CSS Cloud Security & Infrastructure Protection 2 — Questions and Answers
Question 1: What is the recommended approach for managing privileged access in cloud environments?
- Using shared administrator accounts to improve operational efficiency
- Implementing just-in-time (JIT) access with least privilege principles (Correct answer)
- Storing privileged credentials directly in application environment variables
- Granting all administrators full access to simplify permissions management
Correct answer: Implementing just-in-time (JIT) access with least privilege principles
JIT access grants elevated permissions only when operationally required and for a limited duration, minimizing the attack surface while adhering to least privilege.
Question 2: What security vulnerability is MOST associated with serverless (Function as a Service) architectures?
- Complete loss of network connectivity due to ephemeral compute nodes
- Event-data injection attacks via malicious data passed through function triggers (Correct answer)
- Unauthorized physical access to the servers running the functions
- Inability to apply encryption to data processed by serverless functions
Correct answer: Event-data injection attacks via malicious data passed through function triggers
Serverless functions are triggered by events that can carry attacker-controlled data, making input validation against injection attacks a critical security concern.
Question 3: Which control best addresses the risk of a cloud provider outage disrupting business operations?
- Implementing multi-cloud or hybrid cloud redundancy strategies (Correct answer)
- Reducing the total number of cloud services the organization uses
- Storing all disaster recovery backups on the same cloud provider
- Disabling automatic updates in the cloud environment to prevent change-related outages
Correct answer: Implementing multi-cloud or hybrid cloud redundancy strategies
Distributing workloads across multiple cloud providers or a hybrid environment eliminates single-provider dependency and improves resilience against outages.
Question 4: What is Infrastructure as Code (IaC) security scanning?
- Reviewing the physical configurations of cloud data center servers for vulnerabilities
- Analyzing IaC templates such as Terraform or CloudFormation for misconfigurations before deployment (Correct answer)
- Scanning cloud network traffic for malicious executable code
- Encrypting all infrastructure configuration files stored in version control
Correct answer: Analyzing IaC templates such as Terraform or CloudFormation for misconfigurations before deployment
IaC security scanning detects security misconfigurations in infrastructure templates before they are deployed, enabling shift-left security and preventing issues from reaching production.
Question 5: Which encryption protocol version is considered best practice for protecting data in transit within cloud environments?
- SSL 3.0 for maximum compatibility with legacy systems
- TLS 1.2 or higher for all cloud communications (Correct answer)
- MD5-based HMAC for lightweight authentication of cloud API calls
- Symmetric AES-128 with a shared key distributed to all service accounts
Correct answer: TLS 1.2 or higher for all cloud communications
TLS 1.2 and TLS 1.3 are the current industry standards for securing data in transit; earlier versions contain known vulnerabilities and should not be used.
Question 6: What is a primary security advantage of immutable infrastructure in cloud environments?
- It prevents all network-based attacks by blocking inbound connections
- It eliminates configuration drift and reduces the attack surface of long-running systems (Correct answer)
- It automatically encrypts all data stored on cloud volumes
- It enforces MFA for all users accessing cloud resources
Correct answer: It eliminates configuration drift and reduces the attack surface of long-running systems
Immutable infrastructure replaces instances rather than patching them, preventing configuration drift and ensuring every deployment starts from a known-good, consistent state.
Question 7: What is the key security benefit of cloud-native security tools compared to third-party alternatives?
- They are always less expensive than equivalent third-party solutions
- They offer deeper integration with provider APIs and native telemetry for broader visibility (Correct answer)
- They require zero configuration or tuning by security teams after deployment
- They completely replace the need for identity and access management controls
Correct answer: They offer deeper integration with provider APIs and native telemetry for broader visibility
Cloud-native security tools leverage deep API integration and platform telemetry that third-party tools cannot always access, enabling more comprehensive detection and automated response.
CSS Cloud Security & Infrastructure Protection 2
What is the recommended approach for managing privileged access in cloud environments?