anomaly detection alerts provides real-time security monitoring. Option A is incorrect because while streaming to a SIEM is good practice, retaining raw logs on standard storage does not guarantee immutability; logs could be modified or deleted. Option B is incorrect because encrypting logs at rest only protects confidentiality, not integrity; a centralized log management system without WORM may allow tampering.

Option C is incorrect because using separate logging accounts for each service creates silos, increases management complexity, and does not inherently provide tamper-proof storage; logs could be altered within individual accounts.

Full explanation →

533

MCQeasy

Which cloud service model provides the consumer with the ability to deploy and run custom applications using the provider's programming languages, libraries, and tools, but does not allow management of the underlying infrastructure?

A.PaaS

B.SaaS

C.IaaS

D.CaaS

AnswerA

PaaS allows deployment of custom applications without managing infrastructure.

Why this answer

PaaS provides a platform for customers to develop and run applications without managing the underlying infrastructure. IaaS provides infrastructure, SaaS provides software.

Full explanation →

534

MCQmedium

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

A.Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.

B.Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.

C.Use a serverless function to copy logs from each account's storage container to the central storage container.

D.Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.

AnswerD

This leverages the organization management service to centrally manage audit trails, simplifying deployment and ensuring all logs are delivered to a single location.

Why this answer

For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.

Full explanation →

535

MCQmedium

A company is evaluating the risk of using a single cloud provider for all critical workloads. Which risk is most directly associated with this scenario?

A.Inherent risk of shared infrastructure

B.Third-party risk

C.Concentration risk

D.Control effectiveness risk

AnswerC

Correct. Concentration risk is the risk of relying on a single provider.

Why this answer

Concentration risk refers to the over-reliance on a single provider, leading to high impact if that provider suffers an outage or data loss.

Full explanation →

536

MCQeasy

A cloud operations team is setting up a new virtual network in the cloud. They need to segment traffic between different tiers of an application (web, application, database). Which security control should they implement?

A.Network access control lists and security groups

B.Intrusion detection system

C.Data loss prevention

D.Web application firewall

AnswerA

NACLs and security groups filter traffic based on rules, enabling segmentation.

Why this answer

Network access control lists (NACLs) and security groups are the correct controls for segmenting traffic between application tiers. NACLs act as stateless firewalls at the subnet level, while security groups provide stateful filtering at the instance level. Together they allow or deny traffic based on rules, effectively isolating web, application, and database tiers.

Intrusion detection systems (IDS) monitor for malicious activity but do not control traffic flow. Data loss prevention (DLP) focuses on preventing data exfiltration. Web application firewalls (WAF) protect against web-specific attacks at layer 7 and are not designed for general network segmentation.

Full explanation →

537

Multi-Selecthard

Which THREE of the following are key components of a cloud data governance framework?

Select 3 answers

A.Data retention policies

B.Data access controls

C.Data masking

D.Data classification

E.Data encryption at rest

AnswersA, B, D

Policies define how long data is kept and when to delete.

Why this answer

Data retention policies are a key component of a cloud data governance framework because they define the lifecycle of data, specifying how long data must be kept and when it should be securely deleted. This ensures compliance with legal, regulatory, and business requirements, such as GDPR or HIPAA, and prevents unnecessary storage costs and security risks from outdated data.

Exam trap

ISC2 often tests the distinction between governance components (policies, roles, processes) and technical security controls (encryption, masking), leading candidates to mistakenly select data masking or encryption as governance framework elements.

Full explanation →

538

MCQmedium

A cloud operations team is implementing a logging strategy for their hybrid cloud environment. They need to ensure that logs from on-premises systems are collected and stored in a centralized cloud logging service with low latency. Which configuration is most appropriate?

A.Transfer logs via email attachments

B.Use a VPN connection and forward syslog directly to the cloud endpoint

C.Configure on-premises systems to send logs via syslog over the internet with TLS

D.Use a cloud logging agent on-premises that buffers and sends logs via HTTPS

AnswerB

A dedicated VPN reduces latency and ensures consistent connectivity.

Why this answer

The most appropriate. Using a VPN connection provides a dedicated, secure, and low-latency path for forwarding syslog from on-premises to the cloud logging endpoint. This meets the requirement for low latency and centralized collection.

Option A (email attachments) is unsuitable for real-time logging. Option C (syslog over the internet with TLS) may suffer from internet latency and potential unreliability. Option D (cloud logging agent on-premises that buffers and sends via HTTPS) can introduce buffering delays and is less direct than syslog forwarding.

Full explanation →

539

Multi-Selectmedium

A cloud security architect is designing access controls for a cloud storage bucket that contains sensitive customer data. The architect needs to implement a solution that provides granular, time-limited access to specific objects for external auditors. Which TWO methods should the architect consider? (Select TWO.)

Select 2 answers

A.Bucket policies

B.Signed URLs

C.IAM roles

D.Access keys

E.Pre-signed URLs

AnswersB, E

Signed URLs are similar to pre-signed URLs, providing time-limited access.

Why this answer

Pre-signed URLs and signed URLs are both used to grant time-limited access to specific objects without requiring the user to have cloud credentials. IAM roles provide broader access. Bucket policies provide blanket access.

Access keys are long-lived.

Full explanation →

540

MCQhard

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

A.The container was run with the --privileged flag

B.The container was run with a default Seccomp profile

C.The container was run with a read-only root filesystem

D.The container was run with an AppArmor profile in enforce mode

AnswerA

The --privileged flag gives the container almost unrestricted access to the host kernel, enabling easy escape.

Why this answer

Running a container with the --privileged flag grants all capabilities and disables most security mechanisms, making container escape trivial. Other options like Seccomp or AppArmor would restrict actions, and read-only root filesystem would prevent writes, but the privileged mode is the most direct enabler.

Full explanation →

541

MCQmedium

A company has a disaster recovery (DR) plan that includes failing over to a secondary cloud region. The plan was tested six months ago and worked, but since then significant infrastructure changes have been made. Which of the following should the company do to ensure the DR plan remains effective?

A.Wait until the next annual DR test to verify the changes.

B.Automate the entire failover process to eliminate human error.

C.Update the DR documentation to reflect the changes and assume the plan still works.

D.Conduct a tabletop exercise now, followed by a partial failover test of critical applications.

AnswerD

Tabletop and partial failover identify gaps quickly and are less disruptive.

Why this answer

Conducting a tabletop exercise followed by a partial failover test of critical applications allows the company to validate the DR plan against recent infrastructure changes without full disruption. This approach provides immediate feedback and reduces risk. Option A is wrong because waiting for the next annual test leaves the organization exposed to potential failures for an extended period.

Option B is wrong while automation can reduce human error, it does not replace the need to validate the plan's effectiveness after changes. Option C is wrong because updating documentation without testing assumes the plan still works, which is unreliable after significant changes.

Full explanation →

542

Multi-Selectmedium

Which THREE of the following are common risk treatment options in cloud risk management?

Select 3 answers

A.Ignorance

B.Transference

C.Avoidance

D.Deletion

E.Acceptance

AnswersB, C, E

Transference is correct because it moves the financial impact of a risk to a third party, a widely accepted treatment in cloud risk management.

Why this answer

Avoidance (Option C), transference (Option B), and acceptance (Option E) are all standard and common risk treatment options under NIST SP 800-37 and ISO 31000. Ignorance and deletion are not recognized risk treatment options.

Exam trap

Avoidance is a valid risk treatment and should not be dismissed; acceptance is also not the same as ignoring risk.

Full explanation →

543

Multi-Selecteasy

A company is adopting a multi-cloud strategy to reduce concentration risk. Which two benefits are directly associated with this approach? (Choose two.)

Select 2 answers

A.Reduced vendor lock-in

B.Increased resilience

C.Simplified compliance management

D.Unified security controls

E.Lower network latency

AnswersA, B

Multiple providers reduce dependency on one vendor.

Why this answer

Multi-cloud reduces dependency on a single provider (concentration risk) and allows flexibility to use best-of-breed services.

Full explanation →

544

MCQeasy

A cloud customer is decommissioning a storage service that contains sensitive data. The cloud provider offers several data destruction options. Which method provides the HIGHEST assurance that data is irrecoverable?

A.Degaussing the storage media

B.Physical shredding of the storage drives

C.Multiple overwrite passes with zeros and ones

D.Cryptographic erasure of encryption keys

AnswerB

Guarantees data is irrecoverable.

Why this answer

(Physical shredding of the storage drives) is correct because physical destruction renders the storage media completely unusable and data irrecoverable by any means. Option A (Degaussing) is only effective on magnetic media and not on SSDs, and some residual data may remain. Option C (Multiple overwrite passes) can leave residual data due to physical characteristics of the media and is not guaranteed to be irrecoverable.

Option D (Cryptographic erasure) is effective only if the encryption keys are securely destroyed, but if the keys are compromised or not fully erased, data may still be recoverable. Therefore, physical shredding provides the highest assurance.

Exam trap

The trap is that many candidates assume cryptographic erasure is the best method because it is fast and effective, but the question asks for the HIGHEST assurance. The highest assurance is always physical destruction, even though it may not be the most practical for all scenarios.

