Cloud Platform and Infrastructure Security

CCSP · 51 questions

• A bank evaluating a public cloud provider asks to send its own auditors to inspect the physical controls at the provider's data centers. The provider declines, citing its security policy and the number of customers it serves. How should the bank obtain assurance about the provider's physical environment?
• An architect is explaining software-defined networking (SDN) in a cloud provider's infrastructure, where a central controller programs the forwarding behavior of many switches. What is the most important security implication of separating the control plane from the data plane in this way?
• A tenant running a latency-sensitive service on shared IaaS compute notices that response times degrade whenever other tenants on the same physical hosts run CPU-intensive batch jobs. No data has been exposed. How should the security team classify this issue and address it?
• A private cloud provider is choosing a hypervisor for multi-tenant production workloads. One option installs directly on the server hardware; the other runs as an application on top of a general-purpose host operating system. From a security perspective, why is the first option usually preferred?
• A provider stores many tenants' block volumes on the same physical storage array. A prospective customer asks how the provider prevents one tenant from reading another tenant's data. Which combination best describes the expected protection?
• An attacker obtained the password of a cloud administrator and signed in to the provider's web management console for the company's account. From there the attacker could create, modify or delete any resource. Which statement best describes the risk and the primary control?
• During an investigation, a team needs to know which identity changed the network security group rules in a cloud account last Tuesday and from what IP address. The virtual machine logs show only which traffic was allowed or denied. Which log source should have been enabled and retained to answer this?
• A company connects its data center to its cloud provider through a dedicated private circuit from a telecommunications carrier. The network team says traffic on the circuit does not need encryption because it does not cross the public internet. What is the best response?
• A security review finds that the organization's golden virtual machine image, used to launch hundreds of instances, contains an embedded SSH private key that grants administrative access. What is the best corrective action?
• In a provider's data center design, tenant workloads and the provider's own hypervisor management and storage replication traffic all run on the same flat network segment. Which logical design change best reduces the risk this creates?
• At a cloud provider's facility, a single operations administrator can both approve requests for access to customer equipment racks and issue and activate the badges that grant that access. Which control is missing?
• A provider is evaluating a candidate site for a new data center. The site has low land costs and good power availability, but it lies in a designated flood plain and under an airport approach path. What should the provider do first?
• A company needs private cloud capacity within six months, has limited capital to spend, and must show regulators that strict physical access controls protect its equipment. Leadership is choosing between building its own data center and leasing colocation space. Which approach best fits these requirements?
• Monitoring in a provider's data hall shows server inlet temperatures varying widely between rows, with some racks drawing in hot exhaust air from neighboring racks. Total cooling capacity is sufficient. Which environmental design change best addresses this?
• A cloud provider's data center contracts with two different internet carriers for redundancy. A site survey reveals that both carriers' fiber enters the building through the same underground conduit and the same entry room. What is the most significant resilience problem, and how should it be fixed?
• A provider's data center loses utility power. The standby generators start automatically but take several seconds to reach stable output, and some servers reboot during that gap. Which design element was missing or inadequate?
• A data center design team must ensure the facility keeps full power and cooling capacity if any single chiller or UPS module fails or is taken offline for maintenance. The budget calls for the smallest amount of extra equipment that meets this requirement. Which redundancy model fits best?
• At a provider's data center, visitors and contractors have been observed following employees through the badge-controlled door into the server hall without presenting their own credentials. Which control most directly prevents this?
• A company discovers that several business units opened cloud accounts with corporate credit cards and are running production workloads that IT and security never reviewed. The CISO wants to begin a cloud risk assessment. What should be done first?
• Management wants a quick ranking of the top risks in a new multi-cloud environment so it can prioritize funding next quarter. The organization has little reliable historical loss data for cloud incidents. Which risk analysis approach is most appropriate?
• Each outage of a cloud-hosted order system costs about USD 40,000 in lost sales and recovery, and two outages are expected per year. A safeguard costing USD 30,000 per year would cut the expected rate to one outage per year without changing the loss per outage. Based on annualized loss expectancy, is the safeguard cost-justified?
• A penetration test finds that a management API for a company's cloud workloads is reachable from the internet and accepts requests authenticated only by a static key embedded in a mobile app. How should this finding be categorized, and what is the most appropriate treatment?
• An attacker phishes a cloud administrator's credentials, signs in, launches dozens of large compute instances for cryptocurrency mining, and creates new access keys for later use. Which cloud threat best describes this incident?
• A tenant performing cryptographic operations on shared IaaS hosts is concerned that another tenant's virtual machine on the same physical server could infer its private keys by measuring timing differences in shared CPU caches. Which threat is the tenant describing?
• A company's public web application runs on autoscaling compute billed by usage. A botnet floods it with requests that look legitimate; the service stays online because it scales out, but the monthly bill rises to several times the budget. Which threat does this describe, and what control helps most?
• A company buys cyber insurance that will pay for business losses if its primary cloud provider suffers a prolonged regional outage. Which statement best describes this risk treatment?
