CCSP Practice Test 24 — 15 Questions

Question 1

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault provides a cloud-agnostic secrets management service with automated rotation and cross-cloud capabilities. AWS Secrets Manager is AWS-specific. Azure Key Vault is Azure-specific. Encrypted environment variables are not easily rotated and require redeployment.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 2

A cloud application is being designed to handle highly sensitive financial data. The security architect wants to ensure that encryption keys are managed outside the application's memory space. Which service model should they use?

Accepted Answer

Hardware Security Module (HSM). Option D is correct because a Hardware Security Module (HSM) is a dedicated hardware appliance that manages encryption keys in a physically and logically isolated environment, entirely separate from the application's memory space. For highly sensitive financial data, an HSM provides FIPS 140-2 Level 3 or higher certification, ensuring keys never leave the device and are protected against memory-scraping attacks. This aligns with the requirement to keep key management outside the application's memory.

Answer

Cloud Hardware Security Module (CloudHSM)

Answer

Key Management Service (KMS)

Answer

Trusted Platform Module (TPM)

Question 3

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

Accepted Answer

Implement server-side antivirus scanning on all uploaded files before saving.. Option A is correct because scanning files for malware before storage prevents malicious content from reaching the server. Option B is wrong because file extension validation alone is insufficient. Option C is wrong because limiting size does not address malicious content. Option D is wrong because CDN does not inspect file content.

Answer

Store files in a CDN that only serves static content.

Answer

Set a maximum file size limit to 2 MB.

Answer

Restrict file uploads to only image file types by checking the file extension.

Question 4

A company is moving a legacy application to the cloud. The application uses hard-coded passwords for database connections. Which secure development practice should be implemented to address this issue?

Accepted Answer

Secrets management. Hard-coded passwords in application code violate the principle of least privilege and create a persistent security risk if the code is exposed. Secrets management (D) addresses this by storing database credentials in a secure, centralized vault (e.g., HashiCorp Vault, AWS Secrets Manager) and retrieving them at runtime via API calls, eliminating the need to embed passwords in source code or configuration files.

Answer

Multi-factor authentication

Answer

Input validation

Answer

Encryption at rest

Question 5

A healthcare SaaS company runs containerized microservices on Google Kubernetes Engine (GKE). The security team scans containers with a vulnerability scanner and finds that base images have several critical vulnerabilities. The container build process uses a Dockerfile that pulls the latest Ubuntu image from Docker Hub. The team wants to reduce the attack surface without delaying feature releases. What is the best approach?

Accepted Answer

Adopt minimal hardened base images and integrate vulnerability scanning into CI/CD. Option D is correct because using minimal hardened images (e.g., distroless) reduces vulnerabilities and attack surface. Option A (weekly patching) leaves windows open. Option B (rebuild from scratch) is time-consuming and error-prone. Option C (network segmentation) does not address vulnerable images.

Answer

Place a network security policy to restrict outbound traffic from pods

Answer

Schedule weekly automated rebuilds with the latest base image

Answer

Refactor all applications to use scratch as base image

Question 6

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Option C is correct because integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 7

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The egress rule allows all outbound traffic (all ports to any IP). Restricting egress to specific ports reduces the attack surface. The ingress is already restricted to VPC CIDR. Removing ingress would break functionality. Broader ingress is worse. Changing protocol does not improve security.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 8

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Running containers with a non-root user is a fundamental security best practice because it limits the potential damage from a container breakout. By default, Docker containers run as root, which means if an attacker compromises the container, they have root privileges on the host kernel. Using the USER directive in a Dockerfile or specifying a non-root user at runtime reduces the attack surface and enforces the principle of least privilege.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.

Question 9

During a security review, a cloud security architect discovers that a PaaS database service has public network access enabled. The application team claims they need it for external integrations. What is the most secure alternative to allow necessary access?

Accepted Answer

Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.. Option C is correct because private link creates a private endpoint, eliminating exposure to the public internet. Option A is wrong because firewall rules still allow public IP addresses. Option B is wrong because it changes the service but still may have public exposure. Option D is wrong because it is not a security control.

Answer

Encrypt all data at rest and in transit to the database.

Answer

Move the database to a VM-hosted instance with a VPN connection.

Answer

Restrict public access using IP whitelisting to only required external IPs.

Question 10

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 11

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Option C is correct because dedicated secrets management services (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provide centralized, auditable, and policy-controlled storage for secrets like API keys and database credentials. These services enforce encryption at rest (e.g., using envelope encryption with AWS KMS) and in transit (TLS 1.2+), and support automatic rotation, reducing the risk of exposure compared to ad-hoc methods.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 12

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

Accepted Answer

OAuth 2.0 with client credentials. OAuth 2.0 with the client credentials grant is the most appropriate mechanism for machine-to-machine API access because it allows the API to authenticate the third-party application itself (the client) using a client ID and client secret, without involving end-user credentials. This grant type is specifically designed for server-to-server integrations where the client is acting on its own behalf, providing a secure, token-based approach that avoids sharing long-lived secrets directly with each API call.

Answer

Basic authentication with API keys

Answer

SAML 2.0

Answer

X.509 certificates

Question 13

Which THREE of the following are valid techniques to protect application programming interfaces (APIs) from abuse?

Accepted Answer

Use API gateways to enforce authentication and authorization policies.. API gateways act as a centralized policy enforcement point, intercepting all API traffic to validate authentication (e.g., OAuth 2.0, SAML) and authorization (e.g., RBAC, ABAC) before requests reach backend services. This prevents unauthorized access and ensures that only authenticated clients with proper permissions can invoke protected endpoints, directly mitigating abuse such as credential stuffing or privilege escalation.

Answer

Use JSON Web Tokens (JWT) without encryption.

Answer

Use only HTTP GET requests for all API calls.

Question 14

A cloud application experiences intermittent failures during peak load. Logs show database connection timeouts. Which architecture change would best address this issue?

Accepted Answer

Implement connection pooling. Connection pooling reuses a set of established database connections, avoiding the overhead of repeatedly opening and closing connections during high concurrency. This directly resolves intermittent timeouts caused by connection exhaustion or slow connection establishment under peak load, without requiring additional infrastructure.

Answer

Enable auto-scaling on the application tier

Answer

Use read replicas

Answer

Increase database instance size

Question 15

A developer needs to store session state for a cloud-based web application. Which of the following is the most secure approach?

Accepted Answer

Store session data in an encrypted server-side storage. Option A is correct because storing session state in encrypted server-side storage ensures that session data is never exposed to the client, mitigating risks of tampering, replay, or information disclosure. Encryption at rest (e.g., using AES-256) protects against unauthorized access to the storage layer, while server-side control prevents client-side manipulation of session tokens or data. This approach aligns with the principle of least privilege and is recommended by OWASP for secure session management in cloud applications.

Answer

Store session data in a database with SSL

Answer

Store session data in client-side cookies

Answer

Store session data in a distributed cache