CCSP Practice Test 20 — 15 Questions

Question 1

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Accepted Answer

CreateAccessKey. The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.

Answer

DeleteAccessKey

Answer

CreateUser

Answer

UpdateAccessKey

Question 2

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a security platform specifically designed to detect secrets such as API keys, passwords, and tokens in source code repositories, including historical commits. It integrates with version control systems and CI/CD pipelines to scan for hardcoded credentials, making it the correct tool for this scenario.

Answer

tfsec

Answer

Checkov

Answer

Snyk

Question 3

A company is required to retain logs for 7 years per regulation. The cloud provider's default retention is 90 days. What is the most effective approach?

Accepted Answer

Export logs to an external storage with a 7-year retention policy. The customer is responsible for compliance. Configuring log export to an external storage with 7-year retention ensures data is preserved. Relying on provider's default violates regulation, disabling retention breaks compliance, and encryption doesn't affect retention duration.

Answer

Disable log retention completely to avoid risk

Answer

Rely on the provider's default retention

Answer

Encrypt logs and store them in the same provider

Question 4

A cloud architect is designing a data classification scheme for a SaaS application. Data must be classified based on sensitivity and regulatory requirements. Which of the following is the PRIMARY reason to classify data?

Accepted Answer

To apply appropriate security controls based on data sensitivity. The primary reason to classify data in a cloud environment is to enable the application of appropriate security controls based on data sensitivity. Classification drives the selection of encryption standards, access control policies, and data loss prevention (DLP) rules, ensuring that sensitive data receives stronger protection while lower-sensitivity data is handled with less restrictive measures. Without classification, security controls would be applied uniformly, leading to either over-protection of trivial data or under-protection of critical data.

Answer

To reduce storage costs by identifying obsolete data

Answer

To comply with a specific data protection regulation

Answer

To improve data access speeds for high-priority data

Question 5

A cloud security architect is designing a DevSecOps pipeline for a multi-cloud environment. Which THREE practices should be included to ensure security is integrated early? (Select THREE)

Accepted Answer

Scanning dependencies for known vulnerabilities in the CI pipeline. Option A is correct because scanning dependencies for known vulnerabilities in the CI pipeline (e.g., with SCA tools like Dependabot, Snyk, or OWASP Dependency-Check) shifts detection of vulnerable third-party libraries to the earliest build stage, before artifacts are promoted. Option D is correct because IaC security scanning on Terraform templates (e.g., with Checkov, tfsec, or Terrascan) catches misconfigurations such as public S3 buckets or overly permissive security groups before any infrastructure is provisioned. Option E is correct because performing SAST scans in the IDE or during pull requests (e.g., with SonarQube, Semgrep, or CodeQL) gives developers immediate feedback on insecure code patterns at the point of authorship, which is the earliest possible integration point. Option B does not belong because scanning container images only after production deployment is a reactive, post-deployment control rather than an early-shift-left practice. Option C does not belong because DAST against production is a late-stage, runtime test that exercises a live environment and cannot prevent defects from reaching production.

Answer

Scanning container images after they are deployed to production

Answer

Running DAST against the production environment

Question 6

A company is migrating a legacy application to the cloud. The application uses hardcoded database credentials. Which secure development practice should be implemented to address this?

Accepted Answer

Use a secrets management service. Hardcoded database credentials in application code create a severe security risk because they are exposed in version control, logs, and static analysis. Using a secrets management service (e.g., AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) allows credentials to be stored securely, rotated automatically, and accessed at runtime via API calls, eliminating the need to embed secrets in code. This aligns with the principle of least privilege and secure credential management in cloud application security.

Answer

Use code signing for all deployments

Answer

Implement input validation on all user inputs

Answer

Enable encryption at rest for the database

Question 7

Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)

Accepted Answer

Implement rate limiting. Rate limiting is a critical best practice for securing cloud application APIs because it prevents abuse by limiting the number of requests a client can make within a specific time window. This mitigates brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion. By enforcing rate limits, the API maintains availability and protects backend services from being overwhelmed.

Answer

Disable HTTPS to reduce latency

Answer

Return detailed error messages for debugging

Answer

Allow all origins with CORS

Question 8

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Accepted Answer

Automated security scanning with failure conditions. Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.

Answer

Run penetration testing after release

Answer

Dependency scanning only on weekly basis

Answer

Manual code review after deployment

Question 9

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Accepted Answer

Certificate of destruction. A Certificate of Destruction (CoD) is a formal, signed document from the cloud provider that attests to the secure deletion or sanitization of the customer's data at the end of its lifecycle. It provides verifiable evidence that the deletion process occurred as specified, which is critical for compliance with regulations like GDPR, HIPAA, and PCI DSS. Without such a certificate, the company has no independent proof that data was actually destroyed, making it impossible to demonstrate due diligence to auditors or regulators.

