CCSP Practice Test 13 — 15 Questions

Question 1

A global enterprise is designing a cloud storage architecture with cross-region replication for disaster recovery. They must ensure that data replicated to a secondary region is encrypted with keys managed by the customer, and that those keys are stored in the secondary region's key management service (KMS). Which THREE capabilities must be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Permission for the replication service to use the secondary region's key. To meet the requirements, the customer must use customer-managed keys (CMK) in the secondary region, enable cross-region replication, and ensure the replication service has permission to use the target region's key via an appropriate access control mechanism.

Answer

Default encryption with provider keys

Answer

Client-side encryption before upload

Question 2

A healthcare organization stores patient records in a cloud object storage bucket. The compliance team requires that all files containing Protected Health Information (PHI) be automatically identified and classified. Which service should the organization implement to scan the bucket for PHI and label the data accordingly?

Accepted Answer

Data Loss Prevention (DLP) service. A Data Loss Prevention (DLP) service can scan cloud object storage for sensitive data like PHI and perform classification and labeling. This is a common capability provided by cloud providers and third-party solutions.

Answer

Cloud Audit Logs

Answer

Cloud KMS

Answer

Identity and Access Management (IAM)

Question 3

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command). To obtain a forensic memory dump from a compromised EC2 instance without rebooting or altering the disk state, you can use the AWS CLI to invoke a command that runs a memory acquisition tool, such as LiME or AVML. For example, you could send a command via AWS Systems Manager Run Command to dump memory to an S3 bucket for analysis. Options A and D capture non-volatile disk states (AMI and EBS snapshot), and Option B is unrelated to evidence collection. Therefore, Option C is the best choice.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Take a snapshot of the root EBS volume

Question 4

A multinational corporation must comply with data residency requirements that mandate certain data must remain within the European Union. Additionally, the company needs to ensure high availability and disaster recovery for this data. Which TWO measures should be implemented? (Select TWO.)

Accepted Answer

Configure cross-region replication to another EU region. To comply with data residency and ensure availability/DR, select cloud regions located within the EU (D) and configure cross-region replication to another EU region (A). IAM policies restricting data access to EU regions are access controls and do not ensure the data remains stored within the EU. Options C and E violate residency or security. Therefore, A and D are correct.

Answer

Implement IAM policies with conditions restricting data access to EU regions

Answer

Use cross-region replication to a region outside the EU

Answer

Enable public access to the bucket for all users

Question 5

A cloud architect is securing a serverless application that uses serverless functions and an API gateway. Which TWO practices help protect against injection attacks?

Accepted Answer

Parameterized queries for database access. Input validation and parameterized queries prevent injection attacks such as SQL injection or command injection.

Answer

Using environment variables for secrets

Answer

Using a custom domain name

Answer

Enabling API caching

Question 6

An organization wants to deploy a cloud environment where multiple separate agencies with common compliance requirements share the infrastructure, but each agency retains some control over their own resources. Which deployment model best fits this scenario?

Accepted Answer

Community cloud. Community cloud is designed for organizations with shared concerns.

Answer

Hybrid cloud

Answer

Public cloud

Answer

Private cloud

Question 7

A cloud provider offers a service with an SLA of 99.999% availability. What is the maximum allowable downtime per year in minutes? (Assume 365 days)

Accepted Answer

5.26 minutes. 99.999% availability means 0.001% downtime per year. Yearly minutes = 365 * 24 * 60 = 525,600. 0.001% of 525,600 = 5.256 minutes.

Answer

8.76 minutes

Answer

0.526 minutes

Answer

52.6 minutes

Question 8

A financial institution is evaluating a community cloud deployment shared with other banks. Which TWO security considerations are MOST important for this deployment model?

Accepted Answer

Ensuring strong isolation between tenant data and workloads. Community clouds require strong isolation between tenants and compliance with shared regulatory standards. Shared responsibility model still applies, and dedicated hardware is not typical.

Answer

Minimizing network bandwidth to reduce costs

Answer

The provider assumes full responsibility for all security controls

Answer

Use of dedicated physical servers for each tenant

Question 9

An organization is designing a multi-cloud strategy using containers to avoid vendor lock-in. Which of the following approaches BEST ensures portability of containerized applications across different cloud providers?

Accepted Answer

Standardize on Docker images and Kubernetes orchestration with open-source tooling.. Using open standards like Kubernetes and Docker ensures portability, while using proprietary APIs or nested containers can create lock-in or complexity.

Answer

Use cloud provider-specific container services like Amazon ECS with proprietary APIs.

Answer

Use nested containers to abstract the underlying cloud provider.

Answer

Deploy containers directly on virtual machines without an orchestration layer.

Question 10

A cloud security team is implementing a data discovery and classification program for their SaaS applications. Which TWO statements accurately describe best practices for data classification in the cloud?

Accepted Answer

Automated tools can scan cloud storage and apply classification labels based on content inspection.. Automated tools can efficiently scan cloud storage for sensitive data, and DLP policies can enforce classification during data usage. Manual classification is not more accurate than automated for large-scale cloud data, classification labels are not solely applied by the provider, and tokenization is a separate technique.

Answer

Manual classification by users is more accurate than automated methods in large-scale cloud environments.

Answer

Tokenization can replace data classification by eliminating the need to identify sensitive data.

Answer

Data classification labels must be applied by the cloud service provider to ensure consistency.

Question 11

A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?

Accepted Answer

Adopting open standards and open-source APIs like Kubernetes and Terraform. Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.

Answer

Using proprietary APIs from the cloud provider

Answer

Subscribing to a single cloud provider's managed services

Answer

Using proprietary data formats

Question 12

An organization is evaluating a cloud service provider and reviewing their SLA. Which THREE metrics are most important for assessing the provider's reliability and accountability? (Choose three.)

Accepted Answer

Frequency of performance reporting. Uptime guarantee, compensation for failures, and reporting frequency are key SLA metrics.

Answer

Number of data center employees

Answer

Provider's stock price

Question 13

An organization uses Azure Functions and wants to secure its API endpoints exposed via Azure API Management. Which TWO security controls should they implement at the API Gateway level?

Accepted Answer

Enable TLS enforcement. TLS enforcement ensures encryption in transit, protecting data from interception. JWT validation verifies the authenticity and integrity of tokens, ensuring only authorized users access the API endpoints.

Answer

Configure IP whitelisting for all users

Answer

Store secrets in Azure Function environment variables

Answer

Disable API keys

Question 14

A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?

Accepted Answer

Private cloud. Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 15

A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?

Accepted Answer

Support for open APIs and industry standards. SLA guarantees availability, open APIs and standards enable portability, and audit reports demonstrate security and compliance. Data center locations are important for latency but not directly for portability; support tiers are operational but not strategic for these requirements.

Answer

Provider's customer support tiers

Answer

Number of data center locations