CCSP Practice Test 15 — 15 Questions

Question 1

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

Accepted Answer

Implement mutual TLS with unique certificates per service. Mutual TLS (mTLS) with unique certificates per service enforces least privilege by ensuring each microservice authenticates with a distinct identity, and access can be scoped to specific certificates. This prevents a compromised service from impersonating others, as each service has its own private key and certificate, and the TLS handshake requires both sides to present and validate certificates.

Answer

Use long-lived bearer tokens

Answer

Assign IAM roles with broad permissions

Answer

Use a shared API key across all services

Question 2

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

Accepted Answer

Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.. VPCs with subnets and security groups provide native, software-defined network segmentation and stateful firewall rules that directly replicate on-premises network segmentation and ACLs. Security groups act as virtual firewalls at the instance level, while network ACLs provide subnet-level stateless filtering, together enabling granular control without extending the on-premises network.

Answer

Configure a site-to-site VPN between on-premises and cloud to extend the existing network.

Answer

Implement an intrusion detection and prevention system (IDPS) to monitor traffic.

Answer

Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.

Question 3

Under the General Data Protection Regulation (GDPR), if a cloud service provider (acting as a data processor) suffers a personal data breach, what is the provider's obligation regarding notification?

Accepted Answer

The processor must notify the data controller without undue delay upon becoming aware of the breach.. Under GDPR Article 33(2), a processor must notify the controller without undue delay after becoming aware of a personal data breach. The controller — not the processor — is the party responsible for notifying the supervisory authority within 72 hours (Article 33(1)) and, where required, the data subjects (Article 34). The processor's obligation is limited to informing the controller so the controller can meet its own regulatory deadlines.

Answer

The processor must notify the supervisory authority within 72 hours.

Answer

The processor does not have any notification obligation under GDPR.

Answer

The processor must notify the affected data subjects directly within 72 hours.

Question 4

A cloud customer receives a litigation hold notice requiring preservation of data stored in an object storage service. Which service feature should the customer use to ensure data cannot be modified or deleted until the hold is released?

Accepted Answer

Apply a retention policy using Object Lock. Object Lock is the S3-compatible feature that enforces WORM (Write Once, Read Many) protection by applying a retention policy (governance or compliance mode) or a legal hold to objects. When a retention period or legal hold is in place, the object cannot be overwritten or deleted by any user, including the root account, until the hold is released. This directly satisfies the litigation hold requirement to preserve data in an immutable state.

Answer

Set a lifecycle policy to transition to archival storage

Answer

Enable versioning on the bucket

Answer

Configure server-side encryption

Question 5

Which cloud service model provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware. This matches the description exactly.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 6

A cloud security architect is designing a forensics capability for a multi-tenant infrastructure-as-a-service (IaaS) environment. Which of the following is the MOST significant challenge when performing forensic acquisition of virtual machine (VM) memory?

Accepted Answer

Inability to access the hypervisor-level memory of other tenants due to isolation. In a multi-tenant IaaS environment, the most significant challenge for forensic acquisition of VM memory is the inability to access the hypervisor-level memory of other tenants due to the strong isolation boundaries enforced by the cloud provider. Option A is not the most significant because memory acquisition overhead is typically manageable and can be performed with tools. Option C is true that memory content is volatile, but the primary challenge for acquisition is access, not volatility. Option D is less significant because tools for capturing memory from running VMs (e.g., LiME) do exist; the real constraint is that the cloud provider restricts tenant access to hypervisor-level memory for security and multi-tenancy isolation.

Answer

High performance overhead caused by memory acquisition

Answer

Memory content is not available after the VM is powered off

Answer

Lack of tools that can capture memory from a running VM in the cloud

Question 7

A company is evaluating the risk of using a single cloud provider for all critical workloads. Which risk is most directly associated with this scenario?

Accepted Answer

Concentration risk. Concentration risk is the danger that over-reliance on a single provider, service, or region creates a single point of failure whose disruption affects all dependent workloads simultaneously. Using one cloud provider for all critical workloads concentrates operational, financial, and availability exposure in that vendor, so an outage, contract dispute, or bankruptcy cascades across the entire estate. This is precisely the risk regulators and frameworks like the EBA and DORA flag for cloud concentration.

Answer

Inherent risk of shared infrastructure

Answer

Third-party risk

Answer

Control effectiveness risk

Question 8

Which TWO of the following are valid methods to protect data at rest in a cloud environment?

Accepted Answer

Client-side encryption. Client-side encryption (A) is a valid method to protect data at rest because the data is encrypted by the client before being transmitted to the cloud provider. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, which remain under the customer's control. It is a strong approach for maintaining data confidentiality and compliance with regulatory requirements.

