CCSP Practice Test 18 — 15 Questions

Question 1

A media streaming company uses a multi-cloud strategy with AWS and GCP. Their application uses a message queue (Amazon SQS and Google Pub/Sub) for asynchronous processing. The security team discovers that messages contain sensitive user data (e.g., email addresses) that are not encrypted at the broker level. The compliance team mandates encryption of data at rest and in transit for all sensitive data. However, the application already uses TLS for message delivery. What is the most secure and operationally efficient way to meet compliance?

Accepted Answer

Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service. Option C is correct because client-side encryption ensures that sensitive data is encrypted before it ever leaves the application, meeting the compliance mandate for encryption at rest and in transit regardless of the broker's native encryption capabilities. Since TLS already protects data in transit, adding client-side encryption with a centralized key management service (e.g., AWS KMS or GCP Cloud KMS) provides end-to-end confidentiality: the message payload is encrypted by the producer, remains encrypted in the queue, and is decrypted only by the authorized consumer. This approach is operationally efficient because it avoids vendor lock-in and works uniformly across AWS SQS and GCP Pub/Sub without relying on broker-specific SSE features that may not cover all states (e.g., broker logs or backups).

Answer

Enable server-side encryption with SQS (SSE-SQS) and Pub/Sub (CSEK) and rely on TLS for in transit

Answer

Separate sensitive and non-sensitive messages into different queues with different retention policies

Answer

Use a third-party encryption gateway that wraps messages before they reach the queues

Question 2

A financial institution uses a cloud data warehouse to store transaction data. The data is classified into three tiers: public, internal, and confidential. The current architecture stores all data in a single dataset with column-level encryption for confidential fields. A recent internal penetration test revealed that an analyst with access to the data warehouse could query aggregated statistics that inadvertently revealed confidential individual transactions. The security team needs to implement a solution that prevents such data leakage while preserving analytical capabilities. Which solution BEST addresses this?

Accepted Answer

Deploy a differential privacy framework that adds noise to query results.. Differential privacy is the correct solution because it directly addresses the core issue: aggregated statistics can be reverse-engineered to infer individual records. By adding calibrated noise to query results, it ensures that the output of any query does not reveal whether a specific individual's data is present, thus preventing leakage from aggregate queries while still allowing analysts to derive meaningful trends and patterns.

Answer

Implement row-level security to restrict each analyst to only view data related to their assigned region.

Answer

Use dynamic data masking to obscure confidential fields based on the user's clearance.

Answer

Encrypt the entire dataset with a key that is only available to a privileged group.

Question 3

A healthcare organization is migrating to AWS and must protect electronic protected health information (ePHI) stored in S3. They use AWS KMS with a custom key policy that restricts key usage to specific IAM roles. The compliance team discovers that some S3 objects are encrypted with AWS managed keys (SSE-S3) instead of the required SSE-KMS using the custom key. The security architect needs to ensure all future uploads use the customer-managed KMS key. After implementing a bucket policy that denies s3:PutObject if the required encryption is not present, the development team reports that their existing automation scripts fail with access denied errors. The scripts use the AWS SDK and do not explicitly set encryption headers. The security architect must find a solution that enforces encryption with the custom key while minimizing disruption. Which course of action BEST resolves the issue?

Accepted Answer

Modify the bucket policy to use a Deny effect with a condition on the s3:x-amz-server-side-encryption-aws-kms-key-id header being null, and also enable S3 default encryption with the custom KMS key so that objects uploaded without explicit headers are automatically encrypted with the correct key.. Option A is correct because it combines a bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption-aws-kms-key-id header is null (ensuring the custom KMS key ID is explicitly provided) with S3 default encryption configured to use the same custom KMS key. This dual approach ensures that even if the SDK scripts do not set encryption headers, the default encryption will automatically apply the required KMS key, making the policy condition pass and avoiding access denied errors. The Deny condition on the null header forces explicit encryption headers when they are set, while default encryption handles the case where no headers are provided, thus enforcing compliance without breaking existing automation.

Answer

Implement AWS Config rules to detect non-compliant objects and automatically re-encrypt them with the correct key, while keeping the bucket policy unchanged.

Answer

Remove the bucket policy and rely solely on S3 default encryption with the custom KMS key, because default encryption applies to all objects.

Answer

Create a new S3 bucket with the required policy and migrate all data using AWS DataSync, then delete the old bucket.

Question 4

A defense contractor uses a cloud provider that is FedRAMP authorized at the Moderate impact level. The contractor's contract requires compliance with DFARS 252.204-7012, which mandates safeguarding covered defense information (CDI) and reporting cyber incidents. The contractor's security team wants to ensure the cloud provider's security controls are adequate. The provider offers a FedRAMP package that includes a System Security Plan (SSP) and a Security Assessment Report (SAR). The contractor's legal department has determined that if the provider is FedRAMP authorized, the audit requirements are satisfied. What is the most efficient way to verify compliance?

