CCSE Cloud Security Architecture & Design 5 — Questions and Answers
Question 1: Which cloud architecture pattern is MOST effective for protecting against cloud account takeover through compromised administrative credentials?
- Complex password policies
- Privileged Access Workstations (PAW) combined with MFA and just-in-time access (Correct answer)
- Longer session tokens
- IP-based access restrictions only
Correct answer: Privileged Access Workstations (PAW) combined with MFA and just-in-time access
PAWs with MFA and just-in-time access significantly reduce the attack window and ensure administrative access requires multiple strong controls.
Question 2: In cloud security architecture, what is 'blast radius reduction'?
- Minimizing cloud deployment region count
- Limiting the scope of damage a single security failure can cause (Correct answer)
- Reducing firewall rule complexity
- Compressing log data to save storage
Correct answer: Limiting the scope of damage a single security failure can cause
Blast radius reduction involves isolating components, applying least privilege, and segmenting networks so that a single failure cannot cascade across the system.
Question 3: Which secure design principle BEST addresses the risk of supply chain attacks targeting cloud-deployed container images?
- Deploy containers from any public registry
- Use only signed, verified images from trusted private registries with vulnerability scanning (Correct answer)
- Allow only Kubernetes pods to pull images
- Disable container restart policies
Correct answer: Use only signed, verified images from trusted private registries with vulnerability scanning
Signed images from private, scanned registries ensure that only verified, untampered software is deployed into production environments.
Question 4: A security architect is reviewing a cloud design where developers have direct production access. Which control BEST mitigates this risk without disrupting velocity?
- Require manual change approval for all code
- Implement CI/CD pipelines with automated security gates and no direct production access (Correct answer)
- Audit production access logs weekly
- Encrypt all production environment variables
Correct answer: Implement CI/CD pipelines with automated security gates and no direct production access
CI/CD pipelines with automated security testing enforce consistent checks while removing the need for developers to have direct production access.
Question 5: Which cloud architecture approach BEST ensures that a ransomware attack encrypting primary storage cannot destroy backup data?
- Store backups in the same account with different permissions
- Maintain immutable, versioned backups in a separate account with write-once-read-many (WORM) policies (Correct answer)
- Compress backups to reduce attack surface
- Use the same encryption key for primary and backup storage
Correct answer: Maintain immutable, versioned backups in a separate account with write-once-read-many (WORM) policies
Immutable WORM backups in an isolated account cannot be encrypted or deleted by ransomware even if primary account credentials are compromised.
Question 6: In a shared responsibility model, which security control for a SaaS application is ALWAYS the customer's responsibility?
- Physical data center security
- Hypervisor patching
- Identity and access management for user accounts (Correct answer)
- Network infrastructure maintenance
Correct answer: Identity and access management for user accounts
Regardless of cloud model (IaaS/PaaS/SaaS), customers always retain responsibility for managing their own user identities and access controls.
Question 7: Which cloud security architecture control BEST detects when an attacker uses valid credentials to perform unusual data access patterns?
- Static IAM policy review
- User and Entity Behavior Analytics (UEBA) with machine learning baselines (Correct answer)
- Network firewall rules
- Multi-factor authentication enforcement
Correct answer: User and Entity Behavior Analytics (UEBA) with machine learning baselines
UEBA establishes behavioral baselines and flags anomalous access patterns that could indicate credential misuse even when authentication succeeds.
CCSE Cloud Security Architecture & Design 5
Which cloud architecture pattern is MOST effective for protecting against cloud account takeover through compromised administrative credentials?