How should I use these Cloud Platform and Infrastructure Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CCSP · topic practice

Cloud Platform and Infrastructure Security practice questions

Q: Can I practise just Cloud Platform and Infrastructure Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cloud Platform and Infrastructure Security domain.

Practise Certified Cloud Security Professional CCSP Cloud Platform and Infrastructure Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cloud Platform and Infrastructure Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Cloud Platform and Infrastructure Security

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Cloud Platform and Infrastructure Security exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Cloud Platform and Infrastructure Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

Trap 1: Configure a site-to-site VPN between on-premises and cloud to…

A VPN provides encrypted connectivity but does not enforce internal segmentation.

Trap 2: Implement an intrusion detection and prevention system (IDPS) to…

An IDPS detects/mitigates threats but does not provide network segmentation.

Trap 3: Deploy a software-defined WAN (SD-WAN) to manage network traffic…

SD-WAN optimizes WAN connectivity, not internal network segmentation.

Study all Cloud Platform and Infrastructure Security common traps →

A
Configure a site-to-site VPN between on-premises and cloud to extend the existing network.
Why wrong: A VPN provides encrypted connectivity but does not enforce internal segmentation.
B
Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.
VPCs and security groups directly replicate network segmentation and firewall controls.
C
Implement an intrusion detection and prevention system (IDPS) to monitor traffic.
Why wrong: An IDPS detects/mitigates threats but does not provide network segmentation.
D
Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.
Why wrong: SD-WAN optimizes WAN connectivity, not internal network segmentation.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A cloud architect is designing a multi-tier application in a public cloud. The web tier must be accessible from the internet, while the application and database tiers must only be reachable from the web tier. The architect needs to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which architecture BEST meets this requirement?

Trap 1: Place all tiers in the same subnet and use a single security group…

This allows direct access between tiers if the security group allows it, compromising isolation.

Trap 2: Place all tiers in the same VPC but different subnets, and use…

Network ACLs are stateless and less granular; security groups are preferred for instance-level control.

Trap 3: Use a VPN to connect the tiers and rely on IPsec policies for…

VPNs provide encrypted tunnels but are not designed for internal segmentation.

Study all Cloud Platform and Infrastructure Security common traps →

A
Place all tiers in the same subnet and use a single security group to control inbound traffic.
Why wrong: This allows direct access between tiers if the security group allows it, compromising isolation.
B
Place all tiers in the same VPC but different subnets, and use network ACLs to restrict traffic.
Why wrong: Network ACLs are stateless and less granular; security groups are preferred for instance-level control.
C
Place the web tier in a public subnet with a security group allowing HTTP/HTTPS from 0.0.0.0/0, and place the app and database tiers in private subnets with security groups allowing traffic only from the web tier's security group.
This provides proper isolation: private subnets with security group references restrict access to the web tier only.
D
Use a VPN to connect the tiers and rely on IPsec policies for segmentation.
Why wrong: VPNs provide encrypted tunnels but are not designed for internal segmentation.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

During a cloud migration, a company discovers that its existing virtual machine images contain embedded credentials and proprietary software that must not be exposed to the cloud provider's administrators. Which of the following is the BEST strategy to protect this sensitive data while maintaining the ability to create new instances?

Trap 1: Use a VPN to encrypt data in transit between the on-premises…

This protects data during transfer, but the image at rest in the cloud is still exposed.

Trap 2: Use a cryptographic hash of the image to ensure integrity, and…

Hashing ensures integrity, not confidentiality; the image remains unencrypted.

Trap 3: Tokenize the embedded credentials and replace them with…

Tokenization is for sensitive data elements, not entire images, and may break functionality.

Study all Cloud Platform and Infrastructure Security common traps →

A
Use a VPN to encrypt data in transit between the on-premises environment and the cloud.
Why wrong: This protects data during transfer, but the image at rest in the cloud is still exposed.
B
Use a cryptographic hash of the image to ensure integrity, and store the image in object storage with access controls.
Why wrong: Hashing ensures integrity, not confidentiality; the image remains unencrypted.
C
Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.
Encryption with a CMK ensures the provider cannot decrypt the image without the key.
D
Tokenize the embedded credentials and replace them with placeholders in the image.
Why wrong: Tokenization is for sensitive data elements, not entire images, and may break functionality.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

Trap 1: Implement a VPN for all management traffic to the cloud provider's…

A VPN protects management traffic but does not provide key rotation or auditing.

