CCSP Practice Test 21 — 15 Questions

Question 1

Which THREE of the following are effective measures to prevent unauthorized access to cloud storage buckets? (Select THREE)

Accepted Answer

Enabling 'Block all public access' settings. Option B is correct because enabling 'Block all public access' settings on a cloud storage bucket prevents any anonymous or public read/write access, which is a primary vector for unauthorized access. Option D is correct because requiring IAM authentication for all access ensures every request is evaluated against identity-based policies, so only authenticated and authorized principals can reach the bucket. Option E is correct because setting bucket ACLs to 'private' removes grants to AllUsers and AuthenticatedUsers, restricting access to the bucket owner and explicitly authorized accounts. Option A does not belong because bucket versioning only preserves object versions for recovery and does not control who can access the bucket. Option C does not belong because server-side encryption protects data at rest from disclosure but does not prevent unauthorized users from accessing the bucket if permissions are misconfigured.

Answer

Enabling bucket versioning

Answer

Enabling server-side encryption

Question 2

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

Accepted Answer

Use parameterized SQL queries. SQL injection attacks exploit unsanitized user input that is concatenated into SQL queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders, ensuring that user input is always treated as data, not executable code. This prevents an attacker from injecting malicious SQL commands, regardless of the input content.

Answer

Encrypt the database connection

Answer

Implement rate limiting on the login endpoint

Answer

Enforce strong password policies

Question 3

A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)

Accepted Answer

Anomalous spike in outbound traffic to an unknown IP address. Option A is correct because a CASB monitors cloud traffic and would flag an anomalous spike in outbound traffic to an unknown IP address as a strong indicator of unauthorized data exfiltration, since data is being sent to an untrusted external destination. Option C is correct because a large number of file downloads by a single user outside of business hours is a classic user behavior analytics (UBA) anomaly that a CASB detects, indicating possible bulk data theft by an insider or compromised account. Option B is not a CASB exfiltration indicator; firewall rule changes are configuration events typically surfaced by change management or firewall auditing tools, not CASB traffic analysis. Option D reflects failed authentication attempts, which point to brute-force or credential-stuffing attacks rather than data leaving the environment. Option E is an email security or secure email gateway detection of malware signatures, not a CASB data exfiltration indicator.

Answer

A change in the configuration of a firewall rule

Answer

Multiple failed login attempts to a critical application

Answer

An alert for a known malware signature in an email attachment

Question 4

A cloud operations team has a process for making changes to production environments. Which change management practice is MOST important for reducing the risk of service disruption?

Accepted Answer

Testing all changes in a staging environment before production deployment.. Testing all changes in a staging environment before production deployment is the most important practice because it validates the change's behavior, performance, and compatibility in an isolated replica of production. This directly reduces the risk of service disruption by catching configuration errors, resource conflicts, or software defects that could cause outages. Without staging validation, even well-intentioned changes can introduce silent failures or cascading issues.

Answer

Allowing all changes to be made immediately with no approval process.

Answer

Notifying the security team after the change is completed.

Answer

Ensuring a rollback plan is documented after the change is made.

Question 5

A cloud security administrator is reviewing the security controls for a SaaS application. Which of the following are typically the responsibility of the cloud customer (tenant) in a SaaS model? (Choose two.)

Accepted Answer

Managing user access and identity. In a SaaS model, the customer is responsible for managing user access and identity (B) and data classification and encryption at rest (E). The provider handles physical security (A), network infrastructure security (C), and patching the underlying operating system (D).

Answer

Physical security of data center

Answer

Network infrastructure security

Answer

Patching the underlying operating system

Question 6

An enterprise uses a cloud-based relational database service (e.g., AWS RDS) to store customer order data. The database is encrypted at rest using the cloud provider's default encryption. The security team is concerned about the risk of a rogue database administrator (DBA) exfiltrating data by creating unencrypted backups or snapshots and moving them to a different account. Which of the following controls would BEST mitigate this risk while maintaining operational efficiency?

Accepted Answer

Use a customer-managed key (CMK) in KMS and configure the database to use that key for encryption, and restrict the DBA's IAM permissions to prevent using the key on snapshots.. Using a customer-managed key (CMK) in AWS KMS allows the organization to attach a key policy that explicitly denies the DBA's IAM role the kms:Decrypt permission on the CMK when used with snapshot operations. This prevents the DBA from creating an unencrypted snapshot or from copying an encrypted snapshot to another account, as the snapshot would remain encrypted with the CMK and the DBA cannot decrypt it. This maintains operational efficiency because the DBA can still perform routine database management tasks (e.g., creating backups) but cannot exfiltrate data via snapshots.

Answer

Disable the ability for any user to create database snapshots.

Answer

Implement database activity monitoring (DAM) to alert on snapshot creation.

Answer

Enable automatic snapshot encryption and ensure that only the database service role can access snapshots.

Question 7

Which of the following is the most granular method to grant time-limited access to a specific object in a cloud storage bucket without requiring the requester to have cloud provider credentials?

Accepted Answer

Signed URLs. Signed URLs (also called presigned URLs) are generated by the object owner using their own credentials and embed a cryptographic signature plus an expiration timestamp directly in the URL. Anyone holding the URL can retrieve that single object until the expiry time, without needing any cloud provider identity or credentials. This makes them the most granular, time-limited access mechanism for a specific object.

