CCSP Practice Test 24 — 15 Questions

Question 1

A security architect is designing a VPC for a three-tier web application. Which of the following VPC subnet designs provides the most secure isolation for the database tier?

Accepted Answer

Database tier in a private subnet with security group allowing only the application tier. Placing the database tier in an isolated private subnet without direct internet access and with strict security group rules minimizes exposure.

Answer

Database tier in a separate VPC with VPC peering

Answer

Database tier in a public subnet with security group allowing only the application tier

Answer

Database tier in the same subnet as the application tier

Question 2

A cloud security architect is evaluating options for private connectivity to cloud services without traversing the internet. Which TWO services can be used to achieve this? (Select two.)

Accepted Answer

VPC peering. VPC endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and VPC peering provide private connectivity without internet. Internet gateway and NAT gateway use internet; security groups are firewalls.

Answer

Security group

Answer

Internet gateway

Answer

NAT gateway

Question 3

A cloud security architect is designing a multi-tenant environment using Type 1 hypervisors. Which of the following is the primary security risk associated with this architecture?

Accepted Answer

VM escape from guest to hypervisor. In multi-tenant cloud environments, VM escape is a critical risk where an attacker compromises a VM and attempts to break out to the hypervisor to access other VMs. Regular patching of the hypervisor mitigates this.

Answer

Insecure VM migration between hosts

Answer

Insufficient logging of hypervisor events

Answer

Resource contention leading to denial of service

Question 4

A DevOps team is implementing a CI/CD pipeline for a cloud application. They want to automatically scan source code for security vulnerabilities before building the application. Which type of scanning should they integrate?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code or binaries for security vulnerabilities without executing the application, making it suitable for early integration in CI/CD.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 5

During a code review, a developer discovers hardcoded AWS access keys in a configuration file that was committed to the repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a tool that scans repositories for hardcoded secrets like API keys and credentials, helping prevent credential leakage.

Answer

tfsec

Answer

Checkov

Answer

Snyk

Question 6

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a popular tool for scanning Infrastructure as Code (e.g., Terraform) for misconfigurations before deployment.

Answer

GitGuardian

Answer

Snyk

Answer

Dependabot

Question 7

Which practice helps prevent hardcoded cloud credentials from being committed to source code repositories?

Accepted Answer

Implementing secrets management with a vault service. Using secrets management tools like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault to dynamically retrieve credentials at runtime avoids hardcoding them in code.

Answer

Using environment variables for all configuration

Answer

Storing credentials in a configuration file with restricted permissions

Answer

Using a .gitignore file to exclude credential files

Question 8

Which practice is most effective for preventing the deployment of container images with known vulnerabilities in a DevSecOps pipeline?

Accepted Answer

Image scanning in CI pipeline before push. Scanning container images in the CI pipeline before pushing to a registry ensures that only secure images are stored and deployed. This is a preventive control.

Answer

Post-deployment vulnerability scanning

Answer

Using only official base images

Answer

Runtime monitoring with a WAF

Question 9

A cloud application uses IAM roles to grant permissions to compute instances. What is the primary security advantage of this approach over hardcoding credentials?

Accepted Answer

Elimination of hardcoded secrets. Using IAM roles eliminates the need to hardcode credentials (like access keys) in code, reducing the risk of exposure. IAM roles automatically rotate temporary credentials and are managed by the cloud provider.

Answer

Simplified load balancing

Answer

Improved application performance

Answer

Reduced network latency

Question 10

Which tool is specifically designed to scan Infrastructure as Code (IaC) templates for cloud misconfigurations before deployment?

Accepted Answer

Checkov. Checkov is an IaC security scanner that checks Terraform, CloudFormation, and Kubernetes manifests for misconfigurations before deployment. The other tools serve different purposes.

Answer

OWASP ZAP

Answer

Snyk

Answer

GitGuardian

Question 11

What is a Software Bill of Materials (SBOM) primarily used for?

Accepted Answer

Documenting all open-source and third-party components in an application. An SBOM lists all components and dependencies in a software product, aiding in vulnerability management and supply chain security.

Answer

Tracking user access to cloud resources

Answer

Recording incident response procedures

Answer

Listing security controls implemented in the cloud environment

Question 12

Which vulnerability is considered a cloud-specific API security issue?

Accepted Answer

Broken Object Level Authorization (BOLA). Broken Object Level Authorization (BOLA or IDOR) is a common API vulnerability where an attacker can access objects by modifying IDs. This is not unique to cloud but is critical in cloud APIs due to shared responsibility.

Answer

SQL Injection

Answer

Cross-Site Request Forgery (CSRF)

Answer

Clickjacking

Question 13

A company subject to SOX is using a cloud ERP system. Which THREE of the following IT general controls are essential for SOX compliance?

Accepted Answer

Audit logging of user activities and system changes. SOX IT general controls include change management (ensuring system changes are controlled), access controls (preventing unauthorized access), and audit logs (monitoring and accountability).

Answer

Physical security of the cloud provider's data centers

Answer

Multi-factor authentication for all cloud provider administrators

Question 14

A cloud customer must comply with GDPR's right to erasure (right to be forgotten). Which TWO of the following are technical challenges the customer faces when the data is stored in a cloud object storage service with versioning and cross-region replication?

Accepted Answer

Removing previous versions of objects. GDPR right to erasure requires deletion of all copies. Versioning creates multiple versions that must be deleted. Cross-region replication creates additional copies in other regions that must also be deleted.

Answer

Ensuring data is accessible only via a specific IP range

Answer

Encrypting the data at rest with customer-managed keys

Answer

Exporting data in a machine-readable format

Question 15

A cloud customer is evaluating a provider's compliance with PCI DSS. Which two components are part of the PCI DSS shared responsibility model as referenced in Appendix A3? (Choose two.)

Accepted Answer

Physical security of data centers. PCI DSS Appendix A3 requires a Cloud Provider Responsibility Matrix that delineates responsibilities; typical shared responsibilities include physical security (provider) and access controls (customer).

Answer

Network perimeter controls

Answer

Application security for custom code

Answer

Encryption key management