CCSP Practice Test 19 — 15 Questions

Question 1

A company is implementing a DLP strategy to protect PII in cloud storage. They need to discover sensitive data and then apply de-identification transforms. Which THREE de-identification transforms are appropriate for anonymizing PII while maintaining data utility for analytics? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pseudonymisation. Masking, tokenization, and pseudonymisation are de-identification transforms that protect PII while preserving some utility. Masking obscures parts of data (e.g., showing only last four digits). Tokenization replaces with tokens that can be mapped back. Pseudonymisation replaces with consistent pseudonyms that are reversible with additional data. Bucketing groups values into ranges, which can be useful but may reduce utility. Encryption is not considered a de-identification transform in DLP context.

Answer

Encryption

Answer

Bucketing

Question 2

A company is migrating to a hybrid cloud and needs to ensure consistent security policies across both on-premises and cloud environments. Which of the following is the MOST critical consideration?

Accepted Answer

Ensuring that security policies are uniformly applied and enforced across all environments. Consistent security policy enforcement is key in hybrid cloud. While identity management and encryption are important, ensuring the same policies apply across environments is the most critical to avoid gaps.

Answer

Implementing single sign-on (SSO) for all users

Answer

Using dedicated private network connections

Answer

Choosing the same cloud provider for all public cloud workloads

Question 3

A security architect is designing a key management strategy for a cloud environment. They need to ensure that keys are rotated automatically and that the cloud service cannot access the key without explicit authorization. Which TWO options should they consider? (Choose two.)

Accepted Answer

Bring your own key (BYOK) with rotation configured in cloud KMS. Customer-managed keys (CMEK) allow the customer to control key lifecycle in cloud KMS, and BYOK enables importing keys from on-premises while still using cloud KMS for rotation.

Answer

Customer-supplied keys (CSEK) for each operation

Answer

Default server-side encryption using provider-managed keys

Answer

Hold your own key (HYOK) with on-premises HSM

Question 4

A company plans to deploy a multi-tier application across multiple cloud providers to avoid single points of failure. They need to ensure consistent security policies, including identity federation and network segmentation, across all environments. Which architecture consideration is MOST critical?

Accepted Answer

Implementing a unified security policy management tool. Consistent security policy across environments is critical in hybrid/multi-cloud.

Answer

Using a single cloud provider for all tiers

Answer

Storing all data in a single provider's data center

Answer

Using different encryption standards for each provider

Question 5

A cloud security analyst is reviewing access logs and notices that a pre-signed URL for an object was used after its expiration time. What should be the outcome of such an access attempt?

Accepted Answer

The request is denied with an access denied error. Pre-signed URLs are time-limited; once expired, the URL is invalid and access is denied.

Answer

The request is redirected to a new URL automatically

Answer

The request is allowed because the URL was generated with valid credentials

Answer

The request is logged but still granted

Question 6

A multinational corporation must comply with GDPR and local data residency laws. They are designing a cloud storage architecture that will store customer data in the EU region. However, to improve disaster recovery, they want to replicate data to a secondary region outside the EU. Which approach meets compliance requirements?

Accepted Answer

Use same-region replication within the EU and disable cross-region replication. To comply with data residency laws, data must stay within the EU. Replicating to a non-EU region violates GDPR. Instead, they should replicate to another EU region or use encryption with customer-managed keys and ensure the key is stored in the EU.

Answer

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Answer

Use cross-region replication to a US region and encrypt data with SSE-S3

Answer

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Question 7

An organization is evaluating a cloud provider's SLA for a critical application. The provider offers a 99.95% uptime SLA with a 10% service credit for each 30-minute downtime period exceeding the threshold. The organization's business impact analysis requires a maximum downtime of 4.38 hours per year. Does the provider's SLA meet this requirement, and what is the annual allowed downtime based on the SLA?

Accepted Answer

Yes, because the SLA guarantees 99.95% uptime, which equals 4.38 hours of downtime per year.. 99.95% uptime allows 0.05% downtime per year. 0.05% of 365 days * 24 hours = 0.05% * 8760 hours = 4.38 hours. Exactly meets the requirement. The service credit mechanism does not change the allowed downtime.

Answer

No, because service credits only apply after 30 minutes of downtime, so actual uptime is lower.

Answer

Yes, because the 10% credit effectively increases the uptime commitment.

Answer

No, because 99.95% uptime allows 5 hours of downtime per year.

Question 8

Which data classification level typically includes information that, if disclosed, could cause serious damage to an organization, such as trade secrets or personally identifiable information (PII)?

Accepted Answer

Restricted. Restricted data is the highest classification level, covering data that could cause severe damage if disclosed.

Answer

Internal

Answer

Confidential

Answer

Public

Question 9

Which audit report provides the most comprehensive assurance regarding a cloud provider's controls over a period of time, including controls related to security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports cover controls over a period of time and include the five trust service criteria. SOC 2 Type I is a point-in-time report. ISO 27001 is a certification, not a report. CSA STAR is a self-assessment.

Answer

ISO 27001 certification

Answer

SOC 2 Type I

Answer

CSA STAR self-assessment

Question 10

An organization uses a cloud-based data analytics platform with data stored in a data warehouse. The security team discovers that some tables contain unencrypted personally identifiable information (PII). They need to automatically scan the data warehouse for PII and apply pseudonymization to protect sensitive columns. Which cloud service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP (Data Loss Prevention) APIs can scan data stores like BigQuery for sensitive data types (PII, credit card numbers, etc.) and apply de-identification transforms such as pseudonymization, masking, tokenization, etc. This is the intended service for automated discovery and protection.

Answer

Cloud Storage bucket policies

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Key Management Service (KMS)

Question 11

An organization is migrating a legacy application to the cloud and requires reversibility. Which THREE of the following should be considered to ensure the application can be migrated away from the cloud provider in the future?

Accepted Answer

Using containerization with Kubernetes for workload portability. Reversibility involves using open standards and APIs, ensuring data portability, and avoiding deep integration with proprietary services. Auto-scaling is a benefit but not a requirement for reversibility.

Answer

Using proprietary APIs for storage and compute

Answer

Implementing auto-scaling policies

Question 12

A cloud security architect is designing a key management strategy for a hybrid cloud environment. The organization requires that encryption keys never leave their on-premises hardware security module (HSM) due to strict regulatory mandates, yet cloud services must be able to perform encryption operations on data at rest. Which key management approach meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) keeps the key in the customer's on-prem HSM; the cloud service sends data to be encrypted/decrypted on-prem, which can introduce latency but satisfies key location constraints.

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud provider default encryption

Answer

Bring Your Own Key (BYOK)

Question 13

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 14

A data classification scheme for a cloud environment defines labels such as Public, Internal, Confidential, and Restricted. Which label should be applied to data that, if disclosed, would cause severe damage to the organization and is subject to regulatory fines?

Accepted Answer

Restricted. Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Answer

Public

Answer

Confidential

Answer

Internal

Question 15

A cloud architect is designing a data classification scheme for a SaaS provider. The provider handles customer data that includes public marketing materials, internal policies, and sensitive customer financial records. Which classification level should be assigned to customer financial records to enforce the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification level, typically used for data that requires the most stringent controls, such as financial records or PII. Public is least sensitive, internal is for company-internal data, confidential is for sensitive but not critical data.

Answer

Internal

Answer

Public

Answer

Confidential