CCSP Practice Test 24 — 15 Questions

Question 1

A developer accidentally uploaded a file containing API credentials to a public cloud storage bucket. The cloud provider states they cannot guarantee deletion of the object. Which practice could have prevented this incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data loss prevention for cloud storage. Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Answer

Bucket versioning

Answer

Access control lists

Answer

Server-side encryption

Question 2

A company uses a cloud provider's organization management with multiple accounts. A security team wants to ensure that a specific storage bucket in the production account cannot be deleted by anyone, including the account administrator. Which control should be implemented?

Accepted Answer

Apply an organization-level policy to deny the delete action on the bucket for the production account.. An organization-level policy can be applied to an account (or organizational unit) to restrict permissions for all users, roles, and even the account administrator. By attaching a policy that denies the action to delete a storage bucket, the security team ensures that no principal in the production account can delete the specified bucket. This provides a preventive control that overrides any allow permissions within the account.

Answer

Use notifications to alert when a delete is attempted.

Answer

Enable versioning on the bucket.

Answer

Enable audit logging to log any deletion attempt.

Question 3

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.. AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Answer

Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Store the credentials as encrypted environment variables in the Lambda function configuration.

Answer

Hardcode the credentials in the Lambda function code and encrypt the deployment package.

Question 4

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

Accepted Answer

The policy is currently using version v3 as the default.. The DefaultVersionId of an IAM policy indicates which version is currently active and enforced when the policy is attached to an IAM user, group, or role. Since the policy is named S3ReadOnlyAccess and has DefaultVersionId v3, version v3 is the default and is being used for access control decisions. This is the standard behavior for IAM policies in AWS, where you can have multiple versions but only one is designated as the default.

Answer

The policy is newly created.

Answer

The policy has three custom versions.

Answer

The policy cannot be attached to any entity.

Question 5

An organization wants to deploy a cloud environment where multiple separate agencies with common compliance requirements share the infrastructure, but each agency retains some control over their own resources. Which deployment model best fits this scenario?

Accepted Answer

Community cloud. A community cloud is a deployment model where infrastructure is shared by several organizations with common concerns (e.g., compliance, security, jurisdiction). In this scenario, multiple agencies with common compliance requirements share the infrastructure while each retains control over their own resources, which aligns exactly with the community cloud model. This model balances cost-efficiency with the specific needs of a defined community.

Answer

Hybrid cloud

Answer

Public cloud

Answer

Private cloud

Question 6

A cloud provider offers a service with an SLA of 99.999% availability. What is the maximum allowable downtime per year in minutes? (Assume 365 days)

Accepted Answer

5.26 minutes. An SLA of 99.999% availability (often called 'five nines') allows for a maximum of 5.26 minutes of downtime per year. This is calculated by taking the total minutes in a year (365 days × 24 hours × 60 minutes = 525,600 minutes) and multiplying by the allowed unavailability (100% - 99.999% = 0.001%, or 0.00001 as a decimal). 525,600 × 0.00001 = 5.256 minutes, which rounds to 5.26 minutes.

Answer

8.76 minutes

Answer

0.526 minutes

Answer

52.6 minutes

Question 7

An organization is designing a multi-cloud strategy using containers to avoid vendor lock-in. Which of the following approaches BEST ensures portability of containerized applications across different cloud providers?

Accepted Answer

Standardize on Docker images and Kubernetes orchestration with open-source tooling.. Standardizing on Docker images and Kubernetes orchestration with open-source tooling (C) best ensures portability because Docker images are OCI-compliant and Kubernetes is a CNCF-graduated project supported by all major cloud providers. This combination avoids proprietary APIs and allows workloads to be moved between AWS EKS, Azure AKS, Google GKE, or on-premises clusters with minimal changes. Open-source tooling further reduces lock-in by providing consistent APIs and configuration formats.

Answer

Use cloud provider-specific container services like Amazon ECS with proprietary APIs.

Answer

Use nested containers to abstract the underlying cloud provider.

Answer

Deploy containers directly on virtual machines without an orchestration layer.

Question 8

A DevOps team is deploying containers in a Kubernetes cluster. They need to ensure that container images are scanned for vulnerabilities before deployment. Which is the most effective approach?

Accepted Answer

Use a container registry with integrated vulnerability scanning and enforce admission controls.. Integrating vulnerability scanning into the container registry (e.g., using tools like Trivy, Clair, or Amazon ECR scanning) combined with admission controllers (e.g., OPA/Gatekeeper or Kyverno) allows automated scanning of images at rest and blocks deployments of non-compliant images before they enter the cluster. This shift-left approach ensures that only images passing security policies are admitted, preventing vulnerable images from reaching production.

Answer

Scan images manually after deployment.

Answer

Rely on the developer's assurance that images are secure.

Answer

Use a runtime security tool.

Question 9

A multinational corporation operates across multiple cloud providers (AWS, Azure, GCP) and uses a variety of data storage services. They have a requirement to enforce a consistent encryption policy across all providers: all data at rest must be encrypted using a centrally managed key that is rotated every 90 days. The cloud security team is evaluating different key management solutions. They want to minimize operational overhead and avoid vendor lock-in. The team has experience with configuring cloud-native key management services (KMS) but is concerned about managing keys across different regions and providers. Which solution best meets the requirements?

