Sample questions
Cse Cspm MisconfigurationDifficulty 1
What is the primary purpose of a Cloud Security Posture Management (CSPM) tool?
- aTo scan application source code for injection vulnerabilities before deployment.
- bTo continuously check cloud configurations for misconfigurations.✓
- cTo replace the cloud provider's billing dashboard with a cost-optimization view.
- dTo generate synthetic load for performance testing of cloud workloads.
Explanation:CSPM tools continuously inventory cloud resources and compare their configuration against known-good baselines (CIS benchmarks, vendor best practices) to surface misconfigurations like open storage or overly permissive rules.
Cse Cspm MisconfigurationDifficulty 2
A CSPM scan flags a storage bucket whose access control allows requests from "Any authenticated user" or the public internet, with no bucket policy restricting the source. Why is this a high-severity finding?
- aAnyone who finds the bucket name may read or list its contents without authorization.✓
- bIt means the bucket is using an outdated storage class that costs more per gigabyte.
- cIt only affects billing because public buckets are charged at a higher egress rate.
- dIt is purely a naming-convention issue that linting tools flag but that carries no access risk.
Explanation:Public read/list access means the bucket's contents are reachable by anyone who finds the URL or name, with no identity check — this is exactly the open-storage misconfiguration class CSPM is built to catch.
Cse Cspm MisconfigurationDifficulty 2
A CSPM report shows a database snapshot marked as "public" (shareable with any cloud account). What is the concrete risk of this configuration?
- aPublic snapshots automatically get deleted after 24 hours, causing data loss.
- bThe snapshot's storage cost increases because public sharing forces cross-region replication.
- cPublic snapshots cannot be restored at all, so the finding is only a cosmetic warning.
- dAny account on the provider could copy and restore the snapshot, obtaining the data.✓
Explanation:Marking a snapshot public means any other account on the platform can discover and copy it, then restore a full database instance from it — effectively exfiltrating all the data it contains.
Cse Cspm MisconfigurationDifficulty 1
Why do CSPM tools frequently flag resources left in a cloud account's "default VPC"?
- aDefault VPCs are always billed at a premium rate compared to custom VPCs.
- bDefault VPCs typically ship with broad default routing and permissive baseline rules, so resources placed there may get more network exposure than intended.✓
- cDefault VPCs are automatically deleted every 90 days regardless of what is running in them.
- dDefault VPCs cannot host any compute resources, so the finding just means the resource is idle.
Explanation:Cloud providers create a default VPC with permissive defaults (public subnets, broad default security group) to make onboarding easy; production resources left there inherit that permissiveness unless someone deliberately locks it down.
Cse Cspm MisconfigurationDifficulty 2
A CSPM finding lists a security group with an inbound rule allowing TCP port 22 (SSH) from source 0.0.0.0/0. What does this rule actually permit?
- aAny internet host can attempt an SSH connection to that security group.✓
- bOnly instances inside the same VPC can attempt to connect over SSH.
- cOnly traffic originating from the cloud provider's own management plane can reach port 22.
- dThe rule has no effect unless a matching outbound rule is also defined.
Explanation:0.0.0.0/0 is the entire IPv4 address space, so an inbound rule on port 22 from that source allows any internet host to attempt an SSH connection — the instance's actual exposure then depends solely on authentication, not network filtering.
Cse Cspm MisconfigurationDifficulty 1
In the context of CSPM, what does a "CIS benchmark" provide?
- aA live dashboard of current cloud spend broken down by service.
- bA tool that automatically writes application code to fix bugs found during testing.
- cA guarantee from the cloud provider that no misconfiguration can ever occur.
- dA vendor-neutral set of hardening recommendations for a specific platform.✓
Explanation:CIS (Center for Internet Security) benchmarks are consensus-based configuration guidelines for a given platform (e.g., a specific cloud provider); CSPM tools use them as one of the rule sets they check resources against.