Accepted Answer

Use the FedRAMP authorization letter as evidence without further audit.. The FedRAMP authorization letter is the most efficient verification because FedRAMP Moderate authorization is explicitly recognized by the DoD as meeting the security control baseline for DFARS 252.204-7012. The legal department has already determined that FedRAMP authorization satisfies audit requirements, so no additional analysis of the SSP/SAR or third-party testing is needed. Using the authorization letter alone avoids redundant effort while still providing auditable evidence of compliance.

Answer

Request the provider's SSP and SAR and compare against DFARS requirements.

Answer

Engage a third-party auditing firm to assess the provider.

Answer

Perform an independent penetration test on the provider's infrastructure.

Question 5

A company receives an erasure request under GDPR. The cloud provider can delete from active storage within 24 hours but requires 90 days to delete from archives. The company has a contractual obligation to ensure deletion within 30 days. What should the company do?

Accepted Answer

Request the provider to delete from archives within 30 days and verify.. Option C is correct because the company has a contractual obligation to ensure deletion within 30 days, which overrides the provider's default 90-day archive retention policy. The company must formally request the provider to expedite the deletion from archives and verify compliance, as GDPR Article 17 requires the controller to ensure erasure without undue delay, and the provider as processor must assist. Relying on the provider's standard timeline without action would breach the contract and GDPR accountability requirements.

Answer

Delete the data from the application layer only and rely on provider for archives.

Answer

Accept the 90-day timeline and inform the data subject accordingly.

Answer

Reject the request as impractical.

Question 6

Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options:
A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises.
B. Use the provider's default encryption and rely on their BAA that states they will protect the keys.
C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.
D. Disable encryption and rely on access controls and auditing only.

Which option best addresses the compliance requirement while considering the operational impact?

Accepted Answer

Enable client-side encryption using a custom key management system (KMS) on the customer's premises.. Option A is correct because client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.

Answer

Disable encryption and rely on access controls and auditing only.

Answer

Use the provider's default encryption and rely on their BAA that states they will protect the keys.

Answer

Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.

Question 7

A financial services company uses a public IaaS provider to host its customer-facing applications. They have strict compliance requirements (e.g., PCI DSS) mandating that all customer data be encrypted at rest and in transit. The cloud provider recently performed a scheduled hypervisor update that required live migration of all customer VMs to different physical hosts to apply security patches. After the migration, the company's security team discovers that temporary files from one of their VMs remained on the original host's local storage and were accessible by another customer's VM that was subsequently provisioned on that host. Although the files did not contain actual customer data because the VM had encrypted its volumes, the security team is concerned about potential data remanence. Which of the following actions would BEST prevent such data remanence in future hypervisor migrations?

Accepted Answer

Enable full-disk encryption on all VMs.. Option B is correct because full-disk encryption ensures that any residual data left on the original host's local storage after live migration is unreadable without the encryption key. Even if temporary files remain, encryption at rest renders the data inaccessible, directly addressing data remanence concerns without relying on the cloud provider's cleanup processes.

Answer

Request dedicated (single-tenant) hosts for all VMs.

Answer

Perform a secure wipe of the original host after each migration.

Answer

Use encrypted live migration for all VM moves.

Question 8

A healthcare company, MedSecure, is migrating its critical patient record application to a public cloud IaaS environment. The application processes Protected Health Information (PHI) subject to HIPAA in the US and also includes some patient data from EU residents subject to GDPR. MedSecure has signed Business Associate Agreements (BAAs) with the cloud provider covering US HIPAA compliance. However, the compliance officer is concerned about GDPR requirements for EU patient data. The architecture uses AWS EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS (MySQL) using encryption at rest and TLS for transmission. The company uses AWS CloudTrail for logging but only retains logs for 90 days. The compliance officer has identified that the current logging retention does not meet the GDPR requirement for logs to be retained for a minimum of 12 months for audit purposes. Additionally, the data stored in RDS is in a single AWS region in the US (us-east-1). The company plans to expand to EU customers. The GDPR requires that personal data of EU residents be stored in the EU or have adequate safeguards for transfer. Currently, the company has not implemented any data residency controls. What course of action should MedSecure take to address the most critical compliance gaps?

