How should I use these Cloud Platform and Infrastructure Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CCSP · topic practice

Cloud Platform and Infrastructure Security practice questions

Q: Can I practise just Cloud Platform and Infrastructure Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cloud Platform and Infrastructure Security domain.

Practise Certified Cloud Security Professional CCSP Cloud Platform and Infrastructure Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cloud Platform and Infrastructure Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Cloud Platform and Infrastructure Security

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Cloud Platform and Infrastructure Security exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Cloud Platform and Infrastructure Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Study the full virtualization explanation →

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

Trap 1: IOMMU (Input-Output Memory Management Unit)

Incorrect. IOMMU provides isolation for device-initiated DMA accesses, not for CPU memory accesses between virtual machines. It does prevent devices from reading arbitrary VM memory but does not protect against a VM reading another VM's memory via CPU instructions.

Trap 2: Intel TXT (Trusted Execution Technology)

Incorrect. Intel Trusted Execution Technology (TXT) provides a measured and verified launch environment, ensuring system integrity at boot, but it does not provide runtime memory isolation between VMs.

Trap 3: Intel SGX (Software Guard Extensions)

Incorrect. Intel Software Guard Extensions (SGX) creates encrypted enclaves within a process to protect sensitive data from other software, including the OS and hypervisor. It does not isolate memory between different VMs.

Study all Cloud Platform and Infrastructure Security common traps →

A
IOMMU (Input-Output Memory Management Unit)
Why wrong: Incorrect. IOMMU provides isolation for device-initiated DMA accesses, not for CPU memory accesses between virtual machines. It does prevent devices from reading arbitrary VM memory but does not protect against a VM reading another VM's memory via CPU instructions.
B
Intel TXT (Trusted Execution Technology)
Why wrong: Incorrect. Intel Trusted Execution Technology (TXT) provides a measured and verified launch environment, ensuring system integrity at boot, but it does not provide runtime memory isolation between VMs.
C
Intel SGX (Software Guard Extensions)
Why wrong: Incorrect. Intel Software Guard Extensions (SGX) creates encrypted enclaves within a process to protect sensitive data from other software, including the OS and hypervisor. It does not isolate memory between different VMs.
D
AMD SEV (Secure Encrypted Virtualization)
Correct. AMD Secure Encrypted Virtualization (SEV) encrypts the memory of each VM using a unique key, so even if a malicious VM attempts to read memory allocated to another VM, it will only see encrypted data, thus providing hardware-assisted memory isolation.

Cloud Platform and Infrastructure Security practice questions

What to know about Cloud Platform and Infrastructure Security

Common Cloud Platform and Infrastructure Security exam traps

Cloud Platform and Infrastructure Security questions

A cloud provider uses KVM as its hypervisor. To prevent a malicious VM from reading memory allocated to another VM, which hardware-assisted memory isolation technology should be enabled?

An organization uses a multi-cloud strategy and wants to connect their on-premises data center to multiple cloud providers with a single private, low-latency connection. Which solution should they consider?

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

A company uses serverless functions to process sensitive data. The functions need to access a database in a private subnet. What is the most secure way to enable this access without exposing the database to the internet?

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

A security architect is designing a multi-tenant cloud environment. Which hypervisor type provides the strongest isolation between tenant virtual machines by running directly on the hardware without a host operating system?

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Track your progress over time

Start a Cloud Platform and Infrastructure Security only practice session

Related CCSP topic practice pages

Cloud Application Security practice questions

Cloud Security Operations practice questions

Legal, Risk, and Compliance practice questions

Cloud Data Security practice questions

Cloud Platform and Infrastructure Security practice questions

Cloud Concepts, Architecture, and Design practice questions

CCSP fundamentals practice questions

CCSP scenario practice questions

CCSP troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid