CCP Cloud Workload Protection 2 — Questions and Answers
Question 1: Which technology provides runtime protection for containerized workloads by monitoring system calls and blocking anomalous behavior?
- Web Application Firewall
- Runtime Application Self-Protection (RASP) (Correct answer)
- Container Security Runtime (CSR)
- Network Access Control (NAC)
Correct answer: Runtime Application Self-Protection (RASP)
RASP monitors and intercepts system calls at runtime to detect and block anomalous behavior within containerized workloads.
Question 2: A security team discovers that a cloud VM is exfiltrating data to an unknown IP address. What is the BEST immediate containment action?
- Terminate the VM immediately
- Isolate the VM using security group rules to block outbound traffic (Correct answer)
- Take a snapshot and continue monitoring
- Reboot the VM to clear the malware
Correct answer: Isolate the VM using security group rules to block outbound traffic
Isolating the VM via security group rules stops the exfiltration while preserving forensic evidence for investigation.
Question 3: What is the primary purpose of a Cloud Workload Protection Platform (CWPP)?
- To manage cloud billing and cost optimization
- To provide visibility and protection for workloads across hybrid and multi-cloud environments (Correct answer)
- To configure cloud network topology
- To manage user identity and access provisioning
Correct answer: To provide visibility and protection for workloads across hybrid and multi-cloud environments
CWPPs are designed to secure workloads (VMs, containers, serverless) across hybrid and multi-cloud environments with unified visibility.
Question 4: In the context of cloud workload protection, what does 'shift-left security' mean?
- Moving security operations to a different geographic region
- Integrating security earlier in the software development lifecycle (Correct answer)
- Shifting security responsibility to the cloud provider
- Prioritizing left-side firewall rules in security groups
Correct answer: Integrating security earlier in the software development lifecycle
Shift-left security means incorporating security controls and testing earlier in the CI/CD pipeline rather than only at deployment.
Question 5: Which serverless security concern is unique compared to traditional VM-based workload protection?
- Lack of network connectivity
- Inability to use encryption
- Ephemeral execution environment making persistent agent-based protection impractical (Correct answer)
- No support for IAM roles
Correct answer: Ephemeral execution environment making persistent agent-based protection impractical
Serverless functions are ephemeral and short-lived, making traditional persistent agent-based security tools impractical for protection.
Question 6: What is a 'golden image' in the context of cloud workload security?
- A cloud provider's premium support tier
- A hardened, pre-approved VM or container image used as a secure baseline for deployments (Correct answer)
- A backup snapshot stored in object storage
- An image with maximum performance settings enabled
Correct answer: A hardened, pre-approved VM or container image used as a secure baseline for deployments
A golden image is a hardened, security-vetted baseline image that serves as the approved template for cloud workload deployments.
Question 7: Which approach best addresses the security challenge of workloads that auto-scale dynamically in cloud environments?
- Manual security review of each new instance
- Immutable infrastructure with security baked into the image pipeline (Correct answer)
- Disabling auto-scaling to maintain a fixed number of instances
- Applying security patches after each scale-out event
Correct answer: Immutable infrastructure with security baked into the image pipeline
Immutable infrastructure ensures every auto-scaled instance starts from a pre-hardened image, eliminating configuration drift and manual security gaps.
CCP Cloud Workload Protection 2
Which technology provides runtime protection for containerized workloads by monitoring system calls and blocking anomalous behavior?