CCSP Practice Test 16 — 15 Questions

Question 1

An organization is using a public cloud IaaS and wants to ensure they understand which security responsibilities fall on them. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security of the guest operating system. In IaaS, the customer is responsible for securing the operating system, applications, and data, while the provider secures the physical infrastructure.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure hardening

Question 2

A multinational corporation must comply with GDPR and store EU customer data only within the European Union. Which cloud storage security measure directly addresses this requirement?

Accepted Answer

Data residency configuration. Data residency policies restrict data storage to specific geographic regions. By selecting cloud regions within the EU, the organization ensures data does not leave the EU, complying with GDPR data localization requirements.

Answer

Pre-signed URLs

Answer

Bucket policies with IAM conditions

Answer

Cross-region replication

Question 3

A security team is setting up a DLP solution to scan cloud storage for credit card numbers. They want to automatically mask the detected credit card numbers so that only the last four digits are visible. Which DLP de-identification transform should they use?

Accepted Answer

Masking. Masking is a de-identification transform that replaces part of the sensitive data with a placeholder, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 4

An organization is adopting a hybrid cloud strategy and needs to ensure secure connectivity between on-premises and cloud environments. Which TWO approaches are most appropriate for this purpose?

Accepted Answer

Site-to-site VPN over the public internet. VPN and dedicated private connections (like AWS Direct Connect or Azure ExpressRoute) are standard for secure hybrid cloud connectivity. Cloud access security brokers (CASBs) are for monitoring, not connectivity; public internet is not secure; MPLS is a type of private connection but less common in cloud contexts.

Answer

Direct exposure of on-premises services to the cloud via public internet

Answer

Cloud access security broker (CASB)

Answer

MPLS-based VPN from a telecom provider

Question 5

An organization wants to classify data in the cloud and assign labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. What is the primary purpose of this classification scheme?

Accepted Answer

To apply appropriate security controls based on sensitivity. Data classification helps determine appropriate security controls, such as encryption requirements, access permissions, and handling procedures. It guides policy enforcement.

Answer

To reduce cloud storage costs by moving data to cheaper tiers

Answer

To enable public sharing of data

Answer

To comply with data localization laws

Question 6

A healthcare organization is migrating electronic health records (EHR) to the cloud and must comply with HIPAA. They want to use cloud-native encryption but retain the ability to immediately revoke access to all encrypted data. Which key management strategy best meets this requirement?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in the cloud KMS. The cloud service is authorized to use the key, but the customer can revoke access at any time by disabling the key, effectively rendering the data inaccessible. This provides control without the complexity of client-side encryption.

Answer

Hold your own key (HYOK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 7

A cloud security team is deploying a web application with an API Gateway. Which TWO mechanisms should be implemented to protect against API abuse and unauthorized access?

Accepted Answer

Rate limiting. Rate limiting prevents abuse by throttling requests, and authentication (e.g., JWT, API keys) ensures only authorized clients can access the API.

Answer

TLS enforcement

Answer

Resource tagging

Answer

VPC peering

Question 8

An organization uses cloud object storage with versioning enabled. After a ransomware attack, they discover that many objects were encrypted by the attacker. How does versioning help in this scenario?

Accepted Answer

It allows restoration of the previous unencrypted version of each object. Versioning retains previous versions of objects, so if the current version is encrypted or modified, the last unmodified version can be restored, provided the attacker did not delete versions.

Answer

It replicates objects to a different region for disaster recovery

Answer

It prevents any object from being overwritten or deleted

Answer

It automatically encrypts all objects with customer-managed keys

Question 9

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in cloud KMS, enabling automatic rotation and fine-grained access policies.

Answer

Cloud provider default encryption

Answer

Customer-supplied encryption keys (CSEK)

Answer

Bring your own key (BYOK)

Question 10

A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)

Accepted Answer

A process to tag resources with the appropriate classification labels. A classification scheme with defined labels (e.g., public, internal, confidential, restricted) and a process for tagging resources with those labels are essential. Automated DLP scanning can enforce classification but is not essential for the scheme itself. Encryption and access controls are separate security controls.

Answer

Encryption at rest for all classified data

Answer

Access control policies based on classification

Answer

Automated DLP scanning to enforce classification

Question 11

An organization is adopting a hybrid cloud strategy. Which THREE considerations are vital for maintaining consistent security across environments? (Select THREE.)

Accepted Answer

Unified identity and access management (IAM). Consistent identity and access management (IAM) ensures uniform access controls; network segmentation policies prevent unauthorized movement; encryption standards protect data across environments. Patch management is important but not unique to hybrid cloud consistency.

Answer

Dedicated security team for each environment

Answer

Different encryption standards for public and private clouds

Question 12

A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?

Accepted Answer

Hold your own key (HYOK). HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default encryption (SSE-S3)

Question 13

Which design principle is most directly aimed at avoiding vendor lock-in and ensuring that workloads can be moved between cloud providers with minimal effort?

Accepted Answer

Portability. Portability ensures that applications and data can be moved across environments using open standards and APIs, reducing dependence on a single provider.

Answer

Reversibility

Answer

Elasticity

Answer

Multitenancy isolation

Question 14

A cloud provider offers a service with an SLA of 99.9% availability. Which TWO of the following are likely consequences if the provider fails to meet this SLA?

Accepted Answer

The customer receives service credits. Typically, SLA violations result in service credits (refunds) and can trigger penalty clauses. Immediate termination is rare, and full refund is not standard. Legal action is possible but less direct.

Answer

The customer receives a full refund for the service

Answer

The contract is immediately terminated

Answer

The customer can take legal action

Question 15

An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)

Accepted Answer

De-identification transforms such as masking and tokenization. Cloud DLP services can scan data for sensitive patterns (like credit card numbers) and apply de-identification transforms to redact or mask data. They do not manage encryption keys or automate backup.

Answer

Automatic encryption key rotation

Answer

Enforcing multi-factor authentication

Answer

Automated backup of sensitive data