CCSP Practice Test 18 — 15 Questions

Question 1

Which cloud characteristic refers to the ability to automatically scale resources up or down based on demand?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that allows resources to be automatically scaled up or down based on demand. It enables cloud consumers to quickly provision and release resources to match workload fluctuations, often in an automated manner. This is a core tenet of cloud computing as defined by NIST.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 2

A company needs to export data from a cloud service in a machine-readable format to comply with a data subject's right to data portability under GDPR. Which format is most appropriate?

Accepted Answer

CSV (Comma-Separated Values). GDPR Article 20 grants data subjects the right to receive their personal data in a 'structured, commonly used and machine-readable format.' CSV satisfies all three criteria: it is structured (tabular rows/columns), widely used, and easily parsed by software. It also supports transmission to another controller without hindrance, which is the core purpose of portability.

Answer

HTML

Answer

PDF

Answer

JPEG

Question 3

Under GDPR, what is the role of a cloud provider that processes personal data solely on behalf of a customer?

Accepted Answer

Data processor. Under GDPR, a data processor is an entity that processes personal data on behalf of a data controller. The cloud provider, in this scenario, acts as a processor because it processes data solely on behalf of the customer (the controller). The processor must follow the controller's instructions and comply with GDPR obligations.

Answer

Data controller

Answer

Supervisory authority

Answer

Data subject

Question 4

A company wants to export its data from a cloud provider to another provider upon contract termination. Which contract clause is essential to ensure the data can be exported in a usable format?

Accepted Answer

Data portability clause. A data portability clause contractually obligates the cloud provider to return customer data in a structured, commonly used, and machine-readable format upon termination, ensuring the data can be migrated to another provider. Without this clause, the provider might only offer data in a proprietary or non-standard format, making export impractical. This is a key requirement under GDPR Article 20 and other data protection regulations.

Answer

Service level agreement

Answer

Right to audit

Answer

Data deletion clause

Question 5

An organization is using GCP and wants to collect audit logs for all API calls made within the project. Which GCP service should be enabled to capture these logs?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs is the correct GCP service because it automatically records API calls and administrative activities within a GCP project. It captures Admin Activity, Data Access, System Event, and Policy Denied logs, providing a comprehensive audit trail of who did what, where, and when. This is essential for security, compliance, and forensic investigations.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Question 6

Refer to the exhibit. An IAM policy is attached to a user. Which action is the user allowed to perform?

Accepted Answer

Read an existing object from the bucket.. The IAM policy grants the `s3:GetObject` action, which allows the user to read (download) an existing object from the specified S3 bucket. The policy explicitly allows this action for the bucket `my-bucket` and its objects, so the user can perform read operations on objects within that bucket.

Answer

Change the bucket's policy.

Answer

Upload a new object to the bucket.

Answer

Delete an object from the bucket.

Question 7

A company is negotiating a cloud service agreement and wants to ensure it can verify the provider's security controls independently. Which contractual clause is essential for this purpose?

Accepted Answer

Right to audit clause. A right to audit clause is essential because it contractually grants the customer the ability to independently verify the provider's security controls, either through direct audits or by accepting third-party audit reports. This clause ensures transparency and accountability, which is critical for compliance and risk management in cloud services.

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) on uptime

Answer

Data portability clause

Question 8

A cloud application uses IAM roles to grant permissions to compute instances. What is the primary security advantage of this approach over hardcoding credentials?

Accepted Answer

Elimination of hardcoded secrets. IAM roles issue short-lived, automatically rotated temporary credentials to compute instances via instance metadata (e.g., AWS IMDSv2, Azure Managed Identity, GCP service accounts), so no long-lived secret ever exists in code, config files, or repos. This removes the primary attack vector of credential theft via source code leaks, container image scraping, or log exposure. Because the credentials are ephemeral and scoped to the role's policy, blast radius from a compromised instance is also limited.