Trap 2: Enable multi-factor authentication (MFA) for all cloud console…

MFA reduces unauthorized access but does not directly protect the CMK.

Trap 3: Use encryption in transit (TLS) for all data transfers to and from…

This protects data in transit, not the key itself.

Study all Cloud Platform and Infrastructure Security common traps →

A
Enable automatic key rotation and configure detailed audit logging for the key management service.
Key rotation and audit logs are essential controls for CMK security.
B
Implement a VPN for all management traffic to the cloud provider's API.
Why wrong: A VPN protects management traffic but does not provide key rotation or auditing.
C
Enable multi-factor authentication (MFA) for all cloud console users.
Why wrong: MFA reduces unauthorized access but does not directly protect the CMK.
D
Use encryption in transit (TLS) for all data transfers to and from the cloud.
Why wrong: This protects data in transit, not the key itself.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full Cloud Platform and Infrastructure Security explanation →

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Trap 1: Use an active-passive configuration with both instances in the same…

Both instances in one zone share the same failure domain.

Trap 2: Configure the application to run in only one region to simplify…

A single region is vulnerable to regional outages.

Trap 3: Use a single, large virtual machine instance to handle all traffic.

A single instance is a single point of failure.

Study all Cloud Platform and Infrastructure Security common traps →

A
Deploy the application across multiple availability zones within a region.
This provides high availability within a region.
B
Use an active-passive configuration with both instances in the same availability zone.
Why wrong: Both instances in one zone share the same failure domain.
C
Configure the application to run in only one region to simplify management.
Why wrong: A single region is vulnerable to regional outages.
D
Implement automated snapshots and replicate data to a different geographic region.
This ensures disaster recovery and data durability.
E
Use a single, large virtual machine instance to handle all traffic.
Why wrong: A single instance is a single point of failure.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full NAT/PAT explanation →

A multinational corporation is deploying a containerized microservices application on a public cloud Kubernetes cluster. The cluster spans three availability zones in a single region. The application consists of a front-end service, a payment service, and a database service. The security team requires that the payment service must not be directly accessible from the internet, but must be accessible from the front-end service. The database must only be accessible from the payment service. Additionally, all inter-service communication must be encrypted, and the cluster must be able to scale up to 500 nodes during peak load. The cloud provider's container orchestration service is used. After deployment, the security team discovers that the payment service is still reachable from the internet via a public load balancer that was configured for testing. The team needs to remediate this issue immediately without disrupting the front-end service. Which of the following actions should the team take FIRST?

Trap 1: Change the payment service type from LoadBalancer to ClusterIP and…

This would require service recreation and potential downtime; network policy is quicker.

Trap 2: Delete the public load balancer that was used for testing.

The load balancer might also be used by the front-end service; deleting it could disrupt the front-end.

Trap 3: Apply a security group to the node instances to block inbound…

Security groups apply at the node level and do not provide pod-level isolation within the cluster.

Study all Cloud Platform and Infrastructure Security common traps →

A
Change the payment service type from LoadBalancer to ClusterIP and update the front-end configuration.
Why wrong: This would require service recreation and potential downtime; network policy is quicker.
B
Implement a Kubernetes NetworkPolicy that denies ingress to the payment service pods from all sources except the front-end service's pod label.
This immediately restricts access to only the front-end service, without changing the service type or affecting other components.
C
Delete the public load balancer that was used for testing.
Why wrong: The load balancer might also be used by the front-end service; deleting it could disrupt the front-end.
D
Apply a security group to the node instances to block inbound traffic on the payment service port.
Why wrong: Security groups apply at the node level and do not provide pod-level isolation within the cluster.

Full breakdown with real-world context →

Question 7easymulti select

Read the full Cloud Platform and Infrastructure Security explanation →

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Trap 1: Software-defined perimeter (SDP) architecture

Focuses on network segmentation, not workload policy consistency.

Trap 2: Virtual private cloud (VPC) network ACLs

Network-level controls, not workload-specific.

Trap 3: Infrastructure as code templates

Useful for provisioning but not for runtime policy enforcement.

Study all Cloud Platform and Infrastructure Security common traps →

A
Software-defined perimeter (SDP) architecture
Why wrong: Focuses on network segmentation, not workload policy consistency.
B
Virtual private cloud (VPC) network ACLs
Why wrong: Network-level controls, not workload-specific.
C
Unified agent software installed on each VM
Enforces policies locally regardless of environment.
D
Centralized policy management console
Enables consistent policy definition and distribution.
E
Infrastructure as code templates
Why wrong: Useful for provisioning but not for runtime policy enforcement.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Trap 1: The condition key 'aws:SourceIp' does not apply to S3 operations

It does apply; the issue is the second statement.

