CCSP Practice Test 25 — 15 Questions

Question 1

An organization is evaluating a cloud service provider and reviewing their SLA. Which THREE metrics are most important for assessing the provider's reliability and accountability? (Choose three.)

Accepted Answer

Frequency of performance reporting. Option B (Frequency of performance reporting) is correct because an SLA's reporting cadence determines how often the provider must disclose measured performance against targets, giving the customer the visibility needed to verify reliability and hold the provider accountable. Option C (Service credits or compensation for downtime) is correct because financial remedies such as service credits are the primary contractual enforcement mechanism that makes the provider accountable when availability commitments are missed. Option E (Monthly uptime percentage guarantee) is correct because the uptime percentage (for example, 99.9% or 99.95%) is the core quantitative reliability commitment against which actual availability is measured. Option A (Number of data center employees) does not belong because headcount is not a defined SLA reliability or accountability metric and does not reflect service availability. Option D (Provider's stock price) does not belong because stock price is a financial-market indicator unrelated to the contractual service levels in an SLA.

Answer

Number of data center employees

Answer

Provider's stock price

Question 2

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

Accepted Answer

Checkov. Checkov is a static analysis tool purpose-built for scanning Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes) against security and compliance policies. It has built-in policies that flag S3 buckets with public ACLs or policies, making it the right fit for preventing public-read S3 deployments.

Answer

GitGuardian

Answer

Snyk

Answer

Dependabot

Question 3

A company identifies a high-risk vulnerability in a cloud application. The cost to remediate is significantly higher than the potential loss from exploitation. Which risk treatment strategy is most appropriate?

Accepted Answer

Acceptance. When the cost to remediate a vulnerability exceeds the potential loss from exploitation, the most appropriate risk treatment strategy is acceptance. This means the organization formally acknowledges the risk and chooses to tolerate it without implementing additional controls, often documented in a risk register. In cloud environments, this is common for low-impact, high-cost vulnerabilities where the business decides the residual risk is within its risk appetite.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation

Question 4

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Option C is correct because a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) centralizes storage, enforces access control via IAM policies, and provides audit logging and programmatic retrieval, which is the recommended pattern for cloud applications. Option D is correct because regularly rotating secrets limits the blast radius of a leaked credential and is a core requirement of standards like PCI DSS and NIST SP 800-57; managed services can automate rotation via Lambda or native rotation policies. Option E is correct because secrets must be encrypted at rest (e.g., AES-256 via KMS) and in transit (TLS 1.2+) to prevent exposure from compromised storage or network interception. Option A is not a best practice because embedding secrets in application logs exposes them to anyone with log access and defeats the purpose of secret confidentiality. Option B is not a best practice because storing secrets in version control repositories persists them in history, making them retrievable even after deletion and widely accessible to anyone with repo access.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 5

A multinational corporation runs its critical applications on a cloud platform. The security team has implemented a Security Information and Event Management (SIEM) solution that collects logs from various cloud services, including virtual machines, storage, and databases. The SIEM is configured to generate alerts based on predefined rules. Recently, the team noticed an increase in false positive alerts, causing alert fatigue among the analysts. Additionally, there is a lack of context in the alerts, making it difficult to triage and prioritize incidents. The team wants to improve the efficiency of the SOC without increasing headcount. Which of the following is the BEST course of action to address these issues?

Accepted Answer

Deploy a user and entity behavior analytics (UEBA) tool to baseline normal behavior and generate alerts based on anomalies.. UEBA uses machine learning to establish baselines of normal user and entity behavior, then generates alerts only when deviations occur. This directly reduces false positives by filtering out benign anomalies and enriches alerts with behavioral context, enabling analysts to triage and prioritize incidents more efficiently without increasing headcount.

Answer

Assign more analysts to manually review and tune the alert rules.

Answer

Implement automated response playbooks for the most common alerts to reduce analyst workload.

Answer

Increase the threshold levels for all alert rules to reduce the number of alerts generated.

Answer

Create additional correlation rules to capture more specific attack patterns.

Question 6

Which THREE of the following are key considerations when designing a key management lifecycle for cloud data encryption?

Accepted Answer

Key rotation. Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

Answer

Key usage monitoring

Answer

Key escrow

Question 7

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

Accepted Answer

Enable immutable storage (WORM) on the bucket. Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Answer

Implement data classification labels

Answer

Enable versioning on the storage bucket

Answer

Encrypt data with customer-managed keys

Question 8

In the context of eDiscovery, a legal hold must be placed on data stored in a cloud environment. Which THREE actions should the cloud customer take to ensure the legal hold is effective?

