I85PREP
⌘ K
CSPM study materials
CSPM study resources

CSPM practice questions

One question at a time. Build your CSPM understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Domain 1 (not enumerated in source)

In a cloud shared responsibility model, which activity remains the customer's responsibility regardless of the service model (IaaS, PaaS, or SaaS)?

  1. Maintaining the physical security of the data center
  2. Classifying and governing the data placed into the service Correct answer.
  3. Replacing failed storage drives in the provider's fleet
  4. Patching the hypervisor that hosts virtual machines

Explanation

The provider always owns the physical facility, hardware, and virtualization layer, while the customer always owns its data, including classification, access decisions, and governance. Patching the hypervisor and replacing drives are provider duties in every model. Data governance follows the data, so it never transfers to the provider.

Question 2Domain 1 (not enumerated in source)

Which artifact best demonstrates that a cloud control is operating effectively over time rather than merely existing?

  1. The signed security policy document
  2. The architecture diagram from the design review
  3. A continuous stream of configuration compliance results with timestamps Correct answer.
  4. The vendor's SOC 2 report cover page

Explanation

Operating effectiveness requires evidence collected over time showing the control actually ran and produced expected results. A policy, a diagram, or a report cover shows design or intent, not ongoing operation. Timestamped compliance results are continuous monitoring evidence.

Question 3Domain 1 (not enumerated in source)

A team stores encryption keys in the same cloud account as the encrypted data and grants administrators of that account full key access. What is the primary control weakness?

  1. The keys are rotated too infrequently
  2. The account lacks multi-factor authentication for readers
  3. The data is encrypted with a symmetric algorithm
  4. Key custody is not separated from data administration Correct answer.

Explanation

When the same administrators control both keys and ciphertext, encryption does not prevent those administrators from decrypting data. Effective key management separates key custody from the workloads and identities it protects. Rotation frequency and algorithm choice are secondary to this separation-of-duties gap.

Question 4Domain 1 (not enumerated in source)

Which cloud identity practice most directly limits the blast radius of a compromised workload credential?

  1. Storing credentials in a repository for audit visibility
  2. Granting the workload a narrowly scoped role assumed at runtime Correct answer.
  3. Sharing one service account across all production workloads
  4. Issuing long-lived static access keys embedded in the image

Explanation

Short-lived, narrowly scoped role credentials obtained at runtime reduce what an attacker can do with a stolen credential and expire quickly. Static embedded keys, shared accounts, and credentials in repositories all expand exposure. Least privilege plus ephemeral credentials is the core mitigation.

Question 5Domain 1 (not enumerated in source)

A security team wants to detect when a storage bucket is made public. Which capability is the most direct fit?

  1. A web application firewall rule set
  2. A quarterly third-party penetration test
  3. A cloud-native configuration rule that evaluates bucket policy changes continuously Correct answer.
  4. A monthly manual review of bucket inventory

Explanation

Continuous configuration evaluation against a rule that flags public bucket policies detects the change close to real time. Manual reviews and periodic tests leave long blind windows. A WAF inspects HTTP traffic and does not govern storage policy state.

Question 6Domain 1 (not enumerated in source)

Which statement correctly distinguishes cloud security posture management from cloud workload protection platforms?

  1. CSPM protects runtime processes on servers; CWPP inventories cloud accounts
  2. CSPM scans source code; CWPP manages encryption keys
  3. CSPM evaluates configuration and identity posture across cloud resources; CWPP focuses on protecting running workloads such as hosts and containers Correct answer.
  4. CSPM replaces identity governance; CWPP replaces network firewalls

Explanation

CSPM is oriented to posture: misconfiguration, identity exposure, and policy compliance across cloud estates. CWPP concentrates on workload-level protection such as runtime behavior, vulnerability, and malware defense on hosts and containers. The two are complementary and often integrated.

Question 7Domain 1 (not enumerated in source)

An organization needs to prove that its cloud environment complies with an internal baseline across hundreds of accounts. Which approach scales best?

  1. Manual spreadsheet attestations from each account owner
  2. Annual interviews with account owners
  3. Sampling a single account per quarter
  4. Policy-as-code evaluated automatically across all accounts with aggregated findings Correct answer.