Answer

Bucket ACLs

Answer

Bucket policies with conditions

Answer

Identity-based policies

Question 8

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Option A (Use immutable infrastructure) is correct because replacing rather than modifying running instances eliminates configuration drift and prevents attackers from persisting changes on a compromised host, since any tampering is discarded when the instance is rebuilt from a known-good image. Option C (Run applications with least privilege) is correct because granting each process, service account, and container only the minimum permissions it needs limits the blast radius of a compromise and blocks privilege-escalation paths within the runtime environment. Option B (host-based intrusion detection) is a detective control that can complement runtime security but does not itself harden or secure the environment, and it is often impractical in ephemeral cloud workloads. Option D (automatic patching of dependencies) addresses vulnerability management in the build/supply chain rather than securing the runtime environment itself, and blind auto-patching can introduce instability. Option E (container orchestration platform) is a deployment technology, not a security best practice, and using it without proper configuration can actually widen the attack surface.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 9

An organization is required to use client-side encryption for all data uploaded to a cloud storage service to ensure that the cloud provider has no access to plaintext. However, they also need to allow the cloud provider to perform server-side operations like indexing and search on the encrypted data. Which technology can address this conflict?

Accepted Answer

Searchable encryption. Searchable encryption allows data to remain encrypted at rest while still supporting server-side operations such as keyword search and indexing over the ciphertext. It enables the cloud provider to perform searches without decrypting the data, satisfying both the client-side encryption requirement and the need for server-side search functionality. This directly resolves the conflict described.

Answer

Format-preserving encryption

Answer

Tokenization

Answer

Homomorphic encryption

Question 10

Which TWO of the following are best practices for monitoring a cloud environment to detect security incidents?

Accepted Answer

Centralize logs from all cloud services into a single analytics platform.. Centralizing logs from all cloud services into a single analytics platform (e.g., SIEM like Splunk or AWS Security Hub) enables correlation across disparate data sources, which is essential for detecting multi-vector attacks. This practice aligns with the NIST SP 800-92 log management guidelines and the CCSP domain of Cloud Security Operations, as it provides a unified view for threat detection and incident response.

Answer

Enable all available log sources to ensure complete visibility.

Answer

Monitor only network flow logs to reduce data volume.

Answer

Conduct manual log reviews on a weekly basis to identify anomalies.

Question 11

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Option A is correct because running containers with a non-root user (via the USER directive in the Dockerfile or runAsNonRoot/runAsUser in a Kubernetes securityContext) enforces least privilege, so a container breakout or compromised process cannot gain root-level access to the host or mounted resources. Option E is correct because mounting the container's root filesystem as read-only (docker run --read-only or readOnlyRootFilesystem: true in Kubernetes) prevents attackers from modifying binaries, writing malware, or persisting changes, and any needed writable paths can be explicitly mounted as tmpfs or volumes. Option B is not a best practice: enabling SSH inside a container increases the attack surface, bloats the image, and contradicts the immutable, single-process container model; administration should use docker exec, kubectl exec, or orchestration APIs instead. Option C is wrong because the 'latest' tag is mutable and non-deterministic, breaking reproducibility and potentially pulling in unvetted or vulnerable base images; images should be pinned to specific immutable digests or version tags. Option D is also wrong because bundling debugging tools enlarges the attack surface and image size; troubleshooting should be done with ephemeral debug containers or sidecars rather than shipping tools in production images.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.

Question 12

Which audit report provides the most comprehensive assurance regarding a cloud provider's controls over a period of time, including controls related to security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports provide assurance over the design AND operating effectiveness of controls across a defined audit period (typically 3–12 months), covering the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. This period-based testing makes it the most comprehensive assurance option for evaluating a cloud provider's sustained control environment.

Answer

ISO 27001 certification

Answer

SOC 2 Type I

Answer

CSA STAR self-assessment

Question 13

A developer accidentally hardcodes AWS access keys in a public GitHub repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a purpose-built tool for detecting secrets (e.g., AWS access keys, API tokens) in code repositories, including public GitHub repos. It scans commit history and uses pattern matching to identify hardcoded credentials, alerting developers in real time. This directly addresses the scenario of accidental exposure in a public repository.

Answer

Checkov

Answer

Snyk

Answer

tfsec

Question 14

A cloud architect is designing a data classification scheme for a SaaS provider. The provider handles customer data that includes public marketing materials, internal policies, and sensitive customer financial records. Which classification level should be assigned to customer financial records to enforce the highest level of protection?

Accepted Answer

Restricted. Customer financial records represent the most sensitive data class in the scenario, requiring the highest protection tier, which is Restricted. Restricted classification enforces strict access controls, encryption, and monitoring appropriate for regulated financial data. Since the question explicitly asks for the highest level of protection, Restricted is the correct mapping.

Answer

Internal

Answer

Public

Answer

Confidential

Question 15

A security architect is designing a VPC for a three-tier web application. Which of the following VPC subnet designs provides the most secure isolation for the database tier?

Accepted Answer

Database tier in a private subnet with security group allowing only the application tier. Placing the database tier in a private subnet with a security group that only allows traffic from the application tier's security group enforces both network-layer isolation (no route to the internet) and identity-based access control (SG-to-SG referencing). This is the AWS-recommended pattern for three-tier architectures because it minimizes the attack surface and prevents lateral movement from compromised web-tier instances. The database has no public IP and no route to an internet gateway, so it cannot be reached directly from outside the VPC.

Answer

Database tier in a separate VPC with VPC peering

Answer

Database tier in a public subnet with security group allowing only the application tier

Answer

Database tier in the same subnet as the application tier