CCSP Practice Test 14 — 15 Questions

Question 1

A developer is writing code that will be deployed as a serverless function (e.g., AWS Lambda). The function needs to read data from an Amazon S3 bucket. According to the principle of least privilege, how should the developer grant access?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the function. Option D is correct because AWS Lambda functions should assume an IAM role that grants only the specific permissions needed—in this case, an S3 read policy. This follows the principle of least privilege by avoiding hardcoded credentials and instead using temporary, automatically rotated credentials provided by the AWS Security Token Service (STS) via the IAM role. The role is attached to the Lambda function at deployment, ensuring the function can securely access the S3 bucket without exposing long-term access keys.

Answer

Store the AWS access key and secret key in environment variables in the function

Answer

Use the root user credentials of the AWS account

Answer

Set the S3 bucket policy to allow public read access

Question 2

A security engineer is investigating an incident where an attacker exploited a server-side request forgery (SSRF) vulnerability in a cloud application. The application runs on AWS and uses internal metadata endpoints. Which mitigation should be prioritized to prevent future SSRF attacks?

Accepted Answer

Restrict outbound network access from the application instances using security groups. Option B is correct because restricting outbound network access from application instances using security groups directly prevents the application from reaching the internal metadata endpoint (169.254.169.254) and other internal services. This is a fundamental network-layer control that stops SSRF attacks at the source, regardless of input validation or request inspection, by blocking the outbound traffic that the attacker would exploit.

Answer

Implement input validation to block malicious URLs

Answer

Deploy a web application firewall (WAF) to inspect outgoing requests

Answer

Disable the IMDSv1 endpoint and require IMDSv2 tokens

Question 3

A development team is migrating a legacy application to the cloud. Which security testing approach should be adopted early in the CI/CD pipeline to catch vulnerabilities as code is written?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binary code without executing the application, making it ideal for integration early in the CI/CD pipeline to catch vulnerabilities like SQL injection, buffer overflows, and XSS as code is written. This 'white-box' approach provides immediate feedback to developers, aligning with the shift-left security principle for cloud-native development.

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Answer

Runtime application self-protection (RASP)

Question 4

A developer is implementing a cloud application that stores sensitive user data. To minimize the risk of data exposure during transit, which security control should be enforced as a baseline requirement?

Accepted Answer

Enforce TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, providing confidentiality, integrity, and authentication. Enforcing TLS for all communications ensures that sensitive user data is protected from eavesdropping and tampering during transmission, making it a baseline requirement for cloud application security.

Answer

Implement IPsec tunnels between components

Answer

Use HTTPS without additional controls

Answer

Require SSH for all connections

Question 5

A cloud security engineer is configuring an AWS Lambda function that processes messages from an Amazon SQS queue. The function needs to write results to a DynamoDB table. Which of the following is the SECUREST way to manage the function's credentials?

Accepted Answer

Attach an IAM execution role to the Lambda function with fine-grained permissions for SQS and DynamoDB. Option C is correct because AWS Lambda natively supports IAM execution roles, which provide temporary, automatically rotated credentials via the AWS Security Token Service (STS). By attaching an execution role with fine-grained permissions for SQS (e.g., sqs:ReceiveMessage) and DynamoDB (e.g., dynamodb:PutItem), the function never needs to manage long-lived secrets, eliminating the risk of credential leakage or rotation failures.

Answer

Use AWS Secrets Manager to store credentials and retrieve them at runtime

Answer

Store the database credentials as ciphertext in the Lambda environment variables

Answer

Create an IAM user with Access Key and Secret Key and pass them to the function via encrypted environment variables

Question 6

A security analyst reviews the above S3 bucket policy. The bucket stores sensitive application data. What is the primary security issue with this policy?

Accepted Answer

The Deny statement will block all access, including from authorized IPs. The Deny statement with a NotIpAddress condition denies all requests that do not match the specified IP range. However, because the Deny effect overrides any Allow, this statement will block access from any IP address that is not in the listed range, including authorized IPs that the policy intended to allow. This creates a complete denial of service for legitimate users, making it the primary security issue.

Answer

The resource ARN should not include a wildcard

Answer

The policy should use a condition with aws:SourceVpc instead of IP

Answer

The IP address range is too broad

Question 7

A cloud application processes data subject to GDPR. The security team needs to ensure that all personally identifiable information (PII) is encrypted at rest and that access is logged. Which combination of controls should be implemented? (Select THREE)

Accepted Answer

Implement strict least privilege access controls. Option A is correct because strict least privilege access controls ensure that only authorized users or services can access PII, minimizing the risk of unauthorized exposure. This is a fundamental security principle for GDPR compliance, as it directly supports the data minimization and access control requirements. By restricting access to only what is necessary for a role, the organization reduces the attack surface and ensures that any access is intentional and auditable.

