CCSP Practice Exam 2 — 20 Questions

Question 1

A company is implementing a cloud key management system (KMS) to control encryption keys for sensitive data. Which practice is essential to ensure the security of the keys?

Accepted Answer

Periodically rotate the encryption keys.. Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Answer

Use a single key for all encryption operations to simplify management.

Answer

Export keys to the cloud provider's hardware security module (HSM).

Answer

Store encryption keys in the same region as the encrypted data.

Question 2

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 3

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 4

A security analyst reviews the bucket policy above. What is the primary security concern?

Accepted Answer

The bucket policy allows public read access to all objects. The bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.

Answer

The bucket policy uses an outdated version

Answer

The bucket policy is missing a Condition element

Answer

The bucket policy allows public write access to all objects

Question 5

During an eDiscovery process, a company needs to preserve data stored in AWS S3 that may be relevant to a lawsuit. Which AWS feature should be used to implement a legal hold?

Accepted Answer

S3 Object Lock. S3 Object Lock is the AWS feature designed to implement legal holds. It allows you to place a legal hold on an object version, preventing it from being overwritten or deleted for a specified period or indefinitely. This is specifically used for compliance and legal scenarios like eDiscovery.

Answer

AWS CloudTrail

Answer

S3 Versioning

Answer

AWS Config

Question 6

A company is subject to PCI DSS and plans to use a cloud provider to process credit card transactions. The cloud provider has been assessed by a Qualified Security Assessor (QSA). According to PCI DSS, what must the company obtain from the provider to demonstrate compliance?

Accepted Answer

The provider's PCI DSS Attestation of Compliance (AOC) and Responsibility Matrix. Under PCI DSS, when a customer uses a cloud provider to process cardholder data, the provider must be assessed by a QSA and issue an Attestation of Compliance (AOC) along with a Responsibility Matrix (also called a Shared Responsibility Matrix or PCI DSS Responsibility Matrix). The AOC documents the provider's validated compliance status, and the Responsibility Matrix defines which PCI DSS requirements are met by the provider versus the customer. Together they let the customer demonstrate its own compliance to its acquirer or QSA.

Answer

A signed Business Associate Agreement

Answer

An ISO 27001 certificate

Answer

A SOC 2 Type II report

Question 7

A healthcare organization has deployed a cloud-based application that handles protected health information (PHI). The application runs on virtual machines in a virtual private cloud (VPC). The security team has implemented security groups to control traffic to the VMs. Recently, an external penetration test revealed that a web server VM is accessible from the internet on port 22 (SSH) from any IP address (0.0.0.0/0). The security team also discovered that the SSH key pair used for the web server was created with a weak algorithm (1024-bit RSA). The team needs to remediate these issues without causing downtime for the application. Additionally, the application logs must be sent to a centralized logging solution that is encrypted in transit and at rest. Which combination of actions should the security team take?

Accepted Answer

Restrict inbound SSH access to only a bastion host's IP address, generate a new 2048-bit RSA key pair, configure the application to send logs via TLS to a centralized logging service, and enable server-side encryption for the logging bucket.. It addresses both critical vulnerabilities without downtime: restricting SSH to a bastion host's IP eliminates internet-wide exposure, and generating a new 2048-bit RSA key pair replaces the weak 1024-bit key. For logging, TLS ensures encryption in transit, and server-side encryption for the logging bucket ensures encryption at rest, meeting compliance requirements for PHI.

Answer

Implement a VPN connection for all administrative access, keep the existing key pair, and use a third-party logging tool with TLS.

Answer

Change the SSH port to a non-standard port, keep the existing key pair, and enable logging to a cloud storage bucket without encryption.

Answer

Disable SSH access entirely and use a serial console for administration, keep the existing key pair, and send logs via plaintext syslog to a logging server.

Question 8

A cloud security architect is designing an API gateway for a microservices application. The gateway must authenticate requests, enforce rate limiting, and log all transactions for audit. Which of the following security controls is most critical to protect against API abuse?

