CCSP Cloud Platform and Infrastructure Security 2

Question 1

What is the purpose of a bastion host (jump server) in cloud infrastructure security?

Accepted Answer

To provide a hardened, monitored single entry point for administrative access to private network resources

Answer

A bastion host is a specially secured server that serves as the sole access point for SSH/RDP into private cloud networks, reducing the attack surface.

Question 2

Which cloud service model places the MOST infrastructure security responsibility on the cloud customer?

Accepted Answer

Infrastructure as a Service (IaaS)

Answer

In IaaS, the customer manages the OS, middleware, runtime, and applications, making them responsible for the largest share of security controls.

Question 3

What is a security group in AWS cloud infrastructure?

Accepted Answer

A virtual stateful firewall that controls inbound and outbound traffic for cloud instances

Answer

AWS Security Groups act as virtual stateful firewalls at the instance level, allowing administrators to define traffic rules based on port, protocol, and source/destination.

Question 4

What does the principle of immutable infrastructure mean in cloud security?

Accepted Answer

Servers are never modified after deployment; changes are made by replacing instances with new ones

Answer

Immutable infrastructure replaces running instances rather than patching them in place, reducing configuration drift and ensuring a known-good state.

Question 5

Which attack targets the management plane of a cloud environment to gain control over provisioning and configuration?

Accepted Answer

Cloud management plane attack / API abuse

Answer

The cloud management plane (control plane) is a high-value attack target because compromise of the API or console gives an attacker control over all cloud resources.

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP - Certified Cloud Security Professional Exam Practice Test

CCSP Cloud Platform and Infrastructure Security 2