CCSP Practice Test 18 — 15 Questions

Question 1

A financial services company uses a cloud DLP API to scan data stored in Cloud Storage and BigQuery. They need to reduce the risk of exposing credit card numbers in reports by replacing the first 12 digits with asterisks while preserving the last four. Which de-identification technique should they apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Masking. Masking allows selective obfuscation of parts of a data value, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 2

A company wants to migrate its customer relationship management (CRM) system to the cloud and requires that the provider manages the underlying infrastructure, operating system, and middleware, while the company manages only the application and data. Which cloud service model best meets these requirements?

Accepted Answer

Platform as a Service (PaaS). In PaaS, the provider manages the infrastructure, OS, and middleware; the customer manages applications and data. IaaS would require the customer to manage OS and middleware; SaaS would have the provider manage applications as well.

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 3

A cloud architect is designing a solution that must automatically scale compute resources based on real-time demand. The application is stateless and can tolerate brief interruptions. Which cloud design principle is most directly addressed by this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity allows resources to scale up and down automatically to meet demand, which is the principle being applied. This is a key characteristic of cloud computing.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 4

Which cloud service model provides the customer with the most control over the underlying infrastructure, including operating systems and applications?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages OS, middleware, and applications, while the provider manages the physical infrastructure.

Answer

PaaS

Answer

SaaS

Answer

FaaS

Question 5

In a hybrid cloud deployment, which of the following is a critical security consideration?

Accepted Answer

Ensuring consistent security policy across environments. Hybrid cloud requires consistent security policies across both public and private environments, typically enforced via secure connectivity and unified management.

Answer

Using only public cloud for sensitive data

Answer

Avoiding any use of APIs for integration

Answer

Eliminating all private cloud resources

Question 6

An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?

Accepted Answer

Portability. Portability focuses on avoiding vendor lock-in by using open standards and technologies like Kubernetes and Docker that can run across different cloud providers.

Answer

Elasticity

Answer

Multitenancy isolation

Answer

Reversibility

Question 7

A financial services company stores customer transaction data in a cloud object storage service. The security team wants to ensure that if a malicious insider gains access to the storage bucket, they cannot read the data. Which encryption approach provides the highest level of protection against the cloud provider and insiders?

Accepted Answer

Client-side encryption using a customer-managed key. Client-side encryption means data is encrypted before it is uploaded to the cloud. The cloud provider never has access to the encryption keys, and data remains encrypted at rest and in transit (if TLS is also used). This protects against both the cloud provider and insiders with administrative access to the storage service.

Answer

Server-side encryption with AES-256 (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for data in transit

Question 8

A company is adopting a microservices architecture on Kubernetes and needs to ensure least privilege for pod-to-pod communication. Which THREE controls should be implemented?

Accepted Answer

Service accounts with minimal permissions. Network policies restrict pod communication, RBAC controls pod permissions, and service accounts with limited permissions enforce least privilege.

Answer

Pod Security Admission to enforce that containers run as root

Answer

Horizontal Pod Autoscaler

Question 9

Which characteristic of cloud computing allows a user to provision resources automatically without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service enables users to provision and manage resources as needed via a web portal or API without manual provider intervention.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 10

A company wants to enforce data classification in its cloud environment. They need to automatically identify and label sensitive data such as credit card numbers in cloud storage. Which service should they use?

Accepted Answer

Cloud DLP. Cloud DLP (Data Loss Prevention) can scan cloud storage for sensitive data like credit card numbers and apply classification labels or de-identification transforms.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 11

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Versioning preserves previous versions of objects. The organization can restore previous unencrypted versions, provided they have not been deleted and the ransomware did not delete versions.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 12

A company is adopting a hybrid cloud model to run sensitive workloads on-premises and less critical applications in the public cloud. Which security consideration is most critical for this environment?

Accepted Answer

Maintaining consistent security policies across both environments. Hybrid cloud requires consistent security policies across environments to avoid gaps. Connectivity is important but policy consistency ensures security controls are uniformly applied.

Answer

Using a single cloud provider for both environments

Answer

Ensuring high-speed network connectivity

Answer

Implementing data encryption at rest only

Question 13

A company is implementing a data loss prevention (DLP) strategy for cloud storage. They need to detect and mask credit card numbers in documents stored in a cloud storage bucket. The DLP service provides de-identification transforms including masking, tokenization, and pseudonymization. Which transform should the company use to irreversibly replace the credit card numbers with a placeholder while maintaining the original format for analytics?

Accepted Answer

Masking. Masking replaces sensitive data with a masked version, such as showing only the last four digits, preserving format for analytics. Tokenization substitutes with a token that requires a mapping table. Pseudonymization replaces with a consistent pseudonym that can be reversed. Bucketing groups values into ranges.

Answer

Pseudonymisation

Answer

Bucketing

Answer

Tokenization

Question 14

A cloud architect is designing a multi-tenant SaaS application. Which TWO design principles are critical for ensuring tenant isolation? (Select TWO.)

Accepted Answer

Network isolation between tenants. Multitenancy isolation requires strong network isolation (e.g., virtual networks, security groups) and data isolation (e.g., separate databases or encryption per tenant) to prevent one tenant from accessing another's data.

Answer

Single shared database for all tenants

Answer

Using the same OS image for all tenants

Answer

Resource pooling across tenants

Question 15

An organization needs to migrate a legacy application to the cloud. The application requires full control over the operating system, middleware, and runtime. The team wants to minimize management overhead while retaining OS-level access. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides virtualized hardware with OS access; PaaS abstracts the OS.

Answer

SaaS

Answer

FaaS

Answer

PaaS