CISSP CISSP Cloud Security 3

Question 1

Which attestation report type provides a confidential SOC 2 security report shared only with customers under NDA?

Accepted Answer

SOC 2 Type II

Answer

SOC 2 Type II covers a period of time (vs. a point in time) and is restricted to customers, while SOC 3 is the public version.

Question 2

What is hypervisor type 1 (bare-metal) most commonly used for in cloud environments?

Accepted Answer

Running directly on hardware to host multiple guest VMs for cloud workloads

Answer

Type 1 hypervisors run directly on physical hardware without a host OS, providing the efficient multi-tenant isolation that cloud platforms require.

Question 3

What security control helps prevent unauthorized data exfiltration from cloud storage buckets?

Accepted Answer

Bucket policy with least-privilege access and public access block settings

Answer

Restricting bucket policies to least-privilege and enabling public access blocks prevents unintended public exposure of cloud storage objects.

Question 4

Which cloud security principle states that workloads should be isolated so that a compromise in one does not affect others?

Accepted Answer

Blast radius reduction

Answer

Blast radius reduction limits the impact of a security incident by isolating workloads through segmentation and micro-perimeters.

Question 5

What does FedRAMP require for cloud services used by US federal agencies?

Accepted Answer

Standardized security assessment, authorization, and continuous monitoring

Answer

FedRAMP establishes a standardized government-wide approach for security assessment, authorization, and continuous monitoring of cloud products.

CISSP - Certified Information Systems Security Professional Practice Test