Accepted Answer

Implement rate limiting and throttling based on client identity and request volume.. Rate limiting and throttling directly prevent API abuse by limiting request frequency based on client identity and volume. Option B is incorrect because encryption protects data in transit but does not prevent abuse. Option C is incorrect because input validation prevents injection attacks but not volume-based abuse. Option D is incorrect because API keys authenticate clients but do not limit usage; rate limiting is required for abuse protection.

Answer

Use TLS 1.3 to encrypt all traffic between clients and the gateway.

Answer

Validate and sanitize all input parameters to prevent injection attacks.

Answer

Require API keys for all requests and revoke keys of suspicious clients.

Question 9

A DevSecOps team is implementing security scanning in the CI/CD pipeline for a cloud application. Which THREE tools or practices should be included to shift security left?

Accepted Answer

Infrastructure-as-Code (IaC) security scanning. Infrastructure-as-Code (IaC) security scanning (A) is correct because it detects misconfigurations in templates such as Terraform, CloudFormation, or Kubernetes manifests before deployment, catching issues like open security groups or unencrypted storage early in the pipeline. Static Application Security Testing (SAST) (B) is correct because it analyzes source code without executing it to find vulnerabilities such as SQL injection or hardcoded secrets during the build phase, which is the essence of shifting security left. Dependency scanning (E), for example with Snyk, is correct because it identifies known CVEs in third-party libraries and open-source packages before they reach production, a critical early-stage control in DevSecOps. Web Application Firewall (C) deployment is not included because a WAF is a runtime, perimeter defense that filters HTTP traffic in production rather than a shift-left pipeline practice. Runtime Application Self-Protection (D) is not included because RASP instruments the running application to detect and block attacks at execution time, which is a runtime control, not an early CI/CD scanning activity.

Answer

Web Application Firewall (WAF) deployment

Answer

Runtime Application Self-Protection (RASP)

Question 10

A cloud security architect is implementing a CI/CD pipeline for a containerized application on AWS. Which TWO practices should be integrated to enforce container image security?

Accepted Answer

Scan container images for vulnerabilities before push to registry. Option B is correct because scanning container images for vulnerabilities before pushing them to the registry (e.g., using Amazon ECR image scanning, Clair, or Trivy) catches known CVEs in OS packages and application dependencies at build time, preventing vulnerable images from ever entering the pipeline. Option D is correct because signing container images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) and verifying signatures at deploy time ensures image integrity and provenance, blocking tampered or unauthorized images from running. Option A is not appropriate here because RASP protects a running application from attacks at runtime and does not secure the image build/supply chain. Option C is not appropriate because a cloud WAF filters HTTP/S traffic to the application and does not inspect or validate container images. Option E is not appropriate because SAST analyzes source code for flaws, not the built container image and its layers.

Answer

Implement runtime application self-protection (RASP)

Answer

Use a cloud WAF to protect the containerized application

Answer

Run SAST on the application source code

Question 11

A global company uses a cloud provider that stores data in multiple jurisdictions. During an eDiscovery request from a US court, which three challenges are most likely to arise? (Choose three.)

Accepted Answer

Jurisdictional conflicts over which court has authority. Option A is correct because when data resides in multiple jurisdictions, US court orders can conflict with local data-protection or blocking statutes (e.g., GDPR or foreign blocking laws), creating disputes over which court or legal regime has authority over the data. Option C is correct because eDiscovery requires a legal hold to preserve potentially relevant data in place, and in multi-jurisdiction cloud environments this is complicated by distributed storage, automated lifecycle deletion, and differing retention rules that can alter or destroy evidence. Option D is correct because cloud tenants typically lack physical access to the provider's hardware, so forensically sound collection must rely on provider APIs, snapshots, and chain-of-custody documentation rather than direct disk imaging, which can be challenged in court. Option B is not correct because major cloud providers offer extensive encryption options (at rest, in transit, and customer-managed keys), so lack of encryption is not an inherent eDiscovery challenge. Option E is not correct because while cloud storage costs exist, excessive cost is not a legal or forensic challenge specific to cross-jurisdiction eDiscovery and is not among the primary issues courts focus on.

