CCSP Practice Test 17 — 15 Questions

Question 1

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 2

Which TWO of the following are effective methods to protect against server-side request forgery (SSRF) in a cloud application? (Choose two.)

Accepted Answer

Whitelist allowed outbound destinations. Whitelisting allowed outbound destinations is a primary defense against SSRF. By explicitly permitting only trusted external hosts (e.g., specific API endpoints or internal services), the application cannot be tricked into making requests to arbitrary internal or external targets, even if an attacker controls the URL parameter.

Answer

Use SSL inspection to check for malicious payloads

Answer

Block all outbound network traffic from the application

Answer

Sanitize all user input for URL parameters

Question 3

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

Accepted Answer

Configure a web application firewall (WAF) with rate limiting and IP blacklisting. A Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.

Answer

Rotate API keys more frequently

Answer

Implement cross-origin resource sharing (CORS) policies

Answer

Require encryption of session tokens

Question 4

A healthcare SaaS company runs containerized microservices on Google Kubernetes Engine (GKE). The security team scans containers with a vulnerability scanner and finds that base images have several critical vulnerabilities. The container build process uses a Dockerfile that pulls the latest Ubuntu image from Docker Hub. The team wants to reduce the attack surface without delaying feature releases. What is the best approach?

Accepted Answer

Adopt minimal hardened base images and integrate vulnerability scanning into CI/CD. Adopting minimal hardened base images (e.g., distroless, Alpine, or UBI-minimal) reduces the number of packages and thus the attack surface, while integrating vulnerability scanning into CI/CD catches issues early without slowing releases. This directly addresses the root cause—vulnerable base images—and provides continuous feedback. The other options either don't fix the base image problem or are too disruptive.

Answer

Place a network security policy to restrict outbound traffic from pods

Answer

Schedule weekly automated rebuilds with the latest base image

Answer

Refactor all applications to use scratch as base image

Question 5

A security analyst is using a cloud security posture management (CSPM) tool that reports a finding of "storage bucket publicly accessible." However, upon manual inspection, the bucket's ACL and bucket policy both restrict access to authorized users only. What is the most likely cause of the false positive?

Accepted Answer

The bucket contains objects with public ACLs. A CSPM tool may flag a bucket as publicly accessible if any object within the bucket has a public ACL, even if the bucket-level ACL and policy are private. The tool evaluates the effective permissions of the bucket and its contents, and a single public object can trigger the finding. Manual inspection of only bucket-level settings would miss this.

Answer

The bucket is in a different region

Answer

The bucket policy has a syntax error

Answer

The CSPM tool is misconfigured

Question 6

A cloud security architect is designing a multi-tenant environment using Type 1 hypervisors. Which of the following is the primary security risk associated with this architecture?

Accepted Answer

VM escape from guest to hypervisor. In a Type 1 (bare-metal) hypervisor multi-tenant architecture, the hypervisor is the highest-privilege software layer controlling all guest VMs, memory, and virtual devices. A VM escape exploits a hypervisor or virtual-device vulnerability to break out of the guest's isolation boundary and execute code at the hypervisor level, compromising every other tenant on that host. This is the primary and most severe security risk because it defeats the fundamental tenant-isolation guarantee that multi-tenancy depends on.

Answer

Insecure VM migration between hosts

Answer

Insufficient logging of hypervisor events

Answer

Resource contention leading to denial of service

Question 7

A company is deploying a serverless function in AWS Lambda that needs to access a private RDS database. Which TWO configurations are necessary for secure access?

Accepted Answer

Configure VPC integration for the Lambda function. Lambda functions must be attached to a VPC using VPC integration to access resources inside a private subnet, such as an RDS database. Without VPC integration, the Lambda function runs in an AWS-managed VPC and cannot reach resources in the customer’s VPC. This configuration requires the Lambda function to be associated with the same VPC, subnets, and security groups as the RDS instance.

Answer

Disable TLS for the database connection

Answer

Attach an Internet Gateway to the Lambda function

Answer

Assign a public IP address to the Lambda function

Question 8

A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?

Accepted Answer

Use a separate customer-managed key for each database, with automated key rotation. It minimizes the blast radius by ensuring that compromise of one key does not expose data in other databases, while automated key rotation reduces the window of vulnerability and operational overhead. This aligns with the principle of least privilege and the compliance requirement for customer-managed encryption keys (CMEK). Using separate keys per database is a standard security best practice for microservices architectures, especially when handling PHI.

Answer

Use the cloud provider's default encryption keys for all databases

Answer

Disable encryption to improve performance and use network segmentation instead

Answer

Use one customer-managed key for all databases, but enable automatic key rotation

Question 9

A cloud administrator is configuring log retention for a financial application that must comply with PCI DSS. What is the minimum log retention period required by PCI DSS?

Accepted Answer

At least one year with the most recent three months available online.. PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.

Answer

At least 90 days.

Answer

At least six months.

Answer

At least five years.

Question 10

A cloud operations team is setting up a new virtual network in the cloud. They need to segment traffic between different tiers of an application (web, application, database). Which security control should they implement?

Accepted Answer

Network access control lists and security groups. Network access control lists (NACLs) and security groups are the primary tools for segmenting traffic between application tiers in a cloud VPC. Security groups act as stateful firewalls at the instance level, while NACLs are stateless and operate at the subnet level. Together, they enforce least-privilege network access, ensuring that, for example, the web tier can only communicate with the application tier on specific ports, and the database tier is isolated from direct internet access.

Answer

Intrusion detection system

Answer

Data loss prevention

Answer

Web application firewall

Question 11

An organization is looking for a cloud deployment model that is provisioned for exclusive use by a single organization, but may be owned, managed, and operated by the organization, a third party, or some combination. Which deployment model is this?

Accepted Answer

Private cloud. Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Question 12

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Accepted Answer

Continuous improvement process.. The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Answer

Business continuity plan.

Answer

Annual penetration testing.

Answer

Encryption of all data at rest.

Question 13

Which TWO of the following are best practices for implementing baseline configuration management in a cloud environment? (Choose two.)

Accepted Answer

Automate the deployment of baseline configurations using orchestration tools. Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.

Answer

Allow administrators to manually adjust configurations as needed to maintain flexibility

Answer

Disable configuration drift detection to reduce alert fatigue

Answer

Grant all users read/write access to configuration repositories for efficiency

Question 14

Which of the following best describes the purpose of the Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) program?

Accepted Answer

To allow cloud providers to publicly document their security controls and achieve different levels of assurance. The CSA STAR program allows cloud providers to publicly document their security controls and achieve different levels of assurance through self-assessment, third-party audits, or certifications. It provides transparency and trust by mapping controls to recognized standards like ISO 27001 and SOC 2.

Answer

To offer a certification program for cloud security professionals

Answer

To define mandatory security requirements for all cloud services

Answer

To provide a legal framework for cloud contracts

Question 15

Which of the following is a cloud-specific vulnerability that can lead to exposure of IAM credentials through the metadata service?

Accepted Answer

SSRF to metadata endpoint. Server-Side Request Forgery (SSRF) that targets the cloud metadata endpoint (e.g., http://169.254.169.254) can retrieve IAM credentials. This is a cloud-specific issue.

Answer

SQL injection

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)