CCSKV5 Sample Questions & Answers

This is the standard and most secure architecture for this requirement. A NAT (Network Address Translation) Gateway resides in a public subnet and has an elastic IP. Resources in a private subnet can be routed through the NAT Gateway to access the internet. This allows for outbound connections (e.g., for patches) while preventing any inbound connections from being initiated from the internet, as the private resources have no public IP address.

Using native cloud governance tools like AWS Service Control Policies (SCPs) or Azure Policy allows the agency to define and enforce rules centrally. These policies can prevent the creation of non-compliant resources (e.g., deny creating a public bucket) or automatically remediate them. This approach is highly scalable, automated, and provides preventative control, which is far more effective than manual audits or post-creation scripts.

A SIEM is designed specifically for this purpose. It aggregates log data and telemetry from various sources (like DNS logs, VPC flow logs, OS logs), correlates events based on predefined rules or machine learning, and generates alerts for security incidents. The scenario described—correlating DNS queries with network traffic patterns to detect malware—is a classic SIEM use case.

CSPM tools are specifically designed to automate the assessment of cloud environments against compliance frameworks (like SOC 2, PCI DSS, etc.) and security best practices. They continuously scan cloud configurations, identify misconfigurations (e.g., unencrypted storage, overly permissive IAM roles), and provide detailed reports that can be used as evidence for auditors. This directly addresses the need for compliance evidence.

The primary security disadvantage of a single-account model is the lack of isolation. If an attacker compromises credentials or exploits a vulnerability in a low-risk asset (like the marketing website), they could potentially move laterally to access and compromise high-risk assets (like the financial data). This is known as a large 'blast radius'. A multi-account strategy, where different workloads are segregated into separate accounts, contains the impact of a breach to a single account.

Services like AWS CloudTrail, Azure Activity Log, or Google Cloud Audit Logs are specifically designed to record every API call made against an account's resources. This creates an audit trail that answers who, what, when, and from where for all actions. For incident response and forensics, these logs are the primary source of truth for reconstructing an attacker's activities.

On-demand self-service is the essential characteristic that allows users to provision resources through a web portal or API without needing to file a ticket or speak with a human at the cloud provider. This automation and empowerment of the consumer is a fundamental aspect of cloud computing.

ZTNA, also known as a Software-Defined Perimeter (SDP), is the technology that embodies this Zero Trust principle. Unlike a VPN which grants broad network access, a ZTNA solution creates a secure, encrypted tunnel on a per-session, per-application basis after verifying user identity and device posture. It enforces the 'never trust, always verify' mantra for every single access request, making it the ideal replacement for traditional VPNs in a Zero Trust architecture.

This scenario is a classic example of sensitive data leakage. When users input proprietary or confidential information into prompts for public LLMs, that data can potentially be used to train future versions of the model or be exposed in other users' responses. Organizations must have clear policies and technical controls (like DLP) to prevent employees from sending sensitive data to public AI services.

This is the modern standard for this use case. OAuth 2.0 is a framework for delegated authorization, allowing an application to access resources on behalf of a user (e.g., access your Google profile). OpenID Connect (OIDC) is a thin identity layer built on top of OAuth 2.0 that provides the authentication piece, verifying the user's identity and providing a standard set of profile information (the ID Token). Together, they enable secure social logins and API access.