CCSP Practice Test 20 — 15 Questions

Question 1

A financial institution requires a cloud environment that is shared by multiple organizations with common regulatory compliance needs, such as PCI DSS. Which deployment model is most appropriate?

Accepted Answer

Community cloud. A community cloud is designed for organizations with shared concerns like compliance, security, or policy, and is more suitable than public or private cloud for this specific requirement.

Answer

Private cloud

Answer

Public cloud

Answer

Hybrid cloud

Question 2

A cloud security engineer is configuring network security for a multi-tier application in AWS. The web servers must be accessible from the internet on port 443, the application servers should only receive traffic from the web servers, and the database servers should only accept traffic from the application servers on port 3306. Which combination of security controls should be used?

Accepted Answer

Security groups with source referencing the web server security group for app tier, and app server security group for DB tier. Security groups are stateful and allow return traffic automatically. For inbound control, security groups with source references provide the required micro-segmentation.

Answer

NACLs on each subnet with rules referencing source IP ranges

Answer

A single NACL applied to all subnets with layer 7 filtering

Answer

Route tables with deny rules to restrict inter-subnet traffic

Question 3

A cloud security team is implementing VPC peering between two VPCs in the same region. Which statement about VPC peering is correct?

Accepted Answer

VPC peering enables private IP connectivity across VPCs without internet. VPC peering allows direct routing using private IP addresses, but it is not transitive: if VPC A peers with VPC B and VPC B peers with VPC C, traffic cannot flow from A to C via B.

Answer

VPC peering requires VPN gateways to establish connectivity

Answer

VPC peering automatically encrypts all traffic between VPCs

Answer

VPC peering supports transitive routing through intermediate VPCs

Question 4

Which API Gateway security feature limits the number of requests from a client to prevent abuse or DoS attacks?

Accepted Answer

Rate limiting. Rate limiting controls the request rate per client, protecting the backend from overload.

Answer

JWT validation

Answer

WAF integration

Answer

Mutual TLS

Question 5

A financial services company is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. They need to identify and classify data containing personally identifiable information (PII) such as credit card numbers and social security numbers. Which three capabilities should the DLP solution provide? (Choose three.)

Accepted Answer

Classification of data based on content. Cloud DLP solutions typically include discovery (scanning for sensitive data), classification (labeling data types), and de-identification transforms (masking, tokenization) to protect data.

Answer

Encryption at rest using AES-256

Answer

Blocking public access to buckets

Question 6

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

Accepted Answer

AWS WAF. AWS WAF (Web Application Firewall) integrates with API Gateway to filter and monitor HTTP requests for common web exploits. Security groups operate at the network layer, not application layer.

Answer

IAM policies

Answer

Security groups on the API Gateway

Answer

Network ACLs on the VPC

Question 7

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Accepted Answer

Set the container to run as a non-root user. Dropping all Linux capabilities and setting the container to run as a non-root user are effective. Running with a read-only root filesystem also helps, but the question asks for two measures: dropping capabilities and using a non-root user are the most direct.

Answer

Enable host networking mode

Answer

Use a privileged container

Answer

Mount the host filesystem as read-write

Question 8

A DevOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and prevent tampering?

Accepted Answer

Sign container images using Cosign. Image signing with Cosign ensures authenticity, attestation provides metadata about the build, and admission controller verification enforces policies before deployment.

Answer

Use the 'latest' tag for base images

Answer

Store images in a public registry

Question 9

A healthcare company stores patient records in a cloud storage bucket. They need to encrypt the data at rest using encryption keys that they manage themselves, but they want to generate the keys within the cloud provider's key management service. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys within the cloud provider's KMS, giving them control over key lifecycle without the operational overhead of generating keys externally.

Answer

Client-side encryption

Answer

Server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 10

A cloud architect is implementing data loss prevention (DLP) for a data lake containing PII. They want to automatically detect and transform sensitive data like Social Security numbers and medical record numbers. Which THREE actions should they take? (Choose three.)

Accepted Answer

Apply de-identification transforms such as masking or tokenization. Cloud DLP can scan data, apply de-identification transforms, and categorize data for further protection. These are core DLP capabilities.

Answer

Enable bucket versioning

Answer

Set up cross-region replication for durability

Question 11

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

Accepted Answer

Sign images using Cosign. Image signing, vulnerability scanning, and using immutable tags are key supply chain security practices. Using the 'latest' tag is risky, and running containers as root is insecure.

Answer

Always use the 'latest' tag for base images

Answer

Run containers with root privileges by default

Question 12

A cloud architect is designing a VPC for a three-tier application. The web servers need to be accessible from the internet, while the application servers should only be reachable from the web servers, and the database servers should be isolated from all other traffic except the application servers. Which VPC design best meets these requirements?

Accepted Answer

Web servers in a public subnet, app servers in a private subnet, databases in an isolated subnet with appropriate security groups. Public subnets for load balancers/web servers, private subnets for app servers, and isolated subnets (no direct route to internet) for databases provide the required isolation and access control.

Answer

Web servers in a public subnet, app and database servers in a single private subnet

Answer

All servers in a private subnet with a NAT gateway

Answer

All servers in a single public subnet with security groups

Question 13

In a Kubernetes cluster, a pod needs to access a cloud provider's key management service (KMS) to retrieve secrets. Which of the following RBAC configurations is the least privileged approach?

Accepted Answer

Create a Role in the pod's namespace that allows get on secrets and bind it to the pod's service account. The least privileged approach is to grant only the necessary API permissions to the service account used by the pod, not to users or namespaces unnecessarily.

Answer

Bind a ClusterRole with get and list on secrets to the pod's service account

Answer

Grant the pod's service account cluster-admin rights

Answer

Use a PodSecurityPolicy that allows privileged containers

Question 14

A multinational corporation must ensure that customer data from the European Union is stored and processed only within EU regions to comply with GDPR. They are using a cloud provider with data centers globally. What is the primary mechanism to enforce this requirement?

Accepted Answer

Selecting cloud regions located within the EU for all services. Cloud providers allow customers to select specific geographic regions for resource deployment, ensuring data residency compliance.

Answer

Client-side encryption with keys stored in the EU

Answer

Using a VPN to route all traffic through an EU gateway

Answer

Configuring IAM policies to restrict access to EU-based administrators

Question 15

A cloud security professional is designing network security for a VPC hosting a three-tier application. The database tier must be isolated from direct internet access and only accessible from the application tier. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Security Groups. Security Groups act as instance-level firewalls and can restrict traffic to the database tier from only the application tier. NACLs provide subnet-level stateless filtering as an additional layer.

Answer

VPC Peering

Answer

Internet-facing Application Load Balancer

Answer

Internet Gateway