CCSP Practice Test 23 — 15 Questions

Question 1

A financial services company uses a hybrid cloud environment with an on-premises data center and AWS. They have deployed a Cloud Access Security Broker (CASB) to enforce data loss prevention (DLP) policies for SaaS applications. Recently, the security team noticed that sensitive customer data is being exfiltrated via encrypted traffic to a sanctioned cloud storage application. The CASB logs show the traffic is identified as HTTPS, but the DLP policy is not blocking it. The team verifies that the CASB is configured with a forward proxy and SSL inspection is enabled. Which action should the security team take to prevent this exfiltration?

Accepted Answer

Ensure the CASB's SSL certificate is deployed to all endpoint devices. The CASB is configured as a forward proxy with SSL inspection enabled, but for SSL inspection to work, the CASB's certificate must be trusted by the endpoint devices. Without the CASB's certificate deployed to the endpoints, the SSL inspection fails (the CASB cannot decrypt the traffic), so the DLP policy cannot inspect the payload of HTTPS traffic, allowing sensitive data to be exfiltrated. Deploying the CASB's certificate to all endpoint devices ensures that the endpoints trust the CASB's man-in-the-middle decryption, enabling the CASB to decrypt, inspect, and enforce DLP policies on encrypted traffic.

Answer

Block all HTTPS traffic to the cloud storage application

Answer

Configure the CASB to log only metadata for encrypted traffic

Answer

Disable HTTPS for the cloud storage application and force HTTP

Question 2

A multinational corporation stores customer data in an AWS S3 bucket located in the US. The company's European customers' personal data must comply with GDPR. Which TWO actions should the company take to ensure compliance with GDPR data transfer requirements?

Accepted Answer

Sign Standard Contractual Clauses (SCCs) with the cloud provider.. Under GDPR, transfers of personal data to third countries require adequate safeguards. Signing Standard Contractual Clauses (SCCs) with the cloud provider and implementing a Data Processing Agreement (DPA) are both recognized mechanisms. Encryption alone (A) does not address transfer legality; access location (C) is irrelevant; and Direct Connect (D) is a network connectivity option, not a legal safeguard.

Answer

Implement encryption at rest using AWS KMS with a key stored in the US.

Answer

Ensure that the data is only accessed by employees in the EU.

Answer

Use AWS Direct Connect to route traffic exclusively through EU-based links.

Question 3

Refer to the exhibit. A security analyst discovers this bucket policy attached to an S3 bucket containing sensitive customer data. What is the MOST significant security risk posed by this policy?

Accepted Answer

The policy allows any AWS user to read objects if they are within the specified IP range.. The policy allows any AWS user (Principal: "*") to read objects if they are from the specified IP range. This is overly permissive, granting access to the entire internet at that range, which could include malicious actors. The condition is correctly applied (B is false), encryption is not the main issue (C), and NotPrincipal is not required (D).

Answer

The policy does not require encryption in transit, so data could be intercepted.

Answer

The Condition block is misconfigured and will allow access from any IP address.

Answer

The policy does not include a NotPrincipal element to restrict access further.

Question 4

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

Accepted Answer

The policy is currently using version v3 as the default.. The DefaultVersionId of an IAM policy indicates which version is currently active and enforced when the policy is attached to an IAM user, group, or role. Since the policy is named S3ReadOnlyAccess and has DefaultVersionId v3, version v3 is the default and is being used for access control decisions. This is the standard behavior for IAM policies in AWS, where you can have multiple versions but only one is designated as the default.

Answer

The policy is newly created.

Answer

The policy has three custom versions.

Answer

The policy cannot be attached to any entity.

Question 5

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

Accepted Answer

SAML assertion. A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.

Answer

JWT

Answer

Kerberos ticket

Answer

OAuth access token

Question 6

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Accepted Answer

Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles. Option B is correct because AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Answer

Store credentials in the function code

Answer

Hardcode credentials in environment variables

Answer

Use database temporary tokens generated on the fly

Question 7

During a security audit, it is discovered that a cloud application's API endpoints are vulnerable to injection attacks. Which defense in depth measure would be most effective in preventing such attacks?

Accepted Answer

Prepared statements in code. Prepared statements (parameterized queries) are the most effective defense against injection attacks because they separate SQL logic from user input, ensuring that input is treated as data only, never as executable code. This prevents attackers from manipulating query syntax, regardless of the input content. In cloud applications, this is a foundational secure coding practice that addresses the root cause of injection vulnerabilities at the application layer.

