Free CCSKV5 sample questions

Correct answer: Use a customer-managed key stored in the cloud provider's Key Management Service (KMS).

Using a customer-managed key (CMK) within the provider's KMS gives the organization full control over the key's lifecycle, including the ability to disable or delete it. Deleting the key effectively renders the data it encrypted inaccessible, achieving the goal of crypto-shredding. This provides the required control without the complexity of managing a separate HSM or client-side encryption.

Correct answer: Principle of least privilege and individual accountability

The principle of least privilege dictates that users and services should only be granted the minimum permissions necessary to perform their tasks. Using a root account provides maximum, unrestricted permissions. Furthermore, using a shared account violates the principle of individual accountability, as it becomes impossible to trace actions back to a specific person.

Correct answer: False

In a Serverless/FaaS model, the cloud service provider manages the entire underlying infrastructure, including the physical hardware, hypervisor, and the operating system of the execution environment. The customer's responsibility is focused on the function code itself, its permissions (IAM role), and the security of the data it processes. This is a key benefit of the Serverless model.

Correct answer: Place a NAT Gateway in the public subnet and configure the private subnet's route table to use it for outbound internet traffic.

This is the standard and most secure architecture for this requirement. A NAT (Network Address Translation) Gateway resides in a public subnet and has an elastic IP. Resources in a private subnet can be routed through the NAT Gateway to access the internet. This allows for outbound connections (e.g., for patches) while preventing any inbound connections from being initiated from the internet, as the private resources have no public IP address.

Correct answer: Create and apply organization-wide policies using a service like AWS Organizations SCPs or Azure Policy.

Using native cloud governance tools like AWS Service Control Policies (SCPs) or Azure Policy allows the agency to define and enforce rules centrally. These policies can prevent the creation of non-compliant resources (e.g., deny creating a public bucket) or automatically remediate them. This approach is highly scalable, automated, and provides preventative control, which is far more effective than manual audits or post-creation scripts.

Correct answer: Security Information and Event Management (SIEM)

A SIEM is designed specifically for this purpose. It aggregates log data and telemetry from various sources (like DNS logs, VPC flow logs, OS logs), correlates events based on predefined rules or machine learning, and generates alerts for security incidents. The scenario described—correlating DNS queries with network traffic patterns to detect malware—is a classic SIEM use case.

Correct answer: Cloud Security Posture Management (CSPM)

CSPM tools are specifically designed to automate the assessment of cloud environments against compliance frameworks (like SOC 2, PCI DSS, etc.) and security best practices. They continuously scan cloud configurations, identify misconfigurations (e.g., unencrypted storage, overly permissive IAM roles), and provide detailed reports that can be used as evidence for auditors. This directly addresses the need for compliance evidence.

Correct answer: It increases the 'blast radius' of a security incident.

The primary security disadvantage of a single-account model is the lack of isolation. If an attacker compromises credentials or exploits a vulnerability in a low-risk asset (like the marketing website), they could potentially move laterally to access and compromise high-risk assets (like the financial data). This is known as a large 'blast radius'. A multi-account strategy, where different workloads are segregated into separate accounts, contains the impact of a breach to a single account.

Correct answer: Cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Log)

Services like AWS CloudTrail, Azure Activity Log, or Google Cloud Audit Logs are specifically designed to record every API call made against an account's resources. This creates an audit trail that answers who, what, when, and from where for all actions. For incident response and forensics, these logs are the primary source of truth for reconstructing an attacker's activities.

Correct answer: On-demand self-service

On-demand self-service is the essential characteristic that allows users to provision resources through a web portal or API without needing to file a ticket or speak with a human at the cloud provider. This automation and empowerment of the consumer is a fundamental aspect of cloud computing.