CCSP Practice Test 12 — 15 Questions

Question 1

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

Accepted Answer

Multi-region active-active. Multi-region active-active is the only strategy that can meet both a 15-minute RTO and a 5-minute RPO because it maintains synchronous or near-synchronous replication between two or more regions, allowing traffic to be instantly redirected with zero or minimal data loss. This approach eliminates the recovery time needed to spin up infrastructure or restore data, as the application is already fully operational in multiple regions.

Answer

Backup and restore

Answer

Pilot light

Answer

Warm standby

Question 2

A company is subject to a legal hold order and uses a cloud storage service with object replication across multiple regions. Which cloud feature should the company use to prevent deletion or modification of relevant data?

Accepted Answer

Legal hold policies (e.g., S3 Object Lock). Legal hold policies, such as Amazon S3 Object Lock in compliance mode, prevent objects from being deleted or overwritten for a specified retention period, even by privileged users. This directly satisfies a legal hold order requiring preservation of data against alteration or destruction. Object Lock uses a write-once-read-many (WORM) model that is purpose-built for litigation holds and regulatory retention.

Answer

Versioning of objects

Answer

Cross-region replication

Answer

Backup to another provider

Question 3

A company is contracting with a cloud provider and wants to ensure they have visibility into the provider's security controls. Which contract clause is most important to include?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the ability to review the provider's security controls, policies, and procedures. The SLA for uptime focuses on availability, not security. Data portability is about moving data. Indemnification covers liability, not visibility.

Answer

Indemnification clause

Answer

Service Level Agreement (SLA) for uptime

Answer

Data portability clause

Question 4

An organization experiences a data breach in the cloud. The CSP claims they are not liable because the breach was due to customer misconfiguration. The customer disagrees. What document should be reviewed to determine liability?

Accepted Answer

The shared responsibility matrix in the service contract. The shared responsibility matrix (SRM) is the definitive contractual document that delineates which security controls are managed by the cloud service provider (CSP) and which are the customer's obligation. In a breach caused by misconfiguration, the SRM specifies whether the configuration of the affected resource (e.g., an S3 bucket ACL or a security group rule) falls under the customer's responsibility. Without reviewing the SRM, liability cannot be determined because the matrix explicitly maps each control layer (e.g., network, compute, data) to the responsible party.

Answer

The CSP's privacy policy

Answer

The SOC 2 Type II report from the CSP

Answer

The incident response plan

Question 5

Drag and drop the steps for setting up a cloud access security broker (CASB) in a SaaS environment into the correct order.

Accepted Answer

Define security policies, then deploy CASB, then configure CASB, then test CASB, then full rollout.. Start with policy definition, then deploy, configure, test, and finally full rollout.

Answer

Deploy CASB, then configure CASB, then define security policies, then test CASB, then full rollout.

Answer

Define security policies, then deploy CASB, then test CASB, then configure CASB, then full rollout.

Answer

Deploy CASB, then define security policies, then configure CASB, then full rollout, then test CASB.

Question 6

A company is evaluating cloud providers for compliance with the GDPR. Which TWO of the following are mandatory data protection roles under the GDPR?

Accepted Answer

Data Processor. The GDPR defines the Data Controller and Data Processor as mandatory roles. The Data Protection Officer (DPO) is required only under certain conditions (e.g., large-scale monitoring). Cloud Security Architect and Data Steward are not GDPR-defined roles.

Answer

Data Protection Officer (DPO)

Answer

Cloud Security Architect

Answer

Data Steward

Question 7

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

Accepted Answer

Ensure cryptographic operations use constant-time algorithms.. Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Answer

Implement virtual LANs (VLANs) and firewall rules between tenants.

Answer

Use hardware security modules (HSMs) for key management.

Answer

Enforce strict API rate limiting for each tenant.

Question 8

Refer to the exhibit. A cloud security administrator is reviewing the following network firewall rule configuration associated with a web server instance. What security best practice is being violated?

Accepted Answer

Inbound SSH should not be allowed from any source.. Allowing inbound SSH (TCP port 22) from any source (0.0.0.0/0) violates the security best practice of least privilege. SSH should only be permitted from specific administrative IP ranges or bastion hosts to prevent unauthorized access and brute-force attacks. In a cloud environment, network firewall rules should restrict SSH to known management networks, not the entire internet.