Answer

Data loss prevention (DLP) policies

Answer

Tokenization

Answer

Transport Layer Security (TLS)

Question 9

A cloud security architect needs to allow an application in a VPC to access a cloud database service without traversing the public internet. Which feature should be implemented?

Accepted Answer

Private Endpoint (Service Endpoint). Private Endpoint (also known as Service Endpoint or Private Link) enables private connectivity to cloud services without internet exposure.

Answer

VPN Connection

Answer

Internet Gateway

Answer

NAT Gateway

Question 10

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This attack is known as:

Accepted Answer

Dependency confusion. Dependency confusion occurs when an attacker publishes a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as an internal, private package. When a cloud application's build system is configured to fetch dependencies from both public and private registries, the package manager may prioritize the public registry (often due to higher version numbers or default resolution order), causing the malicious package to be installed instead of the legitimate internal one. This exploits the trust in package resolution algorithms and is a specific form of supply chain attack targeting cloud-native CI/CD pipelines.

Answer

Supply chain poisoning

Answer

Man-in-the-middle attack

Answer

Typosquatting

Question 11

A developer is designing a microservices-based application in the cloud. They need to ensure communication between services is loosely coupled and resilient to failures. Which design pattern should they implement?

Accepted Answer

Event-driven messaging. Event-driven messaging (B) is correct because it enables asynchronous, decoupled communication between microservices, allowing them to operate independently and remain resilient to failures. When a service publishes an event, other services consume it at their own pace, preventing cascading failures and ensuring the system can handle partial outages without blocking. This pattern directly supports loose coupling and fault tolerance, which are critical for cloud-based microservices architectures.

Answer

API gateway

Answer

Service mesh

Answer

Database per service

Question 12

A company uses Azure Functions for serverless data processing. To securely access an Azure SQL database, which of the following is the most secure method for managing the database connection string?

Accepted Answer

Reference the connection string from Azure Key Vault using a managed identity. Referencing the connection string from Azure Key Vault using a managed identity eliminates secrets from code and configuration entirely: the Function App authenticates to Key Vault via its Microsoft Entra ID managed identity, and Key Vault returns the secret at runtime. This removes the need to store, rotate, or transmit the credential manually and is Microsoft's recommended pattern for secret management.

Answer

Embed the connection string in the function code and encrypt the code file

Answer

Store the connection string as an environment variable in the function app settings

Answer

Use Azure Policy to enforce encryption of the connection string at rest

Question 13

During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?

Accepted Answer

Use AWS Systems Manager to run a memory acquisition script on the instance.. Memory acquisition on a running EC2 instance requires executing a tool on the instance itself, and AWS Systems Manager (SSM) Run Command allows the security team to run a memory acquisition script remotely without SSH access or opening inbound ports. This preserves the volatile memory contents while maintaining an auditable, IAM-controlled execution path. It is the most appropriate method for capturing RAM from a live instance.

Answer

Analyze CloudTrail logs for the instance's API calls.

Answer

Take a snapshot of the EBS volumes attached to the instance.

Answer

Review VPC Flow Logs for network traffic.

Question 14

An organization uses a cloud storage service to share files with external partners. They want to ensure that the files are automatically deleted after 30 days. Which data lifecycle control should be implemented?

Accepted Answer

Lifecycle policy. A lifecycle policy is the correct data lifecycle control because it allows administrators to define rules that automatically expire and delete objects after a specified period, such as 30 days. This is a native feature of cloud storage services like Amazon S3, Azure Blob Storage, and Google Cloud Storage, enabling automated data retention and deletion without manual intervention.

Answer

Object lock

Answer

Versioning

Answer

Access control list

Question 15

A cloud application is deployed on Kubernetes and uses a cloud identity and access management (IAM) role for service accounts. Which TWO practices should be implemented to ensure least privilege?

Accepted Answer

Grant only the specific permissions required for the application. Option A is correct because least privilege requires granting only the specific permissions the application actually needs, avoiding broad or wildcard permissions that expand the attack surface. Option D is correct because scoping the IAM role to specific resource identifiers (e.g., a particular bucket or secret) ensures the role can only act on the resources it legitimately requires, further tightening access. Option B is wrong because hardcoding credentials in application code exposes secrets and violates secure credential management, typically handled via workload identity or mounted tokens. Option C is wrong because granting full IAM permissions such as 'iam:*' is the opposite of least privilege and grants excessive access. Option E is wrong because sharing a single role across all services in the cluster removes per-service isolation and grants each service more permissions than it needs.

Answer

Hardcode the role's credentials in the application code

Answer

Grant the role the full IAM permissions (e.g., 'iam:*' equivalent)

Answer

Use a single role for all services in the cluster