CCSP · Domain 3
Cloud Platform and Infrastructure Security
About 17% of the exam
Infrastructure components
- Physical
- facility, power, cooling, racks
- Network
- virtual networks, SDN, load balancers
- Compute
- hosts, hypervisors, VMs, containers
- Storage
- block, object, file, backups
- Virtualization
- abstracts and pools the hardware
- Management plane
- console, APIs, orchestration
Provider secures the physical layers; you inherit them and must verify through audit reports
Securing virtualization
- Harden and patch the hypervisor
- Type 1 preferred for production
- Isolate management network from tenant traffic
- Disable unneeded virtual devices
- Secure VM images and templates
- Encrypt VM storage and snapshots
- Hardware roots: TPM, secure boot
- Monitor for VM escape and sprawl
Virtual networking
Constructs
- VPC
- isolated virtual network per tenant
- Subnet
- public or private address range
- Security group
- stateful firewall on the instance
- Network ACL
- stateless rules on the subnet
- NAT gateway
- private outbound to internet
- Peering, transit
- connect VPCs, hub and spoke
Design rules
- Tier by subnet: web, app, data
- Database only reachable from app tier
- Bastion or zero-trust broker for admins
- Private endpoints to platform services
- Flow logs for lateral movement detection
- Hybrid links are high-value targets
SDN separates control plane from data plane; policy is code, so misconfiguration replicates at speed
Containers and orchestration
- Shared kernel: weaker isolation than VMs
- Trusted registries, scan images before deploy
- Never run containers as root
- Restrict runtime, drop capabilities
- Secrets from a vault, not the image
- Network policies between pods
- Audit the orchestrator control plane
- Runtime behavioral monitoring on every node
Serverless and ephemeral compute
- Provider owns OS and runtime patching
- Least-privilege role per function
- Timeouts and limits stop resource abuse
- Short life limits attacker persistence
- Shared execution environment isolation matters
- Logging must be built in, nothing lingers
- Cold starts and vendor lock-in trade-offs
Infrastructure risks
- Default credentials and open defaults
- Overly permissive IAM on instances
- SSRF reaching the instance metadata service
- Public storage from misconfigured policy
- Container breakout to the host node
- Data remanence in deallocated storage
- IP forwarding turns a VM into a router
- Configuration drift from approved baseline
Countermeasures
- Hardened images from a golden baseline
- Immutable infrastructure, redeploy not repair
- Resource tagging for policy and audit
- Permission boundaries and control policies
- Encrypt everything at rest, in transit
- Dedicated hosts when isolation is regulated
- CDN and scrubbing against DDoS
- Continuous compliance with auto-remediation
Identity for infrastructure
- Roles with temporary credentials, not keys
- Managed identities for workloads
- Service control policies cap what accounts can grant
- Federate through one identity provider
- MFA on every console and root account
- Rotate service account secrets automatically
- Behavioral analytics on API usage
Excessive instance permissions are prevented by boundaries, not detected after the fact
Infrastructure as code
- Templates in version control, reviewed
- Scan templates in the pipeline before deploy
- Audit trail of every infrastructure change
- Blue-green deployments allow instant rollback
- Drift detection compares live to declared
- Secrets never inside templates
- GitOps: the repository is the source of truth
Business continuity and disaster recovery
Cloud building blocks
- Availability zone
- isolated data center within region
- Region
- geographic cluster of zones
- Multi-AZ synchronous
- near-zero data loss
- Multi-region
- survives regional disaster, sovereignty check
- Snapshots
- point-in-time recovery, integrity checks
Strategies, cheapest to fastest
- Backup and restore: hours to days
- Pilot light: core data replicated, scale on demand
- Warm standby: scaled-down copy running
- Multi-site active-active: seconds, highest cost
- Match the strategy to RTO and RPO
RPO sets replication frequency, RTO sets how much stands ready; the business pays for both
Planning and testing continuity
- BIA identifies critical services and dependencies
- Provider SLA is not your DR plan
- Shared responsibility applies to recovery too
- Document failover and failback procedures
- Test regularly: tabletop through full failover
- Recovery slower than RTO is a finding
- Avoid single-provider dependency for critical services
- Verify backups restore, not just exist
Logical design for isolation
- Separate accounts or VPCs per tenant
- Service mesh with mutual TLS between services
- Private subnets for anything stateful
- Encrypt hybrid links end to end
- Availability zones inside approved regions
- Segment management traffic from workloads
- Bare metal when physical isolation is required
Know the order
- Isolate
- Snapshot disk and memory
- Analyze
- Rebuild from clean image
- Restore service
- Snapshot before any change on a compromised VM
- Rotate exposed credentials immediately
- Rebuild, never patch a compromised instance
- Forensics continues on the copy
Reference strip: components, risks, controls, continuity
Components
- Hypervisor Type 1 and Type 2
- VPC, subnet, security group, NACL
- Containers, orchestrator, registry
- Functions, queues, managed databases
Risks
- VM escape, container breakout
- SSRF to metadata service
- Public buckets, default credentials
- Drift, sprawl, remanence
Controls
- Golden images, immutable redeploys
- IaC scanning in the pipeline
- Tagging, boundaries, control policies
- Flow logs, UEBA, runtime monitoring
Continuity
- AZ, region, replication
- Backup, pilot light, warm, active-active
- RTO, RPO, MTD
- Test failover and failback
Zero trust in infra
- Identity-aware access to admin planes
- Mutual TLS everywhere
- Microsegmentation by workload
- Continuous verification, no implicit trust
Quick exam traps
- Trap: Security groups are stateless like network ACLs
- Trap: Containers give the same isolation as virtual machines
- Trap: The provider's SLA covers your disaster recovery
- Trap: Patch a compromised instance in place and keep it running
- Trap: Serverless removes all customer security responsibility
- Trap: A multi-region design has no data sovereignty impact
- Trap: Block storage is the best choice for archival
- Trap: Detecting excessive permissions is as good as preventing them
cybercertprep.com · original revision sheet written from the public body of knowledge