CCSP Practice Test 19 — 15 Questions

Question 1

A developer accidentally commits cloud access keys to a public GitHub repository. Which tool would be most effective in detecting this secret exposure?

Accepted Answer

GitGuardian. GitGuardian is a dedicated secrets detection platform that scans repositories (including public GitHub repos) for exposed credentials, API keys, and tokens using pattern matching and entropy analysis. It integrates with GitHub via webhooks or CI/CD to alert on commits containing secrets. This directly addresses the scenario of accidentally committed cloud access keys.

Answer

Terraform

Answer

npm audit

Answer

tfsec

Question 2

A healthcare company uses a cloud-based patient management system. The cloud provider experiences a security incident that may have exposed protected health information (PHI). The provider notifies the company within 72 hours, as required by the service agreement. The company's internal breach response policy requires a legal review of the incident before notifying affected individuals. The legal review typically takes 48 hours. However, the company is required to notify patients within 60 days under HIPAA. With the 72-hour notification from the provider, the company has 60 days to notify patients. What is the most effective approach to meet the 60-day notification requirement while ensuring compliance with internal policy?

Accepted Answer

Begin the legal review immediately and prepare patient notification in parallel.. It allows the company to satisfy both the HIPAA 60-day notification requirement and its internal legal review policy by running the legal review and patient notification preparation concurrently. This parallel approach minimizes delay while ensuring that the notification content is legally vetted before release, which is critical for PHI incidents under HIPAA's Breach Notification Rule (45 CFR § 164.404).

Answer

Notify patients immediately and then perform the legal review.

Answer

Wait for the legal review to complete before notifying patients.

Answer

Notify patients immediately based on the provider's notification.

Question 3

A healthcare organization stores patient records in a cloud database. They need to ensure that database administrators cannot view sensitive columns like SSN and diagnosis. Which data masking technique should be applied?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it allows the healthcare organization to mask sensitive columns (e.g., SSN, diagnosis) in real-time at the database query layer, based on user permissions. DDM does not alter the underlying stored data; it transforms the result set on-the-fly for unauthorized users (like DBAs), ensuring they see masked values while authorized personnel see the actual data. This meets the requirement of preventing database administrators from viewing sensitive columns without changing the data at rest.

Answer

Static data masking

Answer

Encryption at rest

Answer

Tokenization

Question 4

A company has implemented a centralized logging solution for its cloud environment. The security team notices that logs from a critical application are missing for the past hour. What is the MOST likely cause?

Accepted Answer

The logging agent on the application server stopped working. The most likely cause of missing logs from a critical application for the past hour is that the logging agent on the application server stopped working, halting log forwarding. This is a common operational failure point and directly explains a sudden gap in logs from one source.

Answer

The log retention policy was set to 0 days

Answer

Log encryption was enabled causing a delay

Answer

The security team does not have read permission on the log bucket

Question 5

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 6

During a security incident in a multi-tenant cloud environment, the cloud provider's logging system indicates that a virtual machine (VM) on a shared hypervisor has been compromised. The provider wants to assist the customer with forensic analysis while minimizing impact to other tenants. Which approach is most appropriate?

Accepted Answer

Provide the customer with a memory snapshot of the compromised VM.. Providing a memory snapshot of the compromised VM preserves volatile forensic data (e.g., running processes, network connections, encryption keys) without disrupting the hypervisor or other tenants. This approach adheres to the cloud provider's responsibility to isolate forensic evidence while maintaining multi-tenant isolation, as memory snapshots can be taken via hypervisor-level APIs (e.g., VMware VMotion or libvirt) without powering off the VM or cloning the entire host. Option A is incorrect because rebuilding the VM from a known good image destroys the compromised state, overwriting volatile evidence that is critical for forensic analysis. Option C is incorrect because cloning the entire hypervisor introduces significant performance overhead and security risks to other tenants, potentially violating isolation boundaries. Option D is incorrect because powering off the VM immediately may cause loss of volatile memory data crucial for investigation, such as running processes and encryption keys.

Answer

Rebuild the VM from a known good image and then run security scans.

Answer

Clone the entire hypervisor and give the customer access to the clone.

Answer

Power off the VM immediately to contain the incident.

Question 7

A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?

Accepted Answer

allowPrivilegeEscalation: false. Setting `allowPrivilegeEscalation: false` in the pod's security context directly blocks any attempt by a container process to gain more privileges than its parent process, such as through setuid binaries or syscalls like `setuid()`. This satisfies the requirement to prevent privilege escalation within the container, aligning with the least privilege principle.

Answer

runAsNonRoot: true

Answer

capabilities: drop: ['ALL']

Answer

readOnlyRootFilesystem: true

Question 8

A cloud service provider (CSP) experiences a security incident affecting customer data. The contract requires notification within 72 hours, but the CSP fails to notify. What is the most likely legal consequence for the CSP?

Accepted Answer

Breach of contract and potential regulatory fines. The most likely legal consequence is breach of contract and potential regulatory fines. The contract explicitly requires notification within 72 hours, so failure to notify constitutes a breach. Additionally, depending on the data and jurisdiction, regulations like GDPR or CCPA may impose fines for late notification of data breaches.