Answer

Lack of encryption options

Answer

Excessive cost of cloud storage

Question 12

Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 13

A financial services company stores customer transaction data in a cloud object storage bucket. The company requires that all data be encrypted at rest using keys that it generates and manages on-premises, with the cloud provider having no access to the keys. Which encryption approach should the company use?

Accepted Answer

Client-side encryption with customer-owned keys. Client-side encryption with customer-owned keys means the company encrypts data before uploading it to cloud storage, and the keys never leave the company's on-premises environment. The cloud provider stores only ciphertext and has no access to the plaintext or the keys, satisfying the requirement that the provider cannot access the keys.

Answer

Server-side encryption with AES-256

Answer

Server-side encryption with bring your own key (BYOK) to cloud KMS

Answer

Server-side encryption with customer-managed keys (CMK) in cloud KMS

Question 14

What is the primary purpose of a Data Processing Agreement (DPA) between a data controller and a cloud service provider?

Accepted Answer

To define roles and responsibilities for data processing. A Data Processing Agreement (DPA) is a legally binding contract required under regulations like GDPR. Its primary purpose is to define the roles and responsibilities of the data controller and the data processor (the cloud service provider), ensuring the processor acts only on the controller's documented instructions and meets compliance obligations. Without a DPA, the controller cannot legally transfer data to the processor, as the agreement establishes the lawful basis and accountability for processing activities.

Answer

To set data retention periods for processed data

Answer

To specify encryption algorithms to be used

Answer

To establish data backup and recovery procedures

Question 15

A company is migrating sensitive customer data to a public cloud storage service. They want to ensure that even the cloud provider cannot access the plaintext data. Which encryption strategy should they implement?

Accepted Answer

Client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Answer

Server-side encryption with cloud-provider-managed keys

Answer

Tokenization of sensitive fields at the application layer

Answer

Enforcing role-based access control (RBAC) on the storage bucket

Question 16

An organization wants to share a large file from a cloud storage bucket with an external partner for a limited time. They need to ensure that the partner can only access the specific file and that the access expires automatically. Which method should they use?

Accepted Answer

Use a pre-signed URL. A pre-signed URL provides temporary access to a specific object in a cloud storage bucket, with an expiration time. It grants the external partner permission to download the file without needing a cloud account, and access automatically expires. This meets the requirements of limited-time, specific-file access.

Answer

Make the bucket public

Answer

Create a new cloud provider user account for the partner and attach a custom policy to the bucket

Answer

Use cross-region replication

Question 17

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. Under the shared responsibility model, the cloud provider secures the infrastructure (data centers, hypervisors, network fabric), while the customer is responsible for controls over their own data, applications, and access. Logical access controls — user provisioning, authentication, authorization, and segregation of duties — are IT general controls that the financial institution must implement and evidence for SOX compliance, since they directly affect the integrity of financial reporting systems.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines

Question 18

A company is designing a data retention policy for cloud storage. Regulatory requirements mandate that certain records be kept for 7 years and then securely destroyed. Which combination of controls should be used?

Accepted Answer

Lifecycle policy and secure deletion. A lifecycle policy automates the transition and expiration of objects, allowing you to set a rule to delete objects after 7 years. Secure deletion (e.g., overwriting or cryptographic erasure) ensures the data is irrecoverable, meeting the regulatory requirement for secure destruction. Together, they provide a fully automated, auditable process for retention and destruction.

Answer

Data masking and encryption

Answer

Versioning and MFA delete

Answer

Lifecycle policy and object lock

Question 19

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware

Question 20

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

Accepted Answer

Deploy a Web Application Firewall (WAF) with a rule to block SQL injection patterns. A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Answer

Implement rate limiting on the API endpoint

Answer

Enable DDoS protection on the cloud load balancer

Answer

Enable transparent data encryption (TDE) on the database