CCSP Practice Test 10 — 10 Questions

Question 1

A small business uses a cloud provider's default server-side encryption (SSE) to encrypt data at rest in their cloud storage. They are concerned about key management overhead. Which statement best describes the key management responsibility for SSE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cloud provider manages the keys entirely.. With default SSE (e.g., SSE-S3 in AWS), the cloud provider manages the encryption keys entirely. The customer is not involved in key generation, rotation, or storage. CMEK and CSEK require customer involvement. BYOK involves importing customer keys.

Answer

The customer and provider share key management responsibilities.

Answer

Keys are not used; encryption is transparent.

Answer

The customer generates and manages the keys.

Question 2

A cloud architect is designing a data lifecycle policy for a SaaS application. According to the cloud data lifecycle, which phase immediately follows the 'Share' phase?

Accepted Answer

Archive. In the CSA cloud data lifecycle (Create, Store, Use, Share, Archive, Destroy), the Archive phase immediately follows Share. Archiving moves data that is no longer actively used but must be retained for compliance or business reasons into long-term, lower-cost storage.

Answer

Store

Answer

Use

Answer

Destroy

Question 3

In a hybrid cloud deployment, which of the following is a critical security consideration?

Accepted Answer

Ensuring consistent security policy across environments. Consistent security policy across environments is critical in hybrid cloud because workloads and data span on-premises and cloud boundaries, and inconsistent controls create gaps attackers can exploit. Unified policy ensures identity, encryption, logging, and access controls are applied uniformly. This is a foundational governance requirement for hybrid architectures.

Answer

Using only public cloud for sensitive data

Answer

Avoiding any use of APIs for integration

Answer

Eliminating all private cloud resources

Question 4

An organization needs to migrate a legacy application to the cloud. The application requires full control over the operating system, middleware, and runtime. The team wants to minimize management overhead while retaining OS-level access. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking where the customer manages the OS, middleware, and runtime while the provider manages the underlying physical infrastructure. This matches the requirement for full OS-level control with reduced management overhead compared to on-premises. SaaS, PaaS, and FaaS abstract away the OS, so they cannot satisfy the need for OS-level access.

Answer

SaaS

Answer

FaaS

Answer

PaaS

Question 5

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command). Using AWS Systems Manager Run Command to execute a memory dump script on the instance allows the team to capture volatile memory (RAM) while the instance is still running, preserving the system state. This method does not require stopping or modifying the instance, and it can be done remotely via the AWS CLI, making it the best option for forensic memory acquisition.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Take a snapshot of the root EBS volume

Question 6

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates with Amazon API Gateway to protect against common web exploits like SQL injection and cross-site scripting. It inspects incoming HTTP/HTTPS requests and applies rules to block malicious traffic. Enabling AWS WAF on the API Gateway stage provides the required protection.

Answer

IAM policies

Answer

Security groups on the API Gateway

Answer

Network ACLs on the VPC

Question 7

In a cloud VPC, what is the difference between security groups and network ACLs (NACLs)?

Accepted Answer

Security groups are stateful and support allow rules only; NACLs are stateless and support allow and deny rules. Security groups are stateful—return traffic for an allowed inbound connection is automatically permitted—and they support only allow rules, with an implicit deny for anything not explicitly allowed. NACLs are stateless—each direction must be explicitly allowed, including ephemeral return ports—and they support both allow and deny rules, evaluated in numbered order. This stateful/stateless and allow-only/allow-deny distinction is the core difference.

Answer

Security groups support allow and deny rules; NACLs support only allow

Answer

Security groups are stateless and NACLs are stateful

Answer

Security groups and NACLs are both stateless

Question 8

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool from the Sigstore project that signs and verifies container images. It integrates with Kubernetes admission controllers (e.g., via Kyverno or OPA Gatekeeper policies) to enforce that only images with valid signatures from a trusted registry are deployed. This directly addresses the requirement to enforce signed images at admission time.

Answer

Clair

Answer

Trivy

Answer

Snyk Container

Question 9

A financial services company must comply with a regulation that requires encryption keys used for cloud services to be generated and stored on-premises in a Hardware Security Module (HSM). The cloud provider must not have any access to the keys. Which key management approach should the company adopt?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) is the only approach where the customer generates and stores the encryption keys entirely on-premises in their own HSM, and the cloud provider never has access to the plaintext keys. The cloud provider only receives encrypted data or wrapped keys, so it cannot decrypt the data. This satisfies the regulation's requirement that keys be generated and stored on-premises and that the provider have zero access. In contrast, CMEK and BYOK still involve the cloud provider's key management infrastructure, which means the provider has some level of access or control.

Answer

Cloud KMS with HSM-backed keys

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

Bring Your Own Key (BYOK)

Question 10

In a DevSecOps pipeline for a cloud application, which practice best ensures that only approved open-source components are used?

Accepted Answer

Using a private artifact registry with allow-lists. A private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.

Answer

Signing container images

Answer

Implementing dependency scanning with Snyk

Answer

Running SAST scans on all source code