Answer

Automatic termination of all customer contracts

Answer

Criminal liability for the CSP's executives

Answer

No consequence if the incident was not serious

Question 9

A cloud security team is evaluating DLP techniques to protect sensitive data in a cloud data warehouse. They want to replace sensitive values with realistic but fictitious data for non-production environments while preserving referential integrity. Which TWO de-identification techniques are suitable?

Accepted Answer

Pseudonymization. Pseudonymization (A) is correct because it replaces sensitive values with consistent artificial identifiers, so the same input always maps to the same pseudonym, which preserves referential integrity across tables and joins in non-production environments. Tokenization (D) is also correct because it substitutes sensitive data with non-sensitive tokens stored in a secure token vault, and the deterministic token-to-value mapping maintains referential integrity while providing realistic fictitious values. Bucketing (B) only generalizes values into ranges and does not produce realistic fictitious replacements or preserve exact referential links. Masking (C) typically obscures or redacts values, often irreversibly and without guaranteeing consistent cross-table substitution, so it does not reliably preserve referential integrity. Date shifting (E) only alters date values by a consistent offset and applies solely to date fields, not to general sensitive data replacement.

Answer

Bucketing

Answer

Masking

Answer

Date shifting

Question 10

A covered entity under HIPAA is moving electronic protected health information (ePHI) to a public cloud. What is the primary requirement before the cloud provider hosts ePHI?

Accepted Answer

The cloud provider must sign a Business Associate Agreement (BAA). Under HIPAA, a cloud provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a Business Associate, and the covered entity must have a signed Business Associate Agreement (BAA) in place before ePHI is hosted. The BAA contractually obligates the provider to safeguard ePHI and comply with applicable HIPAA Privacy and Security Rule provisions.

Answer

The cloud provider must be located within the United States

Answer

The cloud provider must be certified under ISO 27001

Answer

The covered entity must obtain written authorization from each patient

Question 11

The exhibit shows the versioning configuration for an S3 bucket. What effect does enabling MFADelete have on data protection?

Accepted Answer

It requires MFA to permanently delete an object version. Enabling MFADelete on an S3 bucket requires multi-factor authentication to permanently delete an object version or to suspend versioning on the bucket. This adds a critical layer of protection against accidental or malicious deletion of object versions, ensuring that even with administrative credentials, a second factor is needed to complete the destructive operation. It does not affect encryption, overwrite prevention, or all operations—only permanent deletion and versioning suspension.

Answer

It automatically encrypts all new object versions

Answer

It prevents any version of an object from being overwritten

Answer

It requires MFA for all operations on the bucket

Question 12

A customer requires complete control over encryption keys used to protect data at rest in the cloud. Which cloud service model provides the most direct control?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives customers control over the entire infrastructure stack, including encryption key management. PaaS and SaaS abstract away much of that control, limiting customer-managed key options.

Answer

Anything as a Service (XaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 13

An organization uses a cloud key management service (KMS) for encryption keys. The security policy requires automatic rotation of keys every 90 days. Which rotation strategy best balances security and operational impact?

Accepted Answer

Configure the KMS to automatically generate new key versions and retire old ones with no application changes.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.

Answer

Retain the original key for decryption and use a new key only for new data.

Answer

Have administrators manually create new keys every 90 days and update applications.

Answer

Re-encrypt all data with a new master key each rotation to ensure full key separation.

Question 14

A healthcare organization is migrating to AWS and must protect electronic protected health information (ePHI) stored in S3. They use AWS KMS with a custom key policy that restricts key usage to specific IAM roles. The compliance team discovers that some S3 objects are encrypted with AWS managed keys (SSE-S3) instead of the required SSE-KMS using the custom key. The security architect needs to ensure all future uploads use the customer-managed KMS key. After implementing a bucket policy that denies s3:PutObject if the required encryption is not present, the development team reports that their existing automation scripts fail with access denied errors. The scripts use the AWS SDK and do not explicitly set encryption headers. The security architect must find a solution that enforces encryption with the custom key while minimizing disruption. Which course of action BEST resolves the issue?

Accepted Answer

Modify the bucket policy to use a Deny effect with a condition on the s3:x-amz-server-side-encryption-aws-kms-key-id header being null, and also enable S3 default encryption with the custom KMS key so that objects uploaded without explicit headers are automatically encrypted with the correct key.. It combines a bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption-aws-kms-key-id header is null (ensuring the custom KMS key ID is explicitly provided) with S3 default encryption configured to use the same custom KMS key. This dual approach ensures that even if the SDK scripts do not set encryption headers, the default encryption will automatically apply the required KMS key, making the policy condition pass and avoiding access denied errors. The Deny condition on the null header forces explicit encryption headers when they are set, while default encryption handles the case where no headers are provided, thus enforcing compliance without breaking existing automation.

Answer

Implement AWS Config rules to detect non-compliant objects and automatically re-encrypt them with the correct key, while keeping the bucket policy unchanged.

Answer

Remove the bucket policy and rely solely on S3 default encryption with the custom KMS key, because default encryption applies to all objects.

Answer

Create a new S3 bucket with the required policy and migrate all data using AWS DataSync, then delete the old bucket.

Question 15

A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?

Accepted Answer

Private cloud. Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud