CCSP Practice Exam 1 — 20 Questions

Question 1

A company receives an erasure request under GDPR. The cloud provider can delete from active storage within 24 hours but requires 90 days to delete from archives. The company has a contractual obligation to ensure deletion within 30 days. What should the company do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request the provider to delete from archives within 30 days and verify.. The company has a contractual obligation to ensure deletion within 30 days, which overrides the provider's default 90-day archive retention policy. The company must formally request the provider to expedite the deletion from archives and verify compliance, as GDPR Article 17 requires the controller to ensure erasure without undue delay, and the provider as processor must assist. Relying on the provider's standard timeline without action would breach the contract and GDPR accountability requirements.

Answer

Delete the data from the application layer only and rely on provider for archives.

Answer

Accept the 90-day timeline and inform the data subject accordingly.

Answer

Reject the request as impractical.

Question 2

Which TWO of the following are valid considerations when performing forensic imaging of virtual machines in a public cloud? (Choose two.)

Accepted Answer

Time synchronization between the imaging tool and the VM clock is essential. Options A and E are correct. A: Time synchronization is essential for forensic timeline analysis. E: Volatile data (e.g., RAM contents) is lost when the VM is powered off, so imaging should be performed while the VM is running. B is incorrect because the imaging tool does not need to reside in the same cloud region. C is incorrect because hypervisor-level isolation prevents accessing other tenants' VMs. D is incorrect because cloud providers typically do not provide hypervisor memory dumps upon request.

Answer

The imaging process must be performed from within the same cloud region

Answer

Images of other tenants' VMs can be accessed through the hypervisor if needed

Answer

The cloud provider will provide hypervisor memory dumps upon request

Question 3

A multinational corporation operates in a country where data sovereignty laws require that all customer data remain within the country's borders. The company uses a global public cloud provider. Which operational control is MOST critical to ensure compliance?

Accepted Answer

Implement cloud policy to restrict resource deployment to approved regions.. Implementing a cloud policy to restrict resource deployment to approved regions is the most direct and proactive operational control to enforce data sovereignty. By using Azure Policy, AWS Service Control Policies (SCPs), or GCP Organization Policies, the organization can programmatically prevent resources from being provisioned in non-compliant regions, ensuring customer data never leaves the required jurisdiction. This is a preventive control that operates at the infrastructure level, unlike detective or reactive measures.

Answer

Use a VPN to connect to the cloud provider's network.

Answer

Conduct quarterly audits of data storage locations.

Answer

Encrypt all data at rest and in transit.

Question 4

A cloud customer wants to ensure that their data is encrypted during transmission between their on-premises data center and the cloud provider's service. Which protocol should they use?

Accepted Answer

Transport Layer Security (TLS) 1.2. TLS 1.2 is the correct choice because it is specifically designed to secure data in transit over networks, such as between an on-premises data center and a cloud provider. It operates at the transport layer, providing encryption, authentication, and integrity for HTTP-based traffic (HTTPS), which is the most common method for cloud API interactions. IPSec, while also a valid encryption protocol, is typically used for site-to-site VPN tunnels at the network layer, not for securing individual service-to-service transmissions like those to a cloud provider's REST API.

Answer

Internet Protocol Security (IPSec)

Answer

Secure Shell (SSH)

Answer

Remote Desktop Protocol (RDP)

Question 5

An organization wants to prevent secrets from being exposed in source code. Which two practices should they adopt? (Choose TWO.)

Accepted Answer

Implement secret scanning in the CI/CD pipeline. Using a secrets manager (like AWS Secrets Manager or Vault) avoids hardcoding credentials. Scanning for secrets in code repositories (e.g., GitGuardian) helps detect and remove any secrets that might have been committed.

Answer

Encrypt all source code files

Answer

Use a firewall to block access to code repositories

Answer

Disable git history

Question 6

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

Accepted Answer

Use a combination of input validation, output encoding, and Content Security Policy.. Cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

Answer

Encode all output that is rendered in HTML.

Answer

Implement a Content Security Policy (CSP) as the sole defense.

Answer

Validate all user input on the server side.

Question 7

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 8

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 9

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 10

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

Accepted Answer

Deploy a virtual firewall between tiers.. Deploying a virtual firewall between tiers (e.g., between web, application, and database tiers) enforces micro-segmentation by inspecting and controlling east-west traffic at the application layer. This allows granular, stateful filtering of traffic based on specific protocols, ports, and even application-level attributes, preventing lateral movement of threats within the cloud environment.