Trap 2: The first statement's condition explicitly denies access to IPs…

The condition restricts the Allow, but does not create a Deny.

Trap 3: The policy document has a syntax error that causes the first…

The document is valid JSON.

Study all Cloud Platform and Infrastructure Security common traps →

A
The condition key 'aws:SourceIp' does not apply to S3 operations
Why wrong: It does apply; the issue is the second statement.
B
The first statement's condition explicitly denies access to IPs outside 10.0.0.0/8
Why wrong: The condition restricts the Allow, but does not create a Deny.
C
The second Allow statement does not include the IP restriction, allowing any IP to read objects
The policy grants unrestricted GetObject access via the second statement.
D
The policy document has a syntax error that causes the first statement to be ignored
Why wrong: The document is valid JSON.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full NAT/PAT explanation →

A large financial institution hosts a critical application in a multi-cloud environment using AWS and Azure. The application processes sensitive customer data and requires low-latency access to a shared database. The database is deployed as a MySQL instance in AWS RDS, and the Azure application instances connect to it over the public internet using SSL. Recently, the security team discovered that the database connection traffic is being routed through an unencrypted proxy, exposing the data in transit. The network architect must redesign the connectivity to ensure encryption end-to-end and minimize latency. The current setup includes an AWS Direct Connect and an Azure ExpressRoute that both terminate at the same on-premises data center. The on-premises network has a firewall that inspects all traffic. The architect proposes using the on-premises data center as an intermediary to route traffic between clouds. Which of the following solutions best addresses the security and latency requirements?

Trap 1: Configure the Azure application to use a TLS termination proxy in…

The proxy would decrypt traffic, breaking end-to-end encryption and increasing latency.

Trap 2: Use AWS Direct Connect and Azure ExpressRoute to connect directly…

Direct Connect and ExpressRoute cannot directly peer; they terminate at on-premises.

Trap 3: Deploy a third-party SD-WAN appliance in both AWS and Azure to…

Overlay adds complexity and may not integrate with existing Direct Connect/ExpressRoute.

Study all Cloud Platform and Infrastructure Security common traps →

A
Create an AWS VPC peering connection to the Azure VNet through the on-premises data center using VPN tunnels, and configure the RDS security group to allow traffic only from the Azure VNet CIDR. Ensure the firewall does not decrypt the traffic.
Provides encrypted tunnel end-to-end and uses existing connections for low latency.
B
Configure the Azure application to use a TLS termination proxy in the on-premises data center that forwards traffic to RDS over SSL, and allow the firewall to inspect traffic.
Why wrong: The proxy would decrypt traffic, breaking end-to-end encryption and increasing latency.
C
Use AWS Direct Connect and Azure ExpressRoute to connect directly to each other without going through the on-premises data center by establishing a cross-cloud direct connection.
Why wrong: Direct Connect and ExpressRoute cannot directly peer; they terminate at on-premises.
D
Deploy a third-party SD-WAN appliance in both AWS and Azure to create an encrypted overlay network between the two clouds, bypassing the on-premises data center entirely.
Why wrong: Overlay adds complexity and may not integrate with existing Direct Connect/ExpressRoute.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full Cloud Platform and Infrastructure Security explanation →

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediummatching

Read the full Cloud Platform and Infrastructure Security explanation →

Match each key management solution to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hardware-based key generation and storage

Software-based key lifecycle management

Customer-managed keys in cloud provider HSM

Customer holds and manages own keys

Question 12easymultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

Trap 1: Use AWS Resource Groups to create a group that filters tagged…

Resource Groups organize existing resources but do not enforce tagging.

Trap 2: Enable CloudTrail to monitor instance launches and alert on missing…

CloudTrail provides audit logs but does not prevent the launch.

Trap 3: Configure AWS Config rules to automatically tag untagged instances.

Config rules are detective/corrective, not preventive.

Study all Cloud Platform and Infrastructure Security common traps →

A
Use AWS Resource Groups to create a group that filters tagged instances.
Why wrong: Resource Groups organize existing resources but do not enforce tagging.
B
Enable CloudTrail to monitor instance launches and alert on missing tags.
Why wrong: CloudTrail provides audit logs but does not prevent the launch.
C
Apply a service control policy (SCP) that requires tags on resource creation.
SCPs can use condition keys like aws:RequestTag to require tags, preventing creation of untagged resources.
D
Configure AWS Config rules to automatically tag untagged instances.
Why wrong: Config rules are detective/corrective, not preventive.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

Trap 1: Use server-side encryption with a key stored in the cloud…

KMS keys are stored in the cloud, violating the requirement.

