CCSP Practice Test 14 — 15 Questions

Question 1

A company is using a single cloud provider for all critical services. What is the primary risk this company faces?

Accepted Answer

Concentration risk. Concentration risk is the risk that reliance on a single provider, vendor, region, or service creates a single point of failure — an outage, bankruptcy, or contractual dispute with that provider can disrupt all critical services simultaneously. Using one cloud provider for all critical services is the textbook definition of concentration risk in cloud governance.

Answer

Data sovereignty risk

Answer

Compliance risk

Answer

Insider threat risk

Question 2

Which of the following is a best practice for managing secrets in a cloud-native application?

Accepted Answer

Using a cloud secrets manager to retrieve secrets at runtime. Using a cloud secrets manager (e.g., AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) is the best practice because it centralizes secret storage, enforces access control via IAM, supports automatic rotation, and provides audit logging. Secrets are retrieved at runtime, so they are never persisted in code, images, or configuration files. This minimizes the attack surface and aligns with the principle of least privilege.

Answer

Encrypting secrets and storing them in a configuration file

Answer

Storing secrets in environment variables inside container images

Answer

Hardcoding secrets in the application source code

Question 3

A company uses Terraform to manage cloud infrastructure. Which infrastructure-as-code (IaC) security scanner can detect misconfigurations such as overly permissive security group rules before deployment?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically designed to scan Infrastructure as Code (IaC) templates, including Terraform, for security misconfigurations such as overly permissive security group rules (e.g., 0.0.0.0/0 ingress on port 22). It uses a policy-as-code framework with hundreds of built-in checks (e.g., CKV_AWS_24 for unrestricted SSH) and can be integrated into CI/CD pipelines to catch issues before deployment, making it the correct choice for pre-deployment IaC scanning.

Answer

Snyk

Answer

Dependabot

Answer

GitGuardian

Question 4

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

Accepted Answer

Azure Policy. Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Answer

Azure Security Center

Answer

Azure Automation

Answer

Azure Logic Apps

Question 5

A financial institution is evaluating a community cloud deployment shared with other banks. Which TWO security considerations are MOST important for this deployment model?

Accepted Answer

Ensuring strong isolation between tenant data and workloads. In a community cloud shared by multiple banks, option D is essential because tenants share the same underlying infrastructure, so strong logical isolation of data and workloads (via mechanisms like VLANs, hypervisor isolation, encryption, and access controls) is required to prevent cross-tenant data leakage or interference. Option E is also critical because a community cloud serving financial institutions must satisfy shared regulatory obligations such as PCI-DSS for cardholder data and SOX for financial reporting, and the provider and tenants must jointly demonstrate compliance. Option A is not a security consideration but a cost/performance concern, and minimizing bandwidth could even undermine security monitoring and logging. Option B is incorrect because in cloud deployments security responsibility is shared, not fully transferred to the provider. Option C is not required for a community cloud, since multi-tenancy on shared physical servers is normal as long as isolation is enforced.

Answer

Minimizing network bandwidth to reduce costs

Answer

The provider assumes full responsibility for all security controls

Answer

Use of dedicated physical servers for each tenant

Question 6

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

Accepted Answer

Alert on high volume of GetObject requests from a single IP. Exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Answer

Alert on multiple failed login attempts

Answer

Alert on root account usage

Answer

Alert when a new IAM user is created

Question 7

A covered entity under HIPAA is planning to migrate electronic protected health information (ePHI) to a public cloud environment. Which of the following is a mandatory requirement before using the cloud service?

Accepted Answer

Obtain a signed Business Associate Agreement from the cloud provider. HIPAA requires covered entities to obtain satisfactory assurances that PHI will be protected, typically through a Business Associate Agreement (BAA) with the cloud provider.

Answer

Encrypt all ePHI with keys managed solely by the covered entity

Answer

Conduct a physical on-site audit of the cloud provider's data centers

Answer

Ensure the cloud provider is certified under the Privacy Shield framework

Question 8

A security team is implementing Data Loss Prevention (DLP) for a SaaS application that stores customer PII. They want to detect when sensitive data is shared externally via email. Which is the best approach?

Accepted Answer

Use the SaaS application's API DLP rules to scan email content and attachments. SaaS application API DLP rules can inspect email content and attachments directly within the application, effectively detecting sensitive data shared externally via email. Option A is wrong because database DLP monitors queries to the database, not email communications. Option B is wrong because endpoint DLP agents on user devices may not be able to inspect cloud-based email traffic that is accessed via browser. Option D is wrong because network DLP at the cloud provider's perimeter cannot inspect encrypted email traffic (e.g., TLS) and is less effective for SaaS-based email.

