CCSP Practice Test 13 — 15 Questions

Question 1

Which THREE controls help protect data in use within a cloud environment? (Choose three.)

Accepted Answer

Confidential computing. Confidential computing protects data in use by executing computations within a hardware-based Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, which isolates the data and code from the host operating system and hypervisor. This ensures that even privileged users or cloud administrators cannot access the plaintext data while it is being processed in memory.

Answer

Tokenization

Answer

Access control lists

Question 2

Which practice helps prevent hardcoded cloud credentials from being committed to source code repositories?

Accepted Answer

Implementing secrets management with a vault service. A secrets management vault (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores credentials outside the codebase and injects them at runtime, so no secret ever exists in the repository. This directly prevents hardcoded credentials from being committed because developers never need to embed them in source files. Vault services also provide rotation, auditing, and access control, which are not achievable with file-based approaches.

Answer

Using environment variables for all configuration

Answer

Storing credentials in a configuration file with restricted permissions

Answer

Using a .gitignore file to exclude credential files

Question 3

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

Accepted Answer

Container Threat Detection. Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Answer

Cloud Security Scanner

Answer

Event Threat Detection

Answer

Cloud Audit Logs

Question 4

A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?

Accepted Answer

Isolate the EC2 instance by updating the security group to deny all traffic.. The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.

Answer

Terminate the EC2 instance immediately.

Answer

Take a snapshot of the instance for forensic analysis.

Answer

Disable the IAM role attached to the instance.

Question 5

A company is required to encrypt all data in transit between its on-premises data center and its cloud environment. They have a hybrid cloud setup and need a secure tunnel for all traffic. Which solution should they implement?

Accepted Answer

VPN connection. A VPN connection creates an encrypted IPsec tunnel between the on-premises data center and the cloud environment, securing all traffic in transit across the public internet for a hybrid setup. This satisfies the requirement for a secure tunnel for all traffic, not just API calls. Client-side encryption, pre-signed URLs, and TLS for API calls address different scopes and do not provide a site-to-site encrypted tunnel.

Answer

Client-side encryption

Answer

Pre-signed URLs

Answer

TLS 1.2+ for all API calls

Question 6

An organization is moving a legacy application to the cloud and wants to minimize changes to the application code. They require full control over the operating system and middleware. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides the customer with virtualized compute, storage, and networking while giving them full control over the operating system, middleware, and runtime — exactly what a legacy application needing minimal code changes requires. The customer manages the guest OS and above, while the provider handles the physical infrastructure and hypervisor. This makes IaaS the most appropriate model for lift-and-shift migrations with OS-level control requirements.

Answer

PaaS

Answer

SaaS

Answer

FaaS

Question 7

A company is implementing a data classification policy for cloud storage. They want to label objects with tags indicating the sensitivity level (e.g., 'Confidential'). Which benefit does tagging resources with classification labels provide?

Accepted Answer

It allows enforcement of data handling policies based on sensitivity. Tags applied to cloud resources act as metadata that policy engines, DLP tools, and automation can evaluate at runtime. By labeling objects as 'Confidential', 'Internal', or 'Public', organizations can attach conditional policies (e.g., deny public access, require encryption, restrict cross-region replication) that enforce handling rules based on the classification. This is the primary governance benefit of classification tagging.

Answer

It provides client-side encryption keys

Answer

It automatically encrypts data at rest

Answer

It reduces storage costs by moving data to cheaper tiers

Question 8

An organization wants to protect its cloud storage data from ransomware attacks that might encrypt or delete objects. The security team decides to enable a feature that maintains previous versions of objects when changes are made. Which feature is being described?

Accepted Answer

Object versioning. Object versioning is the feature that retains previous versions of objects when they are overwritten or deleted, allowing recovery from accidental or malicious changes such as ransomware encryption. When versioning is enabled, each PUT creates a new version, and the previous version remains accessible, so encrypted or deleted objects can be restored.

Answer

Access control lists

Answer

Cross-region replication

Answer

Bucket locking

Question 9

A company is using a cloud provider's key management service (KMS) with HSM-backed keys. They want to ensure that key material is automatically replaced periodically to limit the impact of a potential key compromise. Which KMS feature should they configure?

Accepted Answer

Key rotation. Key rotation is the KMS feature that automatically replaces key material on a defined schedule, generating a new cryptographic key version while retaining old versions to decrypt previously encrypted data. This limits the blast radius of a compromise because ciphertext encrypted under the old key version remains protected by the new material going forward. Configuring rotation directly addresses the requirement to periodically replace key material.

Answer

Key export

Answer

Key revocation

Answer

Key policies

Question 10

An incident response team is investigating a potential breach in a cloud environment. They have collected logs from various sources. Which of the following is the MOST critical factor to ensure the admissibility of digital evidence in court?

Accepted Answer

Maintaining a documented chain of custody for all evidence. Maintaining the chain of custody ensures evidence integrity and admissibility. Option B is wrong while important for investigation, admissibility depends on custody. Option C is wrong because logs may not be original but certified copies can be used if chain of custody is maintained. Option D is wrong because encryption does not guarantee authenticity.

Answer

Encrypting all evidence during collection and transport

Answer

Using automated tools for log analysis

Answer

Ensuring logs are in their original format

Question 11

A community cloud is best suited for which scenario?

Accepted Answer

Several government agencies with similar security and compliance requirements. A community cloud is shared infrastructure provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, compliance). Several government agencies with similar security and compliance requirements is the canonical example, because they can share costs while meeting common regulatory mandates like FedRAMP or CJIS. The defining trait is a bounded community with shared interests, not the general public.

Answer

A startup wanting to minimize costs by sharing resources with the general public

Answer

A single organization needing dedicated infrastructure

Answer

A company that needs to burst workloads to the public cloud during peak times

Question 12

Which of the following is a cloud-specific threat that should be included in a threat model for a cloud application?

Accepted Answer

Exposed S3 bucket. An exposed S3 bucket is a cloud-specific threat because it arises from the cloud provider's object storage service and its IAM/bucket-policy misconfiguration model, which has no direct on-premises equivalent. Threat models for cloud applications must account for provider-managed services where a single ACL or bucket policy mistake can publicly expose data at internet scale. XSS, SQL injection, and buffer overflow are classic application-layer vulnerabilities that exist regardless of hosting environment.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Buffer overflow

Question 13

Which of the following is a best practice for managing secrets in cloud-native applications?

Accepted Answer

Store secrets in a dedicated secrets management service. Using a cloud secret manager (like AWS Secrets Manager or HashiCorp Vault) to inject secrets at runtime avoids hardcoding and enables rotation. Least privilege IAM and environment variables are also good but using a dedicated service is best.

Answer

Hardcode secrets in environment variables

Answer

Include secrets in container images

Answer

Use the same secret across all environments

Question 14

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 15

A cloud application processes credit card numbers. To reduce PCI DSS scope, the company wants to remove the original PAN from its databases and use a surrogate value that can be reversed only by a privileged application. Which data protection technique should they use?

Accepted Answer

Tokenization using a cloud-based token vault. Tokenization replaces the original PAN with a randomly generated surrogate value (token) that has no mathematical relationship to the original data. The token can be reversed only by a privileged application that has access to the token vault, which stores the mapping between tokens and actual PANs. This effectively removes the PAN from the application's databases, reducing PCI DSS scope because the tokenized data is not considered sensitive cardholder data.

Answer

Truncation of the first 6 and last 4 digits

Answer

Dynamic data masking in the application tier

Answer

Symmetric encryption with a key stored in the database