Explanation

Policy-as-code applied uniformly and evaluated automatically gives consistent, repeatable coverage and centralized findings across many accounts. Manual attestations, interviews, and small samples introduce inconsistency and scale poorly. Automation also produces auditable evidence.

Question 8Domain 1 (not enumerated in source)

Which data protection approach best reduces the impact of a misconfigured public object store?

  1. Classifying data and applying default-deny access with automated public-access detection Correct answer.
  2. Restricting access to a single administrator
  3. Encrypting only the backup copies
  4. Relying on obscurity of randomized object names

Explanation

Classification tells you which data must never be public, default-deny prevents accidental exposure, and automated detection catches drift. Obscurity and single-administrator access are fragile. Encrypting only backups leaves the live exposure intact.

Question 9Domain 1 (not enumerated in source)

A cloud security analyst reviews an alert showing a service account creating many new identities and attaching broad policies. Which risk does this pattern most suggest?

  1. Normal autoscaling behavior
  2. Privilege escalation and persistence by an attacker Correct answer.
  3. A certificate rotation event
  4. A routine backup job

Explanation

Creating identities and granting broad policies is a classic persistence and privilege-escalation pattern, especially from a service account that should not manage identity. Autoscaling, backups, and certificate rotation do not normally create principals with broad permissions. Investigators should treat this as a high-priority lead.

Question 10Domain 1 (not enumerated in source)

Which control most directly enforces network segmentation between cloud workloads in different trust zones?

  1. A shared flat virtual network for all workloads
  2. Host-based antivirus agents
  3. Security groups and network policies scoped to workload identity and tags Correct answer.
  4. A content delivery network in front of the application

Explanation

Segmentation is enforced by rules that permit only required flows between zones, applied through security groups and workload-level network policies. A flat network removes segmentation, antivirus does not filter traffic, and a CDN accelerates and shields web traffic rather than separating internal zones.

Question 11Domain 1 (not enumerated in source)

Which practice best supports forensic readiness in a cloud environment?

  1. Relying solely on provider-side logs the customer cannot export
  2. Deleting logs after 30 days to reduce storage cost
  3. Granting all engineers write access to audit logs
  4. Enabling centralized, immutable logging with defined retention and access controls Correct answer.

Explanation

Forensic readiness requires that logs are centralized, protected from tampering, retained long enough, and exportable for investigation. Deleting logs, allowing broad write access, and depending on inaccessible provider logs all undermine evidence integrity. Immutability preserves trust in the record.

Question 12Domain 1 (not enumerated in source)

A company wants to prevent developers from deploying resources that violate tagging and encryption requirements. Which mechanism enforces this at deployment time?

  1. A dashboard reviewed weekly
  2. A training course on tagging standards
  3. A post-incident report
  4. An admission or policy guardrail that blocks noncompliant deployments Correct answer.

Explanation

Preventive guardrails evaluate requests before resources are created and reject noncompliant deployments. Reports, dashboards, and training influence behavior but do not block violations. Combining preventive guardrails with detective monitoring gives defense in depth.

Question 13Domain 1 (not enumerated in source)

Which factor most complicates asset inventory in a multi-cloud estate?

  1. All providers expose one identical inventory API
  2. Providers use different resource models and APIs, so discovery must be normalized across them Correct answer.
  3. Cloud resources never change after creation
  4. Encryption is disabled by default everywhere

Explanation

Each provider exposes different resource types, identifiers, and APIs, so a reliable inventory requires normalization and continuous discovery. The claim of a single identical API is false, resources change constantly, and default encryption varies by service. Normalization is the core challenge.

Question 14Domain 1 (not enumerated in source)

A risk assessment finds a publicly reachable management interface with weak authentication. What is the most appropriate immediate remediation?

  1. Restrict network access to trusted sources and enforce strong authentication Correct answer.
  2. Document the interface in the asset inventory only
  3. Accept the risk because the interface is rarely used
  4. Increase logging while leaving access unchanged

Explanation

Exposure plus weak authentication is a high-likelihood compromise path, so the immediate fix is to remove broad reachability and strengthen authentication. Accepting, logging alone, or documenting without fixing leaves the exposure live. Remediation precedes monitoring improvements here.

Question 15Domain 1 (not enumerated in source)

Which metric best indicates whether a CSPM program is reducing risk rather than just producing alerts?