Answer

Allow all traffic from the internet.

Answer

Use a bastion host for all administrative access.

Answer

Use a single network ACL for all subnets.

Question 11

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 12

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Running containers with a non-root user is a fundamental security best practice because it limits the potential damage from a container breakout. By default, Docker containers run as root, which means if an attacker compromises the container, they have root privileges on the host kernel. Using the USER directive in a Dockerfile or specifying a non-root user at runtime reduces the attack surface and enforces the principle of least privilege.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.

Question 13

A medium-sized e-commerce company uses a cloud provider's container orchestration service (e.g., Amazon ECS or Google Kubernetes Engine). They have a security requirement to ensure that all containers run with the least privilege principle. The development team often requests containers to run as root for debugging purposes. The security team wants to enforce a policy that prevents containers from running as root in the production environment. However, the development team still needs the ability to troubleshoot occasionally. The cloud security architect must design a solution that restricts root privilege in production but allows controlled troubleshooting. Which of the following approaches is the most effective?

Accepted Answer

Use a security context constraint (or PodSecurityPolicy) to deny all containers running as root, and require developers to use a sidecar container for debugging.. It uses a security context constraint (SCC) or PodSecurityPolicy (PSP) to enforce a deny-all policy for root containers in production, which aligns with the least privilege principle. The sidecar container provides a controlled debugging mechanism without granting root access to the main application container, allowing developers to troubleshoot via a separate, privileged sidecar that can be audited and restricted.

Answer

Allow containers to run as root but configure host-based intrusion detection to alert on suspicious activities.

Answer

Grant developers SSH access to the host nodes for troubleshooting.

Answer

Create two separate clusters, one for production with root restriction, and one for debugging where root is allowed.

Question 14

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

Accepted Answer

OAuth 2.0 with client credentials. OAuth 2.0 with the client credentials grant is the most appropriate mechanism for machine-to-machine API access because it allows the API to authenticate the third-party application itself (the client) using a client ID and client secret, without involving end-user credentials. This grant type is specifically designed for server-to-server integrations where the client is acting on its own behalf, providing a secure, token-based approach that avoids sharing long-lived secrets directly with each API call.

Answer

Basic authentication with API keys

Answer

SAML 2.0

Answer

X.509 certificates

Question 15

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault provides a cloud-agnostic secrets management service with automated rotation and cross-cloud capabilities. AWS Secrets Manager is AWS-specific. Azure Key Vault is Azure-specific. Encrypted environment variables are not easily rotated and require redeployment.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 16

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

Accepted Answer

Implement a software composition analysis (SCA) tool in the pipeline. A Software Composition Analysis (SCA) tool is specifically designed to automatically scan open-source libraries for known vulnerabilities, licensing issues, and version compliance. By integrating SCA into the CI/CD pipeline, the team can enforce a policy that only approved libraries (e.g., those passing a security and license review) are allowed in production builds, blocking unapproved or vulnerable components before deployment.

Answer

Segment the build network to limit internet access

Answer

Perform static code analysis after each build

Answer

Require manual approval for all library updates

Question 17

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring IAM policies to control access to their data. The provider is responsible for the infrastructure that enforces the policy. Both are not equally responsible for the policy content. The auditor is not responsible for configuration.

Answer

The third-party auditor

Answer

Both equally

Answer

The cloud provider

Question 18

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated. Consent is not generally practical for all data subjects.

Answer

Consent from all data subjects

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield

Question 19

A company uses a cloud provider's managed database service. The security team is concerned about the shared responsibility model for patching the operating system and database engine. According to the shared responsibility model, who is responsible for applying security patches to the database engine?

Accepted Answer

The cloud provider, because it is a managed service. For managed services, the cloud provider is responsible for patching the underlying database engine. Option A is wrong because the customer is responsible for the data and access, not the engine. Option B is wrong because both parties do not share this responsibility. Option D is wrong because the database engine is part of the service.

Answer

The customer, because they control the database configuration

Answer

A third-party vendor contracted by the customer

Answer

Both the customer and the cloud provider equally

Question 20

Which TWO of the following are key elements of a cloud service agreement (CSA) for legal compliance?

Accepted Answer

Audit rights. Data processing terms (DPA) and audit rights are standard CSA elements addressing legal compliance. Encryption key management and portability are more about security and operations, but not always considered 'key legal compliance' elements.

Answer

Encryption key management

Answer

Data portability tools

Answer

Service level agreements (SLA) uptime guarantee