Accepted Answer

Ensure the legal hold prevents both deletion and modification of the data.. Option A is correct because an effective legal hold must preserve data in its original state, meaning it must block both deletion and modification (e.g., via WORM/immutability controls) so the evidence remains authentic and unaltered for litigation. Option D is correct because eDiscovery obligations extend to every copy of potentially relevant data, so the hold must cover backups, snapshots, and cross-region replicas, otherwise a spoliation risk remains in those secondary locations. Option E is correct because the customer typically does not control the underlying cloud infrastructure, so notifying the provider and requesting technical enforcement such as S3 Object Lock, retention policies, or legal-hold flags ensures the hold is actually implemented at the platform level. Option B is wrong because deleting non-relevant data during a hold risks destroying potentially relevant evidence and can constitute spoliation. Option C is wrong because default backup retention policies are provider-controlled, time-limited, and not a substitute for a case-specific legal hold.

Answer

Delete any non-relevant data to reduce storage costs.

Answer

Rely solely on the cloud provider's default backup retention policies.

Question 9

Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can manipulate a server to make HTTP requests to arbitrary destinations, including the cloud metadata endpoint at 169.254.169.254. By exploiting SSRF, an attacker can retrieve temporary credentials associated with the instance's IAM role, leading to cloud account compromise. This is a cloud-specific risk because the metadata endpoint is unique to cloud environments and is a common target for SSRF attacks.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Object Level Authorization (BOLA)

Answer

SQL Injection

Question 10

A cloud security engineer is reviewing incident response procedures for a hybrid cloud environment. During a security incident, the team needs to collect forensic evidence from a compromised virtual machine while preserving its state. Which of the following actions should be taken first?

Accepted Answer

Disconnect the virtual machine from the network. Disconnecting the VM from the network is the first step to prevent further compromise, stop data exfiltration, and preserve the current state of the VM's memory and disk for forensic analysis. This isolates the VM without altering its running state, allowing later snapshot or memory capture. Notifying the provider or installing agents could tip off attackers or modify the system, and taking a snapshot first might capture a compromised state but doesn't stop ongoing malicious activity.

Answer

Take a snapshot of the virtual machine's disk

Answer

Notify the cloud provider

Answer

Install a forensic agent on the virtual machine

Question 11

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Accepted Answer

Description of tests and results. The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Answer

System description

Answer

Opinion letter

Answer

Management's assertion

Question 12

A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?

Accepted Answer

Encrypt the data and then destroy the encryption keys (cryptographic erasure). Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.

Answer

Overwrite the data with multiple patterns of zeros and ones

Answer

Tokenize the data and retain the token mapping

Answer

Delete the data using the cloud provider's API and remove pointers

Question 13

A healthcare organization is migrating patient data to a public cloud. Which legal framework most directly governs the protection of this data?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to protected health information (PHI) in the US, making it the most directly relevant legal framework for healthcare data. GDPR is broader but less specific to US healthcare, and PCI DSS is for payment card data.

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Sarbanes-Oxley Act (SOX)

Answer

General Data Protection Regulation (GDPR)

Question 14

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Accepted Answer

Establishing a VPN for hybrid connectivity. Option A is correct because a VPN (e.g., IPsec or TLS-based tunnel) encrypts traffic between on-premises networks and the cloud, protecting data in transit across hybrid connections. Option C is correct because enforcing HTTPS ensures web application traffic is encrypted with TLS, preventing eavesdropping or tampering over the network. Option E is correct because using TLS 1.2 for API communications encrypts data in transit between clients and services, providing confidentiality and integrity. Option B is not correct because data classification labels identify sensitivity and guide handling but do not themselves encrypt or protect data in transit. Option D is not correct because AES-256 encryption at rest protects stored data, not data moving across a network.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256

Question 15

A financial services company is migrating a critical application to the cloud. They must ensure that the cloud provider supports the ability to conduct forensic investigations in case of a security incident. Which of the following is the MOST important requirement to include in the contract?

Accepted Answer

The provider must grant the customer access to raw logs and the ability to perform memory captures on virtual instances.. Forensic investigations require access to raw logs and the ability to capture memory from virtual instances to analyze incidents. Option A is incorrect because uptime guarantees (99.999%) relate to availability, not forensic capability. Option B is incorrect because automatic patching is a security measure but not specific to forensics. Option D is incorrect because data residency restrictions address data sovereignty, not forensic access.

Answer

The provider must guarantee 99.999% uptime for all cloud services used.

Answer

The provider must automatically patch all virtual machines within 24 hours of patch release.

Answer

The provider must store data only in data centers located within the country of operation.