  1. Total number of alerts generated per day
  2. Number of dashboards published
  3. Count of accounts onboarded
  4. Trend in open high-severity findings and mean time to remediate Correct answer.

Explanation

Risk reduction is shown by fewer unresolved high-severity findings and faster remediation, not by alert or dashboard volume. High alert counts can even indicate poor tuning. Onboarding accounts measures coverage, not outcomes.

Question 16Domain 1 (not enumerated in source)

Which approach best manages third-party and supply-chain risk in cloud deployments?

  1. Delegating all risk decisions to the vendor
  2. Assessing vendor security posture, contractual obligations, and continuous monitoring of integrations Correct answer.
  3. Reviewing vendors only at initial purchase
  4. Trusting any vendor with a recognizable logo

Explanation

Supply-chain risk management combines pre-contract due diligence, contractual security and breach obligations, and ongoing monitoring of the vendor's posture and integrations. Logo recognition, one-time reviews, and full delegation all leave unmanaged residual risk. Continuous oversight is essential because vendor posture changes.

Question 17Domain 1 (not enumerated in source)

An auditor asks how the organization ensures that only approved container images run in production. Which control answers this most directly?

  1. A wiki page listing approved images
  2. Weekly manual inspection of running containers
  3. Image signing with admission control that rejects unsigned images Correct answer.
  4. Antivirus on developer laptops

Explanation

Signing images and enforcing signature verification at admission ensures only approved, unmodified images are deployed. A wiki list, manual inspection, and endpoint antivirus do not technically enforce the requirement. Admission control makes the policy preventive.

Question 18Domain 1 (not enumerated in source)

Which statement about cloud logging is most accurate for security operations?

  1. Data-plane logs should be disabled to save cost
  2. Identity logs are irrelevant to cloud incidents
  3. Correlating control-plane, data-plane, and identity logs gives the most complete detection and investigation picture Correct answer.
  4. Provider control-plane logs alone are sufficient for full investigation

Explanation

Control-plane events show configuration and API changes, data-plane logs show access to data, and identity logs show authentication and authorization behavior. Correlating all three supports both detection and investigation. Relying on one source or disabling others creates blind spots.

Question 19Domain 1 (not enumerated in source)

Which design best limits the impact of a compromised CI/CD pipeline credential?

  1. Sharing the pipeline credential with the whole engineering team
  2. Granting the pipeline permanent administrator rights across all accounts
  3. Storing the credential in plaintext in the pipeline configuration
  4. Scoping pipeline permissions per environment with short-lived credentials and approvals for production Correct answer.

Explanation

Least privilege per environment, short-lived credentials, and approval gates for production contain damage if the pipeline is compromised. Permanent admin rights, plaintext storage, and broad sharing all amplify impact. Segmentation of pipeline permissions is the key control.

Question 20Domain 1 (not enumerated in source)

A CSPM tool reports a resource as compliant, but a manual review finds it noncompliant. What is the most likely root cause?

  1. Compliance is always accurate in automated tools
  2. The policy rule logic or resource attribute mapping is incorrect Correct answer.
  3. The manual reviewer must be mistaken
  4. The resource does not exist

Explanation

When automated results conflict with manual verification, the usual cause is a rule that evaluates the wrong attribute or an incomplete mapping of the resource model. Assuming the reviewer is wrong or that tools are always accurate is unsound. The rule should be validated and corrected.

Question 21Domain 1 (not enumerated in source)

Which combination best implements defense in depth for cloud data storage?

  1. Encryption only, with public access permitted
  2. Encryption at rest, least-privilege access, network restrictions, and continuous exposure detection Correct answer.
  3. A single strong password on the bucket
  4. Relying on provider default settings without review

Explanation

Layered controls ensure that failure of one layer does not expose data: encryption protects content, least privilege limits access, network restrictions reduce reachability, and continuous detection catches drift. Single passwords, unchecked defaults, and encryption with public access leave major gaps.

Question 22Domain 1 (not enumerated in source)

Which practice best ensures cloud security policies remain effective as the estate grows?