Answer

Web application firewall (WAF)

Answer

Rate limiting

Answer

Regular expression input validation

Question 8

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP

Question 9

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

Accepted Answer

Implement mutual TLS with unique certificates per service. Mutual TLS (mTLS) with unique certificates per service enforces least privilege by ensuring each microservice authenticates with a distinct identity, and access can be scoped to specific certificates. This prevents a compromised service from impersonating others, as each service has its own private key and certificate, and the TLS handshake requires both sides to present and validate certificates.

Answer

Use long-lived bearer tokens

Answer

Assign IAM roles with broad permissions

Answer

Use a shared API key across all services

Question 10

A company is adopting DevSecOps and wants to incorporate security testing into their continuous integration pipeline. They have decided to run SAST (static analysis) and SCA (software composition analysis) tools. Which of the following is the PRIMARY reason for including SCA in addition to SAST?

Accepted Answer

To identify known vulnerabilities in third-party libraries and dependencies. SCA (Software Composition Analysis) is specifically designed to identify known vulnerabilities in third-party libraries and dependencies by comparing their versions against public vulnerability databases like the National Vulnerability Database (NVD) or OWASP Dependency-Check. SAST (Static Application Security Testing) analyzes custom source code for security flaws but cannot inspect external libraries that are often pulled in via package managers (e.g., npm, Maven, pip). Including SCA ensures that the organization addresses supply chain risks, which is a primary goal in DevSecOps pipelines.

Answer

To detect insecure runtime behavior

Answer

To reduce false positives identified by SAST

Answer

To scan for vulnerabilities in custom APIs

Question 11

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

Accepted Answer

Configure a web application firewall (WAF) with rate limiting and IP blacklisting. Option C is correct because a Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.

Answer

Rotate API keys more frequently

Answer

Implement cross-origin resource sharing (CORS) policies

Answer

Require encryption of session tokens

Question 12

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

Accepted Answer

Implement a software composition analysis (SCA) tool in the pipeline. A Software Composition Analysis (SCA) tool is specifically designed to automatically scan open-source libraries for known vulnerabilities, licensing issues, and version compliance. By integrating SCA into the CI/CD pipeline, the team can enforce a policy that only approved libraries (e.g., those passing a security and license review) are allowed in production builds, blocking unapproved or vulnerable components before deployment.

Answer

Segment the build network to limit internet access

Answer

Perform static code analysis after each build

Answer

Require manual approval for all library updates

Question 13

A financial services company is adopting a cloud-native microservices architecture. They want to ensure that only authorized services can communicate with each other, and that all inter-service communication is encrypted. Which of the following is the BEST approach?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and fine-grained access policies. Option C is correct because a service mesh (e.g., Istio) provides sidecar proxies that handle mTLS and access policies transparently. Option A (security groups) operate at network level but do not encrypt nor provide service identity. Option B (API gateways) centralize external traffic but not internal. Option D (VPC peering) connects networks but does not enforce application-level authorization or encryption per service.

Answer

Use network security groups to restrict traffic between service subnets

Answer

Connect services using VPC peering and enable encryption in transit

Answer

Deploy an API gateway and route all internal traffic through it

Question 14

An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?

Accepted Answer

Enforcing security policies across cloud applications and controlling access. The primary function of a CASB is to enforce security policies and control access across cloud applications, acting as an intermediary between users and cloud providers. It provides visibility into cloud usage, applies data loss prevention (DLP) rules, and enforces authentication and authorization policies, which directly addresses the need to secure a legacy application migrated to the cloud.

Answer

Performing vulnerability scans on cloud infrastructure

Answer

Encrypting data at rest in cloud storage

Answer

Protecting against distributed denial-of-service (DDoS) attacks

Question 15

Which THREE of the following are common challenges in securing serverless applications?

Accepted Answer

Insecure handling of event source inputs. Option B is correct because serverless functions rely on event-driven architectures where inputs from sources like HTTP requests, database changes, or message queues are processed directly. If these inputs are not properly validated and sanitized, attackers can inject malicious payloads (e.g., SQL injection, command injection) that execute within the function's runtime, leading to data breaches or unauthorized actions. This is a primary attack vector unique to serverless, as the function code directly consumes untrusted data without traditional perimeter defenses.

Answer

Lack of control over the underlying kernel and OS

Answer

Difficulty in applying stateful firewall rules