Answer

Simplified load balancing

Answer

Improved application performance

Answer

Reduced network latency

Question 9

What is a Software Bill of Materials (SBOM) primarily used for?

Accepted Answer

Documenting all open-source and third-party components in an application. An SBOM is a formal, machine-readable inventory of all software components, libraries, and dependencies that make up an application, with particular emphasis on open-source and third-party elements. It exists so organizations can quickly identify whether a newly disclosed CVE affects any component in their supply chain, which is why SBOMs became a mandate under US Executive Order 14028 and are central to supply chain risk management in cloud environments.

Answer

Tracking user access to cloud resources

Answer

Recording incident response procedures

Answer

Listing security controls implemented in the cloud environment

Question 10

A cloud application uses an IAM role with a policy that allows 's3:*' on all buckets. This is an example of which cloud security issue?

Accepted Answer

Over-permissive IAM. Over-permissive IAM roles with wildcard permissions grant excessive privileges, violating least privilege.

Answer

Exposed S3 bucket

Answer

Insecure API endpoint

Answer

Hardcoded credentials

Question 11

An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?

Accepted Answer

Data encrypted before rotation can still be decrypted using the previous key as long as it is available. Cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.

Answer

Key rotation is not supported in cloud KMS

Answer

The KMS automatically re-encrypts all data with the new key

Answer

Existing data encrypted with the previous key must be re-encrypted with the new key

Question 12

A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?

Accepted Answer

Restricted. In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.

Answer

Internal

Answer

Confidential

Answer

Public

Question 13

A financial institution uses a multi-cloud strategy with AWS and Azure. They must comply with PCI DSS. The security team found that a developer accidentally stored a file with credit card numbers in an S3 bucket that is publicly readable. Which immediate action should be taken to contain the breach?

Accepted Answer

Remove the public read permission on the bucket.. Removing the public read permission on the S3 bucket immediately stops unauthorized access to the file containing credit card numbers, containing the breach in accordance with PCI DSS incident response requirements. This action does not destroy evidence (unlike deletion) and directly addresses the root cause—the bucket's misconfigured access control list (ACL) or bucket policy that allowed public read access. It is the fastest way to prevent further data exfiltration while preserving the file for forensic analysis.

Answer

Delete the file immediately.

Answer

Enable default encryption on the bucket.

Answer

Revoke the developer's IAM credentials.

Question 14

Refer to the exhibit. A cloud administrator sees this error log from AWS CloudTrail. The user [email protected] is a member of the 'Analysts' group. Which of the following is the most likely cause of the AccessDenied error?

Accepted Answer

The IAM policy attached to the user or group does not include s3:PutObject for that bucket.. The AccessDenied error for an s3:PutObject operation indicates that the IAM policy attached to the user or group does not grant the necessary permissions. Since the user is a member of the 'Analysts' group, the most likely cause is that the group's IAM policy lacks an Allow effect for s3:PutObject on the target bucket. AWS IAM evaluates both identity-based and resource-based policies, and if no explicit Allow is present, the default implicit deny applies.

Answer

The user is trying to access the bucket from a different AWS region.

Answer

The bucket policy explicitly denies access to the 'Analysts' group.

Answer

The bucket requires server-side encryption and the request did not include encryption headers.

Question 15

A cloud architect needs to protect data in transit between an on-premises data center and a cloud virtual private cloud (VPC). Which solution is MOST appropriate?

Accepted Answer

VPN with IPsec. An IPsec VPN is the most appropriate solution for protecting data in transit between an on-premises data center and a cloud VPC because it provides network-layer encryption and authentication for all IP traffic between the two sites. IPsec operates at Layer 3, securing the entire tunnel without requiring per-application configuration, and is designed specifically for site-to-site connectivity. This ensures confidentiality, integrity, and replay protection for all data traversing the public internet or a direct connect link.

Answer

SSL certificate on web server

Answer

TLS for each application

Answer

Direct Connect without encryption