  1. Freezing policies after initial approval
  2. Applying policies only to new accounts
  3. Reviewing and versioning policies with automated enforcement and periodic exceptions review Correct answer.
  4. Relying on individual teams to interpret policy independently

Explanation

Policies must evolve with the estate, be version controlled, enforced automatically, and have exceptions reviewed so they do not become permanent. Frozen policies, selective application, and independent interpretation create inconsistency and drift. Governance requires continuous review.

Question 23Domain 1 (not enumerated in source)

An organization must demonstrate that a cloud provider's controls meet its requirements without conducting its own full audit. Which approach is most appropriate?

  1. Accepting marketing claims from the provider's website
  2. Reviewing independent attestations and mapping them to the organization's control requirements Correct answer.
  3. Ignoring the provider entirely
  4. Assuming provider controls cover customer responsibilities

Explanation

Independent attestations such as third-party audit reports provide assurance, but they must be mapped to the organization's specific requirements and complemented by customer-side controls. Marketing claims are not assurance, and provider reports do not cover customer responsibilities. Mapping avoids false confidence.

Question 24Domain 1 (not enumerated in source)

Which signal most strongly suggests a cloud identity is over-privileged?

  1. The identity authenticates daily
  2. The identity holds permissions far beyond its observed usage and can modify security controls Correct answer.
  3. The identity is tagged with an owner
  4. The identity uses multi-factor authentication

Explanation

Permissions exceeding observed need, especially the ability to alter security controls, indicate excessive privilege. Daily use, MFA, and ownership tags are good practices but say nothing about scope. Right-sizing permissions to actual usage reduces risk.

Question 25Domain 1 (not enumerated in source)

A team wants to reduce false positives from a CSPM deployment. Which action is most effective?

  1. Disabling all high-severity rules
  2. Tuning rules with environment context and documented exceptions, then reviewing suppression regularly Correct answer.
  3. Ignoring the tool's output
  4. Increasing the number of alerts generated

Explanation

False positives fall when rules incorporate context such as environment and accepted exceptions, provided suppressions are documented and periodically reviewed so they do not hide real risk. Disabling rules, ignoring output, or generating more alerts worsens outcomes. Context-aware tuning preserves detection value.

Question 26Domain 1 (not enumerated in source)

Which CSPM capability is most directly responsible for detecting that an S3 bucket allows public read access?

  1. Runtime process monitoring on EC2 instances
  2. Vulnerability scanning of container images
  3. Continuous configuration assessment against policy rules Correct answer.
  4. Network flow log analysis for anomalous egress

Explanation

CSPM evaluates resource configurations against defined policies continuously. Public bucket ACLs and policies are configuration attributes, so they are detected by policy evaluation rather than runtime or network telemetry.

Question 27Domain 1 (not enumerated in source)

A CSPM finding states that a security group permits ingress from 0.0.0.0/0 on port 22. Which remediation action best addresses the root cause while preserving operational access?

  1. Restrict the rule to the corporate bastion or VPN address range and require session logging Correct answer.
  2. Enable VPC flow logs and alert on port 22 connections
  3. Delete the security group and recreate it with default deny only
  4. Add a WAF rule blocking SSH traffic to the instance

Explanation

The finding is caused by an overly broad source range. Narrowing the source to known administrative networks fixes the exposure while keeping legitimate access, and session logging supports accountability. Detection-only or unrelated controls leave the exposure in place.

Question 28Domain 1 (not enumerated in source)

An organization wants CSPM findings to be actionable across 40 AWS accounts and 15 Azure subscriptions. Which practice most improves consistency of policy evaluation?

  1. Define policies once in a central policy-as-code repository and deploy them uniformly to all accounts Correct answer.
  2. Allow each account owner to tune severity thresholds independently
  3. Review findings quarterly in a spreadsheet compiled by each team
  4. Rely on the cloud providers' native security centers without central aggregation

Explanation

Central policy-as-code ensures every account is evaluated against the same rules and reduces drift between teams. Per-account tuning, siloed native tools, and manual spreadsheets introduce inconsistent evaluation and gaps.

Question 29Domain 1 (not enumerated in source)

Which CSPM metric best demonstrates that remediation is keeping pace with newly introduced risk?

