CCSP Practice Test 16 — 15 Questions

Question 1

Which TWO of the following are effective methods for preventing hardcoded credentials from being committed to a cloud application's source code repository? (Select TWO)

Accepted Answer

Implementing pre-commit hooks with secret scanning. Option A is correct because pre-commit hooks with secret scanning tools (e.g., git-secrets, gitleaks, detect-secrets) run locally before code is committed, detecting and blocking secrets such as API keys, passwords, and tokens before they ever enter the repository history. Option E is correct because storing credentials in environment variables (or a secrets manager) keeps sensitive values out of source files entirely, so nothing hardcoded can be committed. Option B is wrong because disabling SSH keys addresses developer authentication to Git, not the presence of hardcoded credentials in code. Option C is wrong because code reviews are a detective, manual control that may catch secrets but does not reliably prevent them from being committed. Option D is wrong because encrypting the repository at rest does not stop plaintext credentials from being committed and later exposed once decrypted or cloned.

Answer

Disabling SSH keys for developers

Answer

Enforcing code reviews by senior developers

Answer

Encrypting the entire repository

Question 2

A security architect is designing a container runtime security strategy. Which of the following controls is most effective at preventing a container from compromising the host kernel?

Accepted Answer

Seccomp profile. Seccomp (secure computing mode) profiles restrict the system calls a container can make to the host kernel, directly reducing the kernel attack surface. By filtering out dangerous syscalls, seccomp is the most effective control for preventing a compromised container from exploiting kernel vulnerabilities. It operates at the syscall boundary, which is the primary interface between containers and the host kernel.

Answer

Read-only root filesystem

Answer

Resource limits (CPU/memory)

Answer

Image vulnerability scanning

Question 3

A cloud application exposes an API that allows users to view their own orders. Which TWO vulnerabilities could allow an attacker to view another user's orders?

Accepted Answer

Insecure Direct Object Reference (IDOR). Insecure Direct Object Reference (IDOR) (C) is correct because the API likely uses a user-controllable identifier such as an order ID or user ID in the request, and if the application fails to verify that the referenced object belongs to the authenticated user, an attacker can simply change that identifier to access another user's orders. Broken Object Level Authorization (BOLA) (D) is correct because it is the API-specific authorization flaw where the server does not properly enforce object-level access checks on each request, allowing an authenticated user to read objects belonging to other users even when the endpoint itself is properly authenticated. Excessive Data Exposure (A) is not correct here because it concerns returning more data fields than necessary in a response, not accessing another user's records. SQL Injection (B) is not correct because it involves manipulating backend SQL queries through unsanitized input, which is a different attack class than directly referencing another user's object. Cross-Site Scripting (E) is not correct because XSS executes script in a victim's browser and does not by itself grant access to another user's orders.

Answer

Excessive Data Exposure

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 4

A development team builds a serverless application using AWS Lambda. The security team wants to prevent hardcoded credentials. Which TWO methods should they enforce for secure secrets management?

Accepted Answer

Assign an IAM role to the Lambda function and retrieve temporary credentials via the AWS SDK. Option B is correct because assigning an IAM execution role to the Lambda function lets the AWS SDK obtain temporary credentials from the AWS STS service automatically, eliminating the need to hardcode long-lived access keys in code or configuration. Option E is correct because AWS Systems Manager Parameter Store supports SecureString parameters encrypted with AWS KMS, allowing Lambda to fetch secrets at runtime via the SDK with IAM-controlled access instead of embedding them. Option A is wrong because plain-text environment variables expose credentials in the Lambda console and are not encrypted or rotated. Option C is wrong because embedding secrets in code, even if the code artifact is encrypted, still hardcodes credentials that persist in source control and deployment packages. Option D is wrong because using a third-party secrets manager with a hardcoded API key simply replaces one hardcoded credential with another.

Answer

Store secrets in environment variables in plain text

Answer

Embed secrets directly in the Lambda function code but encrypt the code

Answer

Use a third-party secrets manager with a hardcoded API key in the code

Question 5

A company is implementing a software-defined perimeter (SDP) for their cloud environment. Which THREE characteristics are typical of an SDP? (Choose three.)

Accepted Answer

Dynamic firewall rules based on user identity.. Software-defined perimeter (SDP) architecture uses dynamic firewall rules that are created on-the-fly based on user identity and device posture, rather than static IP addresses. The SDP controller authenticates the user and then dynamically provisions a firewall rule to allow the user's specific IP address to access the requested application, ensuring zero-trust network access.

Answer

Static IP whitelisting.

Answer

Single-factor authentication.

Question 6

A healthcare provider is planning to migrate its electronic health records (EHR) system to a public cloud infrastructure. The system will store protected health information (PHI). Under HIPAA, what must the healthcare provider obtain from the cloud service provider before beginning the migration?

Accepted Answer

A Business Associate Agreement (BAA) that outlines the permitted uses of PHI and the security safeguards in place. Under HIPAA, a covered entity must enter into a Business Associate Agreement (BAA) with any vendor that creates, receives, maintains, or transmits protected health information on its behalf. A cloud provider hosting an EHR system is a business associate, so a BAA is legally required before PHI can be migrated to the cloud.

