CCSP Practice Test 22 — 15 Questions

Question 1

A company subject to SOX is using a cloud ERP system. Which THREE of the following IT general controls are essential for SOX compliance?

Accepted Answer

Audit logging of user activities and system changes. Option A is correct because SOX ITGC requires audit logging of user activities and system changes to provide an evidentiary trail for financial reporting controls, enabling detection of unauthorized or anomalous activity and supporting audit testing. Option C is correct because access controls that enforce segregation of duties prevent any single user from initiating, approving, and recording financial transactions, which is a core SOX requirement to reduce fraud risk over financial data in the ERP. Option D is correct because change management procedures ensure that modifications to the ERP system are authorized, tested, approved, and documented, protecting the integrity and availability of financially relevant applications and data. Option B is not correct because physical security of the cloud provider's data centers is the provider's responsibility under the shared responsibility model and is typically addressed through SOC 1/SOC 2 reports rather than being an essential control the customer must implement for SOX. Option E is not correct because, while MFA for cloud provider administrators is a good practice, SOX ITGC focuses on the customer's controls over its own users and privileged access to the ERP, not on the cloud provider's internal administrative accounts.

Answer

Physical security of the cloud provider's data centers

Answer

Multi-factor authentication for all cloud provider administrators

Question 2

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint

Question 3

A security team is setting up a DLP solution to scan cloud storage for credit card numbers. They want to automatically mask the detected credit card numbers so that only the last four digits are visible. Which DLP de-identification transform should they use?

Accepted Answer

Masking. Masking replaces sensitive values with a redacted or partially obscured version — for credit card numbers, showing only the last four digits (e.g., **** **** **** 1234) while hiding the rest. It is a de-identification transform that preserves format and usability for display/analytics without exposing the full PAN. This matches the requirement exactly: detect and automatically mask so only the last four digits remain visible.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 4

A company uses a cloud key management service with customer-managed keys to encrypt data in a cloud storage bucket. The security team wants to ensure that if a key is compromised, they can revoke the cloud service's ability to decrypt the data immediately. What should they do?

Accepted Answer

Disable the key in the cloud key management service or revoke the key's access permissions for the cloud service.. Disabling the customer-managed key or revoking the cloud service's permissions to use it immediately prevents the service from performing cryptographic operations with that key, effectively cutting off decryption. This is a reversible, fast action that preserves the key material for potential recovery. It directly addresses the requirement to revoke the cloud service's ability to decrypt data immediately.

Answer

Rotate the key to a new version.

Answer

Delete the key permanently from the cloud key management service.

Answer

Regenerate the key material by importing a new key.

Question 5

Which THREE statements about tokenization compared to encryption are correct?

Accepted Answer

Tokenization is typically used for payment card data.. Tokenization is commonly used for payment card data (e.g., PCI DSS compliance) because it replaces sensitive PANs with non-sensitive tokens that have no exploitable value outside the tokenization system. This allows organizations to reduce their compliance scope by not storing actual card numbers, while encryption still leaves ciphertext that could be decrypted if keys are compromised.

Answer

Encryption is always more secure than tokenization.

Answer

Tokenization preserves data format and length.

Question 6

In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?

Accepted Answer

Rapid elasticity. NIST SP 800-145 defines rapid elasticity as the capability to elastically provision and release resources, in some cases automatically, to scale rapidly outward and inward commensurate with demand. The phrase 'rapidly and elastically provision and release resources, often automatically' maps directly to this characteristic. It is one of the five essential characteristics of cloud computing alongside on-demand self-service, broad network access, resource pooling, and measured service.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 7

A security team is implementing a DevSecOps pipeline for a cloud-native application. Which three practices should be included to enhance application security? (Choose THREE.)

Accepted Answer

Static application security testing (SAST) in CI/CD. SAST (A) is correct because it analyzes source code in the CI/CD pipeline to catch vulnerabilities like injection flaws and insecure coding patterns before the build is deployed, shifting security left. IaC scanning (B) is correct because it examines templates such as Terraform, CloudFormation, or Kubernetes manifests for misconfigurations (e.g., open S3 buckets, overly permissive IAM roles) before infrastructure is provisioned. Dependency scanning (C) is correct because it identifies known CVEs in open source libraries and transitive dependencies, which are a major attack surface in cloud-native applications, and can fail the build on critical findings. Manual penetration testing only at the final stage (D) is not a DevSecOps practice because it is late, point-in-time, and cannot keep pace with continuous delivery. RASP (E) is a runtime protection control, not a pipeline practice, and it does not prevent vulnerabilities from entering the codebase during development.