Trap 2: Use server-side encryption with a cloud-managed key (SSE-S3).

Cloud-managed keys are fully managed by the provider, not by the customer.

Trap 3: Use client-side encryption where the application encrypts data…

Client-side encryption is not server-side; it encrypts data before upload.

Study all Cloud Platform and Infrastructure Security common traps →

A
Use server-side encryption with a key stored in the cloud provider's key management service (KMS).
Why wrong: KMS keys are stored in the cloud, violating the requirement.
B
Use server-side encryption with a customer-provided key (SSE-C).
SSE-C encrypts data at rest using a key that you provide; the cloud does not store the key.
C
Use server-side encryption with a cloud-managed key (SSE-S3).
Why wrong: Cloud-managed keys are fully managed by the provider, not by the customer.
D
Use client-side encryption where the application encrypts data before sending it to the cloud.
Why wrong: Client-side encryption is not server-side; it encrypts data before upload.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

Trap 1: Configure a VPN connection between VPCs and use route tables to…

VPN adds complexity but does not replace the need for security group rules.

Trap 2: In the network ACL for VPC B's subnet, add an inbound rule allowing…

NACLs are stateless and subnet-level; not instance-level control.

Trap 3: In the database security group, add an inbound rule allowing…

IP-based rules are less granular and do not adapt to dynamic IPs.

Study all Cloud Platform and Infrastructure Security common traps →

A
In the database security group, add an inbound rule allowing TCP/3306 from the security group ID of the web servers.
Security group referencing ensures only instances in the web security group can connect.
B
Configure a VPN connection between VPCs and use route tables to direct traffic.
Why wrong: VPN adds complexity but does not replace the need for security group rules.
C
In the network ACL for VPC B's subnet, add an inbound rule allowing TCP/3306 from VPC A CIDR.
Why wrong: NACLs are stateless and subnet-level; not instance-level control.
D
In the database security group, add an inbound rule allowing TCP/3306 from the VPC A CIDR.
Why wrong: IP-based rules are less granular and do not adapt to dynamic IPs.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

Trap 1: Grant developers full access to EC2 and rely on training.

Training is not a technical control and is less effective.

Trap 2: Use AWS Systems Manager to automatically remediate open SSH rules.

Remediation is reactive, not preventive.

Trap 3: Enable AWS Config rules to detect and alert on open SSH.

Config rules are detective, not preventive.

Study all Cloud Platform and Infrastructure Security common traps →

A
Grant developers full access to EC2 and rely on training.
Why wrong: Training is not a technical control and is less effective.
B
Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.
This IAM policy condition prevents the action at the time of request.
C
Use AWS Systems Manager to automatically remediate open SSH rules.
Why wrong: Remediation is reactive, not preventive.
D
Enable AWS Config rules to detect and alert on open SSH.
Why wrong: Config rules are detective, not preventive.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Trap 1: DeleteAccessKey

DeleteAccessKey removes an access key, the opposite of creation.

Trap 2: CreateUser

CreateUser creates a new IAM user, not an access key.

Trap 3: UpdateAccessKey

UpdateAccessKey modifies an existing key, not creates a new one.

Study all Cloud Platform and Infrastructure Security common traps →

A
CreateAccessKey
CreateAccessKey is the correct API event for creating access keys.
B
DeleteAccessKey
Why wrong: DeleteAccessKey removes an access key, the opposite of creation.
C
CreateUser
Why wrong: CreateUser creates a new IAM user, not an access key.
D
UpdateAccessKey
Why wrong: UpdateAccessKey modifies an existing key, not creates a new one.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Trap 1: Configure each account's IAM policy to deny the services.

This is not centralized and can be overridden by account admins.

Trap 2: Enable AWS Config rules to detect and disable non-approved services.

Config rules are detective and corrective, not preventive.

Trap 3: Use resource-based policies on each resource to restrict usage.

Resource policies are too granular and cannot deny service usage globally.

