CCSP Practice Test 1 — 10 Questions

Question 1

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Accepted Answer

The policy allows GetObject requests only from the specified IP range. The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Answer

The policy grants full administrative access to the bucket

Answer

The policy denies all access from the specified IP range

Answer

The bucket is publicly accessible to any IP address

Question 2

Which TWO of the following are required for GDPR compliance when processing personal data in the cloud?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk. Options A and B are correct. DPIA is required for high-risk processing, and records of processing activities are mandatory. Option C is wrong because data can be stored outside EU with adequate safeguards. Option D is wrong because DPO is only required in certain cases. Option E is wrong because CSP certification is not a legal requirement.

Answer

Appoint a Data Protection Officer (DPO) for all organizations

Answer

Store data only within the European Union

Answer

Use only ISO 27001 certified cloud service providers

Question 3

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Answer

SOX

Answer

HIPAA

Answer

PCI DSS

Question 4

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Accepted Answer

2. The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Answer

12

Answer

4

Answer

3

Question 5

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for early detection of vulnerabilities during the coding phase of the SSDLC. By integrating SAST into the CI/CD pipeline, developers receive immediate feedback on security flaws such as SQL injection or buffer overflows, enabling remediation before the code is built or deployed. This aligns with the 'shift left' principle, catching issues when they are cheapest and easiest to fix.

Answer

Penetration testing in production

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 6

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Accepted Answer

Certificate of destruction. Option A is correct (Certificate of destruction) provides evidence of secure deletion. Option B (Annual penetration testing) is for security testing, not deletion. Option C (Right to audit) is broad. Option D (Service level credits) are for availability.

Answer

Service level credits

Answer

Annual penetration testing

Answer

Right to audit

Question 7

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. Option C is correct because the S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 8

A cloud service provider stores customer data in a multi-tenant environment. A customer from the European Union requests that all personal data be encrypted at rest to comply with GDPR. What is the primary reason for this requirement?

Accepted Answer

To prevent unauthorized access by other tenants. Option A is correct because encryption at rest protects against unauthorized access in multi-tenant environments. Option B is about portability, not encryption. Option C is about minimizing data collected, not encryption. Option D is about deletion, not encryption.

Answer

To ensure data portability

Answer

To meet data minimization principles

Answer

To satisfy the right to be forgotten

Question 9

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

Accepted Answer

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".. Option D is correct because modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer

Add a Deny statement for the 10.0.0.0/16 range.

Answer

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Answer

Remove the Condition element to allow access from any IP.

Question 10

Which TWO of the following are common risk treatment options in cloud risk management?

Accepted Answer

Transference. Options A and C are correct. Avoidance and transference (transfer) are standard risk treatment options. Acceptance is also a treatment, but in this question we require exactly two correct, so we chose avoidance and transference. Mitigation is another common option, but it is not listed as correct here.

Answer

Ignorance

Answer

Deletion

Answer

Acceptance

CCSP Practice Test 1 — 10 Questions

Exhibit

CCSP Practice Test 1 — 10 Questions

Exhibit