CCSP Practice Test 16 — 15 Questions

Question 1

An organization uses cloud databases and needs to protect sensitive fields such as credit card numbers. They want to preserve the ability to perform exact match searches and joins on these fields. Which data protection technique best meets these requirements?

Accepted Answer

Tokenization with a secure token vault. Tokenization with a secure token vault is correct because it replaces sensitive data (e.g., credit card numbers) with unique, randomly generated tokens that have no mathematical relationship to the original values. The token vault stores the mapping, allowing exact match searches and joins on the tokens while keeping the original data secure, as the tokens are consistent for the same input value.

Answer

Format-preserving encryption (FPE)

Answer

Dynamic data masking

Answer

Deterministic encryption

Question 2

A financial services company is migrating to the cloud and must retain transaction records for seven years for regulatory compliance. They plan to use object storage with lifecycle policies. What is the most secure configuration for long-term data retention?

Accepted Answer

Enable object lock with retention mode set to compliance. Option B is correct because Object Lock with compliance retention mode provides the strongest guarantee against data modification or deletion, even by root users. This mode ensures that once an object is written, it cannot be overwritten or deleted until the retention period expires, which is critical for meeting the seven-year regulatory retention requirement. Unlike other options, compliance mode enforces a legal hold that cannot be removed by any user, including cloud administrators, making it the most secure configuration for immutable long-term retention.

Answer

Configure a lifecycle policy to transition to archive storage after seven years

Answer

Store objects in write-once-read-many (WORM) storage class

Answer

Use server-side encryption with KMS key

Question 3

The exhibit shows a key policy for a customer master key (CMK) in a cloud KMS. An administrator wants to prevent the AppRole from using the key to decrypt data. Which change to the policy would accomplish this?

Accepted Answer

Remove "kms:Decrypt" from the action list in the AppRole statement.. Option D is correct because the AppRole's current policy statement explicitly includes 'kms:Decrypt' in the action list, granting it permission to decrypt data. By removing 'kms:Decrypt' from that action list, the AppRole retains its other allowed actions (such as kms:Encrypt) but can no longer perform decryption operations. This is the most precise and least disruptive change, as it only removes the specific permission needed to prevent decryption without affecting other allowed actions.

Answer

Add a deny statement for AppRole with effect "Deny" for kms:Decrypt.

Answer

Remove the entire "Allow use of the key" statement.

Answer

Change the AppRole action list to include only kms:Encrypt.

Question 4

Which THREE statements about cryptographic key lifecycle management are correct?

Accepted Answer

Key usage should be logged and audited.. Option A is correct because auditing key usage is a fundamental requirement for accountability and compliance in cryptographic key management. Logging every key operation (e.g., generation, encryption, decryption, signing) allows detection of unauthorized use or policy violations, and is mandated by standards like NIST SP 800-57 Part 1, which states that audit logs must be protected and reviewed regularly.

Answer

Key backup must be encrypted and stored separately from the keys they protect.

Answer

Key rotation policies must ensure all data is re-encrypted with the new key immediately.

Question 5

During a cloud migration, a company discovers that some sensitive data was inadvertently stored in an object storage bucket with public read access. The security team needs to determine the scope of exposure and remediate. What is the FIRST step they should take?

Accepted Answer

Review the bucket's access logs to identify any unauthorized access.. The first step is to review the bucket's access logs (e.g., AWS CloudTrail or S3 server access logs) to identify any unauthorized access. This determines the scope of exposure—who accessed the data, when, and from where—before taking any remediation action. Without this forensic step, the company cannot assess breach notification obligations or legal liability.

Answer

Notify the data protection authority.

Answer

Change the bucket's permission to private.

Answer

Immediately delete all objects in the bucket.

Question 6

A cloud administrator is rotating encryption keys for a data storage service. The administrator wants to ensure that previously encrypted data remains accessible after the rotation. What is the best practice?

Accepted Answer

Retain the old key and use envelope encryption so the new key can decrypt the old key. Envelope encryption allows the new key to decrypt the old key, which in turn decrypts the data. This ensures that previously encrypted data remains accessible without re-encrypting it, as the old key is retained and protected under the new key. This is the best practice for key rotation in cloud storage services like AWS KMS or Azure Key Vault.

Answer

Delete the old key after rotation

Answer

Re-encrypt all data with the new key immediately

Answer

Disable the old key and only use the new key for new writes

Question 7

Which THREE statements about tokenization compared to encryption are correct?

Accepted Answer

Tokenization is typically used for payment card data.. Tokenization is commonly used for payment card data (e.g., PCI DSS compliance) because it replaces sensitive PANs with non-sensitive tokens that have no exploitable value outside the tokenization system. This allows organizations to reduce their compliance scope by not storing actual card numbers, while encryption still leaves ciphertext that could be decrypted if keys are compromised.