Full explanation →

545

MCQmedium

A financial services company stores customer transaction data in a cloud object storage service. The security team wants to ensure that if a malicious insider gains access to the storage bucket, they cannot read the data. Which encryption approach provides the highest level of protection against the cloud provider and insiders?

A.Client-side encryption using a customer-managed key

B.Server-side encryption with AES-256 (SSE-S3)

C.Server-side encryption with customer-provided keys (SSE-C)

D.Transport Layer Security (TLS) for data in transit

AnswerA

Client-side encryption ensures data is encrypted before upload; the cloud never sees plaintext, and keys are managed by the customer.

Why this answer

Client-side encryption means data is encrypted before it is uploaded to the cloud. The cloud provider never has access to the encryption keys, and data remains encrypted at rest and in transit (if TLS is also used). This protects against both the cloud provider and insiders with administrative access to the storage service.

Full explanation →

546

MCQmedium

A cloud-native application is deployed on AWS. During a security review, the team discovers that if an attacker can send a crafted request to the application, the application will make an HTTP request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Which vulnerability is being exploited?

A.SQL injection

B.Cross-site scripting (XSS)

C.Insecure deserialization

D.Server-Side Request Forgery (SSRF)

AnswerD

SSRF allows an attacker to induce the server to make requests to internal resources, such as the cloud metadata endpoint.

Why this answer

Server-Side Request Forgery (SSRF) targeting the cloud metadata endpoint can expose IAM credentials. The IP 169.254.169.254 is the link-local address for cloud metadata services.

Full explanation →

547

MCQhard

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This attack is known as:

A.Dependency confusion

B.Supply chain poisoning

C.Man-in-the-middle attack

D.Typosquatting

AnswerA

Dependency confusion exploits package resolution order to install a malicious public package.

Why this answer

Dependency confusion occurs when an attacker publishes a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as an internal, private package. When a cloud application's build system is configured to fetch dependencies from both public and private registries, the package manager may prioritize the public registry (often due to higher version numbers or default resolution order), causing the malicious package to be installed instead of the legitimate internal one. This exploits the trust in package resolution algorithms and is a specific form of supply chain attack targeting cloud-native CI/CD pipelines.

Exam trap

The CCSP exam often tests the distinction between dependency confusion and typosquatting, so the trap here is that candidates confuse the exact-name-match technique (dependency confusion) with the misspelling-based technique (typosquatting), leading them to incorrectly select typosquatting when the question explicitly states 'same name.'

How to eliminate wrong answers

Option B (Supply chain poisoning) is wrong because it is a broader category encompassing any attack that compromises a component in the software supply chain (e.g., injecting malicious code into a legitimate package, compromising build servers), whereas dependency confusion is a specific technique that relies on name collision and registry priority. Option C (Man-in-the-middle attack) is wrong because it involves intercepting or altering communications between two parties (e.g., between a client and a registry), not exploiting package name resolution logic; dependency confusion does not require network interception. Option D (Typosquatting) is wrong because it relies on registering a package with a name that is a common misspelling or typo of a popular package (e.g., 'requrests' instead of 'requests'), whereas dependency confusion uses the exact same name as an internal package, not a misspelling.

Full explanation →

548

MCQeasy

A company uses a cloud storage service to store sensitive customer data. They need to ensure that data is encrypted at rest using keys managed by the cloud provider. Which encryption model should they use?

A.Server-Side Encryption with Provider-Managed Keys (SSE-PMK)

B.Server-Side Encryption with Customer-Managed Keys (SSE-CMK)

C.Client-Side Encryption (CSE)

D.Server-Side Encryption with Customer-Provided Keys (SSE-CPK)

AnswerA

This model uses keys managed entirely by the cloud provider, which matches the requirement.

Why this answer

The requirement specifies that the cloud provider manages the encryption keys. Server-Side Encryption with Provider-Managed Keys (SSE-PMK) uses keys that are entirely managed by the cloud provider for encrypting data at rest, with each object encrypted by a unique key that is itself encrypted by a regularly rotated master key. This aligns perfectly with the scenario where the customer does not want to manage keys.

Exam trap

ISC2 often tests the distinction between 'provider-managed keys' (SSE-PMK) and 'customer-managed keys' (SSE-CMK or SSE-CPK), where candidates mistakenly choose SSE-CMK because it offers more control, but the question explicitly requires keys managed solely by the provider.

How to eliminate wrong answers

Option B is wrong because SSE-KMS uses AWS KMS keys, which are still managed by the cloud provider but offer additional control (e.g., key rotation policies, audit trails) and are not the default 'provider-managed' model; the question explicitly asks for keys managed by the cloud provider, and SSE-S3 is the simplest provider-managed option. Option C is wrong because Client-Side Encryption (CSE) requires the customer to encrypt data before uploading, meaning the customer manages the keys, not the cloud provider. Option D is wrong because SSE-C requires the customer to provide their own encryption keys, which the cloud provider uses temporarily but does not manage or store; the customer retains full key management responsibility.

Full explanation →

549

MCQmedium

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

A.Implement image vulnerability scanning in the CI/CD pipeline

B.Regularly update base images

C.Only allow signed images to be pulled from a trusted registry

D.Use network segmentation to isolate production containers

E.Run all containers as non-root users

AnswerA, C

Scanning can fail the build if critical vulnerabilities are found, preventing deployment.

Why this answer

Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Exam trap

ISC2 often tests the distinction between preventive controls (like scanning and signing) that stop vulnerable images from being deployed versus mitigative controls (like network segmentation or non-root users) that reduce the impact after deployment, leading candidates to select the latter as a substitute for prevention.

How to eliminate wrong answers

Option B is wrong because regularly updating base images is a good security hygiene practice but does not prevent already-built vulnerable images from being deployed; it only reduces future vulnerabilities. Option D is wrong because network segmentation isolates production containers at the network layer to limit lateral movement, but it does not prevent a vulnerable image from being deployed in the first place. Option E is wrong because running containers as non-root users reduces the blast radius of a compromise but does not stop a vulnerable image from being deployed to production.

Full explanation →

550

MCQeasy

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

A.The customer.

B.The regulatory authority.

C.The cloud service provider.

D.A third-party auditor.

AnswerC

The CSP manages the hypervisor as part of the shared responsibility model.

Why this answer

In a cloud shared responsibility model, the hypervisor is part of the underlying infrastructure that the cloud service provider (CSP) manages. The CSP is responsible for patching the hypervisor because it controls the virtualization layer that separates tenant workloads. Customers are responsible only for securing their guest operating systems and applications, not the hypervisor itself.

Exam trap

ISC2 often tests the misconception that customers are responsible for all software patching, but the trap here is that the hypervisor is part of the CSP's infrastructure layer, not the customer's virtual environment.

How to eliminate wrong answers

Option A is wrong because the customer does not have administrative access to the hypervisor; patching it would violate the separation of duties and could compromise multi-tenant isolation. Option B is wrong because regulatory authorities (e.g., GDPR, PCI DSS) set compliance requirements but do not perform patching operations. Option D is wrong because a third-party auditor assesses compliance and security controls but has no operational responsibility for applying patches.

Full explanation →

551

MCQmedium

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

A.Basic authentication with API keys

B.OAuth 2.0 with client credentials

C.SAML 2.0

D.X.509 certificates

AnswerB

OAuth 2.0 client credentials grant is a standard for machine-to-machine API authentication.

Why this answer

OAuth 2.0 with the client credentials grant is the most appropriate mechanism for machine-to-machine API access because it allows the API to authenticate the third-party application itself (the client) using a client ID and client secret, without involving end-user credentials. This grant type is specifically designed for server-to-server integrations where the client is acting on its own behalf, providing a secure, token-based approach that avoids sharing long-lived secrets directly with each API call.

Exam trap

ISC2 often tests the distinction between authentication mechanisms by presenting SAML 2.0 as a plausible answer for API security, but the trap here is that SAML is designed for browser-based user authentication and federation, not for direct API access from third-party applications, leading candidates to confuse identity federation with API authorization.

How to eliminate wrong answers

Option A is wrong because Basic authentication with API keys transmits the API key in plaintext (Base64-encoded) with every request, offering no cryptographic protection and requiring the API key to be stored and sent repeatedly, which increases exposure risk and lacks the token expiration and scoping capabilities of OAuth 2.0. Option C is wrong because SAML 2.0 is an XML-based federated identity protocol designed for browser-based single sign-on (SSO) with user authentication, not for direct API access from third-party applications; it is heavy, not optimized for RESTful APIs, and does not provide a simple client credentials flow. Option D is wrong because X.509 certificates are used for mutual TLS (mTLS) authentication, which is more complex to manage (certificate issuance, renewal, revocation) and is typically reserved for high-security environments or regulatory compliance, not as a standard mechanism for third-party API integrations where OAuth 2.0 is the industry norm.

Full explanation →

552

MCQhard

An organization is evaluating cloud service providers and notices that one provider's SLA offers 99.99% availability for a specific service, while another offers 99.9%. If the service costs $100,000 per month, what is the maximum allowable downtime per month for the 99.99% SLA?

A.8.64 minutes

B.43.2 minutes

C.2.16 minutes

D.4.32 minutes

AnswerD

Correct. 99.99% = 0.01% downtime = 4.32 minutes per month.

Why this answer

99.99% availability allows 0.01% downtime. Monthly downtime = 30 days * 24 hours * 60 minutes = 43,200 minutes. 0.01% of 43,200 = 4.32 minutes.

Full explanation →

553

MCQeasy

What does this bucket policy enforce?

A.The policy denies all uploads unless they use SSE-KMS.

B.All objects must be encrypted with a specific KMS key.

C.Any object uploaded without encryption will be denied.

D.Only objects encrypted with SSE-S3 are allowed.

AnswerA

The Deny effect applies when the encryption is not 'aws:kms'.

Why this answer

The bucket policy uses a Condition block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which means any upload must include the `x-amz-server-side-encryption` header with the value `aws:kms`. If the header is missing or set to any other value (e.g., `AES256` for SSE-S3), the request is denied. This enforces that all uploads use SSE-KMS, but does not require a specific KMS key unless a `kms:EncryptionContext` or `kms:KeyArn` condition is also present.

Exam trap

ISC2 often tests the distinction between 'requiring SSE-KMS' and 'requiring a specific KMS key'—candidates mistakenly think that any SSE-KMS condition implies a specific key, but the policy only checks the encryption type, not the key ARN.

How to eliminate wrong answers

Option B is wrong because the policy does not specify a particular KMS key ARN or ID in the Condition block; it only requires the encryption type to be `aws:kms`, not a specific key. Option C is wrong because the policy does not deny unencrypted uploads outright—it denies uploads that do not have the `x-amz-server-side-encryption` header set to `aws:kms`, meaning an upload with no encryption header would be denied, but the statement is too broad because it implies any object without encryption is denied, which is true only if the header is absent; however, the policy also denies uploads with SSE-S3 or other encryption types, so the core issue is that the policy enforces SSE-KMS, not just 'no encryption'. Option D is wrong because the policy explicitly requires `aws:kms`, not `AES256` (SSE-S3), so objects encrypted with SSE-S3 would be denied.

Full explanation →

554

Multi-Selecthard

A company is adopting a microservices architecture on Kubernetes and needs to ensure least privilege for pod-to-pod communication. Which THREE controls should be implemented?

Select 3 answers

A.Service accounts with minimal permissions

B.Network policies to allow only necessary traffic between pods

C.RBAC to limit what pods can do within the cluster

D.Pod Security Admission to enforce that containers run as root

E.Horizontal Pod Autoscaler

AnswersA, B, C

Correct: Service accounts are used for pod identity; minimal permissions reduce risk.

Why this answer

Network policies restrict pod communication, RBAC controls pod permissions, and service accounts with limited permissions enforce least privilege.

Full explanation →

555

MCQmedium

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

A.Use a golden image from the cloud provider's marketplace.

B.Rely on host-based firewalls to protect instances.

C.Perform vulnerability scanning on running instances only.

D.Create a hardened baseline image and store it in a secure repository.

AnswerD

Creating a hardened baseline ensures images are secure before deployment.

Why this answer

Creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Exam trap

ISC2 often tests the misconception that using a cloud provider's marketplace image is sufficient for security, but the trap is that these images are not tailored to the organization's specific hardening requirements and may contain default credentials or unnecessary services.

How to eliminate wrong answers

Option A is wrong because cloud provider marketplace images are generic and may not meet the organization's specific security requirements; they can contain unnecessary software or default configurations that introduce vulnerabilities. Option B is wrong because host-based firewalls only control network traffic and do not detect or remove malware already present in the virtual machine image; they are a perimeter control, not a secure image creation practice. Option C is wrong because vulnerability scanning on running instances only identifies issues after deployment, leaving the initial image potentially compromised; it does not prevent the deployment of a malicious or unhardened image.

Full explanation →

556

Multi-Selecthard

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Select 2 answers

A.Communication plan for notifying stakeholders during a disruption.

B.Strategy to avoid vendor lock-in with the CSP.

C.A detailed risk assessment for all cloud services.

D.Network topology diagrams of the cloud environment.

E.Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for critical systems.

AnswersA, E

A communication plan is critical for coordinating response.

Why this answer

A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Exam trap

ISC2 often tests the distinction between what is required *in* a BCP versus what is required *to create* a BCP, causing candidates to mistakenly include risk assessments or network diagrams as core BCP elements.

Full explanation →

557

Multi-Selecthard

A company is deploying a microservices architecture on Kubernetes and wants to implement supply chain security. Which THREE of the following practices should be adopted?

Select 3 answers

A.Signing container images with Cosign

B.Allowing all images from public registries

C.Scanning images for CVEs using Trivy

D.Using the :latest tag for all images

E.Configuring an admission controller like Kyverno to verify image signatures

AnswersA, C, E

Correct; signing ensures image provenance.

Why this answer

Image signing ensures integrity, scanning for CVEs identifies vulnerabilities, and using admission controllers to verify signatures enforces policy.

Full explanation →

558

MCQhard

An architect reviews this S3 bucket policy. What security concern should be raised?

A.The policy grants access to all users from the specified IP range.

B.The policy allows s3:GetObject from any source.

C.The policy allows s3:GetObject only to the specific bucket.

D.The policy does not restrict access to authenticated users.

AnswerA

Without a Principal, the policy applies to all users (including anonymous) from that IP range.

Why this answer

The policy grants s3:GetObject access to all users (Principal: "*") from the specified IP range, which means any unauthenticated user on the internet within that IP range can read objects in the bucket. This violates the principle of least privilege and exposes data to potential unauthorized access, as the policy does not require authentication or additional authorization checks.

Exam trap

ISC2 often tests the misconception that an IP restriction alone ensures security, when in fact it still allows anonymous access from any user within that range, bypassing authentication and IAM controls.

How to eliminate wrong answers

Option B is wrong because the policy explicitly restricts access to a specific IP range via the `aws:SourceIp` condition, so it does not allow s3:GetObject from any source. Option C is wrong because while the policy does restrict s3:GetObject to the specific bucket (via the Resource ARN), this is not a security concern—it is a correct scoping of permissions. Option D is wrong because the policy does not require authenticated users; it grants access to all users (Principal: "*") within the IP range, which is the actual security concern, not the lack of authentication restriction.

Full explanation →

559

MCQeasy

Which of the following is a key difference between a security group and a network ACL in a VPC?

A.Security groups are stateless, while NACLs are stateful

B.Security groups are applied at the subnet level, while NACLs are applied at the instance level

C.Security groups support both allow and deny rules

D.Security groups are stateful, while NACLs are stateless

AnswerD

Correct: Stateful security groups automatically allow return traffic.

Why this answer

Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules. NACLs are stateless, requiring explicit inbound and outbound rules.

Full explanation →

560

MCQmedium

A company uses Azure Functions for serverless data processing. To securely access an Azure SQL database, which of the following is the most secure method for managing the database connection string?

A.Embed the connection string in the function code and encrypt the code file

B.Store the connection string as an environment variable in the function app settings

C.Use Azure Policy to enforce encryption of the connection string at rest

D.Reference the connection string from Azure Key Vault using a managed identity

AnswerD

Correct: Managed identity and Key Vault provide secure, auditable access.

Why this answer

Using managed identities and Azure Key Vault removes hardcoded secrets and provides automatic rotation and access control.

Full explanation →

561

Multi-Selectmedium

A cloud security architect is designing a data loss prevention (DLP) strategy for a cloud environment that stores sensitive customer data. Which TWO techniques should be implemented to proactively identify and protect sensitive data? (Select TWO.)

Select 2 answers

A.Cross-region replication

B.De-identification transforms

C.Automated DLP scanning for sensitive data

D.Bucket policies blocking all public access

E.Enabling object versioning

AnswersB, C

Transforms protect sensitive data by anonymizing it.

Why this answer

Automated DLP scanning can discover sensitive data, and de-identification transforms can protect data by masking or tokenizing sensitive elements.

Full explanation →

562

MCQeasy

A cloud architect needs to protect data in transit between an on-premises data center and a cloud virtual private cloud (VPC). Which solution is MOST appropriate?

A.SSL certificate on web server

B.TLS for each application

C.VPN with IPsec

D.Direct Connect without encryption

AnswerC

IPsec VPN encrypts all traffic between sites.

Why this answer

An IPsec VPN is the most appropriate solution for protecting data in transit between an on-premises data center and a cloud VPC because it provides network-layer encryption and authentication for all IP traffic between the two sites. IPsec operates at Layer 3, securing the entire tunnel without requiring per-application configuration, and is designed specifically for site-to-site connectivity. This ensures confidentiality, integrity, and replay protection for all data traversing the public internet or a direct connect link.

Exam trap

ISC2 often tests the misconception that TLS or SSL is sufficient for all data-in-transit scenarios, but the trap here is that TLS is application-layer and cannot secure non-HTTP traffic or provide a site-to-site tunnel, whereas IPsec is the correct network-layer solution for connecting entire networks.

