CCSE Cloud Security Architecture & Design 2 — Questions and Answers
Question 1: Which cloud security architecture pattern uses a dedicated virtual network with no internet gateway to isolate sensitive workloads?
- Air-gapped VPC (Correct answer)
- Private subnet with NAT gateway
- Service mesh with mTLS
- Transit gateway hub-and-spoke
Correct answer: Air-gapped VPC
An air-gapped VPC has no internet gateway, ensuring complete network isolation for highly sensitive workloads.
Question 2: In a multi-cloud security architecture, what is the primary purpose of a Cloud Access Security Broker (CASB)?
- Replace on-premises firewalls
- Provide visibility and control over cloud service usage (Correct answer)
- Manage cloud provider billing
- Automate infrastructure provisioning
Correct answer: Provide visibility and control over cloud service usage
A CASB sits between users and cloud services to provide visibility, compliance enforcement, and threat protection across cloud usage.
Question 3: Which security design principle ensures that a compromised cloud component cannot access resources beyond its specific function?
- Defense in depth
- Least privilege (Correct answer)
- Separation of duties
- Zero trust
Correct answer: Least privilege
Least privilege limits each component's access to only what is required for its specific function, containing blast radius.
Question 4: A company needs to enforce consistent security policies across 50 AWS accounts. Which architecture approach is MOST efficient?
- Deploy security tools manually to each account
- Use AWS Organizations with Service Control Policies (Correct answer)
- Implement account-level IAM roles
- Configure VPC peering between all accounts
Correct answer: Use AWS Organizations with Service Control Policies
AWS Organizations with Service Control Policies (SCPs) enforces guardrails across all member accounts centrally.
Question 5: What is the security advantage of using immutable infrastructure in cloud environments?
- Reduces cloud computing costs
- Eliminates the risk of configuration drift and persistent attacks (Correct answer)
- Increases deployment speed
- Simplifies database management
Correct answer: Eliminates the risk of configuration drift and persistent attacks
Immutable infrastructure replaces rather than patches components, eliminating configuration drift and removing any persistent attacker footholds.
Question 6: Which cloud architecture pattern provides the BEST protection against data exfiltration via DNS tunneling?
- Restrict outbound HTTP traffic only
- Deploy DNS filtering and logging at the VPC resolver level (Correct answer)
- Use private hosted zones exclusively
- Disable recursive DNS lookups
Correct answer: Deploy DNS filtering and logging at the VPC resolver level
DNS filtering at the VPC resolver level inspects and blocks suspicious DNS queries used for tunneling before they leave the network.
Question 7: In a serverless architecture, which security control is MOST critical to prevent function-to-function lateral movement?
- Enable function versioning
- Assign each function the minimum IAM role required (Correct answer)
- Use environment variables for secrets
- Configure function timeout limits
Correct answer: Assign each function the minimum IAM role required
Assigning each serverless function a unique IAM role with minimum permissions prevents a compromised function from accessing other resources.
CCSE Cloud Security Architecture & Design 2
Which cloud security architecture pattern uses a dedicated virtual network with no internet gateway to isolate sensitive workloads?