Answer

Service level credits

Answer

Annual penetration testing

Answer

Right to audit

Question 10

A cloud security operations team is evaluating SIEM solutions. They need to minimize false positives while ensuring critical security events are not missed. Which of the following is the MOST effective technique to achieve this balance?

Accepted Answer

Implement context-aware correlation and tune rules based on feedback loops. Context-aware correlation leverages environmental context (e.g., asset value, user behavior) to reduce false positives while maintaining sensitivity. Feedback loops allow continuous tuning based on actual incidents. Option B is incorrect because aggregating all events into a single rule increases noise and makes analysis difficult. Option C is incorrect because increasing thresholds may cause true positives to be missed. Option D is incorrect because signature-based detection alone cannot detect novel attacks and may miss critical events.

Answer

Aggregate all security events into a single correlation rule

Answer

Increase the alert threshold for all event types to reduce noise

Answer

Rely exclusively on signature-based detection

Question 11

An incident response playbook for a cloud environment includes containment steps. For a compromised IAM user in AWS, which action is least likely to be effective for containment?

Accepted Answer

Change the IAM user's password. Changing the IAM user's password does not invalidate existing authenticated sessions or tokens (such as temporary credentials from STS or access keys). An attacker who has already established a session or obtained access keys can continue to use them until they expire or are explicitly revoked. Therefore, password change alone is ineffective for immediate containment.

Answer

Disable the IAM user

Answer

Attach a DenyAll policy to the user

Answer

Disable the IAM user's access keys

Question 12

A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies. A service mesh with mutual TLS (mTLS) provides both encryption and identity-based authorization for inter-service communication. mTLS ensures that each service presents a valid certificate, proving its identity, and the mesh's control plane enforces fine-grained access policies (e.g., which services can call which endpoints). This directly meets the requirement for authorized, encrypted communication in a cloud-native microservices architecture.

Answer

Use network security groups to restrict traffic between service subnets

Answer

Connect services using VPC peering and enable encryption in transit

Answer

Deploy an API gateway and route all internal traffic through it

Question 13

In a public cloud IaaS model, which of the following security controls is the cloud customer primarily responsible for implementing?

Accepted Answer

Guest OS patch management. The customer is responsible for securing the guest OS and applications.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of data centers

Question 14

When evaluating a cloud service provider's SLA, which TWO metrics are MOST relevant for assessing availability and reliability?

Accepted Answer

Uptime percentage (e.g., 99.99%). Uptime is the primary SLA metric that quantifies availability, directly expressing the percentage of time the service is operational and typically tied to service credits when the committed threshold is missed. Option E (Recovery Time Objective (RTO) and Recovery Point Objective (RPO)) is correct because these metrics define reliability in terms of how quickly service is restored after an outage (RTO) and how much data loss is tolerable (RPO), which are core to assessing a provider's resilience and disaster recovery commitments. Option B (Support ticket response time) relates to support quality and incident handling, not directly to availability or reliability guarantees. Option C (Maximum throughput per instance) is a performance/capacity metric rather than an availability or reliability measure. Option D (Average latency for API calls) is a performance metric that affects responsiveness but does not by itself indicate availability or reliability.

Answer

Support ticket response time

Answer

Maximum throughput per instance

Answer

Average latency for API calls

Question 15

An organization is migrating a legacy application to the cloud and wants to maximize elasticity. Which THREE characteristics should the application support to benefit from cloud elasticity?

Accepted Answer

Distributed architecture. Option A (Distributed architecture) is correct because spreading workloads across multiple independent components or nodes lets the cloud platform add or remove capacity in parallel, which is essential for elastic scaling. Option C (Horizontal scaling support) is correct because elasticity is achieved primarily by adding or removing instances (scale out/in), so the application must be designed to run across multiple identical instances. Option D (Stateless design) is correct because stateless components do not hold session or local state, allowing any instance to handle any request and enabling instances to be created or destroyed freely during elastic scaling. Option B (Monolithic architecture) is not correct because a single tightly coupled deployment unit cannot be scaled or updated granularly, limiting elasticity. Option E (Vertical scaling capability) is not correct because vertical scaling means resizing a single server (scale up/down), which is constrained by hardware limits and does not provide the rapid, automated elasticity that horizontal scaling delivers.

Answer

Monolithic architecture

Answer

Vertical scaling capability