CCSP Practice Test 20 — 15 Questions

Question 1

A financial services firm is designing a cloud environment that must comply with PCI DSS. The security architect proposes using a virtual private cloud (VPC) with subnets, security groups, and network ACLs. However, the compliance officer is concerned about the risk of data exposure due to misconfiguration. Which additional control would BEST address this concern?

Accepted Answer

Integrate Cloud Security Posture Management (CSPM). CSPM tools continuously monitor cloud infrastructure configurations against compliance frameworks like PCI DSS, automatically detecting misconfigurations such as overly permissive security group rules or network ACLs that could expose cardholder data. This directly addresses the compliance officer's concern about data exposure due to misconfiguration by providing real-time visibility and remediation guidance, which is more proactive than the other options.

Answer

Use a Web Application Firewall (WAF)

Answer

Implement a Security Information and Event Management (SIEM) system

Answer

Deploy Data Loss Prevention (DLP) tools

Question 2

A cloud architect is tasked with designing a disaster recovery plan for a critical application. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. The application runs on IaaS with data stored in a relational database. Which replication strategy is MOST cost-effective while meeting the objectives?

Accepted Answer

Asynchronous storage-level replication with 15-minute snapshots. Option D is correct because asynchronous storage-level replication with 15-minute snapshots meets the RPO of 15 minutes and the RTO of 1 hour, while being more cost-effective than synchronous replication. Asynchronous replication avoids the latency and bandwidth costs of synchronous mirroring across regions, and the 15-minute snapshot schedule ensures data loss is limited to the RPO window. This strategy is suitable for IaaS relational databases where near-real-time consistency is acceptable.

Answer

Daily full backups to another region

Answer

Synchronous database mirroring across regions

Answer

Multi-region active-active deployment with load balancing

Question 3

A cloud security team is implementing tokenization for a payment system. Which THREE statements correctly describe tokenization characteristics?

Accepted Answer

The original sensitive data is stored in a secure token vault.. Option B is correct because tokenization replaces sensitive data (e.g., credit card numbers) with a token, and the original data is stored securely in a token vault. This vault is isolated and access-controlled, ensuring that only authorized systems can detokenize the data when needed. The vault is the authoritative source for mapping tokens back to original values, which is fundamental to tokenization's security model.

Answer

Tokenization uses encryption algorithms to protect data.

Answer

Tokenization is reversible using the token alone.

Question 4

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

Accepted Answer

Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.. Option B is correct because VPCs with subnets and security groups provide native, software-defined network segmentation and stateful firewall rules that directly replicate on-premises network segmentation and ACLs. Security groups act as virtual firewalls at the instance level, while network ACLs provide subnet-level stateless filtering, together enabling granular control without extending the on-premises network.

Answer

Configure a site-to-site VPN between on-premises and cloud to extend the existing network.

Answer

Implement an intrusion detection and prevention system (IDPS) to monitor traffic.

Answer

Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.

Question 5

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

Accepted Answer

Enable automatic key rotation and configure detailed audit logging for the key management service.. Option A is correct because enabling automatic key rotation reduces the risk of key compromise by limiting the exposure window of any single key, while detailed audit logging for the key management service (e.g., AWS CloudTrail for KMS, Azure Monitor for Key Vault) provides an immutable record of all key usage and administrative actions. This combination ensures that even if a CMK is exposed, the window of vulnerability is minimized, and any unauthorized access or misuse is detectable through logs. Without these controls, the customer-managed key could remain static for long periods, increasing risk, and access events would not be auditable, violating the policy requirement.

Answer

Implement a VPN for all management traffic to the cloud provider's API.

Answer

Enable multi-factor authentication (MFA) for all cloud console users.

Answer

Use encryption in transit (TLS) for all data transfers to and from the cloud.

Question 6

A cloud security team is investigating a data breach in their AWS environment. The logs show that an EC2 instance with an attached IAM role was compromised. The attacker used the instance's temporary credentials to access an S3 bucket containing sensitive data. Which design change would BEST prevent this type of attack in the future?

Accepted Answer

Enable IMDSv2 with a hop limit of 1 on the EC2 instance.. Option B is correct because enabling IMDSv2 with a hop limit of 1 forces the EC2 instance to use a session-oriented method to retrieve temporary credentials from the Instance Metadata Service (IMDS). This prevents SSRF attacks or other techniques that trick the instance into leaking its IAM role credentials, as the attacker would need to be on the instance itself to obtain the token. By setting the hop limit to 1, the metadata response is not forwarded beyond the instance's network interface, blocking remote access to the credentials.

Answer

Implement a network ACL that denies all outbound traffic from the EC2 instance to the S3 service.

