CCSP Cloud Platform and Infrastructure Security 2 — Questions and Answers
Question 1: What is the purpose of a bastion host (jump server) in cloud infrastructure security?
- To load balance traffic across multiple servers
- To provide a hardened, monitored single entry point for administrative access to private network resources (Correct answer)
- To encrypt all traffic within the VPC
- To store encryption keys for cloud resources
Correct answer: To provide a hardened, monitored single entry point for administrative access to private network resources
A bastion host is a specially secured server that serves as the sole access point for SSH/RDP into private cloud networks, reducing the attack surface.
Question 2: Which cloud service model places the MOST infrastructure security responsibility on the cloud customer?
- Software as a Service (SaaS)
- Platform as a Service (PaaS)
- Infrastructure as a Service (IaaS) (Correct answer)
- Function as a Service (FaaS)
Correct answer: Infrastructure as a Service (IaaS)
In IaaS, the customer manages the OS, middleware, runtime, and applications, making them responsible for the largest share of security controls.
Question 3: What is a security group in AWS cloud infrastructure?
- A group of IAM users with shared permissions
- A virtual stateful firewall that controls inbound and outbound traffic for cloud instances (Correct answer)
- A compliance framework grouping
- A collection of encryption keys managed together
Correct answer: A virtual stateful firewall that controls inbound and outbound traffic for cloud instances
AWS Security Groups act as virtual stateful firewalls at the instance level, allowing administrators to define traffic rules based on port, protocol, and source/destination.
Question 4: What does the principle of immutable infrastructure mean in cloud security?
- Infrastructure that cannot be encrypted
- Servers are never modified after deployment; changes are made by replacing instances with new ones (Correct answer)
- Infrastructure that is always available with 100% uptime
- Cloud resources that cannot be deleted
Correct answer: Servers are never modified after deployment; changes are made by replacing instances with new ones
Immutable infrastructure replaces running instances rather than patching them in place, reducing configuration drift and ensuring a known-good state.
Question 5: Which attack targets the management plane of a cloud environment to gain control over provisioning and configuration?
- SQL injection
- Cross-site scripting (XSS)
- Cloud management plane attack / API abuse (Correct answer)
- DNS poisoning
Correct answer: Cloud management plane attack / API abuse
The cloud management plane (control plane) is a high-value attack target because compromise of the API or console gives an attacker control over all cloud resources.
Question 6: What is the main purpose of a Cloud Access Security Broker (CASB)?
- To replace the cloud provider's built-in firewall
- To act as an intermediary that enforces security policies between cloud users and cloud services (Correct answer)
- To provide multi-factor authentication to cloud portals
- To encrypt data before it reaches the cloud provider
Correct answer: To act as an intermediary that enforces security policies between cloud users and cloud services
A CASB sits between cloud service consumers and providers to enforce visibility, compliance, data security, and threat protection policies.
CCSP Cloud Platform and Infrastructure Security 2
What is the purpose of a bastion host (jump server) in cloud infrastructure security?