Accepted Answer

Enable S3 Object Lock for CloudTrail logs to ensure they cannot be deleted before 12 months, and use AWS DMS with CDC to replicate data to a eu-west-1 region. Also, sign a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage.. Option C is correct because it directly addresses the two most critical compliance gaps: GDPR log retention (12 months) and data residency for EU patient data. Enabling S3 Object Lock on CloudTrail logs ensures they cannot be deleted or altered before 12 months, meeting GDPR audit requirements. Using AWS DMS with Change Data Capture (CDC) to replicate the RDS database to eu-west-1 provides a continuous, low-latency copy of PHI within the EU, satisfying GDPR data residency. Signing a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage is essential because the existing BAA only covers HIPAA, and GDPR requires a separate DPA to establish the cloud provider as a data processor under EU law.

Answer

Extend CloudTrail log retention to 12 months by configuring a new trail in a separate account and storing logs in an S3 bucket with a lifecycle policy to delete after 12 months. For data residency, use AWS DMS to replicate the RDS database to a second RDS instance in the eu-west-1 region and enable cross-region replication for continuous sync.

Answer

Implement AWS Config rules to monitor compliance with both HIPAA and GDPR, and enable AWS CloudTrail Insights to detect unusual activity. For data residency, sign a Standard Contractual Clauses (SCCs) with the cloud provider for the existing US-based data.

Answer

Use AWS Lambda to copy CloudTrail logs from the existing trail to a separate S3 bucket with a retention policy of 12 months. For data residency, configure the RDS instance to have a read replica in eu-west-1 and implement a DPA with AWS for GDPR.

Question 9

A large enterprise is migrating a legacy .NET application to Azure App Service. The application currently stores session state in-memory on the web server. During the migration, the team plans to horizontally scale the application across multiple instances. The security team requires that session data remain confidential and be available even if an instance fails. Which solution should the team implement?

Accepted Answer

Use Azure Redis Cache to store session state with encryption enabled. Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.

Answer

Store session data in Azure SQL Database with column-level encryption

Answer

Encrypt session data and store it as a client-side cookie

Answer

Configure Application Gateway with cookie-based affinity (sticky sessions)

Question 10

A software company develops a mobile application that communicates with a cloud backend using REST APIs. The application uses OAuth 2.0 with the authorization code grant and PKCE for authentication. After a security audit, the team identifies that the backend API accepts both a client secret (from the authorization code grant) and a PKCE code verifier. The security team wants to remove unnecessary attack surface. Which change should be made?

Accepted Answer

Remove the client_secret parameter from the token endpoint and rely solely on PKCE. Option C is correct because PKCE (Proof Key for Code Exchange, RFC 7636) was specifically designed to secure the authorization code grant for public clients like mobile apps, where a client secret cannot be reliably kept confidential. By removing the client_secret parameter and relying solely on PKCE, the team eliminates an unnecessary attack surface—since the secret is effectively a static credential that can be extracted from the app binary—while maintaining strong protection against authorization code interception attacks. The backend should enforce PKCE verification using the code_challenge and code_verifier, making the client_secret redundant for public clients.

Answer

Switch to the implicit grant (response_type=token) to avoid client secrets

Answer

Keep both mechanisms but use short-lived tokens to reduce risk

Answer

Require a stronger client secret (e.g., 256-bit) and store it in the app's encrypted storage

Question 11

A financial organization is migrating a critical application to a cloud environment. The application processes sensitive customer data and must comply with PCI DSS. The security architect proposes using serverless functions for the compute layer. Which security control is essential to protect the application from injection attacks?

Accepted Answer

Use parameterized queries in the functions' database calls. Injection attacks (e.g., SQL injection) exploit untrusted input that is concatenated into database queries. Parameterized queries (prepared statements) separate SQL logic from data, ensuring user input is treated as data only, not executable code. This is the foundational control for preventing injection in serverless functions that interact with databases, as required by PCI DSS Requirement 6.5.1.

Answer

Enable function-level logging for audit trails

Answer

Encrypt all data in transit between functions

Answer

Implement a web application firewall (WAF) in front of the functions

Question 12

A software development company is migrating its development and test environments to a public cloud. The security team has identified that many developers have assigned overly permissive IAM roles to the resources they create, such as giving full administrative access to databases and virtual machines. The company wants to enforce least privilege without impeding development agility. The cloud architect suggests using a combination of permission boundaries and service control policies. Which of the following approaches BEST enforces least privilege while maintaining development flexibility?

Accepted Answer

Define permission boundaries that limit the maximum permissions a developer can grant to resources, and allow developers to create IAM roles within those boundaries.. Permission boundaries in AWS IAM (or similar constructs in other clouds) allow an administrator to set the maximum permissions that a developer can grant to any IAM role or resource. By defining a permission boundary, developers retain the flexibility to create and attach policies within that boundary, ensuring they cannot exceed the defined limits. This directly enforces least privilege because even if a developer attaches a permissive policy, the boundary caps the effective permissions, preventing full administrative access to databases or VMs.