How to eliminate wrong answers

Option A is wrong because an SSL certificate on a web server only protects HTTP traffic (Layer 7) and does not secure other protocols or the entire data stream between the data center and VPC. Option B is wrong because implementing TLS for each application is application-specific, requires individual configuration per service, and does not provide a unified, network-level security boundary for all traffic between the two sites. Option D is wrong because Direct Connect without encryption leaves all data in transit unencrypted, exposing it to potential interception or tampering, and does not meet the requirement to protect data in transit.

Full explanation →

563

MCQhard

Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options: A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises. B. Use the provider's default encryption and rely on their BAA that states they will protect the keys. C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer. D. Disable encryption and rely on access controls and auditing only. Which option best addresses the compliance requirement while considering the operational impact?

A.Enable client-side encryption using a custom key management system (KMS) on the customer's premises.

B.Disable encryption and rely on access controls and auditing only.

C.Use the provider's default encryption and rely on their BAA that states they will protect the keys.

D.Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.

AnswerA

Correct. Client-side encryption with customer-controlled keys ensures compliance and maintains security.

Why this answer

Client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.

Exam trap

ISC2 often tests the misconception that a Business Associate Agreement (BAA) alone is sufficient to satisfy HIPAA encryption requirements, when in fact the covered entity must maintain exclusive control over encryption keys to prevent unauthorized access by the cloud provider.

How to eliminate wrong answers

Option B is wrong because disabling encryption entirely violates HIPAA's Security Rule requirement to implement encryption as an addressable implementation specification for ePHI at rest, and relying solely on access controls and auditing does not provide the necessary confidentiality protection. Option C is wrong because using the provider's default encryption with a BAA does not give the covered entity exclusive control over the keys; the provider still generates and stores the keys, which the auditor has identified as non-compliant. Option D is wrong because implementing a third-party KMS that stores keys in the cloud but is controlled by the customer still exposes the keys to the cloud provider's infrastructure, potentially allowing the provider to access them via hypervisor or storage layers, and introduces additional latency and cost without guaranteeing exclusive control.

Full explanation →

564

MCQhard

A security engineer is reviewing an S3 bucket policy that grants 's3:GetObject' access to 'Principal: *' and 'Condition: {IpAddress: {aws:SourceIp: ["1.2.3.4/32"]}}'. Despite the IP restriction, why is this policy still considered risky?

A.The policy uses 'GetObject' instead of 'ListBucket'

B.The IP address is not properly masked

C.The bucket is still exposed to anyone who can spoof that IP

D.The condition uses 'aws:SourceIp' which is deprecated

AnswerC

If an attacker can spoof the allowed IP, they can access the bucket; also, the policy allows the principal '*' which is public.

Why this answer

The policy grants public access to a specific IP, but if that IP is compromised or the condition is misconfigured, it can lead to data exposure; additionally, the bucket policy may override other controls.

Full explanation →

565

MCQhard

A cloud application processes credit card numbers. To reduce PCI DSS scope, the company wants to remove the original PAN from its databases and use a surrogate value that can be reversed only by a privileged application. Which data protection technique should they use?

A.Truncation of the first 6 and last 4 digits

B.Dynamic data masking in the application tier

C.Tokenization using a cloud-based token vault

D.Symmetric encryption with a key stored in the database

AnswerC

Tokenization replaces PAN with a token and the token vault controls detokenization.

Why this answer

Tokenization replaces the original PAN with a randomly generated surrogate value (token) that has no mathematical relationship to the original data. The token can be reversed only by a privileged application that has access to the token vault, which stores the mapping between tokens and actual PANs. This effectively removes the PAN from the application's databases, reducing PCI DSS scope because the tokenized data is not considered sensitive cardholder data.

Exam trap

ISC2 often tests the distinction between tokenization and encryption, where candidates mistakenly choose symmetric encryption (Option D) because they think encryption alone removes data from scope, but PCI DSS requires that the decryption key be stored separately from the encrypted data, and even then, encrypted PANs are still considered cardholder data unless the key is managed by a third-party service.

How to eliminate wrong answers

Option A is wrong because truncation (showing only the last 4 digits) still leaves the full PAN stored elsewhere in the system, and the truncated value cannot be reversed to recover the original PAN, so it does not meet the requirement for a reversible surrogate value. Option B is wrong because dynamic data masking only hides data at query time from unauthorized users, but the original PAN remains stored in the database, so it does not remove the PAN from databases or reduce PCI DSS scope. Option D is wrong because symmetric encryption with a key stored in the database keeps the key co-located with the ciphertext, violating the principle of separation of duties and failing to reduce PCI DSS scope, as the encrypted data is still considered cardholder data under PCI DSS requirements.

Full explanation →

566

MCQeasy

Which of the following best describes the purpose of the Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) program?

A.To offer a certification program for cloud security professionals

B.To define mandatory security requirements for all cloud services

C.To provide a legal framework for cloud contracts

D.To allow cloud providers to publicly document their security controls and achieve different levels of assurance

AnswerD

STAR includes self-assessment (Tier 1), third-party assessment (Tier 2), and continuous monitoring (Tier 3).

Why this answer

CSA STAR provides a framework for cloud providers to demonstrate their security posture through self-assessment or third-party assessments. It increases transparency and helps customers assess risk.

Full explanation →

567

MCQmedium

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

A.Cloud KMS with software keys

B.Cloud KMS with hardware keys

C.Cloud HSM

D.Cloud External Key Manager (EKM)

AnswerD

EKM allows customers to store keys outside the cloud provider, preventing provider access.

Why this answer

Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Exam trap

ISC2 often tests the distinction between 'cloud-managed' and 'customer-managed' keys, where candidates mistakenly think that using hardware keys (HSM) automatically prevents provider access, but the trap is that provider-managed HSMs still give the provider administrative control over the hardware.

How to eliminate wrong answers

Option A is wrong because Cloud KMS with software keys stores keys within the cloud provider's infrastructure, and the provider can potentially access them, especially if the keys are managed by the provider's software. Option B is wrong because Cloud KMS with hardware keys still stores keys in the cloud provider's HSM, meaning the provider has logical access and control over the key management process, even if the keys are in hardware. Option C is wrong because Cloud HSM, while providing dedicated hardware security modules, is still managed by the cloud provider, and the provider retains administrative access to the HSMs, which could allow them to access keys if they chose to.

Full explanation →

568

MCQmedium

A cloud security architect is designing network connectivity between multiple virtual networks in the same region. The requirement is to allow full mesh connectivity with centralized management and the ability to apply network policies. Which service should be used?

A.Transit gateway

B.Internet gateway

C.Virtual network peering

D.Virtual network endpoint

AnswerA

A transit gateway provides a hub-and-spoke model for multiple VPCs with centralized management.

Why this answer

A transit gateway acts as a central hub for multiple virtual networks, enabling transitive peering and centralized routing and policy management. Virtual network peering is point-to-point and does not support transitive routing, requiring a full mesh of connections for multiple virtual networks.

Full explanation →

569

MCQmedium

A company is using AWS Lambda functions that need to access a private RDS database. Which configuration allows the Lambda function to connect securely without traversing the internet?

A.Assign an Elastic IP to the Lambda function

B.Use a Lambda environment variable to store the database endpoint and credentials

C.Place the Lambda function in a public subnet with an internet gateway

D.Configure the Lambda function to use a VPC with private subnets and a VPC endpoint for RDS

AnswerD

Correct: VPC integration and VPC endpoint allow private access.

Why this answer

Attaching the Lambda function to a VPC and placing it in private subnets with a VPC endpoint for RDS or a NAT gateway allows private connectivity.

Full explanation →

570

MCQhard

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

A.Deploy HashiCorp Vault as a centralized secrets manager

B.Store secrets as encrypted environment variables in each environment

C.Use Azure Key Vault with a federation bridge to AWS

D.Use AWS Secrets Manager for all secrets

AnswerA

Vault is cloud-agnostic, supports automated rotation, and integrates with both AWS and Azure.

Why this answer

HashiCorp Vault provides a cloud-agnostic secrets management service with automated rotation and cross-cloud capabilities. AWS Secrets Manager is AWS-specific. Azure Key Vault is Azure-specific.

Encrypted environment variables are not easily rotated and require redeployment.

Full explanation →

571

MCQmedium

A healthcare organization uses a cloud-based electronic health record system. Patient data is encrypted at rest using server-side encryption with AWS KMS keys. The security team notices that during a recent security incident, an attacker used compromised credentials to decrypt and exfiltrate a large number of patient records. The attacker performed decryption operations using the KMS API, which was logged in CloudTrail. The organization wants to implement additional controls to prevent such bulk decryption in the future while still allowing authorized access. Which of the following is the BEST course of action?

A.Implement a key vault with an access broker that requires multi-factor authentication for each decryption request.

B.Change the encryption to client-side encryption using keys stored on-premises.

C.Create a KMS key policy that requires a condition for a specific IP range or VPC endpoint.

D.Enable automatic key rotation on the KMS key.

AnswerA

MFA adds strong authentication for each decryption, preventing bulk decryption even with compromised credentials.

