What is the primary purpose of IAM policies in a cloud environment?

To monitor network traffic for suspicious activity

To manage the physical security of data centers

To define the specific permissions that identities have on resources

To encrypt data stored in cloud services

A company has deployed a web application in a cloud VPC. The security team wants to detect and respond to malicious network traffic, such as port scans and SQL injection attempts. Which set of controls should be implemented?

Use only network security groups to block all inbound traffic from the internet.

Use a web application firewall (WAF) and disable all logging to reduce noise.

Enable encryption in transit and rely on the cloud provider to monitor the traffic.

Enable VPC flow logs and use a network intrusion detection system (IDS) to analyze the traffic.

What is the goal of system hardening?

To reduce the cost of cloud services

To increase the processing speed of the system

To reduce the attack surface by disabling unnecessary services and applying secure configurations

To make the system easier to administer

A company is implementing IAM for a new cloud environment. The security team wants to enforce least privilege for all users and services. However, the team is concerned that too many restrictive policies will hinder productivity. Which IAM strategy balances security and usability?

Grant all users broad permissions initially and then gradually reduce them based on usage.

Use role-based access control (RBAC) with predefined roles that align with job functions, and grant permissions based on the principle of least privilege.

Use a single administrative role for all users to simplify management.

Use attribute-based access control (ABAC) with policies that are so restrictive that most users cannot access resources.

Certified Cloud Security Professional

Domain 1Objective 3

Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 11)

Part of the Cloud Concepts, Architecture and Design domain, which accounts for 17% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

20concepts

17%of the exam

20 Concepts in This Objective

Cryptography fundamentals
Key management in the cloud
Identity and access management (IAM)
Privileged access management
Service and workload access
Data sanitization methods
Media lifecycle management
Network security controls
Traffic inspection and monitoring
Geofencing and geographic restrictions
Hypervisor security
Container security
Ephemeral computing and serverless security
Virtualization isolation
Common cloud threats
Threat modeling and risk assessment
Patching and vulnerability management
Baselining and configuration management
Immutable architecture
System hardening

Questions 51–55

51foundation · easy
At which stage of the media lifecycle is data sanitization most critical?
Select an answer first
52foundation · easy
What is the primary purpose of IAM policies in a cloud environment?
Select an answer first
53application · medium
A company has deployed a web application in a cloud VPC. The security team wants to detect and respond to malicious network traffic, such as port scans and SQL injection attempts. Which set of controls should be implemented?
Select an answer first
54foundation · easy
What is the goal of system hardening?
Select an answer first
55expert · medium
A company is implementing IAM for a new cloud environment. The security team wants to enforce least privilege for all users and services. However, the team is concerned that too many restrictive policies will hinder productivity. Which IAM strategy balances security and usability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.