Answer

Implement an automated system that reviews and removes any privileges not used within 60 days.

Answer

Attach a service control policy at the organizational level that denies all actions unless explicitly allowed, and have developers create their own IAM policies.

Answer

Create a permission boundary that restricts all users to read-only access and require subordinates to request access for specific privileges.

Question 13

A multinational corporation operates across multiple cloud providers (AWS, Azure, GCP) and uses a variety of data storage services. They have a requirement to enforce a consistent encryption policy across all providers: all data at rest must be encrypted using a centrally managed key that is rotated every 90 days. The cloud security team is evaluating different key management solutions. They want to minimize operational overhead and avoid vendor lock-in. The team has experience with configuring cloud-native key management services (KMS) but is concerned about managing keys across different regions and providers. Which solution best meets the requirements?

Accepted Answer

Deploy a third-party cloud-agnostic key management solution that supports BYOK and integrates with all providers' KMS. Option A is correct because a third-party cloud-agnostic key management solution (e.g., HashiCorp Vault, Thales CipherTrust) that supports Bring Your Own Key (BYOK) allows the organization to centrally manage and rotate a single root key every 90 days, while integrating with each provider's native KMS via external key stores (e.g., AWS KMS custom key store, Azure Key Vault managed HSM, GCP Cloud HSM). This minimizes operational overhead by avoiding manual per-provider policy replication and prevents vendor lock-in by decoupling key management from any single cloud provider's proprietary KMS.

Answer

Use each cloud provider's native KMS and create identical key policies manually

Answer

Store the key in an internal secrets manager and configure each provider's KMS to use that key as a root key

Answer

Implement client-side encryption using a single master key stored in the application configuration

Question 14

A large healthcare organization runs its electronic health records (EHR) system on a private cloud built with VMware vSphere. They have implemented a hybrid cloud strategy with a public cloud provider for disaster recovery. The EHR application is mission-critical and must maintain high availability with zero data loss. During a routine audit, the security team discovers that the replication between the private cloud and the public cloud uses asynchronous replication with a 15-minute recovery point objective (RPO). However, the application requires an RPO of less than 1 minute. Additionally, the replication data is not encrypted in transit. The compliance officer demands immediate remediation. The cloud architect must propose a solution that meets the RPO requirement and ensures encryption of data in transit. Which of the following actions is the most appropriate first step?

Accepted Answer

Switch to synchronous replication between the private cloud and public cloud to achieve near-zero RPO, and enable TLS for replication traffic.. Option C is correct because synchronous replication ensures that data is written to both the primary and secondary sites before acknowledging the write, achieving near-zero RPO (typically sub-second). Enabling TLS for replication traffic encrypts data in transit, directly addressing the compliance requirement. This approach meets the application's mission-critical need for zero data loss and encryption without changing the underlying hybrid architecture.

Answer

Move the entire EHR system to the public cloud and use native replication services.

Answer

Increase the frequency of asynchronous replication to every 30 seconds and use IPsec VPN for encryption.

Answer

Implement a third-party replication tool that uses compression and encryption, and keep asynchronous replication with 15-minute RPO.

Question 15

A financial services company runs a critical application on a cloud infrastructure. The application consists of a web tier, an application tier, and a database tier, all deployed in a single cloud region. The database is a managed relational database service with automated backups enabled. The company's disaster recovery plan requires a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. During a recent regional outage, the primary region became unavailable for 6 hours. The company attempted to restore the database from the latest automated backup in a different region, but the restore took 5 hours due to the large database size, exceeding the RTO. Additionally, the backup was 2 hours old at the time of the outage, exceeding the RPO. The security team has also noted that the backup data is encrypted with a cloud-managed key, which may not meet future compliance requirements for customer-managed encryption keys. Which course of action should the company take to meet both the RTO and RPO objectives while also addressing the encryption requirement?

Accepted Answer

Implement cross-region read replicas with synchronous replication and enable encryption with a customer-managed key that is replicated to the disaster recovery region.. Option A is correct because cross-region read replicas with synchronous replication can provide a standby database in another region with an RPO of effectively zero (synchronous replication ensures no data loss) and an RTO measured in minutes (promote the replica to primary), meeting both the 4-hour RTO and 1-hour RPO. Using a customer-managed key (CMK) replicated to the DR region satisfies the compliance requirement for customer-managed encryption keys, as the key can be controlled and audited independently of the cloud provider.

Answer

Store the backup in a different region using cross-region copy and use a cloud HSM to manage the encryption key.

Answer

Use cross-region asynchronous replication with a separate database instance and encrypt with a cloud-managed key.

Answer

Increase the frequency of automated backups to every 30 minutes and use faster storage for the database restore process.