CCSP Practice Test 5 — 10 Questions

Question 1

An organization is migrating a legacy application to the cloud and must comply with PCI DSS. The application currently logs credit card numbers in plaintext. Which data security control should be implemented FIRST?

Accepted Answer

Perform data discovery and classification. Before any remediation can be applied, the organization must first perform data discovery and classification to locate where all credit card numbers (PANs) are stored, including logs, databases, and backups. PCI DSS Requirement 3.1 mandates that cardholder data be identified and classified before implementing controls like tokenization or encryption. Without discovery, subsequent controls may miss critical data stores, leaving plaintext PANs exposed.

Answer

Implement tokenization for credit card numbers

Answer

Deploy a data loss prevention (DLP) solution

Answer

Encrypt the database at rest

Question 2

Which TWO of the following are key components of a cloud incident response plan that should be tested regularly?

Accepted Answer

Automation playbooks for containment and eradication.. Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.

Answer

Encryption key management procedures.

Answer

Backup and restore procedures.

Answer

Service level agreements (SLAs) with cloud provider.

Question 3

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

Accepted Answer

Modify the bucket policy to deny access from all IP addresses except trusted ranges.. The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Answer

Enable bucket logging to track access attempts.

Answer

Notify the security team and wait for a formal change request.

Answer

Enable server-side encryption on the bucket.

Question 4

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Option B is correct because client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 5

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 6

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

Accepted Answer

Ensure cryptographic operations use constant-time algorithms.. Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Answer

Implement virtual LANs (VLANs) and firewall rules between tenants.

Answer

Use hardware security modules (HSMs) for key management.

Answer

Enforce strict API rate limiting for each tenant.

Question 7

A company uses a cloud key management service (KMS) and wants to ensure that keys can be used only within a specific geographic region. Which of the following should be configured?

Accepted Answer

Key policy with a condition for allowed regions. Option C is correct because a key policy with a condition using the `kms:CallerRegion` or `aws:RequestRegion` condition key can explicitly restrict the geographic region where the KMS key can be used. This ensures that any cryptographic operation (e.g., Encrypt, Decrypt) attempted from an unauthorized region is denied, enforcing regional data sovereignty requirements.

Answer

VPC endpoint for KMS

Answer

CloudTrail logging

Answer

Key rotation policy

Question 8

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. Option A is correct because NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 9

A multinational corporation uses a cloud CASB to enforce data loss prevention (DLP) policies across SaaS applications. The security team discovers that sensitive data is being exfiltrated via encrypted traffic that the CASB cannot inspect. What is the most effective design change to mitigate this risk?

Accepted Answer

Deploy a forward proxy with SSL/TLS interception capabilities.. Option C is correct because a forward proxy with SSL/TLS interception capabilities allows the CASB to decrypt, inspect, and re-encrypt traffic, enabling DLP policy enforcement on data in transit. This design change addresses the root cause—encrypted traffic bypassing inspection—without breaking application functionality or security.

Answer

Implement user training to prevent data exfiltration.

Answer

Block all encrypted traffic at the network perimeter.

Answer

Disable TLS/SSL encryption for all sensitive data transfers.

Question 10

A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?

Accepted Answer

New key material is generated, and the old key material is retained for decryption.. Option C is correct because cloud KMS services (e.g., AWS KMS, Azure Key Vault) implement automatic key rotation by generating new cryptographic key material while retaining the old key material. This allows data encrypted with the previous key version to still be decrypted, as the old key material is not destroyed but simply marked as retired for encryption operations.

Answer

The key ID changes after each rotation.

Answer

The old key is immediately destroyed after rotation.

Answer

All data encrypted with the old key must be re-encrypted.