CCSP Practice Test 12 — 15 Questions

Question 1

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. A Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 2

Which THREE of the following are valid techniques to protect application programming interfaces (APIs) from abuse?

Accepted Answer

Use API gateways to enforce authentication and authorization policies.. API gateways act as a centralized policy enforcement point, intercepting all API traffic to validate authentication (e.g., OAuth 2.0, SAML) and authorization (e.g., RBAC, ABAC) before requests reach backend services. This prevents unauthorized access and ensures that only authenticated clients with proper permissions can invoke protected endpoints, directly mitigating abuse such as credential stuffing or privilege escalation.

Answer

Use JSON Web Tokens (JWT) without encryption.

Answer

Use only HTTP GET requests for all API calls.

Question 3

A container image is built and scanned in a CI pipeline. Which practice should be implemented to ensure that the image has not been tampered with before deployment?

Accepted Answer

Signing the image with a private key and verifying the signature. Signing container images provides cryptographic verification of image integrity, ensuring they have not been altered since signing.

Answer

Using a minimal base image

Answer

Scanning the image with a vulnerability scanner

Answer

Storing the image in a private registry

Question 4

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

Accepted Answer

Container Threat Detection. Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Answer

Cloud Security Scanner

Answer

Event Threat Detection

Answer

Cloud Audit Logs

Question 5

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 6

An organization is designing a cloud application that must remain available even if an entire AWS availability zone fails. Which architecture pattern should they implement?

Accepted Answer

Single region with multiple AZs active-active. The correct architecture is a single region with multiple Availability Zones (AZs) in an active-active configuration. This ensures that if one AZ fails, the application continues to serve traffic from the remaining AZs without any manual intervention, as all AZs are actively handling requests. AWS Availability Zones are physically separate data centers within a region, and an active-active pattern distributes the workload across them to achieve high availability and fault tolerance.

Answer

Single region with multiple AZs active-standby

Answer

Active-passive in a single region

Answer

Multi-region active-active

Question 7

Drag and drop the steps for managing identity and access in a multi-cloud environment using a centralized identity provider (IdP) into the correct order.

Accepted Answer

Integrate the centralized IdP → Create groups and roles → Configure attribute/role mapping → Assign users with MFA enforcement → Audit and review access. First integrate IdP, then create groups/roles, configure mapping, assign users with MFA, and audit.

Answer

Create groups and roles → Integrate the centralized IdP → Configure attribute/role mapping → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Configure attribute/role mapping → Create groups and roles → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Create groups and roles → Assign users with MFA → Configure attribute/role mapping → Audit

Question 8

A company is adopting a serverless architecture using AWS Lambda. The security team is concerned about potential injection attacks via event payloads. Which practice is most effective at mitigating such attacks?

Accepted Answer

Validate and sanitize all input data from event sources. Serverless functions like AWS Lambda are directly invoked by event payloads, and without input validation and sanitization, an attacker can inject malicious code (e.g., SQL, NoSQL, OS commands) that the function executes. This is the most effective mitigation as it addresses the root cause at the application layer, regardless of any perimeter controls.

Answer

Use a web application firewall (WAF) in front of the API Gateway

Answer

Assign the least privilege IAM role to each Lambda function

Answer

Encrypt environment variables containing sensitive configuration

Question 9

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Accepted Answer

The policy allows GetObject requests only from the specified IP range. The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Answer

The policy grants full administrative access to the bucket

Answer

The policy denies all access from the specified IP range

Answer

The bucket is publicly accessible to any IP address

Question 10

A software development company is migrating its development and test environments to a public cloud. The security team has identified that many developers have assigned overly permissive IAM roles to the resources they create, such as giving full administrative access to databases and virtual machines. The company wants to enforce least privilege without impeding development agility. The cloud architect suggests using a combination of permission boundaries and service control policies. Which of the following approaches BEST enforces least privilege while maintaining development flexibility?

