CCSE Cloud Security Architecture & Design 4 — Questions and Answers
Question 1: Which cloud network architecture pattern BEST prevents east-west lateral movement between application tiers?
- Single flat VPC network
- Micro-segmentation with security groups per workload (Correct answer)
- Public subnet for all tiers
- VPN tunnels between tiers
Correct answer: Micro-segmentation with security groups per workload
Micro-segmentation applies granular security group policies per workload tier, blocking lateral movement even within the same VPC.
Question 2: What is the security purpose of a Cloud Workload Protection Platform (CWPP)?
- Manage cloud billing and cost optimization
- Protect workloads at runtime from threats like malware and privilege escalation (Correct answer)
- Provide web application firewall capabilities
- Monitor cloud provider SLA compliance
Correct answer: Protect workloads at runtime from threats like malware and privilege escalation
CWPP solutions provide runtime protection for cloud workloads by monitoring process behavior, detecting anomalies, and blocking threats.
Question 3: When designing a multi-region cloud architecture for compliance, which data security concern is MOST critical?
- Latency between regions
- Data residency and sovereignty requirements (Correct answer)
- Cross-region replication costs
- Load balancer configuration
Correct answer: Data residency and sovereignty requirements
Data residency requirements mandate that certain data must remain within specific geographic boundaries, which must be enforced in multi-region designs.
Question 4: Which approach BEST reduces the risk of credential compromise in cloud-native applications?
- Store credentials in encrypted config files
- Use instance/pod identity with short-lived tokens from a secrets manager (Correct answer)
- Rotate credentials annually
- Hash credentials before storage
Correct answer: Use instance/pod identity with short-lived tokens from a secrets manager
Instance or pod identity with dynamic, short-lived tokens eliminates long-lived credentials that can be stolen and reused.
Question 5: In a cloud security reference architecture, what role does a Security Operations Center (SOC) play in the 'detect' function?
- Provisions new cloud accounts
- Monitors alerts from SIEM and cloud-native tools to identify security incidents (Correct answer)
- Approves firewall rule changes
- Manages cloud provider contracts
Correct answer: Monitors alerts from SIEM and cloud-native tools to identify security incidents
The SOC analyzes telemetry from SIEM, CSPM, and cloud-native security services to detect active threats and anomalies.
Question 6: Which cloud encryption architecture ensures that a cloud provider cannot decrypt customer data even if compelled by legal order?
- Provider-managed encryption (SSE)
- Customer-managed keys (CMK) with BYOK stored in HSM outside the provider (Correct answer)
- TLS in transit only
- Database-level encryption
Correct answer: Customer-managed keys (CMK) with BYOK stored in HSM outside the provider
Bring Your Own Key (BYOK) with keys stored in an HSM outside the provider's control ensures the provider has no ability to decrypt data.
Question 7: What is the MAIN security risk of using wildcard certificates in a cloud service mesh?
- Wildcard certificates are more expensive to renew
- Compromise of one service exposes all services using the shared wildcard certificate (Correct answer)
- Wildcard certificates do not support mutual TLS
- Certificate authorities do not issue wildcards for cloud domains
Correct answer: Compromise of one service exposes all services using the shared wildcard certificate
A stolen wildcard certificate can be used to impersonate any service in the domain, allowing an attacker to intercept traffic across all covered services.
CCSE Cloud Security Architecture & Design 4
Which cloud network architecture pattern BEST prevents east-west lateral movement between application tiers?