Answer

Implement database DLP to monitor queries to the PII database

Answer

Install endpoint DLP agents on all user devices

Answer

Deploy network DLP at the cloud provider's network perimeter

Question 9

An organization wants to ensure compliance with industry regulations by implementing data classification in the cloud. Which two actions should the organization take? (Choose two.)

Accepted Answer

Implement auditing of access to sensitive data.. Option A is correct because implementing auditing of access to sensitive data provides the traceability and accountability records required to demonstrate regulatory compliance, capturing who accessed which classified data and when. Option C is correct because data classification must begin with defined sensitivity levels (for example, Public, Internal, Confidential, Restricted) and labels applied to data so that handling, protection, and retention policies can be enforced consistently. Together, these two actions establish both the classification scheme and the monitoring needed to prove compliance. Option B is not appropriate because consolidating all data into a single repository increases blast radius and does not by itself satisfy classification or regulatory requirements. Option D is wrong because encrypting all data indiscriminately ignores classification-based handling and can be impractical or unnecessary for public data. Option E is wrong because automatically tagging all data at creation without a defined sensitivity scheme produces unreliable labels and does not establish meaningful classification.

Answer

Store all data in a single repository for easy management.

Answer

Encrypt all data regardless of classification.

Answer

Automatically tag all data as it is created.

Question 10

A security engineer is investigating a potential data exfiltration incident involving an Amazon S3 bucket. Which set of logs would provide the most relevant information to identify the source IP and API calls made to the bucket?

Accepted Answer

AWS CloudTrail data events for the S3 bucket. AWS CloudTrail data events capture object-level S3 API activity such as GetObject, PutObject, and DeleteObject, including the identity and source IP of the caller. This is exactly the evidence needed to trace who accessed or exfiltrated objects from a specific bucket. Management events alone would not show object reads, so data events must be explicitly enabled for the bucket.

Answer

VPC Flow Logs for the subnet where the bucket resides

Answer

AWS Config configuration history for the S3 bucket

Answer

Amazon CloudWatch Logs for the EC2 instance accessing the bucket

Question 11

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

Accepted Answer

Agentless scanning using cloud API-based assessment. Agentless scanning leverages cloud provider APIs (e.g., for configuration and asset inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Answer

Network-based vulnerability scanning

Answer

Agent-based scanning using a cloud-specific vulnerability scanner

Answer

Container image scanning in a registry

Question 12

A security engineer is integrating security into a cloud application's CI/CD pipeline. Which practice is an example of 'shift-left' security?

Accepted Answer

Running SAST scans during pull request review. Shift-left security means moving security activities earlier in the software development lifecycle, and running SAST scans during pull request review catches vulnerabilities before code is merged. This is a classic example because it integrates security into the developer's existing workflow at the earliest feasible point. The other options all occur after deployment or after an incident, which is the opposite of shifting left.

Answer

Performing a penetration test after deployment

Answer

Analyzing logs after an incident

Answer

Scanning container images in production

Question 13

Which THREE components are essential for establishing a secure baseline configuration for a cloud virtual machine? (Choose three.)

Accepted Answer

Removing unnecessary software and services from the OS.. Removing unnecessary software and services from the OS reduces the attack surface by eliminating potential vulnerabilities and backdoors. A secure baseline configuration must minimize the number of running components to only those required for the VM's intended function, following the principle of least functionality.

Answer

Running applications as a service account.

Answer

Configuring network security groups at the subnet level.

Question 14

During a CI/CD pipeline, a developer wants to automatically block builds if Terraform configuration files contain security misconfigurations. Which tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed to scan Infrastructure as Code (IaC) files — including Terraform, CloudFormation, Kubernetes, and ARM templates — for security and compliance misconfigurations. It integrates directly into CI/CD pipelines and can fail builds when policy violations are detected, making it the best fit for blocking Terraform misconfigurations.

Answer

Snyk

Answer

GitGuardian

Answer

OWASP ZAP

Question 15

Which of the following is a primary risk specific to virtual machine escape attacks in cloud environments?

Accepted Answer

Unauthorized access to other tenant VMs. VM escape attacks occur when an attacker breaks out of the guest VM's isolation and gains access to the hypervisor or host. In a multi-tenant cloud environment, the hypervisor manages multiple tenants' VMs, so a successful escape can allow the attacker to access or compromise other tenants' VMs running on the same host. This cross-tenant access is the primary risk specific to cloud VM escape, as it violates the fundamental isolation guarantee of cloud computing.

Answer

Data corruption within the same VM

Answer

Increased latency in virtual networking

Answer

Denial of service to the attacker's own VM