CCSE Cloud Security Architecture & Design 3 — Questions and Answers
Question 1: Which security architecture approach treats every network request as potentially hostile, regardless of source location?
- Perimeter-based security
- Zero trust architecture (Correct answer)
- Defense in depth
- Network segmentation
Correct answer: Zero trust architecture
Zero trust architecture assumes no implicit trust based on network location, requiring verification for every access request.
Question 2: A cloud security engineer is designing a system to detect misconfigured S3 buckets across 200 accounts. Which tool category is MOST appropriate?
- Web Application Firewall
- Cloud Security Posture Management (CSPM) (Correct answer)
- Intrusion Detection System
- Data Loss Prevention
Correct answer: Cloud Security Posture Management (CSPM)
CSPM tools continuously assess cloud configurations against security best practices and compliance frameworks across multiple accounts.
Question 3: What is the PRIMARY security benefit of deploying applications using containers compared to traditional VMs?
- Containers are inherently more secure than VMs
- Smaller attack surface due to minimal OS dependencies (Correct answer)
- Containers cannot be exploited by malware
- Container images are always scanned automatically
Correct answer: Smaller attack surface due to minimal OS dependencies
Containers package only the application and its dependencies, resulting in a smaller attack surface compared to full OS virtual machines.
Question 4: Which cloud design pattern uses multiple redundant security controls so that failure of one does not compromise overall security?
- Fail-open design
- Defense in depth (Correct answer)
- Single point of control
- Micro-segmentation
Correct answer: Defense in depth
Defense in depth layers multiple security controls so that bypassing one layer does not grant full system access.
Question 5: In cloud security architecture, what is the purpose of a 'security landing zone'?
- A physical data center location
- A pre-configured baseline environment with security guardrails for new accounts (Correct answer)
- A disaster recovery site
- An intrusion detection sensor placement
Correct answer: A pre-configured baseline environment with security guardrails for new accounts
A security landing zone provides a standardized, pre-hardened multi-account environment with centralized logging, IAM policies, and guardrails.
Question 6: Which architecture pattern BEST addresses insider threat risks in a cloud environment handling sensitive financial data?
- Network segmentation only
- Separation of duties with dual authorization for critical operations (Correct answer)
- Single admin account with audit logging
- Encrypted storage volumes
Correct answer: Separation of duties with dual authorization for critical operations
Separation of duties with dual authorization requires multiple parties to approve critical operations, preventing any single insider from acting maliciously.
Question 7: A security engineer needs to ensure cloud API calls are authentic and tamper-proof. Which mechanism is MOST appropriate?
- TLS encryption only
- Request signing with HMAC using access key secrets (Correct answer)
- IP allowlisting
- Rate limiting
Correct answer: Request signing with HMAC using access key secrets
HMAC request signing (like AWS Signature Version 4) ensures API requests are authenticated and have not been tampered with in transit.
CCSE Cloud Security Architecture & Design 3
Which security architecture approach treats every network request as potentially hostile, regardless of source location?