Study all Cloud Platform and Infrastructure Security common traps →

A
Configure each account's IAM policy to deny the services.
Why wrong: This is not centralized and can be overridden by account admins.
B
Enable AWS Config rules to detect and disable non-approved services.
Why wrong: Config rules are detective and corrective, not preventive.
C
Apply a service control policy (SCP) that denies the services.
SCPs are applied at the OU or account level and cannot be overridden by account admins.
D
Use resource-based policies on each resource to restrict usage.
Why wrong: Resource policies are too granular and cannot deny service usage globally.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

Trap 1: AWS Transit Gateway

Transit Gateway is a network transit hub, does not itself provide encryption.

Trap 2: AWS Route 53 Resolver

Route 53 Resolver is for DNS, not encryption.

Trap 3: AWS Direct Connect

Direct Connect provides a private connection but does not encrypt data by default.

Study all Cloud Platform and Infrastructure Security common traps →

A
AWS Transit Gateway
Why wrong: Transit Gateway is a network transit hub, does not itself provide encryption.
B
AWS Route 53 Resolver
Why wrong: Route 53 Resolver is for DNS, not encryption.
C
AWS Site-to-Site VPN
Site-to-Site VPN uses IPSec to encrypt all traffic between the on-premises network and VPC.
D
AWS Direct Connect
Why wrong: Direct Connect provides a private connection but does not encrypt data by default.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

Trap 1: Enable multi-factor authentication for the database user accounts.

MFA is good but does not prevent the attack from the current source if credentials are compromised.

Trap 2: Change the database port to a non-standard port.

Security by obscurity is not a reliable control.

Trap 3: Delete the database instance and restore from backup.

Too drastic and does not address the root cause.

Study all Cloud Platform and Infrastructure Security common traps →

A
Enable multi-factor authentication for the database user accounts.
Why wrong: MFA is good but does not prevent the attack from the current source if credentials are compromised.
B
Review the security group inbound rules and restrict the source IP to only the required application servers.
This limits who can attempt to connect, reducing the attack surface.
C
Change the database port to a non-standard port.
Why wrong: Security by obscurity is not a reliable control.
D
Delete the database instance and restore from backup.
Why wrong: Too drastic and does not address the root cause.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full Cloud Platform and Infrastructure Security explanation →

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

Trap 1: Use S3 event notifications to alert when a delete is attempted.

Notifications are reactive, not preventive.

Trap 2: Enable S3 Versioning on the bucket.

Versioning preserves objects but does not prevent bucket deletion.

Trap 3: Enable AWS CloudTrail to log any deletion attempt.

Logging does not prevent deletion.

Study all Cloud Platform and Infrastructure Security common traps →

A
Use S3 event notifications to alert when a delete is attempted.
Why wrong: Notifications are reactive, not preventive.
B
Enable S3 Versioning on the bucket.
Why wrong: Versioning preserves objects but does not prevent bucket deletion.
C
Enable AWS CloudTrail to log any deletion attempt.
Why wrong: Logging does not prevent deletion.
D
Apply a service control policy (SCP) to deny s3:DeleteBucket on the production account.
SCPs apply to all principals including root, and cannot be overridden within the account.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Cloud Platform and Infrastructure Security sessions

Start a Cloud Platform and Infrastructure Security only practice session

Every question in these sessions is drawn from the Cloud Platform and Infrastructure Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Cloud Platform and Infrastructure Security questions →Mixed CCSP session

Frequently asked questions

What does the CCSP exam test about Cloud Platform and Infrastructure Security?: Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Cloud Platform and Infrastructure Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Cloud Platform and Infrastructure Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CCSP topics?: Use the topic links above to move to related areas, or go back to the CCSP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CCSP exam covers. They are not copied from any real exam or dump site.

Cloud Platform and Infrastructure Security only

10 questions 20 questions 30 questions 50 questions

Mixed CCSP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CCSP questions Cloud Platform and Infrastructure Security domain overview CCSP exam guide

Exam traps to avoid

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Cloud Platform and Infrastructure Security practice questions

What to know about Cloud Platform and Infrastructure Security

Common Cloud Platform and Infrastructure Security exam traps

Cloud Platform and Infrastructure Security questions

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Exhibit

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Match each key management solution to its characteristic.

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that a specific S3 bucket in the production account cannot be deleted by anyone, including the root user of that account. Which control should be implemented?

Track your progress over time

Start a Cloud Platform and Infrastructure Security only practice session

Related CCSP topic practice pages

Cloud Application Security practice questions

Cloud Security Operations practice questions

Legal, Risk and Compliance practice questions

Cloud Concepts, Architecture and Design practice questions