Why this answer

A is correct because implementing a key vault with an access broker that requires multi-factor authentication for each decryption request directly addresses the root cause: compromised credentials. By requiring MFA per decryption operation, even if an attacker steals credentials, they cannot perform bulk decryption without also bypassing the MFA challenge for each API call. This control operates at the application layer, independent of the KMS key policy, and provides granular, per-request authorization.

Exam trap

ISC2 often tests the misconception that network-layer controls (like IP restrictions) or key rotation are sufficient to prevent unauthorized decryption, when in fact they do not address the core issue of compromised credentials being used to make legitimate API calls.

How to eliminate wrong answers

Option B is wrong because moving to client-side encryption with on-premises keys does not prevent bulk decryption if the attacker compromises the client application or the key management system; it also introduces key availability and latency issues for a cloud-based EHR system. Option C is wrong because restricting decryption to a specific IP range or VPC endpoint does not stop an attacker who uses compromised credentials from a legitimate IP or VPC; it only limits the network path, not the authorization of the request. Option D is wrong because automatic key rotation does not prevent an attacker from using compromised credentials to decrypt data with the current key; rotation only limits the window of exposure for future data, not the ability to decrypt already-encrypted records.

Full explanation →

572

MCQhard

A company's cloud storage bucket policy inadvertently allowed anonymous users to list and read objects. After discovering the exposure, the security team has corrected the policy. Which additional step is critical to prevent recurrence?

A.Enable logging and monitoring to detect similar exposures.

B.Assign a dedicated security team to manually approve all policy changes.

C.Review all existing bucket policies and correct any other misconfigurations.

D.Implement automated policy validation as part of the infrastructure as code deployment process.

AnswerD

Automated checks in CI/CD prevent misconfigured policies from being applied.

Why this answer

Implementing automated policy validation as part of the infrastructure as code (IaC) deployment process ensures that any bucket policy changes are automatically checked against security rules before they are applied. This prevents misconfigurations like allowing anonymous access from reaching production, addressing the root cause rather than just reacting after exposure. In cloud environments like AWS S3, tools such as AWS CloudFormation with cfn-nag or Terraform with Sentinel can enforce policies programmatically, eliminating human error in manual reviews.

Exam trap

ISC2 often tests the distinction between detective controls (logging/monitoring) and preventive controls (automated validation in IaC), and the trap here is that candidates choose option A because they think monitoring is sufficient, but the question specifically asks for a step to 'prevent recurrence,' which requires a preventive control.

How to eliminate wrong answers

Option A is wrong because enabling logging and monitoring detects exposures after they occur but does not prevent recurrence; it is a detective control, not a preventive one. Option B is wrong because assigning a dedicated security team to manually approve all policy changes is impractical at scale, introduces delays, and still relies on human review which can miss subtle misconfigurations like a missing condition key in an S3 bucket policy. Option C is wrong because reviewing all existing bucket policies is a one-time remediation step that does not prevent future misconfigurations; it lacks the automated, continuous enforcement needed to stop recurrence.

Full explanation →

573

MCQeasy

A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?

A.Ignore the risk until it materializes.

B.Accept the risk because the likelihood is low.

C.Implement controls to reduce the risk.

D.Transfer the risk to a third party.

AnswerC

Mitigation is appropriate for high-impact risks even if likelihood is low.

Why this answer

In risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.

Exam trap

ISC2 often tests the misconception that low likelihood alone justifies risk acceptance, but the trap here is that high impact overrides low probability in most compliance-driven frameworks, requiring active mitigation.

How to eliminate wrong answers

Option A is wrong because ignoring a risk with high impact violates the fundamental risk management principle of proactive mitigation; waiting for materialization could lead to catastrophic data loss and regulatory penalties. Option B is wrong because accepting a risk solely due to low likelihood ignores the high impact; risk acceptance requires a formal decision based on risk appetite, not just probability, and low likelihood does not negate the need for controls when impact is severe. Option D is wrong because transferring the risk (e.g., via cyber insurance) does not eliminate the vulnerability; the organization remains liable for the breach and must still implement technical controls to meet compliance requirements like GDPR or HIPAA.

Full explanation →

574

MCQeasy

A small business uses a cloud file storage service to share project files with external partners. They have enabled versioning on the bucket, and each partner has a unique folder. The security team discovers that a former employee, who had administrative access, deleted all files in a partner's folder and then deleted the folder. The bucket's versioning allows restoration of the files, but the folder deletion cannot be undone. The business wants to prevent similar incidents in the future while still allowing external partners to upload and download files. Which approach should be taken?

A.Use access policies to prevent deletion of objects by anyone except a specific admin group, and use lifecycle policies to manage temporary files.

B.Use object immutability to prevent object deletion or overwrites.

C.Enable multifactor authentication for deletion on the storage.

D.Disable versioning and implement a backup process.

AnswerB

Immutable storage policies, such as WORM, ensure that objects cannot be deleted or overwritten during the retention period, providing strong protection against deletion while allowing uploads and downloads.

Why this answer

Object immutability prevents any object from being deleted or overwritten by any user for the specified retention period. This directly addresses the requirement to prevent file deletion while still allowing partners to upload and download files, as versioning remains enabled and folder structure can be recreated.

Exam trap

CCSP often tests the distinction between multifactor authentication for deletion (which only adds an authentication step but does not prevent deletion by authorized users) and object immutability (which provides immutable protection against deletion or overwrites).

How to eliminate wrong answers

Option A is wrong because bucket policies can restrict deletion but do not prevent a user with administrative access (like the former employee) from modifying the policy or bypassing it, and lifecycle policies manage temporary files but do not prevent deletion. Option C is wrong because MFA Delete only requires multi-factor authentication for delete operations, but a former employee with administrative credentials could still authenticate and delete objects if they have MFA access, and it does not prevent folder deletion. Option D is wrong because disabling versioning and implementing a backup process would remove the ability to restore previous versions and does not prevent deletion; backups are reactive, not preventive.

Full explanation →

575

MCQeasy

A cloud security administrator needs to ensure that all API calls to the cloud provider's management plane are logged for audit purposes. Which service should be enabled?

A.Cloud configuration service

B.Cloud threat detection service

C.Cloud audit logging service

D.Cloud monitoring service

AnswerC

Audit logs capture all management plane API calls.

Why this answer

The cloud audit logging service (e.g., AWS CloudTrail) records API calls for auditing. Option A (monitoring) focuses on performance metrics. Option B (configuration) tracks resource changes but not all API calls.

Option D (threat detection) is for security threats.

Full explanation →

576

MCQhard

A multinational corporation is migrating its data to the cloud and needs to ensure that data belonging to EU residents never leaves the EU region due to GDPR data sovereignty requirements. Additionally, the company wants to prevent accidental deletion and protect against ransomware. Which combination of cloud storage features should be implemented to meet these requirements?

A.IAM policies and access logs

B.Cross-region replication and object lock

C.Bucket policy restricting to EU regions and versioning

D.Client-side encryption and signed URLs

AnswerC

Bucket policy enforces region restriction; versioning allows recovery from accidental deletes and ransomware.

Why this answer

Configuring a bucket policy that restricts data storage to EU regions ensures data residency. Enabling versioning protects against accidental deletion and ransomware by allowing recovery of previous object versions.

Full explanation →

577

MCQeasy

A company is migrating its on-premises workloads to a public cloud environment. The security team is concerned about maintaining visibility into network traffic between virtual machines in the same virtual network. Which cloud architecture component should be implemented to address this concern?

A.Security groups

B.Virtual network traffic mirroring

C.Virtual private cloud (VPC) peering

D.Network access control lists (NACLs)

AnswerB

Correct: Enables packet capture for analysis.

Why this answer

Virtual network traffic mirroring (or port mirroring) enables the capture and inspection of all network packets flowing between virtual machines within the same virtual network, including east-west traffic. This provides the security team with the deep packet visibility needed for threat detection, compliance auditing, and troubleshooting without requiring changes to the VM configurations or routing paths.

Exam trap

The trap here is that candidates often confuse security groups or NACLs with visibility tools, mistakenly believing that filtering or logging features (like flow logs) provide the same packet-level capture as traffic mirroring, when in fact flow logs only record metadata (e.g., source/destination IP, port, protocol) and not the full packet payload.

How to eliminate wrong answers

Option A is wrong because security groups act as a stateful virtual firewall that filters traffic based on rules (e.g., source IP, port), but they do not capture or mirror traffic for analysis; they only permit or deny packets. Option C is wrong because VPC peering connects two separate virtual networks, allowing traffic between them, but it does not provide visibility into traffic within a single virtual network. Option D is wrong because network access control lists (NACLs) are stateless packet filters applied at the subnet boundary, not a mechanism for copying or monitoring traffic flows between VMs inside the same subnet.

Full explanation →

578

Multi-Selectmedium

A cloud security architect is designing a data loss prevention (DLP) strategy for a multi-cloud environment. Which TWO actions are effective in preventing unauthorized exfiltration of sensitive data?