Answer

Encryption is always more secure than tokenization.

Answer

Tokenization preserves data format and length.

Question 8

What additional security benefit does the VPC endpoint provide?

Accepted Answer

It ensures data is not traversing the public internet.. A VPC endpoint (specifically an interface or gateway endpoint) allows instances within a VPC to privately connect to supported AWS services (like S3 or DynamoDB) without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. The core security benefit is that all traffic between the VPC and the service stays entirely within the AWS network backbone and never traverses the public internet, eliminating exposure to internet-based threats.

Answer

It encrypts data in transit.

Answer

It provides an additional layer of authentication.

Answer

It enables cross-region replication.

Question 9

A company is implementing a cloud key management system (KMS) to control encryption keys for sensitive data. Which practice is essential to ensure the security of the keys?

Accepted Answer

Periodically rotate the encryption keys.. Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Answer

Use a single key for all encryption operations to simplify management.

Answer

Export keys to the cloud provider's hardware security module (HSM).

Answer

Store encryption keys in the same region as the encrypted data.

Question 10

The exhibit shows a bucket policy that grants public read access. What is the most effective way to remove this public access?

Accepted Answer

Enable S3 Block Public Access settings at the bucket or account level.. Option C is correct because S3 Block Public Access settings provide a definitive, override-capable mechanism to prevent any public access to an S3 bucket, regardless of other policies or ACLs. These settings can be applied at the bucket or account level and will block all public access even if a bucket policy explicitly grants it, making them the most effective and secure method to remove public access.

Answer

Add an access control list (ACL) that denies public access.

Answer

Change the bucket policy to deny all access.

Answer

Enable bucket versioning and delete the public objects.

Question 11

The exhibit shows a bucket policy applied to a cloud storage bucket. After applying this policy, the security team notices that objects in the bucket are publicly accessible. Which additional condition should be added to restrict access to only authorized applications?

Accepted Answer

Add a condition that limits access to specific IP addresses or VPC endpoints.. Option A is correct because the bucket policy already grants public access via 'Principal': '*', so removing that principal or changing actions won't fix the underlying exposure. By adding a condition that restricts access to specific IP addresses or VPC endpoints, you ensure that only requests originating from authorized network sources can access the bucket, effectively overriding the broad principal wildcard.

Answer

Remove the 'Principal': '*' statement to make the bucket private.

Answer

Change the Action to s3:PutObject to limit exposure.

Answer

Add a condition to require Multi-Factor Authentication (MFA).

Question 12

A multi-national corporation uses a cloud storage service to store files that are subject to data residency requirements. Data must remain within a specific geographic region. Which of the following controls provides the STRONGEST assurance that data does not leave the region?

Accepted Answer

Using the cloud provider's data residency policy with region-restricted storage buckets. Option C is correct because using the cloud provider's data residency policy with region-restricted storage buckets enforces data at rest to be physically stored only in the specified geographic region. This is a technical control implemented at the infrastructure layer, ensuring that the cloud provider's storage service will not replicate or move data outside the designated region, providing the strongest assurance against data leaving the region.

Answer

Contractual clauses with the cloud provider

Answer

Implementing strict IAM policies to limit data access

Answer

Client-side encryption with keys managed on-premises

Question 13

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Accepted Answer

CreateAccessKey. The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.

Answer

DeleteAccessKey

Answer

CreateUser

Answer

UpdateAccessKey

Question 14

Refer to the exhibit. An administrator applies this S3 bucket policy. What is the overall effect?

Accepted Answer

Only requests originating from VPC vpc-12345678 are allowed to retrieve objects. The S3 bucket policy includes an Allow statement that grants s3:GetObject access only to the VPC endpoint vpc-12345678, using the aws:SourceVpce condition key. This means only requests originating from that specific VPC endpoint are permitted to retrieve objects. The Deny statement with a NotPrincipal condition is redundant or misconfigured, but the Allow statement's condition effectively restricts access to the VPC endpoint, making option A correct.

Answer

All requests are denied because the Deny statement overrides the Allow statement

Answer

All requests are allowed because there is an Allow statement

Answer

Only requests made with HTTPS are allowed

Question 15

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

Accepted Answer

Use server-side encryption with a customer-provided key (SSE-C).. Server-side encryption with customer-provided keys (SSE-C) allows the organization to encrypt data at rest in the cloud while retaining full control of the encryption keys on-premises. With SSE-C, the customer provides the encryption key with each API request, and the cloud service uses it to encrypt/decrypt the data server-side, but the key is never stored by the provider. This meets the requirement of keeping the key entirely on-premises and never exposed to the cloud provider.

Answer

Use server-side encryption with a key stored in the cloud provider's key management service (KMS).

Answer

Use server-side encryption with a cloud-managed key (SSE-S3).

Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.