CCSP Cloud Application Security Practice Question
During a security review, a cloud security architect discovers that a PaaS database service has public network access enabled. The application team claims they need it for external integrations. What is the most secure alternative to allow necessary access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.
Azure Private Link or AWS PrivateLink creates a private endpoint within the cloud network, allowing the database to be accessed privately without public internet exposure. This is the most secure alternative as it eliminates the attack surface of a public IP. Option A is incorrect because encryption does not prevent public access; it only protects data confidentiality. Option C is incorrect because moving to a VM-hosted instance introduces additional management overhead and may still require public access depending on configuration. Option D is a less secure alternative because IP whitelisting still exposes the database to the public internet, and IP addresses can be spoofed or change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all data at rest and in transit to the database.
Why it's wrong here
Encryption does not address network exposure.
- ✓
Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.
Why this is correct
Traffic never traverses the public internet, and access is restricted to private endpoints.
- ✗
Move the database to a VM-hosted instance with a VPN connection.
Why it's wrong here
Adds complexity but doesn't guarantee security; VPN may not cover all integrations.
- ✗
Restrict public access using IP whitelisting to only required external IPs.
Why it's wrong here
Whitelisting can be bypassed and still uses public network.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.