Select 2 answers

A.Enable detailed logging and monitoring of all data access events

B.Encrypt all data at rest using provider-managed keys

C.Use a cloud access security broker (CASB) to enforce data classification

D.Implement strict Identity and Access Management (IAM) policies with least privilege

E.Deploy DLP tools to inspect outbound traffic for sensitive data patterns

AnswersD, E

Correct: Limits access to sensitive data, reducing exfiltration risk.

Why this answer

Implementing strict IAM policies with least privilege ensures that users and services have only the minimum permissions necessary to perform their functions. This directly limits the attack surface and prevents unauthorized access to sensitive data, which is a foundational control against exfiltration. Without least privilege, even with other controls in place, an over-privileged account could be exploited to move or copy data out of the environment.

Exam trap

ISC2 often tests the distinction between preventive and detective controls, and the trap here is that candidates confuse monitoring (detective) or encryption (protective but not preventive against exfiltration by authorized users) with direct prevention mechanisms like least privilege and DLP content inspection.

Full explanation →

579

MCQmedium

A company is subject to a legal hold order and uses a cloud storage service with object replication across multiple regions. Which cloud feature should the company use to prevent deletion or modification of relevant data?

A.Versioning of objects

B.Cross-region replication

C.Backup to another provider

D.Legal hold policies (e.g., S3 Object Lock)

AnswerD

Correct. Legal hold policies ensure data cannot be deleted or overwritten.

Why this answer

Legal hold features like S3 Object Lock (AWS) or Azure Immutable Blob prevent data from being deleted or modified during the hold period, even if replication exists.

Full explanation →

580

MCQmedium

A company subject to PCI DSS is considering a cloud provider to process credit card transactions. What must the cloud provider present to demonstrate compliance with PCI DSS?

A.A CSA STAR Level 1 self-assessment

B.A PCI DSS Attestation of Compliance (AOC) from a QSA

C.A SOC 2 Type II report

D.An ISO 27001 certificate

AnswerB

The AOC is the formal evidence of a PCI DSS assessment by a Qualified Security Assessor.

Why this answer

PCI DSS allows cloud providers to be assessed by a QSA; the resulting Attestation of Compliance (AOC) demonstrates compliance.

Full explanation →

581

Multi-Selecthard

Which THREE controls help protect data in use within a cloud environment? (Choose three.)

Select 3 answers

A.Confidential computing

B.Tokenization

C.Access control lists

D.Secure enclaves (e.g., Intel SGX)

E.Homomorphic encryption

AnswersA, D, E

Encrypts data in use in memory.

Why this answer

Confidential computing protects data in use by executing computations within a hardware-based Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, which isolates the data and code from the host operating system and hypervisor. This ensures that even privileged users or cloud administrators cannot access the plaintext data while it is being processed in memory.

Exam trap

ISC2 often tests the distinction between data-at-rest, data-in-transit, and data-in-use controls, and the trap here is that candidates confuse tokenization (which protects data at rest) or access control lists (which protect data at rest/in transit) with technologies that specifically protect data during active processing in memory.

Full explanation →

582

MCQmedium

An enterprise uses a cloud-based relational database service (e.g., AWS RDS) to store customer order data. The database is encrypted at rest using the cloud provider's default encryption. The security team is concerned about the risk of a rogue database administrator (DBA) exfiltrating data by creating unencrypted backups or snapshots and moving them to a different account. Which of the following controls would BEST mitigate this risk while maintaining operational efficiency?

A.Use a customer-managed key (CMK) in KMS and configure the database to use that key for encryption, and restrict the DBA's IAM permissions to prevent using the key on snapshots.

B.Disable the ability for any user to create database snapshots.

C.Implement database activity monitoring (DAM) to alert on snapshot creation.

D.Enable automatic snapshot encryption and ensure that only the database service role can access snapshots.

AnswerA

Ensures snapshots are encrypted and DBA cannot decrypt them without key permission.

Why this answer

Using a customer-managed key (CMK) in AWS KMS allows the organization to attach a key policy that explicitly denies the DBA's IAM role the kms:Decrypt permission on the CMK when used with snapshot operations. This prevents the DBA from creating an unencrypted snapshot or from copying an encrypted snapshot to another account, as the snapshot would remain encrypted with the CMK and the DBA cannot decrypt it. This maintains operational efficiency because the DBA can still perform routine database management tasks (e.g., creating backups) but cannot exfiltrate data via snapshots.

Exam trap

ISC2 often tests the misconception that enabling automatic encryption or monitoring alone is sufficient to prevent data exfiltration by a privileged insider, when in reality only a combination of customer-managed keys with strict key policies and IAM permission boundaries can block the DBA's ability to decrypt or re-encrypt snapshots for exfiltration.

How to eliminate wrong answers

Option B is wrong because completely disabling snapshot creation would break critical operational processes such as automated backups, point-in-time recovery, and disaster recovery, making it an impractical and overly restrictive control. Option C is wrong because database activity monitoring (DAM) only provides alerting after the fact; it does not prevent a rogue DBA from successfully exfiltrating data via unencrypted snapshots, as the DBA could still create and move the snapshot before the alert is acted upon. Option D is wrong because enabling automatic snapshot encryption does not prevent the DBA from creating a snapshot that is encrypted with a key they can access (e.g., the default AWS managed key), and restricting access to only the database service role does not stop a DBA with elevated IAM permissions from assuming that role or using their own permissions to copy the snapshot to another account.

Full explanation →

583

Multi-Selectmedium

A cloud security team is designing network security for a multi-VPC architecture in AWS. Which TWO of the following are valid considerations for VPC peering?

Select 2 answers

A.VPC peering can be used to connect on-premises networks

B.VPC peering requires an internet gateway for communication

C.VPC peering is a one-to-one relationship

D.VPC peering supports transitive routing across multiple VPCs

E.VPC peering allows private IP connectivity between VPCs

AnswersC, E

Correct; each peering connection is between exactly two VPCs.

Why this answer

VPC peering is a direct, non-transitive connection between two VPCs, and transitive routing is not supported without additional components.

Full explanation →

584

MCQmedium

A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?

A.Use IP address binding for session tokens

B.Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections

C.Switch from OAuth to SAML for authentication

D.Shorten the session token expiration time

AnswerB

HSTS forces browsers to use HTTPS only, eliminating HTTP access and reducing token interception risk.

Why this answer

The root cause is that the application is accessible via HTTP due to a misconfiguration, allowing session tokens to be intercepted in transit despite HTTPS being available. Implementing HTTP Strict Transport Security (HSTS) forces the browser to always use HTTPS, preventing any HTTP connections and thus eliminating the interception vector. This directly addresses the misconfiguration before other controls, which would only mitigate but not prevent the theft.

Exam trap

ISC2 often tests the concept that session hijacking prevention must address the root cause (insecure transport) rather than just mitigating the impact of token theft, leading candidates to choose options like shortening expiration or IP binding instead of enforcing HTTPS with HSTS.

How to eliminate wrong answers

Option A is wrong because IP address binding for session tokens is a server-side binding that can help prevent token reuse from different IPs, but it does not prevent the initial interception of the token over HTTP; the token can still be stolen in transit. Option C is wrong because switching from OAuth 2.0 to SAML does not change the transport security issue; both protocols can be used over HTTP and are equally vulnerable to interception if HTTPS is not enforced. Option D is wrong because shortening the session token expiration time reduces the window of opportunity for an attacker to use a stolen token, but it does not prevent the token from being intercepted in the first place over an HTTP connection.

Full explanation →

585

MCQmedium

A security analyst is investigating a data breach in a cloud environment. The analyst needs to preserve evidence for legal proceedings. Which of the following actions is most critical to ensure the chain of custody is maintained?

A.Calculate cryptographic hashes of all relevant files.

B.Isolate all affected systems from the network to prevent further data loss.

C.Begin a detailed log documenting all actions, timestamps, and personnel involved.

D.Immediately notify senior management and legal counsel.

AnswerC

This is the first step in establishing chain of custody.

Why this answer

Chain of custody requires meticulous documentation of every action taken with evidence. Option C is most critical because maintaining a detailed log of actions, timestamps, and personnel involved directly supports the chain of custody. Option A is important for integrity but does not document the chain of custody.

Option B may preserve data but does not document handling. Option D is necessary but procedural; documenting the investigation is more critical for custody.

Full explanation →

586

Multi-Selectmedium

A financial services company is migrating its customer account management system to a public cloud provider. The company is subject to SOX compliance requirements for internal controls over financial reporting. Which TWO controls are essential for the cloud environment to meet SOX IT general control requirements? (Choose two.)

Select 2 answers

A.Enforcing role-based access control with least privilege

B.Establishing a formal change management process

C.Enabling detailed audit logging for all user and system activities

D.Implementing encryption for data at rest and in transit

E.Configuring automated backups with daily snapshots

AnswersB, C

Change management is a key ITGC required by SOX to ensure system changes are controlled and documented.

Why this answer

SOX requires IT general controls (ITGC) for systems that support financial reporting. Change management ensures that changes to the system are authorized and tested, and audit logs provide evidence of user activities and system events. While encryption and backup are important security measures, they are not specifically ITGC requirements under SOX.

