CCSP Practice Test 2 — 25 Questions

Question 1

An enterprise uses a cloud access security broker (CASB) to protect data in cloud applications. They want to prevent users from uploading files containing credit card numbers to a cloud storage service. Which CASB feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies are the correct CASB feature because they allow the enterprise to define content inspection rules that scan files for sensitive data patterns, such as credit card numbers (matching Luhn algorithm or regex patterns like those in PCI DSS). When a match is detected, the CASB can block the upload, quarantine the file, or trigger an alert, directly preventing data exfiltration to the cloud storage service.

Answer

Encryption in transit settings

Answer

User activity monitoring

Answer

Single sign-on (SSO) integration

Question 2

An organization wants to ensure that its CSP does not access customer data for any purpose other than providing the service. Which clause should be included?

Accepted Answer

Data use restriction. A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

Answer

Right to audit

Answer

Security incident response

Answer

Non-disclosure agreement

Question 3

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 4

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 5

An organization uses a private artifact registry for approved package sources. A developer accidentally publishes a package with a similar name to an internal package to the public registry. This could lead to which type of attack?

Accepted Answer

Dependency confusion. Dependency confusion occurs when a package manager (e.g., npm, pip, Maven) resolves a package name to a public registry instead of a private one, because the public registry has a package with the same or similar name. In this scenario, the developer accidentally published a package with a similar name to the public registry, so internal builds may fetch that malicious public package instead of the intended internal one, leading to arbitrary code execution in the build pipeline.

Answer

Cross-site request forgery (CSRF)

Answer

Denial of service (DoS)

Answer

Man-in-the-middle (MITM)

Question 6

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Accepted Answer

One month. GDPR requires the controller to respond to data subject requests without undue delay and in any event within one month of receipt.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 7

A company's cloud security policy mandates strict control over encryption keys used for data at rest. Which THREE practices are recommended for secure key management in the cloud?

Accepted Answer

Rotate encryption keys on a regular schedule.. Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Answer

Use a single master key for all encryption operations.

Answer

Store keys in the same cloud region as the data to reduce latency.

Question 8

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

Accepted Answer

HTTP-only cookies with Secure and SameSite flags. HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Answer

sessionStorage

Answer

URL query parameters

Answer

localStorage

Question 9

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users

Question 10

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 11

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 12

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 13

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

Accepted Answer

The policy allows anonymous read access to all objects in the bucket. The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.

Answer

The policy does not restrict access to specific IP addresses

Answer

Any unencrypted request is denied, which could cause data loss if encryption fails

Answer

The policy requires server-side encryption, but does not enforce it for all requests

Question 14

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 15

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. The correct best practices are A (using separate keys per tenant/application) and D (regular key rotation). Option B (hard-coding keys) is a security risk. Option C (storing keys in the same region) is not a security best practice. Option E (single master key) defeats the purpose of encryption key separation.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.

Question 16

In a DevSecOps pipeline for a cloud application, which practice best ensures that only approved open-source components are used?

Accepted Answer

Using a private artifact registry with allow-lists. A private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.

Answer

Signing container images

Answer

Implementing dependency scanning with Snyk

Answer

Running SAST scans on all source code

Question 17

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 18

A financial institution is migrating sensitive transaction data to the cloud. They must comply with a regulation that requires data to be retained for 7 years, but also support immediate legal holds. The cloud storage service offers object lock with governance mode. What is the best practice to ensure compliance?

Accepted Answer

Use object lock in governance mode with a 7-year retention period and grant legal hold permissions to authorized users. Governance mode allows authorized users to override retention settings for legal holds while still enforcing a 7-year minimum retention period. This balances compliance with the need for immediate legal holds, as users with appropriate permissions can place a legal hold on objects without extending the retention period for all data.

Answer

Use object lock in compliance mode with a 7-year retention period

Answer

Apply a lifecycle policy to delete objects after 7 years and rely on backups

Answer

Encrypt all objects with a client-managed key and store deletion timestamps in a database

Question 19

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Accepted Answer

API keys in URLs are often logged in plaintext in server logs and browser history.. The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Answer

API keys in query strings are not encrypted, even with HTTPS.

Answer

API keys provide weak authentication because they are not tied to a user session.

Answer

API keys are not valid for use in query strings; they require a certificate.

Question 20

During a cloud migration, a company discovers that some sensitive data was inadvertently stored in an object storage bucket with public read access. The security team needs to determine the scope of exposure and remediate. What is the FIRST step they should take?

Accepted Answer

Review the bucket's access logs to identify any unauthorized access.. The first step is to review the bucket's access logs (e.g., AWS CloudTrail or S3 server access logs) to identify any unauthorized access. This determines the scope of exposure—who accessed the data, when, and from where—before taking any remediation action. Without this forensic step, the company cannot assess breach notification obligations or legal liability.

Answer

Notify the data protection authority.

Answer

Change the bucket's permission to private.

Answer

Immediately delete all objects in the bucket.