CCSP Practice Test 2 — 10 Questions

Question 1

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The employee's credentials were stolen via a phishing attack. The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 2

A company's cloud security policy mandates strict control over encryption keys used for data at rest. Which THREE practices are recommended for secure key management in the cloud?

Accepted Answer

Rotate encryption keys on a regular schedule.. Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Answer

Use a single master key for all encryption operations.

Answer

Store keys in the same cloud region as the data to reduce latency.

Question 3

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 4

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 5

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 6

Which THREE of the following are essential steps in a cloud data discovery process?

Accepted Answer

Map data flows between systems. Mapping data flows between systems is a foundational step in cloud data discovery. It enables organizations to understand how data moves across cloud services, APIs, and storage tiers, which is critical for identifying where sensitive data may be transmitted or stored. Without this mapping, discovery efforts may miss data in transit or in transient storage, leading to incomplete visibility.

Answer

Encrypt all discovered data

Answer

Create backup copies of data

Question 7

A security team is deploying a Kubernetes cluster on a cloud platform and wants to harden the worker nodes against container breakout and privilege escalation. They are reviewing kubelet and container runtime configurations. Which TWO of the following measures are MOST effective at reducing the attack surface and preventing a compromised container from gaining node-level privileges? (Choose two.)

Accepted Answer

Run containers with a read-only root filesystem and drop all Linux capabilities except those explicitly required.. Hardening worker nodes against container breakout requires preventive controls that limit what a compromised container can do. Running with a read-only root filesystem and dropping unnecessary Linux capabilities removes the tools and privileges needed for escalation. Enforcing the restricted Pod Security Standard via Pod Security Admission ensures workloads cannot run as root, cannot escalate privileges, and must meet seccomp and capability restrictions. Together these measures significantly reduce the attack surface and block common escape techniques.

Answer

Enable the kubelet read-only port and disable anonymous authentication to the kubelet API.

Answer

Configure the container runtime to use the overlay2 storage driver with a dedicated volume for each container.

Answer

Enable audit logging on the Kubernetes API server and ship logs to a central SIEM for alerting.

Question 8

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 9

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Accepted Answer

API keys in URLs are often logged in plaintext in server logs and browser history.. The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Answer

API keys in query strings are not encrypted, even with HTTPS.

Answer

API keys provide weak authentication because they are not tied to a user session.

Answer

API keys are not valid for use in query strings; they require a certificate.

Question 10

A company uses a cloud provider's managed database service. The security team is concerned about the shared responsibility model for patching the operating system and database engine. According to the shared responsibility model, who is responsible for applying security patches to the database engine?

Accepted Answer

The cloud provider, because it is a managed service. In the cloud shared responsibility model, for a managed database service (such as Amazon RDS or Azure SQL Database), the cloud provider is responsible for patching the underlying operating system and the database engine. The customer is responsible for data, access management, and configuration within the database, but not for engine patching. Therefore the cloud provider applies security patches to the database engine (option C).

Answer

The customer, because they control the database configuration

Answer

A third-party vendor contracted by the customer

Answer

Both the customer and the cloud provider equally