CCSP Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

Accepted Answer

The deletion was performed without evidence of compliance team approval. Option D is correct because the company policy explicitly requires compliance team approval for all deletion operations, and the CloudTrail log entry does not contain any evidence of such approval (e.g., no MFA context, no approval token, no IAM policy condition key indicating approval). CloudTrail logs record API calls but do not inherently capture external approval workflows; the absence of an approval artifact in the log indicates a policy violation.

Answer

The deletion was performed from an internal IP address

Answer

The deletion was performed by a user who may not have authorization

Answer

The log entry does not include the object's encryption status

Question 2

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

Accepted Answer

The policy allows anonymous read access to all objects in the bucket. The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.

Answer

The policy does not restrict access to specific IP addresses

Answer

Any unencrypted request is denied, which could cause data loss if encryption fails

Answer

The policy requires server-side encryption, but does not enforce it for all requests

Question 3

Which THREE of the following are key components of a data protection impact assessment (DPIA) under GDPR?

Accepted Answer

Measures to address risks. Option C is correct because Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.

Answer

List of all data subjects' names

Answer

Copy of the encryption algorithm

Question 4

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. Option B is correct because the second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 5

Which risk assessment method uses subjective scales to assign probabilities and impacts?

Accepted Answer

Qualitative risk assessment. Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Answer

Semi-quantitative risk assessment

Answer

Quantitative risk assessment

Answer

Bottom-up risk assessment

Question 6

Which THREE of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Resource pooling. Resource pooling is correct because NIST SP 800-145 defines it as one of the five essential characteristics, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. This enables economies of scale and location independence, as the customer generally has no control or knowledge over the exact location of the provided resources.

Answer

Multi-tenancy

Answer

Virtualization

Question 7

A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?

Accepted Answer

Automated security testing in CI/CD pipeline. Automated security testing in the CI/CD pipeline (Option C) is the correct practice because it embeds security checks—such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA)—directly into the build and deployment process. This ensures that vulnerabilities are detected and remediated early, aligning with the DevSecOps principle of 'shifting left' and enabling continuous security validation without slowing down development velocity.

Answer

Security awareness training

Answer

Annual penetration testing

Answer

Manual code review before release

Question 8

A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?

Accepted Answer

Conduct regular tabletop exercises to simulate incident scenarios. Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.

Answer

Conduct a post-mortem analysis of previous incidents

Answer

Implement automated isolation of compromised instances

Answer

Deploy a security information and event management (SIEM) system

Question 9

A security architect applies the above bucket policy to an Amazon S3 bucket containing sensitive data. What is the net effect of this policy?

Accepted Answer

It denies all PutObject requests that do not specify an encryption header, enforcing encryption at rest.. The bucket policy uses a condition key `s3:x-amz-server-side-encryption` with a `StringNotEquals` condition to deny `PutObject` requests that do not include the `x-amz-server-side-encryption` header set to `AES256`. This effectively denies any upload that does not specify server-side encryption with S3-Managed Keys (SSE-S3), enforcing encryption at rest for all objects written to the bucket.

Answer

It denies all PutObject requests, regardless of encryption.

Answer

It allows only PutObject requests using SSE-KMS (AWS KMS managed keys).

Answer

It allows PutObject requests only from principals that use an IAM role with encryption permissions.

Question 10

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

Accepted Answer

SQL injection. Option D is correct because directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)

Question 11

A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?

Accepted Answer

Use dedicated (single-tenant) hosts for sensitive workloads.. Option A is correct because using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.

Answer

Encrypt all data at rest using AES-256.

Answer

Implement network segmentation using VLANs.

Answer

Enable multi-factor authentication for all cloud administrative accounts.

Question 12

An architect reviews this S3 bucket policy. What security concern should be raised?

Accepted Answer

The policy grants access to all users from the specified IP range.. Option A is correct because the policy grants s3:GetObject access to all users (Principal: "*") from the specified IP range, which means any unauthenticated user on the internet within that IP range can read objects in the bucket. This violates the principle of least privilege and exposes data to potential unauthorized access, as the policy does not require authentication or additional authorization checks.

Answer

The policy allows s3:GetObject from any source.

Answer

The policy allows s3:GetObject only to the specific bucket.

Answer

The policy does not restrict access to authenticated users.

Question 13

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

Accepted Answer

Use a combination of input validation, output encoding, and Content Security Policy.. Option C is correct because cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

Answer

Encode all output that is rendered in HTML.

Answer

Implement a Content Security Policy (CSP) as the sole defense.

Answer

Validate all user input on the server side.

Question 14

A security analyst is reviewing CloudTrail logs and sees the above event. The analyst suspects that the AMI used may be outdated and vulnerable. Which action should the analyst take to verify the security posture of the launched instance?

Accepted Answer

Look up the AMI in the EC2 console and review its description and security bulletins. Option D is correct because the AMI ID in the CloudTrail log can be used to look up the AMI in the EC2 console, where its description, release notes, and associated security bulletins are available. This allows the analyst to determine if the AMI is outdated or has known vulnerabilities, directly addressing the suspicion about the AMI's security posture.

Answer

Verify that the instance is not assigned a public IP address

Answer

Check the security groups associated with the instance

Answer

Check the AMI ID for known vulnerabilities using the AWS Systems Manager Patch Manager

Question 15

Refer to the exhibit. A cloud security administrator is reviewing the following security group configuration associated with a web server instance. What security best practice is being violated?

Accepted Answer

Inbound SSH should not be allowed from any source.. Option B is correct because allowing inbound SSH (TCP port 22) from any source (0.0.0.0/0) violates the security best practice of least privilege. SSH should only be permitted from specific administrative IP ranges or bastion hosts to prevent unauthorized access and brute-force attacks. In a cloud environment like AWS, security groups should restrict SSH to known management networks, not the entire internet.

Answer

Outbound traffic should be allowed to any destination.

Answer

Inbound HTTPS should be allowed from any source.

Answer

Security groups should not be used for web servers.

CCSP Practice Test 13 — 15 Questions

Exhibit

CCSP Practice Test 13 — 15 Questions

Exhibit