Answer

Restrict S3 bucket access to the EC2 instance's private IP address only.

Answer

Disable public access on the S3 bucket using a bucket policy.

Question 7

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Answer

GDPR

Answer

HIPAA

Answer

ISO 27001

Question 8

A healthcare organization is migrating sensitive patient data to a public cloud. The compliance team requires that data be encrypted at rest and in transit, and that the cloud provider cannot access the encryption keys. Which cloud service model should the organization use to maintain sole control over encryption keys?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS provides the customer with full control over the underlying infrastructure, including virtual machines, storage, and networking. This allows the organization to implement their own encryption mechanisms and manage their own keys using a Hardware Security Module (HSM) or a key management service (KMS) that the cloud provider cannot access. In contrast, SaaS and PaaS typically abstract away the infrastructure, limiting customer control over encryption key management.

Answer

Software as a Service (SaaS)

Answer

Hybrid Cloud

Answer

Platform as a Service (PaaS)

Question 9

A cloud architect is designing a multi-tier application in a public cloud. The web tier must be accessible from the internet, while the application and database tiers must only be reachable from the web tier. The architect needs to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which architecture BEST meets this requirement?

Accepted Answer

Place the web tier in a public subnet with a security group allowing HTTP/HTTPS from 0.0.0.0/0, and place the app and database tiers in private subnets with security groups allowing traffic only from the web tier's security group.. Option C is correct because it implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Answer

Place all tiers in the same subnet and use a single security group to control inbound traffic.

Answer

Place all tiers in the same VPC but different subnets, and use network ACLs to restrict traffic.

Answer

Use a VPN to connect the tiers and rely on IPsec policies for segmentation.

Question 10

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

Accepted Answer

To provide centralized protection against common web exploits before traffic reaches the microservices.. Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Answer

To reduce latency by caching responses at the API gateway.

Answer

To offload authentication from the microservices to the API gateway.

Answer

To monitor API usage and detect anomalies in traffic patterns.

Question 11

A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

Accepted Answer

It denies access to objects over HTTP, but allows HTTPS.. The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Answer

It allows all access to the bucket.

Answer

It denies access to objects over HTTPS, but allows HTTP.

Answer

It denies all access to the bucket.

Question 12

During a cloud migration, a company discovers that its existing virtual machine images contain embedded credentials and proprietary software that must not be exposed to the cloud provider's administrators. Which of the following is the BEST strategy to protect this sensitive data while maintaining the ability to create new instances?

Accepted Answer

Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.. Option C is correct because encrypting the virtual machine images with a customer-provided key (CMK) integrated with the cloud provider's key management service ensures that the cloud provider's administrators cannot access the embedded credentials and proprietary software. The encryption is performed client-side or using envelope encryption where the CMK wraps a data encryption key, and only the customer holds the master key material. This allows the customer to create new instances from the encrypted image while maintaining full control over access to the sensitive data.

Answer

Use a VPN to encrypt data in transit between the on-premises environment and the cloud.

Answer

Use a cryptographic hash of the image to ensure integrity, and store the image in object storage with access controls.

Answer

Tokenize the embedded credentials and replace them with placeholders in the image.

Question 13

A cloud architect is designing a disaster recovery (DR) plan for a financial services application hosted on a public cloud. The plan must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The application uses a relational database and stores files in object storage. Which TWO strategies should the architect recommend to meet these objectives?

Accepted Answer

Deploy a hot standby environment in a different availability zone with automated failover.. Option B is correct because a hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Answer

Take daily snapshots of the database and object storage.

Answer

Maintain a cold standby server that is provisioned only during a disaster.

Answer

Use asynchronous replication for the database to reduce latency.

Question 14

Which TWO of the following are valid methods to protect data at rest in a cloud environment?

Accepted Answer

Client-side encryption. Client-side encryption (A) is a valid method to protect data at rest because the data is encrypted by the client before being transmitted to the cloud provider. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, which remain under the customer's control. It is a strong approach for maintaining data confidentiality and compliance with regulatory requirements.

Answer

Data loss prevention (DLP) policies

Answer

Tokenization

Answer

Transport Layer Security (TLS)

Question 15

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

Accepted Answer

Man-in-the-middle (MITM) attacks between services. The primary risk of using self-signed certificates in a gRPC mutual TLS environment is that there is no trusted Certificate Authority (CA) to verify the identity of the communicating services. Without proper CA-signed certificates, an attacker can easily perform a man-in-the-middle (MITM) attack by presenting a forged self-signed certificate, intercepting and modifying gRPC traffic between microservices.

Answer

Inability to revoke certificates

Answer

Exposure of private keys in the container image

Answer

Increased latency due to certificate validation