SSCP Systems and Application Security Practice Question
A cloud security team is implementing CSPM (Cloud Security Posture Management) for their IaaS environment. Which THREE issues is CSPM MOST likely to detect? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM roles with overly permissive policies
CSPM detects misconfigurations such as open security groups, unencrypted storage, and excessive IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IAM roles with overly permissive policies
Why this is correct
CSPM identifies privilege risks.
- ✓
Open security groups allowing unrestricted inbound access
Why this is correct
Misconfigured security groups are common findings.
- ✗
Outdated OS patches on cloud VMs
Why it's wrong here
Patch management is typically CWPP or vulnerability scanning.
- ✓
Unencrypted S3 buckets
Why this is correct
CSPM scans for missing encryption.
- ✗
Runtime malware in a virtual machine
Why it's wrong here
Runtime threats are detected by CWPP, not CSPM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A cloud security team is implementing a Cloud Security Posture Management (CSPM) tool. What is the primary purpose of a CSPM solution?
medium- A.Manage user identities and access
- B.Protect workloads from runtime threats
- C.Encrypt data at rest
- ✓ D.Detect and remediate cloud misconfigurations
Why D: CSPM tools automate the detection of misconfigurations and compliance violations in cloud environments.
Variation 2. A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?
hard- A.An application running on a cloud VM has a memory leak causing performance degradation
- ✓ B.A cloud storage bucket is configured with public read access
- C.A cloud-based database is experiencing slow query response times
- D.An employee's credentials were used from an unusual geographic location
Why B: CSPM tools scan cloud environments for misconfigurations like publicly accessible storage buckets, excessive permissions, etc. An open S3 bucket is a classic misconfiguration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.