CCSP Practice Test 1 — 10 Questions

Question 1

A company receives an erasure request under GDPR. The cloud provider can delete from active storage within 24 hours but requires 90 days to delete from archives. The company has a contractual obligation to ensure deletion within 30 days. What should the company do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request the provider to delete from archives within 30 days and verify.. The company has a contractual obligation to ensure deletion within 30 days, which overrides the provider's default 90-day archive retention policy. The company must formally request the provider to expedite the deletion from archives and verify compliance, as GDPR Article 17 requires the controller to ensure erasure without undue delay, and the provider as processor must assist. Relying on the provider's standard timeline without action would breach the contract and GDPR accountability requirements.

Answer

Delete the data from the application layer only and rely on provider for archives.

Answer

Accept the 90-day timeline and inform the data subject accordingly.

Answer

Reject the request as impractical.

Question 2

Which TWO of the following are valid considerations when performing forensic imaging of virtual machines in a public cloud? (Choose two.)

Accepted Answer

Time synchronization between the imaging tool and the VM clock is essential. Options A and E are correct. A: Time synchronization is essential for forensic timeline analysis. E: Volatile data (e.g., RAM contents) is lost when the VM is powered off, so imaging should be performed while the VM is running. B is incorrect because the imaging tool does not need to reside in the same cloud region. C is incorrect because hypervisor-level isolation prevents accessing other tenants' VMs. D is incorrect because cloud providers typically do not provide hypervisor memory dumps upon request.

Answer

The imaging process must be performed from within the same cloud region

Answer

Images of other tenants' VMs can be accessed through the hypervisor if needed

Answer

The cloud provider will provide hypervisor memory dumps upon request

Question 3

A multinational corporation operates in a country where data sovereignty laws require that all customer data remain within the country's borders. The company uses a global public cloud provider. Which operational control is MOST critical to ensure compliance?

Accepted Answer

Implement cloud policy to restrict resource deployment to approved regions.. Implementing a cloud policy to restrict resource deployment to approved regions is the most direct and proactive operational control to enforce data sovereignty. By using Azure Policy, AWS Service Control Policies (SCPs), or GCP Organization Policies, the organization can programmatically prevent resources from being provisioned in non-compliant regions, ensuring customer data never leaves the required jurisdiction. This is a preventive control that operates at the infrastructure level, unlike detective or reactive measures.

Answer

Use a VPN to connect to the cloud provider's network.

Answer

Conduct quarterly audits of data storage locations.

Answer

Encrypt all data at rest and in transit.

Question 4

A cloud customer wants to ensure that their data is encrypted during transmission between their on-premises data center and the cloud provider's service. Which protocol should they use?

Accepted Answer

Transport Layer Security (TLS) 1.2. TLS 1.2 is the correct choice because it is specifically designed to secure data in transit over networks, such as between an on-premises data center and a cloud provider. It operates at the transport layer, providing encryption, authentication, and integrity for HTTP-based traffic (HTTPS), which is the most common method for cloud API interactions. IPSec, while also a valid encryption protocol, is typically used for site-to-site VPN tunnels at the network layer, not for securing individual service-to-service transmissions like those to a cloud provider's REST API.

Answer

Internet Protocol Security (IPSec)

Answer

Secure Shell (SSH)

Answer

Remote Desktop Protocol (RDP)

Question 5

An organization wants to prevent secrets from being exposed in source code. Which two practices should they adopt? (Choose TWO.)

Accepted Answer

Implement secret scanning in the CI/CD pipeline. Using a secrets manager (like AWS Secrets Manager or Vault) avoids hardcoding credentials. Scanning for secrets in code repositories (e.g., GitGuardian) helps detect and remove any secrets that might have been committed.

Answer

Encrypt all source code files

Answer

Use a firewall to block access to code repositories

Answer

Disable git history

Question 6

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

Accepted Answer

Use a combination of input validation, output encoding, and Content Security Policy.. Cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

Answer

Encode all output that is rendered in HTML.

Answer

Implement a Content Security Policy (CSP) as the sole defense.

Answer

Validate all user input on the server side.

Question 7

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 8

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 9

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 10

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

Accepted Answer

Deploy a virtual firewall between tiers.. Deploying a virtual firewall between tiers (e.g., between web, application, and database tiers) enforces micro-segmentation by inspecting and controlling east-west traffic at the application layer. This allows granular, stateful filtering of traffic based on specific protocols, ports, and even application-level attributes, preventing lateral movement of threats within the cloud environment.

Answer

Allow all traffic from the internet.

Answer

Use a bastion host for all administrative access.

Answer

Use a single network ACL for all subnets.