CCSP Practice Questions: Cloud Platform & Infrastructure Security Domain

Correct Answer: B

Explanation: Implementing network policies to restrict traffic between containers is a critical security measure that limits exposure and potential attack vectors. Option A is incorrect as using a single image increases the attack surface. Option C is insecure because running containers with root access can lead to privilege escalation. Option D is a poor practice as storing sensitive data within images can lead to data breaches.

Correct Answer: D

Explanation: In the IaaS model, the customer is responsible for securing their virtual network, including configuring network firewalls and security groups to control traffic flow to and from their instances. While IAM policies are crucial, they are a broader concern not specific to IaaS. The security of the hypervisor is the responsibility of the cloud provider, and securing application code is more relevant to the application layer.

Correct Answer: B

Explanation: Multi-Factor Authentication (MFA) is a critical control for securing access to the management plane, as it significantly reduces the risk of unauthorized access by requiring additional authentication factors. Network segmentation (A) and patching (D) are important but do not directly protect the management plane access. A WAF (C) is more relevant for application layer security rather than management plane protection.

Correct Answer: B

Explanation: Implementing a third-party key management solution integrated with AWS provides greater control and flexibility over encryption keys, which is crucial for meeting regulatory requirements. This approach allows organizations to manage keys independently of the cloud provider. While AWS KMS with AWS-managed keys (option A) is convenient, it may not meet specific compliance needs. On-premises HSMs (option C) can be used but may lack integration benefits. Relying solely on AWS default settings (option D) does not provide sufficient key management control.

Correct Answer: B

Explanation: Using a container registry with vulnerability scanning capabilities is a best practice for ensuring the security of containerized applications. This helps identify and remediate vulnerabilities before deployment. Option A poses a security risk, option C hinders incident response, and option D increases the risk of network attacks.

Correct Answer: B

Explanation: Hardware-assisted virtualization extensions (such as Intel VT-x or AMD-V) provide hardware-level isolation between virtual machines, ensuring that tenants cannot access each other's memory, CPU states, or other resources. This hardware-based isolation is more secure than software-only isolation.

Correct Answer: C

Explanation: Regularly updating container images and using a vulnerability scanning tool helps to identify and mitigate vulnerabilities in the container environment, ensuring that the latest security patches are applied. While network segmentation (option B) and WAFs (option D) provide additional layers of security, they do not directly address vulnerabilities within the container images themselves. HIDS (option A) is useful but not specific to container security.

Correct Answer: B

Explanation: Implementing network segmentation to isolate containers from each other is crucial to prevent lateral movement in case of a security breach. This helps contain any potential compromise within a specific segment. Running containers with root privileges (Option C) is a security risk and should be avoided. Disabling logging (Option D) reduces visibility and can hinder incident response efforts. Using default settings (Option A) can introduce vulnerabilities if not properly configured.

Correct Answer: A

Explanation: Enabling multi-factor authentication (MFA) for all administrative access is a critical security measure for protecting the management plane. It adds an additional layer of security by requiring a second factor of authentication, reducing the risk of unauthorized access. Using a single admin account, relying solely on encryption for data in transit, and disabling monitoring and logging are not sufficient to secure the management plane.

Correct Answer: B

Explanation: Implementing multi-factor authentication (MFA) for all management plane access significantly reduces the risk of unauthorized access by requiring an additional verification factor beyond just a password. Option A, while important, is a reactive measure. Option C, IP whitelisting, can enhance security but is less effective if credentials are compromised. Option D, regular security audits, are important but do not actively prevent unauthorized access.