CCSP Practice Test 10 — 10 Questions

Question 1

A company uses a cloud object storage service to host a public website. The website content is static and needs to be accessible to anyone on the internet, but the company wants to prevent direct listing of the bucket contents. Which combination of access controls should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bucket ACLs set to public and block public access disabled. Setting bucket ACLs to public and disabling block public access allows anonymous read access to objects. However, to prevent listing of bucket contents, the ACL must grant only object-level read (GetObject) and not bucket-level list (ListBucket). In cloud storage services like AWS S3, a bucket ACL with READ grants list access, so a bucket policy is typically used instead. In this scenario, with the given options, C is the only choice that enables public access while attempting to prevent listing, though it may not fully achieve it in all providers.

Answer

IAM policies granting public access to the bucket

Answer

Enable versioning and cross-region replication

Answer

Block public access to the bucket and use pre-signed URLs for objects

Question 2

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 3

Which type of threat is this log most likely indicating?

Accepted Answer

Data exfiltration. The log shows a large volume of outbound data transfers from a cloud storage bucket to an external IP address, which is characteristic of data exfiltration. In cloud environments, such activity often involves unauthorized copying of sensitive data to an attacker-controlled location, bypassing normal access controls.

Answer

Account takeover

Answer

Malware infection

Answer

Insider threat

Question 4

A multinational corporation with its headquarters in the United States processes personal data of European Union data subjects using a cloud-based customer relationship management (CRM) system hosted in the United States. According to the General Data Protection Regulation (GDPR), which of the following is the company's primary obligation regarding the protection of that data?

Accepted Answer

The company must appoint a representative in the EU and ensure that any data transfers outside the EU are covered by an adequacy decision, standard contractual clauses, or binding corporate rules.. GDPR applies to any organization processing personal data of EU data subjects, regardless of where the processing occurs. The company is a data controller and must comply with all GDPR requirements, including data subject rights and breach notification.

Answer

The company must delete all personal data within 30 days of collection.

Answer

The company is not subject to GDPR because its headquarters and the cloud server are located outside the EU.

Answer

The company must obtain explicit consent from each data subject before processing their data.

Question 5

A company is adopting DevSecOps and wants to incorporate security testing into their continuous integration pipeline. They have decided to run SAST (static analysis) and SCA (software composition analysis) tools. Which of the following is the PRIMARY reason for including SCA in addition to SAST?

Accepted Answer

To identify known vulnerabilities in third-party libraries and dependencies. SCA (Software Composition Analysis) is specifically designed to identify known vulnerabilities in third-party libraries and dependencies by comparing their versions against public vulnerability databases like the National Vulnerability Database (NVD) or OWASP Dependency-Check. SAST (Static Application Security Testing) analyzes custom source code for security flaws but cannot inspect external libraries that are often pulled in via package managers (e.g., npm, Maven, pip). Including SCA ensures that the organization addresses supply chain risks, which is a primary goal in DevSecOps pipelines.

Answer

To detect insecure runtime behavior

Answer

To reduce false positives identified by SAST

Answer

To scan for vulnerabilities in custom APIs

Question 6

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create a custom IAM role with only the required actions on specific resources. AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Answer

Use resource-based policies on the Lambda function

Answer

Attach a managed policy that grants full access to S3 and DynamoDB

Answer

Use the root user credentials of the AWS account

Question 7

A cloud service provider stores customer data in a multi-tenant environment. A customer from the European Union requests that all personal data be encrypted at rest to comply with GDPR. What is the primary reason for this requirement?

Accepted Answer

To prevent unauthorized access by other tenants. Encryption at rest ensures that even if physical storage is accessed by unauthorized parties, the data remains unreadable, thus preventing unauthorized access by other tenants in a multi-tenant environment. Option A describes data portability, which is about transferring data between providers, not encryption. Option C refers to data minimization, which limits the collection of personal data to what is necessary. Option D is about the right to be forgotten, which involves deletion of data, not encryption.

Answer

To ensure data portability

Answer

To meet data minimization principles

Answer

To satisfy the right to be forgotten

Question 8

An organization is implementing data masking to protect sensitive data in non-production environments. Which THREE of the following are common data masking techniques? (Choose three.)

Accepted Answer

Shuffling. Shuffling is a common data masking technique that randomly reorders values within a column to break the link between records while preserving the overall distribution and statistical properties. This ensures that sensitive data, such as names or account numbers, cannot be traced back to the original individuals, making it suitable for non-production environments where referential integrity is not required.

Answer

Perturbation

Answer

Encryption

Question 9

A cloud application processes data subject to GDPR. The security team needs to ensure that all personally identifiable information (PII) is encrypted at rest and that access is logged. Which combination of controls should be implemented? (Select THREE)

Accepted Answer

Implement strict least privilege access controls. Strict least privilege access controls ensure that only authorized users or services can access PII, minimizing the risk of unauthorized exposure. This is a fundamental security principle for GDPR compliance, as it directly supports the data minimization and access control requirements. By restricting access to only what is necessary for a role, the organization reduces the attack surface and ensures that any access is intentional and auditable.

Answer

Use TLS for all network connections

Answer

Implement a key management system

Question 10

Refer to the exhibit. A cloud administrator discovers this Azure role assignment in the Finance resource group. The role definition ID corresponds to 'Storage Blob Data Contributor'. What is the immediate compliance concern?

Accepted Answer

The assignment provides unconstrained access without any condition. The role assignment 'Storage Blob Data Contributor' grants full read, write, and delete permissions on blob data within the scope, without any Azure attribute-based access control (ABAC) conditions. This violates the principle of least privilege, as it allows unconstrained access to all blob containers and blobs in the storage account, which is a compliance concern under frameworks like SOC 2 or ISO 27001 that require fine-grained access controls.

Answer

The principal ID is not a human-readable name

Answer

The assignment is scoped to a storage account

Answer

The assignment has no expiration date