CCSP Practice Exam 2 — 20 Questions

Question 1

A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CPU Pinning. CPU Pinning (option A) ensures VM isolation at the hardware level by dedicating specific physical CPU cores exclusively to a particular VM. This prevents other VMs from scheduling on those cores, eliminating CPU-level side-channel attacks and resource contention. It is a hardware-enforced isolation mechanism because the hypervisor uses the CPU's hardware virtualization extensions (e.g., Intel VT-x or AMD-V) to enforce the pinning, ensuring that one tenant's VM cannot access another's CPU resources.

Answer

Hypervisor Introspection

Answer

Security Groups

Answer

Network ACLs

Question 2

A cloud security architect is implementing a CI/CD pipeline for a containerized application on AWS. Which TWO practices should be integrated to enforce container image security?

Accepted Answer

Scan container images for vulnerabilities before push to registry. Scanning container images for vulnerabilities before pushing them to a registry is a critical shift-left security practice. It ensures that known Common Vulnerabilities and Exposures (CVEs) in base images or application dependencies are detected and remediated early in the CI/CD pipeline, preventing insecure images from being deployed. Tools like Trivy, Clair, or AWS ECR image scanning integrate directly into the pipeline to enforce this policy.

Answer

Implement runtime application self-protection (RASP)

Answer

Use a cloud WAF to protect the containerized application

Answer

Run SAST on the application source code

Question 3

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 4

A company uses a cloud KMS with HSM-backed keys for regulatory compliance. They need to allow a cloud service to use a key for encryption while retaining the ability to revoke access at any time. Which TWO key management models satisfy this? (Choose two.)

Accepted Answer

Bring your own key (BYOK). BYOK is correct because it allows the customer to import their own key material into the cloud KMS, which is backed by an HSM, and the customer retains full control over the key's lifecycle, including the ability to revoke access at any time by disabling or deleting the key. CMEK is correct because it gives the customer direct management of the key (e.g., rotation, disabling, deletion) within the cloud KMS, while the HSM provides hardware-level protection, and the customer can revoke the cloud service's access by modifying key permissions or disabling the key.

Answer

Hold your own key (HYOK)

Answer

Customer-supplied keys (CSEK)

Answer

Cloud provider-managed keys

Question 5

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

Accepted Answer

Sub-processor authorization. GDPR requires that data controllers obtain prior authorization before a processor engages a sub-processor. The customer (controller) was not notified, violating the requirement for sub-processor authorization. Other rights like erasure are unrelated to this scenario.

Answer

Data protection by design

Answer

Data breach notification

Answer

Right to erasure

Question 6

An enterprise uses a cloud access security broker (CASB) to protect data in cloud applications. They want to prevent users from uploading files containing credit card numbers to a cloud storage service. Which CASB feature should be configured?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies are the correct CASB feature because they allow the enterprise to define content inspection rules that scan files for sensitive data patterns, such as credit card numbers (matching Luhn algorithm or regex patterns like those in PCI DSS). When a match is detected, the CASB can block the upload, quarantine the file, or trigger an alert, directly preventing data exfiltration to the cloud storage service.

Answer

Encryption in transit settings

Answer

User activity monitoring

Answer

Single sign-on (SSO) integration

Question 7

An organization wants to ensure that its CSP does not access customer data for any purpose other than providing the service. Which clause should be included?

Accepted Answer

Data use restriction. A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

Answer

Right to audit

Answer

Security incident response

Answer

Non-disclosure agreement

Question 8

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 9

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 10

An organization uses a private artifact registry for approved package sources. A developer accidentally publishes a package with a similar name to an internal package to the public registry. This could lead to which type of attack?

Accepted Answer

Dependency confusion. Dependency confusion occurs when a package manager (e.g., npm, pip, Maven) resolves a package name to a public registry instead of a private one, because the public registry has a package with the same or similar name. In this scenario, the developer accidentally published a package with a similar name to the public registry, so internal builds may fetch that malicious public package instead of the intended internal one, leading to arbitrary code execution in the build pipeline.

Answer

Cross-site request forgery (CSRF)

Answer

Denial of service (DoS)

Answer

Man-in-the-middle (MITM)

Question 11

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Accepted Answer

One month. GDPR requires the controller to respond to data subject requests without undue delay and in any event within one month of receipt.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 12

A company's cloud security policy mandates strict control over encryption keys used for data at rest. Which THREE practices are recommended for secure key management in the cloud?

Accepted Answer

Rotate encryption keys on a regular schedule.. Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Answer

Use a single master key for all encryption operations.

Answer

Store keys in the same cloud region as the data to reduce latency.

Question 13

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

Accepted Answer

HTTP-only cookies with Secure and SameSite flags. HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Answer

sessionStorage

Answer

URL query parameters

Answer

localStorage

Question 14

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users

Question 15

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 16

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 17

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 18

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

Accepted Answer

The policy allows anonymous read access to all objects in the bucket. The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.

Answer

The policy does not restrict access to specific IP addresses

Answer

Any unencrypted request is denied, which could cause data loss if encryption fails

Answer

The policy requires server-side encryption, but does not enforce it for all requests

Question 19

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 20

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. The correct best practices are A (using separate keys per tenant/application) and D (regular key rotation). Option B (hard-coding keys) is a security risk. Option C (storing keys in the same region) is not a security best practice. Option E (single master key) defeats the purpose of encryption key separation.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.