CCSP Practice Exam 2 — 20 Questions

Question 1

A cloud security architect is designing a secure CI/CD pipeline for a containerized application deployed on a Kubernetes cluster. The pipeline must ensure that only approved images are deployed. Which TWO of the following controls should be implemented? (Choose two.)

Accepted Answer

Configure the Kubernetes admission controller to reject pods that use unsigned images.. Option B is correct because Kubernetes admission controllers can enforce policies such as rejecting pods that use unsigned images, ensuring only images with verified signatures are deployed. This directly addresses the requirement to deploy only approved images by validating image integrity at admission time.

Answer

Implement role-based access control (RBAC) to restrict who can push images to the registry.

Answer

Use network policies to restrict pod-to-pod communication.

Answer

Scan all container images for vulnerabilities in the CI pipeline.

Question 2

An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?

Accepted Answer

The bucket's ACLs grant PutObject permission to the authenticated user, which takes effect before the bucket policy is evaluated.. Option C is correct because S3 bucket policies and ACLs are evaluated independently, and if an ACL grants PutObject permission to the authenticated user, that permission is effective even if a bucket policy denies the same action based on a condition like 'aws:SecureTransport'. The AWS CLI request without HTTPS still succeeds because the ACL allows the upload before the bucket policy's Deny statement is evaluated, as S3 evaluates all access control mechanisms and grants access if any applicable policy allows it, unless an explicit Deny is present in the same policy evaluation context. However, the bucket policy's Deny statement does not override the ACL's Allow because the ACL is a separate authorization mechanism that is evaluated first, and S3's authorization model grants access if any of the policies (ACL, bucket policy, user policy) allow the action, provided there is no explicit Deny from the same source.

Answer

The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

Answer

The policy does not apply to requests made by the AWS root account user.

Answer

The bucket policy has a syntax error; the Allow and Deny statements cannot be combined in the same policy.

Question 3

A company's security team is investigating an anomalous spike in outbound traffic from a cloud workload. The workload is a web server running in an IaaS environment. The team suspects data exfiltration. Which of the following is the BEST initial step to identify the source and type of traffic?

Accepted Answer

Enable VPC flow logs for the subnet hosting the workload and analyze the logs.. Option D is correct because VPC flow logs capture metadata about all IP traffic to and from network interfaces in a subnet, including source/destination IPs, ports, protocols, and packet/byte counts. Analyzing these logs allows the security team to identify the external destination IPs and ports involved in the anomalous outbound traffic, which is the fastest way to pinpoint the source workload and characterize the exfiltration pattern without disrupting service or requiring agent deployment.

Answer

Immediately isolate the workload by blocking all outbound traffic in the security group.

Answer

Deploy a host-based intrusion detection system (HIDS) agent on the workload.

Answer

Run a vulnerability scanner against the workload to identify possible entry points.

Question 4

Refer to the exhibit. A cloud security analyst is reviewing an S3 bucket policy. The bucket contains sensitive data and must only be accessible over HTTPS from the internal network (10.0.0.0/24). Which of the following correctly describes the behavior of this policy?

Accepted Answer

Requests from 10.0.0.0/24 over HTTPS are allowed; all other requests are denied.. The policy uses an explicit Deny for any request that is not using HTTPS (i.e., aws:SecureTransport is false) or does not originate from the 10.0.0.0/24 IP range. This Deny overrides the Allow statement, ensuring that only requests meeting both conditions (source IP 10.0.0.0/24 AND HTTPS) are permitted. Requests from 10.0.0.0/24 over HTTPS satisfy the Allow and are not caught by the Deny, so they are allowed; all other requests are denied.

Answer

Requests from 10.0.0.0/24 over HTTP are allowed because the Allow statement matches.

Answer

The policy is invalid because it combines Allow and Deny statements.

Answer

All requests from 10.0.0.0/24 are denied because the Deny statement applies to all actions.

Question 5

A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?

Accepted Answer

Least privilege principle. The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.

Answer

Change management procedures

Answer

Encryption of data at rest

Answer

Physical access controls

Question 6

Drag and drop the steps for implementing a cloud data encryption strategy using a customer-managed key (CMK) in AWS KMS into the correct order.

Question 7

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Accepted Answer

Horizontal auto-scaling for the web tier and a fixed database tier. Option A is correct because it separates the stateless web tier, which can safely scale horizontally using auto-scaling groups triggered by CPU utilization thresholds, from the stateful database tier, which must remain fixed to avoid consistency issues such as split-brain or replication lag. Horizontal scaling adds or removes identical web server instances without affecting session state, while a fixed database tier preserves ACID properties and prevents conflicts from concurrent writes across multiple database nodes.

Answer

Manual scaling for both tiers

Answer

Vertical scaling of all tiers

Answer

Single-tier architecture with auto-scaling

Question 8

Drag and drop the steps for responding to a security incident involving a compromised cloud VM into the correct order.

Question 9

A healthcare organization stores patient records in a cloud-based object storage service. To comply with HIPAA, they must ensure that data is encrypted at rest and that encryption keys are managed by the organization itself. Which key management approach should they implement?

Accepted Answer

Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.. Option D is correct because HIPAA requires the organization to maintain control over encryption keys, and a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud allows the healthcare organization to generate, store, and manage their own keys externally while using them for cloud-based encryption. This approach ensures that the cloud provider cannot access the keys, meeting the regulatory requirement for key management by the organization itself.

Answer

Use server-side encryption with S3-managed keys (SSE-S3).

Answer

Use server-side encryption with AWS KMS-managed keys (SSE-KMS).

Answer

Use client-side encryption with customer-supplied encryption keys (CSEKS).

Question 10

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Question 11

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 12

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Option A is correct because under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 13

Drag and drop the steps for implementing a secure DevOps (DevSecOps) pipeline in a cloud environment into the correct order.

Question 14

Drag and drop the steps for setting up a virtual private cloud (VPC) with public and private subnets in AWS into the correct order.

Question 15

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 16

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.. A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.

Answer

Use shared API keys embedded in each service's configuration.

Answer

Implement TLS termination at the load balancer with internal certificates.

Answer

Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.

Question 17

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 18

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. Option A is correct because the bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 19

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.. AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Answer

Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Store the credentials as encrypted environment variables in the Lambda function configuration.

Answer

Hardcode the credentials in the Lambda function code and encrypt the deployment package.

Question 20

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)