Cloud Security Operations

CCSP · 51 questions

A cloud provider's architect needs hardware to generate and protect thousands of tenant master keys with tamper-resistant, high-throughput cryptographic operations. Separately, each hypervisor host must record measurements of its own boot components. Which pairing is correct?
A cloud platform team discovers that new object storage containers are created publicly readable and unencrypted unless an engineer remembers to change the settings, and several have already been exposed. Which principle should guide the fix?
A team installs a virtualization management console on a server with a public IP address so administrators can manage hosts from home. The console still uses the vendor's default administrator account. What should the cloud security professional recommend?
A review of the organization's standard virtual machine template finds virtual floppy, CD-ROM, serial port and USB controllers attached to every image, although no workload uses them. What is the best action?
On a private cloud virtualization cluster, host management, storage replication, live migration and tenant VM traffic all share one virtual network interface and a single network. What design change best reduces the risk this creates?
Administrators have been installing guest OS virtualization toolsets, the drivers and agents that integrate VMs with the hypervisor, by downloading them from a third-party mirror site. What should the security policy require instead?
A cloud provider wants each hypervisor host to prove that it booted untampered firmware, boot loader and kernel before the orchestrator is allowed to schedule tenant workloads onto it. Which mechanism provides this assurance?
A cloud security review finds that RDP is open to the internet on every Windows VM in the customer's IaaS environment, so administrators can connect from anywhere. What is the best remediation?
All six administrators of a Linux server fleet in the cloud use the same SSH private key, which is kept on a shared file server. One administrator has just left the company. What is the best long-term fix?
Engineers sign in to the cloud management console, the monitoring platform and the CI/CD system with separate local accounts, each with its own password. Several accounts belonging to former staff are still active. What should the security team implement?
In a private cloud, hypervisor management interfaces sit on the same layer 2 broadcast domain as tenant virtual machines, so tenant workloads can reach management services directly. Which network control best addresses this?
Users of a cloud-hosted service are being sent to a malicious site by forged DNS responses injected into resolver caches. The operations team proposes deploying DNSSEC for the service's zones. What does DNSSEC provide in this case?
Twelve branch offices must send internal traffic to workloads in the organization's virtual network in a public cloud. That traffic currently crosses the internet unencrypted, and dedicated private circuits are not in the budget. What is the most appropriate solution?
A cloud security team wants to stop known exploit traffic before it reaches its web servers, and separately wants to study attacker techniques without putting production systems at risk. Which combination fits these goals?
A quarterly audit finds that many Linux and Windows servers in the organization's cloud environment no longer match the approved hardened build, because settings were changed by hand during troubleshooting. Which approach best prevents this from recurring?
Monthly patches applied directly to running production servers in the organization's IaaS environment have repeatedly broken applications, and teams now delay patching for months. Which process best balances security and stability?
A host in the organization's private cloud cluster needs a firmware update that requires a reboot. Tenant workloads on that host have availability commitments. What should the operations team do?
In a private cloud virtualization cluster, some hosts run at sustained high CPU while others sit nearly idle, and tenant VMs on the busy hosts are suffering slow response times. Which capability addresses this automatically?
After an outage, operations discovers that several hypervisor hosts had rising fan speeds, high temperatures and disk errors for days beforehand, but nobody noticed. What should be implemented?
A private cloud team backs up hypervisor host configurations every night, but nobody has ever restored a guest VM from backup, and an auditor questions whether recovery would actually work. What should the team do?
During an active attack, the SOC needs to block an attacker's IP range at the cloud firewall immediately. The organization's change advisory board normally meets once a week. What is the correct approach?
An operations team uses the terms release and deployment interchangeably. The service manager wants to separate the two responsibilities in line with ITIL practices. Which distinction is correct?
Before approving a change to a shared cloud load balancer, the change board cannot tell which applications, certificates and network rules depend on it. Which practice fills this gap?
The same storage latency outage happens almost every week. Each time, the service desk restarts a service, restores normal operation and closes the ticket, and nothing else is done. Which practice is missing?
A company relies on a cloud provider for a critical service. Leadership wants regular reports comparing the provider's actual availability and response times with the targets in the contract, and formal reviews whenever targets are missed. Which practice is this?
A cloud-hosted ordering service never goes down, but response times climb sharply at month-end peaks and customers abandon their orders. Which management practice is primarily responsible for addressing this?
The business continuity office has published recovery priorities based on its business impact analysis. The cloud operations team must now make sure its IT service recovery plans support those priorities. Which operational practice is responsible?