Full explanation →

587

Multi-Selecthard

A company is evaluating cloud providers for a global application. They need to ensure high availability and low latency. Which THREE factors are most important to consider during provider evaluation? (Select THREE.)

Select 3 answers

A.Availability of third-party audit reports (e.g., SOC 2, ISO 27001)

B.SLA uptime guarantees

C.Provider's stock price performance

D.Number of employees at the provider

E.Global data center locations and regions

AnswersA, B, E

Correct. Audit reports verify security and operational controls.

Why this answer

SLA guarantees (e.g., 99.99%) affect availability; global data center presence reduces latency; audit reports like SOC 2 demonstrate operational effectiveness, which impacts reliability.

Full explanation →

588

Multi-Selecteasy

Which TWO data lifecycle stages are most critical for applying encryption controls in a cloud object storage service? (Choose two.)

Select 2 answers

A.Data in transit

B.Data in use

C.Data deletion

D.Data at rest

E.Data creation

AnswersA, D

Encryption protects data during API calls.

Why this answer

Encryption for data in transit (e.g., TLS 1.3) protects data as it moves between the client and the cloud object storage service, preventing interception or man-in-the-middle attacks. Data at rest encryption (e.g., server-side encryption with AES-256) protects stored objects from unauthorized access, whether from compromised infrastructure or misconfigured access controls. These two stages cover the primary threat vectors for cloud object storage: network interception and storage compromise.

Exam trap

ISC2 often tests the distinction between data lifecycle stages by making candidates confuse 'data in use' with 'data at rest' or 'data in transit,' but cloud object storage does not process data in memory, so encryption for data in use is irrelevant here.

Full explanation →

589

MCQhard

A multinational corporation is deploying a containerized microservices application on a public cloud Kubernetes cluster. The cluster spans three availability zones in a single region. The application consists of a front-end service, a payment service, and a database service. The security team requires that the payment service must not be directly accessible from the internet, but must be accessible from the front-end service. The database must only be accessible from the payment service. Additionally, all inter-service communication must be encrypted, and the cluster must be able to scale up to 500 nodes during peak load. The cloud provider's container orchestration service is used. After deployment, the security team discovers that the payment service is still reachable from the internet via a public load balancer that was configured for testing. The team needs to remediate this issue immediately without disrupting the front-end service. Which of the following actions should the team take FIRST?

A.Change the payment service type from LoadBalancer to ClusterIP and update the front-end configuration.

B.Implement a Kubernetes NetworkPolicy that denies ingress to the payment service pods from all sources except the front-end service's pod label.

C.Delete the public load balancer that was used for testing.

D.Apply a security group to the node instances to block inbound traffic on the payment service port.

AnswerB

This immediately restricts access to only the front-end service, without changing the service type or affecting other components.

Why this answer

A Kubernetes NetworkPolicy can enforce fine-grained ingress rules at the pod level, allowing only traffic from the front-end service's pod label to reach the payment service pods. This directly addresses the requirement to block internet access while preserving front-end-to-payment communication, without modifying the service type or disrupting the front-end service. NetworkPolicies operate at Layer 3/4 and are native to Kubernetes, making them the immediate and precise remediation.

Exam trap

ISC2 often tests the misconception that deleting the load balancer (Option C) is the first step, but the trap is that this ignores the need to maintain front-end-to-payment connectivity and the fact that a NetworkPolicy can immediately block internet traffic without removing the load balancer resource itself.

How to eliminate wrong answers

Option A is wrong because changing the payment service type from LoadBalancer to ClusterIP would remove the public load balancer but also require updating the front-end configuration to point to the new ClusterIP, which could disrupt the front-end service during the transition; it also does not address the immediate need to block internet access without disruption. Option C is wrong because deleting the public load balancer would stop internet traffic but does not ensure that the payment service remains accessible from the front-end service, and it may cause downtime if the load balancer is still referenced; it also does not provide a scalable, policy-based solution. Option D is wrong because applying a security group to the node instances blocks traffic at the infrastructure level, which is coarse-grained and does not account for Kubernetes pod IPs that may change with scaling; it also does not differentiate between traffic from the front-end service and other internal sources, potentially breaking legitimate inter-service communication.

Full explanation →

590

Multi-Selectmedium

Which TWO of the following are effective strategies for protecting sensitive data in a public cloud environment?

Select 2 answers

A.Using the same encryption key for all data to simplify key management.

B.Storing encryption keys in the same storage bucket as the encrypted data.

C.Consolidating all sensitive data into a single storage bucket for easier management.

D.Data masking to obscure sensitive fields in non-production environments.

E.Tokenization to replace sensitive data with non-sensitive placeholders.

AnswersD, E

Correct. Data masking protects data in development and testing.

Why this answer

Data masking (option D) and tokenization (option E) are both effective data protection techniques for public cloud environments. Data masking obscures sensitive fields in non-production environments, while tokenization replaces sensitive data with non-sensitive placeholders. Options A, B, and C are insecure or poor practices.

Full explanation →

591

MCQmedium

A company wants to encrypt data at rest in a cloud object storage service. They require that the cloud provider has no access to the encryption keys. Which key management approach should they use?

A.Server-side encryption with customer-managed keys stored in a cloud HSM

B.Client-side encryption

C.Server-side encryption with cloud-managed keys

D.Server-side encryption with envelope encryption

AnswerB

Encryption happens on the client side; cloud provider never sees the keys.

Why this answer

Client-side encryption (B) is the correct approach because the data is encrypted before it is sent to the cloud provider, ensuring that the cloud provider never has access to the plaintext data or the encryption keys. With server-side encryption, even if the keys are customer-managed and stored in a cloud HSM (A), the encryption and decryption operations occur on the provider's infrastructure, meaning the provider's software stack could theoretically access the keys or plaintext. Options C and D also involve server-side operations, where the cloud provider manages or processes the keys, violating the requirement that the provider has no access to the keys.

Exam trap

The trap here is that candidates confuse 'customer-managed keys' (CMK) with 'client-side encryption,' assuming that storing keys in a cloud HSM (A) prevents provider access, but the CCSP exam emphasizes that server-side encryption inherently involves the provider's infrastructure in the encryption process, which violates the 'no access' requirement.

How to eliminate wrong answers

Option A is wrong because server-side encryption with customer-managed keys stored in a cloud HSM still requires the cloud provider's infrastructure to perform the encryption/decryption operations, and the provider's HSM service may have administrative access to the keys. Option C is wrong because server-side encryption with cloud-managed keys explicitly gives the cloud provider full control over the keys, directly violating the requirement. Option D is wrong because server-side encryption with envelope encryption still involves the cloud provider managing the key encryption key (KEK) and performing the encryption/decryption on its servers, so the provider retains access to the data encryption key (DEK) during processing.

Full explanation →

592

MCQhard

A large enterprise is migrating its data center workloads to a public cloud. The security policy requires that all sensitive data stored in cloud storage services be encrypted with keys managed by the enterprise's on-premises HSM. The cloud storage service offers server-side encryption with customer-provided keys. However, compliance regulations prohibit the transmission of encryption keys over the public internet. The enterprise also has a dedicated network connection to the cloud provider. The security team is considering several options. Which solution meets all requirements: (1) data encrypted at rest on the cloud service, (2) keys controlled by the enterprise, (3) keys never transmitted over the internet?

A.Use a cloud-based HSM and keep the key material in the cloud HSM.

B.Use server-side encryption with customer-provided keys with the enterprise's HSM, sending keys over the dedicated network connection as it is private.

C.Use server-side encryption with a key management service using an imported key material protected by the enterprise's HSM, accessed via the key management service API over the dedicated network connection.

D.Use client-side encryption on-premises before uploading data, using keys from the HSM.

AnswerD

Correct. Client-side encryption ensures keys never leave the on-premises HSM.

Why this answer

Client-side encryption encrypts data on-premises using keys from the enterprise's HSM before the data is ever transmitted to the cloud. This ensures the data is encrypted at rest in the cloud, the enterprise retains full control of the keys, and the keys never traverse any network—public or private—to the cloud provider. The dedicated network connection is irrelevant for key transmission since the keys never leave the on-premises HSM.

Exam trap

ISC2 often tests the misconception that a private or dedicated network connection satisfies a 'no transmission over the internet' requirement, but the trap here is that the regulation prohibits any network transmission of keys, not just over the public internet, so even a private link is disallowed if keys are sent over it.

How to eliminate wrong answers

Option A is wrong because using a cloud-based HSM (e.g., AWS CloudHSM) means the key material is stored and managed within the cloud provider's environment, not controlled exclusively by the enterprise's on-premises HSM, violating the requirement that keys be managed by the enterprise's on-premises HSM. Option B is wrong because SSE-C requires the customer to provide the encryption key with each API call (e.g., PUT Object), and even though the dedicated connection (Direct Connect) is private, the key is still transmitted over a network path that is not the public internet but is still a network transmission, which the compliance regulations prohibit (the regulation forbids transmission over any network, not just the public internet). Option C is wrong because using KMS with imported key material still requires the key to be transmitted to the KMS service via API calls over the dedicated connection, and the KMS service itself stores and manages the key, not the enterprise's on-premises HSM; the enterprise loses direct control and the key is transmitted over the network.