Answer

A signed letter of attestation that the cloud provider is HIPAA-compliant

Answer

A Data Processing Agreement (DPA) as defined under GDPR

Answer

A Service Organization Control (SOC) 2 Type II report

Question 7

Which THREE of the following are key components of a cloud data governance framework?

Accepted Answer

Data retention policies. Data retention policies are a key component of a cloud data governance framework because they define the lifecycle of data, specifying how long data must be kept and when it should be securely deleted. This ensures compliance with legal, regulatory, and business requirements, such as GDPR or HIPAA, and prevents unnecessary storage costs and security risks from outdated data.

Answer

Data masking

Answer

Data encryption at rest

Question 8

What is the primary purpose of a Software Bill of Materials (SBOM) in cloud application security?

Accepted Answer

To inventory all dependencies and facilitate vulnerability management. The primary purpose of an SBOM is to inventory all software components and dependencies, enabling vulnerability management and supply chain security. It provides a formal, machine-readable list of components, their versions, and relationships. This helps organizations identify and remediate vulnerabilities like Log4Shell quickly.

Answer

To scan infrastructure as code

Answer

To automate deployment of containers

Answer

To document software licensing

Question 9

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

Accepted Answer

A site-to-site VPN connection. A site-to-site VPN connection creates an encrypted tunnel between an on-premises data center and a cloud VPC using IPsec (IKEv1/IKEv2) to protect all data in transit. This directly meets the requirement for encryption, as traffic traverses the public internet or a dedicated private connection with encryption enabled.

Answer

A cloud transit hub

Answer

A cloud DNS resolver

Answer

A dedicated private connection

Question 10

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

Accepted Answer

Configuration management service and serverless compute function. Automated remediation of non-compliant resources requires a configuration management service to detect and evaluate compliance (e.g., AWS Config rules) and a serverless compute function (e.g., AWS Lambda) to execute the remediation action, such as modifying a public S3 bucket policy. This combination enables event-driven, automatic correction without manual intervention.

Answer

Audit logging service and serverless compute function

Answer

Threat detection service and workflow orchestration service

Answer

Security hub and vulnerability management service

Question 11

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Question 12

An organization uses cloud storage and wants to protect against accidental deletion of objects. They also want to be able to recover previous versions of objects in case of unintended modifications. Which feature should they enable?

Accepted Answer

Versioning. Versioning is the cloud storage feature that retains multiple variants of an object, allowing recovery from accidental deletion or modification. When versioning is enabled, overwriting or deleting an object creates a new version or a delete marker, and previous versions remain accessible. This directly meets the requirement to recover previous versions and protect against accidental deletion.

Answer

Bucket policies

Answer

Access logs

Answer

Server-side encryption

Question 13

A security team is implementing container image scanning in a CI pipeline. Which TWO of the following actions should be performed? (Select TWO)

Accepted Answer

Scan the image before pushing to the registry. Option B is correct because scanning the container image before pushing it to the registry ensures that vulnerabilities are detected and remediated prior to the image being stored or distributed, preventing flawed images from entering the supply chain. Option D is correct because signing the image (e.g., using Docker Content Trust or Sigstore) ensures integrity and authenticity, verifying that the image has not been tampered with and originates from a trusted source. Option A is incorrect because disabling scanning removes a critical security control and exposes the pipeline to known vulnerabilities. Option C is incorrect because scanning after deployment to production is too late—vulnerable images would already be running in a live environment. Option E is incorrect because scanning should apply to all images regardless of their base image origin, as vulnerabilities can exist in any layer or dependency.

Answer

Disable scanning to speed up the pipeline

Answer

Scan the image after deployment to production

Answer

Scan the image only if it is based on a public base image

Question 14

A cloud security team wants to integrate security testing early in the development lifecycle to reduce vulnerabilities. Which approach best describes this concept?

Accepted Answer

Shift-left security. Shift-left security is the practice of integrating security testing and controls early in the software development lifecycle (SDLC), such as during design and coding phases, rather than waiting until deployment. This proactive approach reduces vulnerabilities by catching flaws when they are cheaper and easier to fix, aligning with DevSecOps principles.

Answer

Runtime application self-protection (RASP)

Answer

Software bill of materials (SBOM)

Answer

Web application firewall (WAF)

Question 15

Which TWO responsibilities are typically shared between the cloud customer and the cloud provider in an IaaS model? (Choose two.)

Accepted Answer

Management of security group rules.. In an IaaS model, the cloud customer is responsible for managing security group rules, which act as virtual stateful firewalls controlling inbound and outbound traffic at the instance level. The cloud provider is responsible for the underlying network infrastructure, but the customer must configure these rules to enforce least-privilege access. This shared responsibility is explicitly defined in the AWS Shared Responsibility Model and similar frameworks.

Answer

Physical security of data centers.

Answer

Hypervisor security.

Answer

Patching the guest operating system.