Accepted Answer

Define permission boundaries that limit the maximum permissions a developer can grant to resources, and allow developers to create IAM roles within those boundaries.. Permission boundaries in AWS IAM (or similar constructs in other clouds) allow an administrator to set the maximum permissions that a developer can grant to any IAM role or resource. By defining a permission boundary, developers retain the flexibility to create and attach policies within that boundary, ensuring they cannot exceed the defined limits. This directly enforces least privilege because even if a developer attaches a permissive policy, the boundary caps the effective permissions, preventing full administrative access to databases or VMs.

Answer

Implement an automated system that reviews and removes any privileges not used within 60 days.

Answer

Attach a service control policy at the organizational level that denies all actions unless explicitly allowed, and have developers create their own IAM policies.

Answer

Create a permission boundary that restricts all users to read-only access and require subordinates to request access for specific privileges.

Question 11

A financial organization is migrating a critical application to a cloud environment. The application processes sensitive customer data and must comply with PCI DSS. The security architect proposes using serverless functions for the compute layer. Which security control is essential to protect the application from injection attacks?

Accepted Answer

Use parameterized queries in the functions' database calls. Injection attacks (e.g., SQL injection) exploit untrusted input that is concatenated into database queries. Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is treated as data only, not executable code. This is the foundational control for preventing injection in serverless functions that interact with databases, as required by PCI DSS Requirement 6.5.1.

Answer

Enable function-level logging for audit trails

Answer

Encrypt all data in transit between functions

Answer

Implement a web application firewall (WAF) in front of the functions

Question 12

A multinational corporation uses a cloud DLP service to scan data stored in cloud storage and a cloud data warehouse for personally identifiable information (PII). The DLP scan identifies credit card numbers in a dataset. According to the cloud data lifecycle, at which stage should the DLP scan ideally be performed to minimize exposure?

Accepted Answer

Create. DLP scanning should ideally occur during the Create stage, as data is being created or ingested, to prevent sensitive data from being stored without proper protections. Scanning at Store stage may allow data to persist. Scanning at Use or Share stages is reactive and may already have exposed data.

Answer

Store

Answer

Use

Answer

Share

Question 13

A multinational corporation uses a cloud CASB to enforce data loss prevention (DLP) policies across SaaS applications. The security team discovers that sensitive data is being exfiltrated via encrypted traffic that the CASB cannot inspect. What is the most effective design change to mitigate this risk?

Accepted Answer

Deploy a forward proxy with SSL/TLS interception capabilities.. A forward proxy with SSL/TLS interception capabilities allows the CASB to decrypt, inspect, and re-encrypt traffic, enabling DLP policy enforcement on data in transit. This design change addresses the root cause—encrypted traffic bypassing inspection—without breaking application functionality or security.

Answer

Implement user training to prevent data exfiltration.

Answer

Block all encrypted traffic at the network perimeter.

Answer

Disable TLS/SSL encryption for all sensitive data transfers.

Question 14

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

Accepted Answer

Defender for Key Vault. Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Answer

Defender for Databases

Answer

Defender for Containers

Answer

Defender for Servers

Question 15

During a security incident in a multi-tenant cloud environment, the cloud provider's logging system indicates that a virtual machine (VM) on a shared hypervisor has been compromised. The provider wants to assist the customer with forensic analysis while minimizing impact to other tenants. Which approach is most appropriate?

Accepted Answer

Provide the customer with a memory snapshot of the compromised VM.. Providing a memory snapshot of the compromised VM preserves volatile forensic data (e.g., running processes, network connections, encryption keys) without disrupting the hypervisor or other tenants. This approach adheres to the cloud provider's responsibility to isolate forensic evidence while maintaining multi-tenant isolation, as memory snapshots can be taken via hypervisor-level APIs (e.g., VMware VMotion or libvirt) without powering off the VM or cloning the entire host. Option A is incorrect because rebuilding the VM from a known good image destroys the compromised state, overwriting volatile evidence that is critical for forensic analysis. Option C is incorrect because cloning the entire hypervisor introduces significant performance overhead and security risks to other tenants, potentially violating isolation boundaries. Option D is incorrect because powering off the VM immediately may cause loss of volatile memory data crucial for investigation, such as running processes and encryption keys.

Answer

Rebuild the VM from a known good image and then run security scans.

Answer

Clone the entire hypervisor and give the customer access to the clone.

Answer

Power off the VM immediately to contain the incident.