CCSP - Cloud Security Operations (17% of the exam) - Section 5.2
Operate and maintain physical and logical infrastructure for cloud environment.
Access controls for local and remote access, secure network configuration, hardening, patch management, performance and capacity monitoring, and availability of management plane.
An architect is placing network security controls for a cloud-hosted three-tier application and wants to describe the difference between a security group applied to instance interfaces and a network access control list applied to a subnet. Which statement is TRUE of the security group in this comparison?
AIt evaluates rules statelessly, so return traffic must be permitted by an explicit separate rule in the opposite direction.
BIt applies to every instance in the subnet regardless of interface membership, because it is bound to the subnet boundary.
CIt supports ordered numbered rules that are evaluated top to bottom until the first match decides the outcome.
DIt is stateful, so permitted outbound requests automatically allow their return traffic without a matching inbound rule.check_circle Correct
Differentiate a stateful instance security group from a stateless subnet access control list when placing cloud network controls. A security group is stateful and attached to instance interfaces, so it tracks each connection and permits return traffic automatically, whereas a subnet access control list is stateless and evaluates ordered rules independently per direction; conflating them is a common configuration error.
Why A is wrong: Stateless evaluation requiring explicit return rules describes the subnet access control list, not the instance security group, so this reverses the two.
Why B is wrong: Binding to the subnet boundary and applying to all instances describes a subnet-level access control list; a security group applies to the interfaces explicitly associated with it.
Why C is wrong: First-match ordered numbered rules characterise a network access control list; security groups evaluate the whole permissive rule set rather than stopping at a first match.
Why D is correct: Correct: an instance security group is stateful, tracking connections so return traffic for an allowed request is permitted automatically without a separate inbound rule.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
A one-time hardening scan performed during host provisioning to confirm the baseline was applied before the workload went live.
errorWhy it is wrong: A provisioning-time scan confirms the initial state and is tempting because it references the baseline, but it is a point-in-time check that cannot detect configuration drift that happens after the host is in production.
That installed software has no known exploitable weaknesses, by matching component versions against a catalogue of published advisories.
errorWhy it is wrong: Matching versions against published advisories describes vulnerability scanning; it detects known weaknesses, not deviation from an approved configuration standard.
Encrypt the virtual disk files of every guest so that a stolen storage volume cannot be read outside the cluster.
errorWhy it is wrong: Guest disk encryption protects data at rest against storage theft, but it does nothing to limit access to the management console itself, which is the source of the flagged risk.