Answer

Outbound traffic should be allowed to any destination.

Answer

Inbound HTTPS should be allowed from any source.

Answer

Security groups should not be used for web servers.

Question 9

An organization wants to ensure that all resources are compliant with CIS benchmarks. Which cloud service provides a unified view of compliance posture and recommendations?

Accepted Answer

Cloud Security Posture Management (CSPM) tool. A cloud security posture management (CSPM) tool provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from various security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

Answer

Security Information and Event Management (SIEM) tool

Answer

Cloud monitoring and logging service

Answer

Policy-as-code enforcement service

Question 10

A cloud customer receives a legal hold notice for pending litigation. The data resides in multi-tenant storage. What is the most appropriate initial action?

Accepted Answer

Preserve the relevant data using customer-accessible tools. Preserving all relevant data from the customer's tenant is required. Alerting other tenants violates privacy; relying solely on provider backup may be insufficient as backups might not be retained indefinitely; doing nothing is non-compliant.

Answer

Do nothing until the provider issues a notice

Answer

Rely on the provider's backup retention cycle

Answer

Alert all other tenants about the hold

Question 11

Drag and drop the steps for implementing a secure DevOps (DevSecOps) pipeline in a cloud environment into the correct order.

Accepted Answer

SAST at commit, then DAST in staging, then IaC scanning, then policy enforcement, then runtime monitoring. First SAST at commit, then DAST in staging, IaC scanning, policy enforcement, and runtime monitoring.

Answer

DAST in staging first, then SAST at commit, then IaC scanning, then policy enforcement, then runtime monitoring

Answer

Policy enforcement, then SAST at commit, then DAST in staging, then IaC scanning, then runtime monitoring

Answer

Runtime monitoring, then SAST at commit, then DAST in staging, then IaC scanning, then policy enforcement

Question 12

A security engineer is implementing automated incident response for common cloud threats. Which TWO cloud services can be used together to create a serverless orchestration workflow for incident response? (Choose two.)

Accepted Answer

Orchestration service for serverless workflows. Option A, an orchestration service for serverless workflows (such as AWS Step Functions), is correct because it provides the state-machine logic that coordinates, sequences, and branches incident-response steps without managing servers. Option B, a serverless compute service (such as AWS Lambda), is correct because it executes the actual response actions—enriching findings, isolating resources, or notifying teams—as event-driven functions invoked by the orchestration workflow. Together, A and B form a fully serverless orchestration pipeline: the workflow service defines the incident-response state machine while the compute service runs the per-step code. Option C, infrastructure as code, is for declaratively provisioning resources, not for orchestrating runtime incident-response logic. Option D, a virtual machine service, requires managing persistent instances and is not serverless. Option E, vulnerability management, identifies weaknesses but does not orchestrate or execute response workflows.

Answer

Infrastructure as code service

Answer

Virtual machine service

Answer

Vulnerability management service

Question 13

A company experiences a security breach in its cloud environment, and the security team needs to preserve evidence for legal proceedings. Which of the following is the MOST important step to take first?

Accepted Answer

Isolate the compromised systems from the network to prevent lateral movement.. The immediate priority in a cloud security incident is to contain the breach and prevent lateral movement, which preserves the integrity of the evidence by stopping further compromise. Isolating compromised systems (e.g., via network security groups or virtual network segmentation) ensures that volatile data, such as memory contents and active connections, is not altered by ongoing attacker activity. This step aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before evidence collection.

Answer

Disable all logging to prevent the attacker from seeing detection efforts.

Answer

Notify all affected customers of the breach.

Answer

Contact the legal department to obtain a warrant before any action.

Question 14

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 15

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Accepted Answer

Assess current environment, set up target cloud environment, replicate applications and data, transfer data, test and cut over. First assess, then set up target, replicate, transfer data, and finally test and cut over.

Answer

Set up target cloud environment, assess current environment, replicate applications and data, transfer data, test and cut over

Answer

Assess current environment, replicate applications and data, transfer data, set up target cloud environment, test and cut over

Answer

Assess current environment, set up target cloud environment, transfer data, replicate applications and data, test and cut over