  1. Median time from finding creation to verified remediation Correct answer.
  2. Number of policy rules enabled in the platform
  3. Total number of findings open at any point in time
  4. Count of accounts connected to the CSPM tool

Explanation

Time-to-remediation measures how quickly risk is closed after detection, which reflects operational effectiveness. Raw counts of findings, rules, or accounts describe scale or configuration but not whether risk is being reduced.

Question 30Domain 1 (not enumerated in source)

A CSPM tool flags an EC2 instance for missing required tags. The instance was launched by an autoscaling group whose launch template omits the tags. What is the most effective corrective action?

  1. Add the required tags to the launch template and update the autoscaling group Correct answer.
  2. Create a new CSPM rule that ignores untagged instances
  3. Move the instances to a different AWS account with different policies
  4. Manually tag each running instance and suppress future alerts

Explanation

The root cause is the launch template that defines every new instance. Fixing the template ensures future instances inherit the tags, whereas manual tagging or suppression only treats symptoms and recurs on the next scale event.

Question 31Domain 1 (not enumerated in source)

Which statement best describes how CSPM differs from a cloud infrastructure entitlement management (CIEM) tool?

  1. CSPM focuses only on network security, while CIEM focuses only on storage encryption
  2. CSPM and CIEM are interchangeable terms for the same capability
  3. CSPM analyzes identity permissions, while CIEM assesses resource configuration
  4. CSPM assesses configuration against security policies, while CIEM analyzes effective permissions and entitlement risk Correct answer.

Explanation

CSPM centers on configuration posture against policy, while CIEM specializes in understanding effective permissions across identities and resources. They are complementary capabilities with different primary data sources and questions.

Question 32Domain 1 (not enumerated in source)

A CSPM scan reports that an Azure storage account allows public blob access. Which configuration change most directly closes the finding?

  1. Set allowBlobPublicAccess to false on the storage account Correct answer.
  2. Enable diagnostic logging for blob read operations
  3. Rotate the storage account access keys on a schedule
  4. Enable soft delete for blobs on the storage account

Explanation

The allowBlobPublicAccess property controls whether anonymous public access is permitted at the account level. Disabling it removes the exposure, while soft delete, key rotation, and logging address recovery, credential hygiene, and visibility rather than public access.

Question 33Domain 1 (not enumerated in source)

A security team wants to reduce alert fatigue from a CSPM deployment that produces thousands of low-value findings. Which action is most effective?

  1. Route all findings directly to the service desk as tickets
  2. Disable all policies with severity below critical
  3. Tune policies to the organization's risk context and suppress rules that do not map to a real threat or control Correct answer.
  4. Increase the scan frequency to every minute

Explanation

Alert fatigue is reduced by aligning policies with actual risk and removing rules that generate noise without a corresponding control objective. Blanket disabling by severity or increasing volume does not improve signal quality and may hide meaningful findings.

Question 34Domain 1 (not enumerated in source)

A CSPM dashboard shows 95 percent compliance with the encryption-at-rest policy, but a sample audit finds several unencrypted volumes. Which explanation is most plausible?

  1. Encryption at rest is enforced by the cloud provider and cannot be misconfigured
  2. The audit team used a different cloud provider account than the CSPM tool
  3. The policy rule evaluates only newly created resources and does not cover existing volumes Correct answer.
  4. The CSPM tool is correctly reporting and the audit sample is invalid

Explanation

A coverage gap in the policy scope, such as evaluating only resources created after a date, would allow existing noncompliant volumes to escape detection. Discrepancies between tool reporting and manual audit usually indicate rule scope or data freshness issues rather than invalid audit results.

Question 35Domain 2 (not enumerated in source)

In a cloud shared responsibility model, which security activity remains the customer's obligation when using a provider-managed relational database service?

  1. Managing the logical access controls and data classification for the database Correct answer.
  2. Replacing failed storage drives in the provider's storage cluster
  3. Maintaining the physical security of the datacenter hosting the database
  4. Patching the database engine binaries on the underlying hosts

Explanation

Under the shared responsibility model, the provider secures the physical infrastructure and managed platform layers, while the customer always retains responsibility for their data, identity, and access configuration. Classifying data and controlling who can reach it are therefore customer duties regardless of service model.

Question 36Domain 2 (not enumerated in source)

A security team wants to enforce that no storage bucket can be created without encryption enabled. Which control placement best guarantees this outcome across all teams?

