CCP CASB & Cloud Security Posture 3 — Questions and Answers
Question 1: What does the CIS Cloud Security Benchmark primarily provide?
- Legal compliance requirements for cloud providers
- Prescriptive configuration guidelines for securing cloud environments (Correct answer)
- A framework for cloud vendor contract negotiations
- Penetration testing methodology for cloud APIs
Correct answer: Prescriptive configuration guidelines for securing cloud environments
CIS Benchmarks offer prescriptive, consensus-based configuration best practices that CSPM tools use as baseline checks for cloud resource hardening.
Question 2: An attacker exfiltrates data from a cloud environment by encoding it in DNS queries to an external resolver. Which control would MOST effectively detect this?
- Cloud-native WAF rule
- CASB API integration scanning storage
- DNS query logging and anomaly detection (Correct answer)
- Egress firewall blocking port 443
Correct answer: DNS query logging and anomaly detection
DNS exfiltration bypasses traditional network controls, so logging DNS queries and analyzing volume/entropy anomalies is the most effective detection approach.
Question 3: Which CASB control mode allows an administrator to warn users about policy violations and let them proceed, while logging their decision?
- Block mode
- Coaching/justify mode (Correct answer)
- Quarantine mode
- Encrypt mode
Correct answer: Coaching/justify mode
Coaching (or justify) mode presents a policy warning and requires users to provide a business justification before proceeding, balancing security with productivity.
Question 4: A CSPM tool identifies that multi-factor authentication is not enforced for privileged cloud console accounts. Under which compliance framework would this most likely be cited as a finding?
- PCI DSS Requirement 8
- HIPAA Security Rule § 164.312(d)
- SOC 2 CC6.1
- All of the above frameworks address MFA for privileged accounts (Correct answer)
Correct answer: All of the above frameworks address MFA for privileged accounts
PCI DSS, HIPAA, and SOC 2 all require strong authentication controls for privileged access, making this a cross-framework compliance gap.
Question 5: Which cloud security concept describes the practice of deploying security controls as code within CI/CD pipelines to catch misconfigurations before deployment?
- Cloud-native application protection (CNAPP)
- Shift-left security (Correct answer)
- Runtime application self-protection (RASP)
- Cloud access brokering
Correct answer: Shift-left security
Shift-left security integrates security testing and policy checks early in the software development lifecycle, preventing misconfigurations from reaching production.
Question 6: What is the purpose of a Cloud Infrastructure Entitlement Management (CIEM) solution?
- Encrypt data stored in cloud object storage
- Discover and right-size excessive permissions across cloud identities (Correct answer)
- Monitor network flows between cloud services
- Detect malware in cloud workloads
Correct answer: Discover and right-size excessive permissions across cloud identities
CIEM solutions analyze identity permissions across cloud environments to identify and remediate over-privileged accounts, service principals, and roles.
Question 7: A company's CASB reports high usage of an unapproved file-sharing app. The security team decides to formally sanction it with DLP controls rather than block it. What is this approach called?
- Shadow IT remediation
- Risk acceptance with compensating controls (Correct answer)
- Threat modeling
- Application whitelisting
Correct answer: Risk acceptance with compensating controls
Formally approving a previously shadow IT application and applying compensating controls (like DLP) is a documented risk acceptance decision.
CCP CASB & Cloud Security Posture 3
What does the CIS Cloud Security Benchmark primarily provide?