CCSP Cloud Platform and Infrastructure Security 1 — Questions and Answers
Question 1: Which cloud infrastructure component acts as a logical boundary to isolate resources between different tenants or business units?
- Virtual Private Cloud (VPC) (Correct answer)
- Content Delivery Network (CDN)
- Load Balancer
- API Gateway
Correct answer: Virtual Private Cloud (VPC)
A Virtual Private Cloud (VPC) creates an isolated network segment within the cloud provider's infrastructure to separate tenant resources.
Question 2: What is the primary security concern with a hypervisor in a multi-tenant cloud environment?
- Hypervisors cannot support encrypted VMs
- A compromised hypervisor can expose all guest VMs running on that host (Correct answer)
- Hypervisors increase network latency significantly
- Hypervisors prevent the use of firewalls
Correct answer: A compromised hypervisor can expose all guest VMs running on that host
Because the hypervisor controls all VMs on a host, a vulnerability in it can allow an attacker to break out of one VM and access others on the same physical host.
Question 3: What does the term 'VM sprawl' refer to in cloud environments?
- Virtual machines consuming excessive CPU
- The uncontrolled proliferation of virtual machine instances that increases attack surface and management overhead (Correct answer)
- VMs replicating across too many regions
- VMs with outdated operating systems
Correct answer: The uncontrolled proliferation of virtual machine instances that increases attack surface and management overhead
VM sprawl occurs when virtual machines are created without proper lifecycle management, leading to forgotten, unpatched VMs that expand the attack surface.
Question 4: Which network security control is typically used at the boundary of a cloud VPC to filter inbound and outbound traffic?
- Intrusion Prevention System (IPS)
- Security Group / Network Access Control List (NACL) (Correct answer)
- Web Application Firewall (WAF)
- Data Loss Prevention (DLP)
Correct answer: Security Group / Network Access Control List (NACL)
Security Groups and NACLs are cloud-native controls that filter traffic at the VPC or subnet level based on IP, port, and protocol rules.
Question 5: What is a key security risk of using shared storage in a multi-tenant cloud environment?
- Increased latency
- Data remnance — residual data from one tenant being accessible to another (Correct answer)
- Higher cost
- Reduced redundancy
Correct answer: Data remnance — residual data from one tenant being accessible to another
Data remnance (or data remanence) is the risk that deleted data from one tenant persists on shared storage and could potentially be read by another tenant.
Question 6: In cloud infrastructure, what is infrastructure as code (IaC) primarily used for?
- Writing application source code for cloud-native apps
- Provisioning and managing infrastructure through machine-readable configuration files (Correct answer)
- Monitoring cloud resource performance
- Billing and cost management
Correct answer: Provisioning and managing infrastructure through machine-readable configuration files
IaC allows infrastructure to be defined, versioned, and deployed using code, enabling consistent, repeatable, and auditable provisioning.
CCSP Cloud Platform and Infrastructure Security 1
Which cloud infrastructure component acts as a logical boundary to isolate resources between different tenants or business units?