CCSP Practice Test 21 — 15 Questions

Question 1

In a cloud VPC, what is the difference between security groups and network ACLs (NACLs)?

Accepted Answer

Security groups are stateful and support allow rules only; NACLs are stateless and support allow and deny rules. Security groups are stateful and support allow rules only, while NACLs are stateless and support both allow and deny rules.

Answer

Security groups support allow and deny rules; NACLs support only allow

Answer

Security groups are stateless and NACLs are stateful

Answer

Security groups and NACLs are both stateless

Question 2

A healthcare organization stores patient records in a cloud object storage service. They require that all data be encrypted at rest using keys that they generate and manage on-premises, but they want to minimize operational overhead. Which encryption approach should they choose?

Accepted Answer

Server-side encryption with CSEK. CSEK (customer-supplied encryption keys) allows the customer to provide their own encryption key for each operation, giving them full control while the cloud provider handles the encryption/decryption. This minimizes overhead compared to client-side encryption.

Answer

BYOK

Answer

Client-side encryption

Answer

Server-side encryption with CMEK

Question 3

A cloud security team is implementing data loss prevention (DLP) for sensitive data in a cloud data warehouse. They need to detect and classify Social Security numbers (SSNs) stored in tables. Which cloud service capability is most appropriate for this task?

Accepted Answer

Cloud DLP API. Cloud DLP APIs can scan structured data like BigQuery tables for sensitive patterns (e.g., SSNs) and classify them.

Answer

Object storage bucket policies

Answer

Key management service

Answer

Identity and access management (IAM)

Question 4

An organization uses a cloud DLP API to scan data in Cloud Storage and BigQuery for sensitive information. They need to replace social security numbers (SSNs) with a non-reversible token that can be used for consistent mapping without exposing the original SSN. Which de-identification technique should they use?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a unique, non-reversible token that maintains referential integrity. Unlike masking, it completely replaces the original value.

Answer

Masking

Answer

Date shifting

Answer

Pseudonymization

Question 5

An organization is designing a VPC with multiple tiers. Which TWO network components are used to restrict traffic between subnets?

Accepted Answer

Network ACL (NACL). Network ACLs (stateless) and Security Groups (stateful) can be applied at subnet and instance level to control traffic.

Answer

VPC Peering

Answer

Internet Gateway

Answer

Route Table

Question 6

A cloud security engineer is implementing API Gateway security for a public-facing API. Which combination of controls best protects against both injection attacks and excessive usage?

Accepted Answer

WAF integration and rate limiting. WAF integration protects against injection and other web attacks, while rate limiting prevents abuse by limiting requests per client.

Answer

IAM authentication and VPC endpoint

Answer

JWT validation and WAF integration

Answer

API keys and TLS enforcement

Question 7

A security team is reviewing container image supply chain security. Which tool is specifically designed for signing container images to ensure integrity and provenance?

Accepted Answer

Cosign. Cosign is a tool for signing container images and verifying signatures, ensuring the image has not been tampered with.

Answer

Kube-bench

Answer

Clair

Answer

Trivy

Question 8

An organization is required to use client-side encryption for all data uploaded to a cloud storage service to ensure that the cloud provider has no access to plaintext. However, they also need to allow the cloud provider to perform server-side operations like indexing and search on the encrypted data. Which technology can address this conflict?

Accepted Answer

Searchable encryption. Searchable encryption allows certain operations (e.g., keyword search) on encrypted data without decrypting it, enabling server-side processing while maintaining confidentiality.

Answer

Format-preserving encryption

Answer

Tokenization

Answer

Homomorphic encryption

Question 9

A container runtime is configured to drop all Linux capabilities, use a read-only root filesystem, and apply a Seccomp profile. Which primary security goal does this configuration achieve?

Accepted Answer

Prevention of container escape. These measures restrict container permissions and system calls, making container escape much harder.

Answer

Image integrity verification

Answer

Ensuring immutability of containers

Answer

Network segmentation between pods

Question 10

A security architect is designing a multi-tenant cloud environment. Which hypervisor type provides the strongest isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

VMware ESXi (Type 1). Type 1 hypervisors run directly on hardware, minimizing the attack surface and providing strong isolation. Type 2 hypervisors run on top of an OS, adding extra layers of vulnerability.

Answer

VMware Workstation (Type 2)

Answer

KVM (Type 2)

Answer

VirtualBox (Type 2)

Question 11

A DevOps engineer is configuring a Kubernetes cluster and wants to enforce that containers cannot run as root and cannot mount host paths. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) allows enforcing predefined security policies (privileged, baseline, restricted) at the pod level, covering controls like running as root and host path mounts.

Answer

Network policies

Answer

RBAC

Answer

Secrets management

Question 12

A financial institution is migrating to the cloud and must comply with regulations requiring that sensitive data be stored only in specific geographic regions and that access to data is logged and monitored. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Enable server access logs for the storage bucket. To enforce data residency, the cloud region must be restricted via IAM or organization policies. Server access logging captures all requests to storage. VPC Service Controls create a security perimeter around cloud resources, preventing data exfiltration. Cross-region replication would violate residency, and default encryption is not sufficient.

Answer

Use default server-side encryption with cloud-managed keys

Answer

Enable cross-region replication for disaster recovery

Question 13

Which of the following is a primary risk specific to virtual machine escape attacks in cloud environments?

Accepted Answer

Unauthorized access to other tenant VMs. VM escape allows an attacker to break out of a VM and interact with the hypervisor, potentially compromising other tenants.

Answer

Data corruption within the same VM

Answer

Increased latency in virtual networking

Answer

Denial of service to the attacker's own VM

Question 14

A security engineer is implementing container image security. They want to ensure that only signed images from a trusted registry can be deployed in the Kubernetes cluster. Which tool should they use to enforce this at the admission controller level?

Accepted Answer

Cosign. Cosign is a tool for signing and verifying container images. It integrates with admission controllers like Kyverno or OPA Gatekeeper to enforce that only signed images are deployed.

Answer

Clair

Answer

Trivy

Answer

Snyk Container

Question 15

An organization must implement encryption for data in transit between its on-premises data center and a cloud provider. The data is sensitive and the organization requires a dedicated, encrypted tunnel. Which solution should be used?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) provides a dedicated, encrypted tunnel for hybrid connectivity between on-premises and cloud.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for API communication

Answer

Cloud KMS for key exchange