An operations director wants a repeatable method to measure cloud service performance, identify improvement opportunities, and track those improvements to completion, instead of fixing issues on an ad hoc basis. Which practice fits this goal?
A cloud service provider's board wants to adopt a certifiable management system that sets information security objectives, assesses risk, selects controls and drives continual improvement of the security program. Which standard should it adopt?
A cloud provider already follows ITIL practices and now wants an independent, third-party certification of its IT service management capability that it can show to customers. What should it pursue?
A CIO wants a framework for the governance and management of enterprise information and technology that aligns IT goals with business objectives and stakeholder value. Other executives have proposed frameworks built for internal control over financial reporting, prioritized technical safeguards, or a catalog of security controls. Which framework fits the CIO's purpose?
An IaaS virtual machine is confirmed compromised and is still running. The investigation may support legal action, and the responder must choose an evidence collection sequence. Which sequence best preserves the evidence?
A company suspects that data was exfiltrated through its SaaS customer relationship management application. It has no access to the provider's servers, hypervisors or storage. What most determines what forensic evidence the company can obtain?
A disk image taken from a cloud VM will pass between three analysts and an external lab over several weeks and may be presented in court. Which practice best demonstrates that the evidence was not altered and is properly accounted for?
A cloud workload has been confirmed compromised. A junior analyst wants to terminate the instance immediately to stop the attack. What should the incident lead direct instead?
Investigators need evidence from a shared cloud storage system on which the suspect tenant's data is interleaved with data belonging to many other tenants. What must the evidence acquisition approach account for?
A forensic team wants an international standard that provides guidelines for identifying, collecting, acquiring and preserving potential digital evidence, including from cloud systems. Which standard should it adopt for these activities?
A company is negotiating with a SaaS vendor that will process its customers' personal data. The company must meet its own regulatory breach-reporting deadlines. What should the contract specify regarding incident communication?
A cloud-hosted retailer has confirmed a breach of customer data. The marketing team wants to publish a reassuring public statement immediately, before the facts are verified. What is the best approach to customer communication?
A company jointly delivers a cloud service with a partner, and each organization operates different components. An incident now affects both organizations. How should communication with the partner be handled?
An EU-based retailer runs its customer portal on a public cloud platform. Its investigation confirms that personal data of EU residents was exfiltrated and that the breach is likely to result in a risk to those individuals' rights and freedoms. Acting as the controller under the GDPR, which communication obligation applies to the retailer?
During an active security incident at a SaaS company, journalists and investors begin calling engineers on the response team directly and asking what happened, how many customers are affected and whether data was stolen. What should the incident manager do?
A security operations center built around network taps and endpoint agents in the company's own data centers must now cover new IaaS and PaaS workloads, where it has no access to the provider's physical network. What should the SOC manager prioritize?
A SOC receives thousands of static-threshold alerts a day from its cloud workloads. Most are false positives, analysts have begun ignoring whole alert categories, and a recent credential misuse attack went unnoticed among the noise. Which approach best addresses this problem?
A company sends logs from its cloud management plane, web application firewall, guest operating systems and several SaaS applications to one platform. Each source uses different field names, formats and time zones, so analysts cannot link related events into a single attack sequence. Which SIEM capability addresses this?
A SIEM alert shows a cloud virtual machine making repeated outbound connections to an external IP address and domain. Analysts cannot tell whether these are known command-and-control servers or a legitimate partner service, so triage takes hours. Which capability would most directly speed up this decision?
Malware is spreading laterally between virtual machines in a company's IaaS virtual network. An analyst wants to immediately reimage the first infected virtual machine to remove the malware. According to the incident response lifecycle, what should happen before eradication?
Management plane logs show that a long-lived access key belonging to a service account is being used right now from an unfamiliar IP address to launch compute instances in regions the company never uses. What is the most effective immediate containment step?
A quarterly vulnerability scan of a company's IaaS Linux instances is run from the network without any credentials. It reports only a handful of low findings, even though the instance images have not been patched in months. What best explains the result, and how should the scanning be improved?
A company's security team plans a penetration test of its IaaS tenancy and proposes including attacks against the shared storage service and the hypervisor because a weakness there could affect its workloads. What should the team do before testing begins?
A chief financial officer asks why the company pays for an annual third-party penetration test of its cloud application when the security team already runs weekly automated vulnerability scans of the same environment. Which explanation is most accurate?