  1. A monthly manual review of bucket configurations by the security team
  2. A training module instructing engineers to enable encryption
  3. A detective alert that fires after an unencrypted bucket is created
  4. A preventive policy enforced at the organization or landing-zone level Correct answer.

Explanation

Preventive controls applied at the organization or landing-zone level block noncompliant resource creation before it happens, which is stronger than detecting it afterward. Detective and manual controls only identify violations after the fact and depend on remediation discipline.

Question 37Domain 2 (not enumerated in source)

Which artifact is the primary output of a cloud security posture assessment used to prioritize remediation?

  1. A copy of the provider's compliance certification reports
  2. A ranked list of misconfigurations mapped to risk and affected assets Correct answer.
  3. An inventory of employee security training completion
  4. A network packet capture of the management subnet

Explanation

Posture assessment identifies configuration weaknesses and contextualizes them by risk and asset criticality so remediation can be sequenced. Provider certifications and training records are assurance inputs but do not describe the organization's own misconfigurations.

Question 38Domain 2 (not enumerated in source)

An organization needs continuous visibility into whether cloud resources drift from an approved baseline. Which capability is most directly suited to this requirement?

  1. Cloud security posture management with continuous configuration scanning Correct answer.
  2. Web application firewall in blocking mode
  3. Static application security testing in the build pipeline
  4. Endpoint detection and response on developer workstations

Explanation

CSPM continuously evaluates cloud configurations against baselines and policies and surfaces drift as it occurs. The other options address application code, endpoint threats, or HTTP traffic rather than cloud resource configuration state.

Question 39Domain 2 (not enumerated in source)

Which identity practice most reduces the blast radius of a compromised cloud service account?

  1. Storing long-lived access keys in the application source repository
  2. Disabling multi-factor authentication for automated pipelines
  3. Sharing a single administrative account among the operations team
  4. Granting least privilege with short-lived credentials scoped to specific resources Correct answer.

Explanation

Least privilege limits what a compromised identity can do, and short-lived scoped credentials reduce the window and reach of misuse. Shared admin accounts, embedded long-lived keys, and disabled MFA all expand exposure rather than contain it.

Question 40Domain 2 (not enumerated in source)

What distinguishes a cloud security benchmark from a regulatory compliance framework?

  1. A benchmark replaces the need for any audit evidence
  2. A benchmark is legally binding, while a framework is purely advisory
  3. A benchmark applies only to on-premises systems, while a framework covers cloud
  4. A benchmark offers prescriptive technical hardening guidance, while a framework defines control objectives to satisfy Correct answer.

Explanation

Benchmarks such as provider hardening guides give concrete technical settings, whereas frameworks state control objectives that must be mapped to evidence. Neither substitutes for the other, and benchmarks are generally not legally binding by themselves.

Question 41Domain 2 (not enumerated in source)

A company wants alerts when an administrator disables audit logging in a production account. Which data source is most appropriate?

  1. Application performance monitoring traces
  2. Cloud control-plane audit logs such as activity or trail records Correct answer.
  3. DNS query logs from the corporate resolver
  4. Container image vulnerability scans

Explanation

Disabling audit logging is a control-plane API action recorded in the provider's activity or trail logs. Those logs are the authoritative source for administrative configuration changes.

Question 42Domain 2 (not enumerated in source)

Which practice best supports reproducibility and review of infrastructure security settings?

  1. Defining infrastructure as code and reviewing changes through pull requests Correct answer.
  2. Applying console changes directly during incidents and documenting later
  3. Relying on individual engineers to remember baseline settings
  4. Maintaining a wiki page describing intended firewall rules

Explanation

Infrastructure as code makes security configuration versioned, reviewable, and repeatable, and pull-request review creates an auditable approval trail. Out-of-band console changes and informal documentation undermine consistency.

Question 43Domain 2 (not enumerated in source)

A CSPM tool reports a publicly readable object storage bucket containing customer records. Which response sequence is most appropriate?

  1. Delete the entire bucket to remove the data
  2. Restrict public access immediately, then investigate exposure scope and rotate any exposed credentials Correct answer.
  3. Wait for the next scheduled scan to confirm the finding before acting
  4. Disable the CSPM rule to prevent further alerts

Explanation

Containment comes first: removing public access stops ongoing exposure, after which the team determines what was accessed and remediates any leaked secrets. Deleting data destroys evidence, and delaying or suppressing alerts prolongs exposure.