Accepted Answer

Deploy a third-party cloud-agnostic key management solution that supports BYOK and integrates with all providers' KMS. A third-party cloud-agnostic key management solution (e.g., HashiCorp Vault, Thales CipherTrust) that supports Bring Your Own Key (BYOK) allows the organization to centrally manage and rotate a single root key every 90 days, while integrating with each provider's native KMS via external key stores (e.g., AWS KMS custom key store, Azure Key Vault managed HSM, GCP Cloud HSM). This minimizes operational overhead by avoiding manual per-provider policy replication and prevents vendor lock-in by decoupling key management from any single cloud provider's proprietary KMS.

Answer

Use each cloud provider's native KMS and create identical key policies manually

Answer

Store the key in an internal secrets manager and configure each provider's KMS to use that key as a root key

Answer

Implement client-side encryption using a single master key stored in the application configuration

Question 10

An organization is using Azure and wants to centrally collect activity logs from multiple subscriptions into a single Log Analytics workspace for cross-account analysis and retention management. What is the best approach?

Accepted Answer

Use Azure Policy to deploy Diagnostic Settings on each subscription to stream Activity Logs to a central Log Analytics workspace.. Azure Policy can enforce the deployment of Diagnostic Settings across all subscriptions, automatically streaming Activity Logs to a central Log Analytics workspace. This ensures centralized collection, cross-account analysis, and retention management without manual configuration per subscription.

Answer

Use Azure Monitor Agent on all VMs to collect logs.

Answer

Enable Azure Sentinel on each subscription and aggregate using cross-workspace queries.

Answer

Use Azure Storage account with event grid to forward logs to a central location.

Question 11

Which hypervisor type is most commonly deployed in production cloud data centers to host multiple tenant virtual machines?

Accepted Answer

Type 1 bare-metal hypervisor like VMware ESXi. Type 1 (bare-metal) hypervisors run directly on hardware and are used in cloud environments for better performance and isolation.

Answer

Container runtime like Docker

Answer

Para-virtualization interface

Answer

Type 2 hosted hypervisor like VirtualBox

Question 12

A development team is working with production-like data in a non-production cloud environment. To comply with data privacy regulations, sensitive fields must be obscured without being retrievable. Which technique should they apply?

Accepted Answer

Irreversible masking. Irreversible masking (C) is correct because it transforms sensitive data into a non-reversible format, ensuring that the original values cannot be retrieved. This meets the requirement of obscuring production-like data in a non-production environment while complying with data privacy regulations that prohibit reversible transformations. Unlike encryption or tokenization, irreversible masking does not provide any decryption or mapping mechanism, making it suitable for scenarios where data must be permanently de-identified.

Answer

Format-preserving encryption

Answer

Reversible masking

Answer

Tokenization

Question 13

A global enterprise is conducting a cloud risk assessment. Which THREE factors should be considered? (Select three.)

Accepted Answer

Inherent risk of data leaving the on-premises environment. Option B is correct because moving data off-premises introduces inherent risk—loss of direct physical and logical control, jurisdictional exposure, and reliance on the provider's network and encryption—which is a core element of any cloud risk assessment. Option D is correct because concentration risk (vendor lock-in and dependence on a single provider) can create systemic exposure; if that provider suffers an outage, breach, or business failure, the enterprise's operations are broadly impacted, so it must be evaluated. Option E is correct because the effectiveness of the provider's controls must be verified through independent audit reports (e.g., SOC 2 Type II, ISO/IEC 27001 certifications, or CSA STAR), which provide evidence that security, availability, and confidentiality controls actually operate as claimed. Option A is not relevant because a logo's color has no bearing on security, compliance, or operational risk. Option C is not relevant because stock price reflects market performance, not the provider's control effectiveness or the enterprise's risk exposure.

Answer

Color of the provider's logo

Answer

Provider's stock price

Question 14

Which THREE of the following are required components of a cloud data lifecycle policy?

Accepted Answer

Data deletion procedures. Data deletion procedures are a required component of a cloud data lifecycle policy because they define how data is securely and irreversibly removed at the end of its useful life. This includes methods such as cryptographic erasure, overwriting with patterns (e.g., NIST SP 800-88), or degaussing, ensuring compliance with legal and regulatory requirements. Without explicit deletion procedures, data may persist in cloud storage, leading to unauthorized access or retention violations.

Answer

Legal hold process

Answer

Data encryption algorithm selection

Question 15

Which design principle is MOST directly concerned with the ability to move workloads between cloud providers or back on-premises without significant re-architecture?

Accepted Answer

Portability. Portability is the design principle concerned with the ability to move workloads, data, and applications between cloud providers or back on-premises without significant re-architecture. It emphasizes avoiding proprietary lock-in through open standards, containers, and abstraction layers. The scenario's phrase 'move workloads between cloud providers or back on-premises without significant re-architecture' is the definition of portability.

Answer

Reversibility

Answer

Isolation

Answer

Elasticity