Certificate of Cloud Security Knowledge v5 Free Sample Questions

Data poisoning is an attack against the integrity of the training data itself. The most direct and proactive control is to secure the data supply chain. This involves implementing strong access controls (least privilege) on the training data, using cryptographic hashes to ensure data integrity, and monitoring the data ingestion pipeline for any unauthorized or anomalous modifications. While other options are good security practices for AI, they are reactive (output validation) or address different threats (model encryption, network segmentation).

SAST analyzes source code from the 'inside-out' early in the development cycle, identifying vulnerabilities before the application is even compiled. This is a core component of a secure CI/CD pipeline.

Modern applications heavily rely on third-party libraries. SCA scans these dependencies for known vulnerabilities (CVEs) and license compliance issues, which is a critical step as these components are a major source of risk.

Using a customer-managed key (CMK) within the provider's KMS gives the organization full control over the key's lifecycle, including the ability to disable or delete it. Deleting the key effectively renders the data it encrypted inaccessible, achieving the goal of crypto-shredding. This provides the required control without the complexity of managing a separate HSM or client-side encryption.

The principle of least privilege dictates that users and services should only be granted the minimum permissions necessary to perform their tasks. Using a root account provides maximum, unrestricted permissions. Furthermore, using a shared account violates the principle of individual accountability, as it becomes impossible to trace actions back to a specific person.

In a Serverless/FaaS model, the cloud service provider manages the entire underlying infrastructure, including the physical hardware, hypervisor, and the operating system of the execution environment. The customer's responsibility is focused on the function code itself, its permissions (IAM role), and the security of the data it processes. This is a key benefit of the Serverless model.

This is the standard and most secure architecture for this requirement. A NAT (Network Address Translation) Gateway resides in a public subnet and has an elastic IP. Resources in a private subnet can be routed through the NAT Gateway to access the internet. This allows for outbound connections (e.g., for patches) while preventing any inbound connections from being initiated from the internet, as the private resources have no public IP address.

Using native cloud governance tools like AWS Service Control Policies (SCPs) or Azure Policy allows the agency to define and enforce rules centrally. These policies can prevent the creation of non-compliant resources (e.g., deny creating a public bucket) or automatically remediate them. This approach is highly scalable, automated, and provides preventative control, which is far more effective than manual audits or post-creation scripts.

A SIEM is designed specifically for this purpose. It aggregates log data and telemetry from various sources (like DNS logs, VPC flow logs, OS logs), correlates events based on predefined rules or machine learning, and generates alerts for security incidents. The scenario described—correlating DNS queries with network traffic patterns to detect malware—is a classic SIEM use case.

CSPM tools are specifically designed to automate the assessment of cloud environments against compliance frameworks (like SOC 2, PCI DSS, etc.) and security best practices. They continuously scan cloud configurations, identify misconfigurations (e.g., unencrypted storage, overly permissive IAM roles), and provide detailed reports that can be used as evidence for auditors. This directly addresses the need for compliance evidence.

The primary security disadvantage of a single-account model is the lack of isolation. If an attacker compromises credentials or exploits a vulnerability in a low-risk asset (like the marketing website), they could potentially move laterally to access and compromise high-risk assets (like the financial data). This is known as a large 'blast radius'. A multi-account strategy, where different workloads are segregated into separate accounts, contains the impact of a breach to a single account.