• After a risk assessment, leadership decides not to migrate a sensitive research workload to any public cloud because no available provider can meet a data residency requirement, and the workload will remain on premises. Which risk treatment has leadership chosen, and what is its main trade-off?
• After a cloud migration, a residual risk remains that is within the organization's documented risk appetite, and further controls would cost more than the expected loss. Who should formally accept this risk, and how?
• A company runs a hybrid cloud. Most workloads are in a public cloud, but a small on-premises server room hosts identity servers and the routers for private connectivity to the cloud. The provider's SOC 2 report shows strong physical controls. What is true about physical and environmental protection for the server room?
• A vulnerability scan of newly launched IaaS virtual machines shows default services listening on many ports, including remote administration and file sharing services the workload does not use. What is the most appropriate system protection measure?
• Several teams share block volumes and snapshots containing sensitive customer data in an IaaS account. Any engineer in the account can attach a volume to an instance or copy a snapshot to another account. Which control combination best protects this storage?
• Microservices in a company's cloud application communicate with each other over plain HTTP inside a virtual network, on the assumption that the network is private. A threat model notes that a compromised service could impersonate others or read their traffic. Which control best addresses this?
• All twenty engineers on a company's cloud team share the same administrator role, with full rights to every resource in every account, including billing and identity settings. Which change best applies authorization principles to cloud administration?
• Cloud administrators use SMS one-time codes as their second factor for console sign-in. Several recent attacks used fake sign-in pages that relayed both the password and the SMS code to the real console in real time. Which MFA change best defends against this attack?
• A company creates new cloud resources daily, each tagged with a project name and a data sensitivity label. Security wants access to be granted automatically when a user's project attribute matches a resource's project tag, without creating a new role for every project. Which access control model fits best?
• Each of a company's twelve cloud accounts has its own locally created administrator and user identities with separate passwords. Offboarding often misses some accounts, leaving former employees with access. Which change best addresses the root cause?
• In a company's cloud environment, each account keeps its own management plane, network and workload logs locally, and no one reviews them unless an incident is already known. Which audit mechanism should be implemented first?
• An attack moved through three cloud accounts in two regions over several hours. Investigators have logs from all of them, but cannot reconstruct the sequence of events because each source records time differently and uses different field names for the same identity. Which capability is most needed?
• A security team needs full packet capture of traffic to a group of IaaS workloads to investigate suspected command-and-control activity. They cannot attach a physical network tap because the provider owns the switches. What is the most appropriate approach?
• A cloud security team investigating suspected data exfiltration reviews the virtual network flow logs for a compromised workload. The logs show the source, destination, ports, protocol and byte counts of a suspicious session, but the analysts need to see what was actually transmitted. Which capability would have provided that content?
• A payment authorization service runs in a single cloud region. Its business impact analysis requires that customers see no meaningful interruption and lose no committed transactions if that region fails, so both the RTO and the RPO are near zero. The board has approved a large resilience budget. Which disaster recovery strategy best fits?
• An internal reporting application has a business impact analysis showing a maximum tolerable downtime of five days and an acceptable data loss of twenty-four hours. Management wants the least costly disaster recovery approach that still meets these targets. Which strategy should the cloud security professional recommend?
• During business impact analysis for a cloud-hosted order system, the business states it can survive at most eight hours without the system. The IT recovery team then commits to restoring the system to operation within four hours of a disaster being declared. Which recovery metric is the four-hour commitment?
• The finance department of a company running its trading ledger in the cloud states that, after any disaster, no more than fifteen minutes of committed transactions may be lost. Which aspect of the disaster recovery design does this requirement most directly determine?
• While planning disaster recovery for a cloud-hosted customer portal, the business agrees that during a disaster the portal may run at half of its normal capacity until the primary environment is restored. Which planning parameter does this agreement define?
• A regulator requires a financial services firm to show that its critical cloud-hosted workloads could be recovered even if its only cloud service provider suffered a prolonged provider-wide outage or ceased operations. Which disaster recovery design best satisfies this requirement?
• A cloud security professional is drafting a new business continuity and disaster recovery plan for a group of cloud-hosted services. The business impact analysis is complete and recovery strategies have been selected. What must the plan document contain so staff can execute it during a disaster?
• A company wants to verify that its cloud disaster recovery site can actually process real workloads, but management prohibits any test that would interrupt or shift production traffic. Which type of test meets both goals?
• A newly written disaster recovery plan for a cloud-hosted ERP system has never been exercised, and several of the people it names have not yet read it. What should the organization do first to begin validating the plan?
• Eighteen months after a disaster recovery plan was approved, the application it covers was re-architected from virtual machines into containers managed by an orchestration platform. The plan still describes restoring virtual machine images. What should happen next?
• An audit of a cloud-hosted CRM finds that nightly backup jobs have reported success for two years, yet no one has ever restored data from them, and failover is a manual process documented only in one engineer's notes. Which action best addresses the audit finding?