Question 44Domain 2 (not enumerated in source)

Why is tagging cloud resources with owner, environment, and data classification valuable to a CSPM program?

  1. Tags replace the need for identity and access management policies
  2. Tags enable scoping policies and prioritizing findings by business context Correct answer.
  3. Tags encrypt the resource data at rest automatically
  4. Tags guarantee resources are compliant with regulatory frameworks

Explanation

Metadata tags let posture tooling apply different policies per environment and rank findings by data sensitivity and ownership. Tags do not encrypt data, substitute for IAM, or by themselves make a resource compliant.

Question 45Domain 2 (not enumerated in source)

A policy requires that privileged roles be assumed only through federation with an identity provider. Which misconfiguration most directly violates this?

  1. A role with administrative permissions trusting a broad external principal without conditions Correct answer.
  2. A role with a session duration of one hour
  3. A role that requires multi-factor authentication through the identity provider
  4. A role limited to read-only actions on a single service

Explanation

Trust policies define who may assume a role; trusting a broad external principal without conditions lets non-federated or unintended identities obtain privileged access. The other options describe constrained, compliant configurations.

Question 46Domain 2 (not enumerated in source)

Which approach best reduces false positives when tuning CSPM policies in a large multi-account environment?

  1. Setting every policy to the highest severity level
  2. Disabling all rules that have ever generated an alert
  3. Removing the asset inventory to simplify rule evaluation
  4. Scoping rules by account, tag, and resource type and validating exceptions with owners Correct answer.

Explanation

Context-aware scoping and owner-validated exceptions distinguish genuine risk from acceptable configurations, improving signal quality. Blanket disabling or severity inflation degrades prioritization, and asset inventory is essential context.

Question 47Domain 2 (not enumerated in source)

A team discovers that a service principal has unused permissions far beyond what its workload requires. Which remediation best embodies least privilege?

  1. Rightsize the permissions to observed usage and monitor for further drift Correct answer.
  2. Move the service principal into a broader administrative group
  3. Rotate the credential but keep the permission set unchanged
  4. Add a second service principal with the same broad permissions

Explanation

Rightsizing permissions to actual usage and then continuously monitoring removes excess privilege while preserving function. Adding equivalent identities or broadening group membership expands the attack surface, and rotation alone leaves excessive permissions intact.

Question 48Domain 2 (not enumerated in source)

Which control most effectively prevents data exfiltration through a compromised workload identity?

  1. Inbound firewall rules that allow only port 443
  2. Increasing the identity's session timeout
  3. Egress restrictions combined with scoped data-access permissions Correct answer.
  4. Enabling verbose application logging

Explanation

Exfiltration requires both the ability to read data and a path to send it out, so constraining egress and limiting data permissions together address the risk. Inbound rules, logging, and longer sessions do not restrict outbound data movement.

Question 49Domain 2 (not enumerated in source)

A security architect must choose between agent-based and agentless workload scanning for a fleet of short-lived containers. Which consideration is most decisive?

  1. Agentless scanning captures live process memory across all nodes
  2. Agent-based scanning eliminates the need for image registries
  3. Agentless snapshot scanning avoids per-container agent lifecycle overhead for ephemeral workloads Correct answer.
  4. Agent-based scanning requires no access permissions to function

Explanation

Ephemeral containers may not live long enough for agent installation and management, making agentless approaches attractive because they inspect artifacts or snapshots without per-instance agents. Agent-based tools still need deployment and permissions, and neither approach removes registry needs.

Question 50Domain 2 (not enumerated in source)

What is the primary purpose of mapping CSPM findings to a control framework such as a cloud security benchmark?

  1. To eliminate the need for logging and monitoring
  2. To replace the cloud provider's shared responsibility obligations
  3. To translate technical misconfigurations into auditable control status for stakeholders Correct answer.
  4. To automatically remediate every finding without human review

Explanation

Mapping findings to framework controls lets teams report posture in the language auditors and leadership understand. It does not automate all remediation, alter provider responsibilities, or remove logging requirements.