Full explanation →

593

Multi-Selectmedium

A cloud application is deployed on Kubernetes and uses a cloud identity and access management (IAM) role for service accounts. Which TWO practices should be implemented to ensure least privilege?

Select 2 answers

A.Grant only the specific permissions required for the application

B.Hardcode the role's credentials in the application code

C.Grant the role the full IAM permissions (e.g., 'iam:*' equivalent)

D.Restrict the role to specific resources using resource identifiers

E.Use a single role for all services in the cluster

AnswersA, D

Correct. Granting only required permissions aligns with the principle of least privilege.

Why this answer

Least privilege for IAM roles means granting only the permissions necessary for the application to function and limiting the scope of those permissions to specific resources using resource identifiers. This prevents excessive access and reduces risk.

Full explanation →

594

Multi-Selecteasy

A cloud security team is auditing a cloud environment and needs to ensure compliance with logging requirements. Which TWO actions are essential? (Choose two.)

Select 2 answers

A.Store logs in a publicly accessible bucket.

B.Allow users to modify logs.

C.Encrypt logs at rest.

D.Enable CloudTrail (or equivalent) for all regions.

E.Delete logs after 30 days.

AnswersC, D

Encryption protects log data at rest.

Why this answer

Encrypting logs at rest (Option C) is essential to protect sensitive audit data from unauthorized access if the storage medium is compromised. Cloud providers like AWS offer server-side encryption (SSE-S3 or SSE-KMS) for log buckets, ensuring compliance with standards such as SOC 2, PCI DSS, and ISO 27001. Without encryption, logs could be read by anyone with physical or administrative access to the storage infrastructure.

Exam trap

ISC2 often tests the misconception that deleting logs after a short period is a security best practice, but the trap is that compliance mandates specific retention durations, and premature deletion can lead to audit failures.

Full explanation →

595

Multi-Selecthard

A cloud application exposes an API that allows users to view their own orders. Which TWO vulnerabilities could allow an attacker to view another user's orders?

Select 2 answers

A.Excessive Data Exposure

B.SQL Injection

C.Insecure Direct Object Reference (IDOR)

D.Broken Object Level Authorization (BOLA)

E.Cross-Site Scripting (XSS)

AnswersC, D

IDOR occurs when user input directly references objects without authorization checks.

Why this answer

Broken Object Level Authorization (BOLA) occurs when the API does not verify that the user owns the object, and IDOR (Insecure Direct Object Reference) allows access by manipulating object IDs.

Full explanation →

596

MCQmedium

A cloud provider's data center is located in Country A, but the customer's data is subject to litigation in Country B. The court in Country B orders the cloud provider to produce data. The cloud provider refuses, citing Country A's laws that prohibit disclosure. This situation best illustrates which challenge in eDiscovery?

A.Data portability

B.Jurisdiction issues

C.Data preservation

D.Forensic soundness

AnswerB

This demonstrates conflicting legal requirements across jurisdictions.

Why this answer

Jurisdictional issues arise when data is stored in multiple legal jurisdictions, and courts in one country may not have authority over data in another, leading to conflicts of law.

Full explanation →

597

Multi-Selectmedium

A development team builds a serverless application using AWS Lambda. The security team wants to prevent hardcoded credentials. Which TWO methods should they enforce for secure secrets management?

Select 2 answers

A.Store secrets in environment variables in plain text

B.Assign an IAM role to the Lambda function and retrieve temporary credentials via the AWS SDK

C.Embed secrets directly in the Lambda function code but encrypt the code

D.Use a third-party secrets manager with a hardcoded API key in the code

E.Use AWS Systems Manager Parameter Store with KMS encryption

AnswersB, E

Correct. IAM roles provide temporary credentials without hardcoding.

Why this answer

Using cloud-native secret managers and IAM roles are secure ways to manage secrets without hardcoding. AWS Systems Manager Parameter Store is a secret manager; Lambda execution roles eliminate the need for embedded credentials.

Full explanation →

598

MCQeasy

A company wants to ensure that its cloud infrastructure can automatically add capacity during traffic spikes and remove capacity during low demand. Which cloud characteristic is primarily needed?

A.Broad network access

B.Measured service

C.Rapid elasticity

D.Resource pooling

AnswerC

Correct: Allows automatic scaling of resources.

Why this answer

Rapid elasticity is the cloud characteristic that enables automatic scaling of resources up or down in response to demand, often leveraging orchestration tools like AWS Auto Scaling or Azure VM Scale Sets. This ensures that capacity matches workload spikes and troughs without manual intervention, directly addressing the requirement for dynamic capacity adjustment.

Exam trap

ISC2 often tests the distinction between rapid elasticity and resource pooling, where candidates mistakenly think that sharing resources (pooling) inherently enables scaling, but pooling is about multi-tenancy, not dynamic capacity adjustment.

How to eliminate wrong answers

Option A is wrong because broad network access refers to the ability to access cloud services over standard network protocols (e.g., HTTPS, SSH) from various devices, not the dynamic scaling of resources. Option B is wrong because measured service involves metering and billing based on usage (e.g., per-hour or per-GB charges), not the automatic adjustment of capacity. Option D is wrong because resource pooling describes the multi-tenant model where physical resources are shared among multiple customers using virtualization, not the elasticity to scale resources on demand.

Full explanation →

599

MCQmedium

A cloud security team is investigating a data breach in their AWS environment. The logs show that an EC2 instance with an attached IAM role was compromised. The attacker used the instance's temporary credentials to access an S3 bucket containing sensitive data. Which design change would BEST prevent this type of attack in the future?

A.Implement a network ACL that denies all outbound traffic from the EC2 instance to the S3 service.

B.Enable IMDSv2 with a hop limit of 1 on the EC2 instance.

C.Restrict S3 bucket access to the EC2 instance's private IP address only.

D.Disable public access on the S3 bucket using a bucket policy.

AnswerB

IMDSv2 with hop limit 1 prevents the attacker from using the instance as a proxy to retrieve credentials.

Why this answer

Enabling IMDSv2 with a hop limit of 1 forces the EC2 instance to use a session-oriented method to retrieve temporary credentials from the Instance Metadata Service (IMDS). This prevents SSRF attacks or other techniques that trick the instance into leaking its IAM role credentials, as the attacker would need to be on the instance itself to obtain the token. By setting the hop limit to 1, the metadata response is not forwarded beyond the instance's network interface, blocking remote access to the credentials.

Exam trap

ISC2 often tests the distinction between IMDSv1 (which is vulnerable to SSRF) and IMDSv2 with hop limit enforcement, and the trap here is that candidates mistakenly choose network-level controls (like NACLs or IP restrictions) instead of addressing the metadata service vulnerability that directly enables credential theft.

How to eliminate wrong answers

Option A is wrong because a network ACL denying all outbound traffic to S3 would block legitimate access from the EC2 instance to S3, breaking functionality, and does not address the root cause of credential theft from the instance metadata service. Option C is wrong because S3 bucket policies cannot restrict access based on the EC2 instance's private IP address; S3 uses source IP conditions, but private IPs are not routable over the internet and this approach would not prevent an attacker from using the stolen credentials from another location. Option D is wrong because disabling public access on the S3 bucket does not prevent an attacker who has valid temporary credentials from accessing the bucket; the attacker is using the instance's IAM role permissions, not public access.

Full explanation →

600

MCQhard

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

A.Configure each account's access control policy to deny the services.

B.Enable a cloud configuration monitoring service to detect and disable non-approved services.

C.Apply a cloud governance policy at the organization level that denies the services.

D.Use resource-specific access policies on each resource to restrict usage.

AnswerC

Correct. A centralized policy operates at the organizational level, providing a preventive control that denies specified services across all accounts, and it cannot be overridden by individual account administrators.

Why this answer

Cloud governance policies at the organization level are the correct mechanism because they operate across all accounts, allowing centrally defined whitelists or blacklists of services. Unlike account-level access control policies, organizational policies set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Exam trap

The trap here is that candidates confuse detective controls (like configuration monitoring) with preventive controls (like organizational governance policies), or assume that account-level access control policies can achieve the same centralized enforcement, missing the fact that organizational policies are the only mechanism that cannot be bypassed by account-level administrators.

How to eliminate wrong answers

Option A is wrong because configuring each account's IAM policy individually is not an organizational-level enforcement; it is decentralized, error-prone, and can be overridden by account administrators with full IAM permissions. Option B is wrong because AWS Config rules are detective controls that can only detect and report non-compliant resources, not prevent their creation or usage; they cannot disable services in real time. Option D is wrong because resource-based policies are attached to individual resources (e.g., S3 buckets, KMS keys) and cannot restrict the use of entire services or apply at the organizational level across all accounts.

Full explanation →

Page 8 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice CCSP by domain

Target a specific domain to shore up weak areas.

Cloud Application Security Cloud Security Operations Legal, Risk, and Compliance Cloud Data Security Cloud Platform and Infrastructure Security Cloud Concepts, Architecture, and Design

See all domains with question counts →