Answer

Use TLS for all network connections

Answer

Implement a key management system

Question 8

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

Accepted Answer

Use of signed certificates from a trusted CA. Signed certificates from a trusted Certificate Authority (CA) are essential for authenticating the server's identity and establishing a chain of trust. Without them, a client cannot verify that it is communicating with the legitimate server, making the connection vulnerable to man-in-the-middle (MITM) attacks. This is a foundational requirement for any secure communication channel over the internet.

Answer

Regular penetration testing

Answer

Implementation of IPsec VPNs

Answer

Encryption at rest using AES-256

Question 9

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 10

Which TWO of the following are key components of a secure software development lifecycle (SSDLC) in a cloud environment?

Accepted Answer

Automated static application security testing (SAST) during code commit.. Automated SAST during code commit is a key component of a secure software development lifecycle (SSDLC) in a cloud environment because it enables early detection of vulnerabilities (e.g., injection flaws, buffer overflows) by scanning source code as it is committed to the repository. This shift-left approach integrates security directly into the CI/CD pipeline, preventing flaws from progressing to later stages where remediation is more costly and complex.

Answer

Performing security testing only after deployment to production.

Answer

Mandatory security awareness training for developers.

Answer

Integration of unit tests that check for security functionality.

Question 11

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

Accepted Answer

Use a secrets management service such as HashiCorp Vault to inject secrets at runtime.. Option B is correct because a secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Answer

Hardcode secrets in the application code and obfuscate with encryption.

Answer

Pass secrets as environment variables during container deployment.

Answer

Store secrets in a separate configuration file within the image.

Question 12

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

Accepted Answer

Validate serialized objects before deserialization. Option D is correct because validating serialized objects before deserialization ensures that the data conforms to expected schemas and constraints, preventing malicious payloads from triggering arbitrary code execution. This practice is critical in cloud applications where deserialization of user-supplied data (e.g., JSON or XML) can lead to remote code execution (RCE) or denial-of-service (DoS) attacks if not validated.

Answer

Allow deserialization from untrusted sources

Answer

Use strong encryption for all serialized data

Answer

Implement custom deserialization without validation

Question 13

A cloud application uses OAuth 2.0 for authorization. What is the primary purpose of using a refresh token in this flow?

Accepted Answer

To obtain a new access token when the current one expires without user interaction.. In OAuth 2.0, access tokens are short-lived by design to limit the window of compromise. A refresh token is a long-lived credential that allows the client to obtain a new access token from the authorization server without requiring the user to re-authenticate or re-consent. This enables seamless, ongoing access to protected resources while maintaining security through short-lived access tokens.

Answer

To grant the same access token indefinitely.

Answer

To authenticate the user without a password.

Answer

To store user credentials on the resource server for later use.

Question 14

A cloud application uses customer-managed encryption keys (CMK) stored in a cloud HSM. The application needs to decrypt data on demand. How should the key be accessed?

Accepted Answer

Use a key management service with IAM permissions. Option B is correct because cloud key management services (e.g., AWS KMS, Azure Key Vault) allow you to use customer-managed keys (CMK) stored in a cloud HSM without ever exposing the plaintext key to the application. The application calls the KMS API with IAM permissions to request decryption, and the HSM performs the decryption inside its hardware boundary, returning only the decrypted data. This ensures the key material never leaves the HSM's secure enclave, maintaining the security posture required for CMK usage.

Answer

Use the HSM to decrypt without exposing the key

Answer

Store the key in application configuration

Answer

Copy the key to the application's memory

Question 15

A cloud architect is designing a multi-cloud strategy to avoid vendor lock-in. Which three design considerations should be included? (Choose three.)

Accepted Answer

Implement abstraction layers such as containers or cloud-agnostic APIs. Option A is correct because implementing abstraction layers such as containers (e.g., Docker, Kubernetes) or cloud-agnostic APIs (e.g., Terraform, OpenStack) decouples application code from underlying cloud infrastructure. This allows workloads to be migrated between providers without rewriting core logic, directly addressing vendor lock-in by standardizing deployment and orchestration interfaces.

Answer

Standardize on one cloud provider for core services

Answer

Use provider-specific APIs for optimal performance