Crucial Exams

ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Your organization is moving a set of microservices from virtual machines to a provider-hosted Kubernetes service. As part of updating the cloud reference architecture, you must ensure that the new container platform aligns with secure-by-design principles adopted in the DevSecOps pipeline. Which design choice BEST addresses container security risks while maintaining the agility benefits that motivated the migration?

  1. Run each microservice in a separate VM inside the cluster so that a hypervisor provides isolation in addition to the container engine.

  2. Require all images to be digitally signed and enforce an admission controller that rejects unsigned or out-of-date images before they are scheduled.

  3. Deploy application containers directly on bare-metal worker nodes using a user-space sandbox such as gVisor to avoid kernel overhead.

  4. Replace the container approach with provider serverless functions, shifting all security responsibility to the cloud service provider.

  • Abandon containers and migrate the services to serverless functions, relying on the cloud provider to handle all security responsibilities.

  • Implement mandatory image signing and use a Kubernetes admission controller to block any unsigned or out-of-date container images before they are scheduled.

  • Run each microservice in a dedicated virtual machine inside the Kubernetes cluster to gain an extra hypervisor layer of isolation.

  • Deploy containers directly on bare-metal worker nodes using a user-space sandbox such as gVisor for isolation.

ISC2 Certified Cloud Security Professional (CCSP)
Cloud Concepts, Architecture and Design
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot