CCSP Practice Test 17 — 15 Questions

Question 1

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establishing a VPN for hybrid connectivity. TLS 1.2+, VPNs, and HTTPS are standard controls for encrypting data in transit. Data classification is a policy, not a technical control. Encryption at rest protects stored data, not in transit.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256

Question 2

A company is adopting a hybrid cloud strategy. Which TWO security considerations are most critical for maintaining a consistent security posture across environments? (Choose two.)

Accepted Answer

Establishing consistent network security policies (e.g., firewall rules). Identity federation and consistent network security policies ensure seamless and secure integration.

Answer

Relying solely on perimeter security

Answer

Deploying separate security teams for each environment

Answer

Using different encryption keys for each environment

Question 3

A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?

Accepted Answer

Enable server-side encryption with AES-256 and block public access. Enabling object-level encryption with customer-managed keys (CMEK) and blocking public access at the bucket level ensures that even if the bucket is misconfigured, data is encrypted and inaccessible without the key.

Answer

Apply data classification labels and enable DLP scanning

Answer

Enable bucket versioning and cross-region replication

Answer

Use pre-signed URLs and IAM policies

Question 4

A cloud security team is implementing data loss prevention for a data lake that stores customer support logs. They need to redact credit card numbers from the logs before they are used for analytics. Which DLP de-identification technique should be applied?

Accepted Answer

Masking. Masking replaces sensitive data with a placeholder, such as replacing credit card digits with asterisks, while preserving format for analytics. Tokenization replaces data with tokens but requires a token vault. Masking is simpler for one-way redaction.

Answer

Date shifting

Answer

Bucketing

Answer

Tokenization

Question 5

Which cloud service model allows customers to manage only their data and user access, while the provider manages everything else including the infrastructure, operating system, and applications?

Accepted Answer

SaaS. SaaS (Software as a Service) provides a complete application managed by the provider, with the customer responsible only for data and access control.

Answer

IaaS

Answer

CaaS

Answer

PaaS

Question 6

Which of the following is a key benefit of using containers, such as Docker, in a cloud environment to achieve portability?

Accepted Answer

Containers package applications with dependencies to run consistently across environments. Containers package applications with dependencies, making them portable across different environments. Virtual machines are less portable, APIs enable interoperability but not specifically portability.

Answer

Containers are always stateless

Answer

Containers require a specific hypervisor to run

Answer

Containers provide hardware-level virtualization

Question 7

In the NIST SP 800-145 definition, which deployment model is described as infrastructure provisioned for exclusive use by a single organization comprising multiple consumers?

Accepted Answer

Private cloud. NIST SP 800-145 defines private cloud as provisioned for exclusive use by a single organization with multiple consumers (e.g., business units).

Answer

Public cloud

Answer

Community cloud

Answer

Hybrid cloud

Question 8

A small business uses a cloud provider's default server-side encryption (SSE) to encrypt data at rest in their cloud storage. They are concerned about key management overhead. Which statement best describes the key management responsibility for SSE?

Accepted Answer

The cloud provider manages the keys entirely.. With default SSE (e.g., SSE-S3 in AWS), the cloud provider manages the encryption keys entirely. The customer is not involved in key generation, rotation, or storage. CMEK and CSEK require customer involvement. BYOK involves importing customer keys.

Answer

The customer and provider share key management responsibilities.

Answer

Keys are not used; encryption is transparent.

Answer

The customer generates and manages the keys.

Question 9

A security analyst is reviewing a cloud storage bucket that contains archived customer records. The analyst wants to ensure that no object in the bucket can be modified or deleted for 7 years to meet regulatory retention requirements. Which TWO features should be enabled? (Select TWO.)

Accepted Answer

Bucket versioning. Object lock (retention mode) enforces a retention period on objects, preventing deletion or modification. Versioning allows recovery in case of accidental deletion of lock or creation of delete markers. Together they provide a comprehensive retention solution, though object lock alone may suffice if versioning is not required.

Answer

Bucket ACL restricting write access

Answer

Lifecycle policy to transition to archival storage

Answer

Cross-region replication

Question 10

Which of the following is an example of a cloud interoperability standard that facilitates portability of containerized applications across different cloud environments?

Accepted Answer

Kubernetes. Kubernetes is an open-source container orchestration platform that enables portability of containerized applications across different cloud providers and on-premises environments.

Answer

SOC 2 Type II

Answer

CSA STAR

Answer

ISO 27001

Question 11

A cloud architect is designing a data lifecycle policy for a SaaS application. According to the cloud data lifecycle, which phase immediately follows the 'Share' phase?

Accepted Answer

Archive. The cloud data lifecycle is: Create, Store, Use, Share, Archive, Destroy. After sharing, data is typically archived for long-term retention before eventual destruction.

Answer

Store

Answer

Use

Answer

Destroy

Question 12

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 13

An organization is evaluating cloud service providers and wants to ensure that the provider can demonstrate independent verification of its security controls. Which THREE of the following are recognized cloud security audit reports or certifications?

Accepted Answer

ISO 27001. SOC 2 Type II, ISO 27001, and CSA STAR are well-known cloud security certifications/audit reports. FedRAMP is US government specific, and PCI DSS is for payment card industry, not a general cloud security audit.

Answer

PCI DSS

Answer

FedRAMP

Question 14

A company needs to encrypt data in transit between its on-premises data center and a cloud virtual private cloud (VPC). They require a dedicated, encrypted tunnel with consistent throughput. Which solution should be used?

Accepted Answer

Cloud VPN (IPsec) connection. A site-to-site VPN (IPsec VPN) provides an encrypted tunnel over the public internet between on-premises and cloud VPC. For higher throughput and reliability, dedicated connections like AWS Direct Connect or Azure ExpressRoute can be used with optional encryption. However, the question specifies 'encrypted tunnel', which VPN provides.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for all API communication

Answer

Cloud KMS key for envelope encryption

Question 15

A company uses a cloud KMS service with an HSM backing for key storage. The security policy requires that keys be rotated automatically every 90 days and that old keys be retained for at least one year to decrypt archived data. Which key management feature should be configured to meet these requirements?

Accepted Answer

Key versioning with rotation schedule. Key rotation schedules and key version management allow automatic rotation and retention of old key versions for decryption of older data.

Answer

Key hierarchy with root key separation

Answer

Key policy with conditions for automatic rotation

Answer

Key import with manual rotation