Answer

Manual penetration testing only at final stage

Answer

Runtime application self-protection (RASP) deployment

Question 8

Which THREE of the following are key considerations when designing a disaster recovery plan for a cloud-based application?

Accepted Answer

Implementing cross-region replication for critical data.. Cross-region replication ensures that critical data is asynchronously or synchronously copied to a geographically separate cloud region, providing resilience against regional outages. This design directly supports disaster recovery by enabling failover to a secondary site with minimal data loss, often leveraging cloud-native services like AWS S3 Cross-Region Replication or Azure Geo-Redundant Storage.

Answer

Performing manual failover testing only once a year.

Answer

Eliminating all security controls to speed up recovery.

Question 9

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. The bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 10

A cloud security team is auditing a cloud environment and needs to ensure compliance with logging requirements. Which TWO actions are essential? (Choose two.)

Accepted Answer

Encrypt logs at rest.. Encrypting logs at rest (Option C) is essential to protect sensitive audit data from unauthorized access if the storage medium is compromised. Cloud providers like AWS offer server-side encryption (SSE-S3 or SSE-KMS) for log buckets, ensuring compliance with standards such as SOC 2, PCI DSS, and ISO 27001. Without encryption, logs could be read by anyone with physical or administrative access to the storage infrastructure.

Answer

Store logs in a publicly accessible bucket.

Answer

Allow users to modify logs.

Answer

Delete logs after 30 days.

Question 11

A cloud security architect is evaluating a CSP for a financial services client. Which of the following audit reports would provide the most comprehensive assurance regarding the CSP's controls over security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II is specifically designed to provide assurance over security, availability, processing integrity, confidentiality, and privacy (the Trust Services Criteria). It includes an independent auditor's opinion on the effectiveness of controls over a period. This makes it the most comprehensive for the listed areas.

Answer

PCI DSS Attestation of Compliance

Answer

SOC 1 Type II

Answer

ISO 27001 certification

Question 12

A company wants to use a cloud KMS to encrypt data but requires that the encryption key never leaves their on-premises hardware security module (HSM) due to compliance. Which key management model should they adopt?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) is the only model where the encryption key material is generated, stored, and used exclusively within the customer's on-premises HSM and never exported to the cloud provider. The cloud KMS is used only to wrap or reference the key, satisfying compliance mandates that keys must remain under customer physical control. CMEK, CSEK, and BYOK all involve the key material being imported into or generated within the cloud provider's infrastructure at some point.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Customer-Supplied Encryption Key (CSEK)

Answer

Bring Your Own Key (BYOK)

Question 13

A security engineer needs to provide temporary access to a specific object in a cloud storage bucket for a third-party auditor, without granting them any other permissions. The access should expire automatically after 24 hours. Which method should the engineer use?

Accepted Answer

Generate a time-limited signed URL for the object with a 24-hour expiration.. A time-limited signed URL is generated using the object owner's credentials and embeds an expiration (e.g., 24 hours) directly in the URL. The third-party auditor can retrieve only that specific object until expiry, with no cloud identity, no IAM user, and no broader permissions. This satisfies least privilege, automatic expiry, and zero credential distribution.

Answer

Configure a bucket access policy that allows access from the auditor's IP address.

Answer

Assign the auditor a cloud role with read-only access to the bucket.

Answer

Generate a long-term access key pair for the auditor and attach a user policy.

Question 14

Which phase of the cloud data lifecycle involves making data available for processing by applications and users?

Accepted Answer

Use. The Use phase of the cloud data lifecycle is when data is made available to applications and users for processing, analysis, and consumption. It follows Create and Store, and precedes Share, Archive, and Destroy. During Use, controls like access management, encryption in use, and monitoring are applied to protect data while it is actively being processed.

Answer