CCSP Practice Test 2 — 25 Questions

Question 1

A healthcare organization stores patient records in a cloud-based object storage service. To comply with HIPAA, they must ensure that data is encrypted at rest and that encryption keys are managed by the organization itself. Which key management approach should they implement?

Accepted Answer

Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.. Option D is correct because HIPAA requires the organization to maintain control over encryption keys, and a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud allows the healthcare organization to generate, store, and manage their own keys externally while using them for cloud-based encryption. This approach ensures that the cloud provider cannot access the keys, meeting the regulatory requirement for key management by the organization itself.

Answer

Use server-side encryption with S3-managed keys (SSE-S3).

Answer

Use server-side encryption with AWS KMS-managed keys (SSE-KMS).

Answer

Use client-side encryption with customer-supplied encryption keys (CSEKS).

Question 2

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 3

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Option A is correct because under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 4

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 5

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.. A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.

Answer

Use shared API keys embedded in each service's configuration.

Answer

Implement TLS termination at the load balancer with internal certificates.

Answer

Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.

Question 6

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 7

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. Option A is correct because the bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 8

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.. AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Answer

Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Store the credentials as encrypted environment variables in the Lambda function configuration.

Answer

Hardcode the credentials in the Lambda function code and encrypt the deployment package.

Question 9

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Question 10

An organization is migrating a legacy application to the cloud and must comply with PCI DSS. The application currently logs credit card numbers in plaintext. Which data security control should be implemented FIRST?

Accepted Answer

Perform data discovery and classification. Before any remediation can be applied, the organization must first perform data discovery and classification to locate where all credit card numbers (PANs) are stored, including logs, databases, and backups. PCI DSS Requirement 3.1 mandates that cardholder data be identified and classified before implementing controls like tokenization or encryption. Without discovery, subsequent controls may miss critical data stores, leaving plaintext PANs exposed.

Answer

Implement tokenization for credit card numbers

Answer

Deploy a data loss prevention (DLP) solution

Answer

Encrypt the database at rest

Question 11

Which TWO of the following are key components of a cloud incident response plan that should be tested regularly?

Accepted Answer

Automation playbooks for containment and eradication.. Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.

Answer

Encryption key management procedures.

Answer

Backup and restore procedures.

Answer

Service level agreements (SLAs) with cloud provider.

Question 12

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

Accepted Answer

Modify the bucket policy to deny access from all IP addresses except trusted ranges.. The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Answer

Enable bucket logging to track access attempts.

Answer

Notify the security team and wait for a formal change request.

Answer

Enable server-side encryption on the bucket.

Question 13

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Option B is correct because client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 14

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 15

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

Accepted Answer

Ensure cryptographic operations use constant-time algorithms.. Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Answer

Implement virtual LANs (VLANs) and firewall rules between tenants.

Answer

Use hardware security modules (HSMs) for key management.

Answer

Enforce strict API rate limiting for each tenant.

Question 16

A company uses a cloud key management service (KMS) and wants to ensure that keys can be used only within a specific geographic region. Which of the following should be configured?

Accepted Answer

Key policy with a condition for allowed regions. Option C is correct because a key policy with a condition using the `kms:CallerRegion` or `aws:RequestRegion` condition key can explicitly restrict the geographic region where the KMS key can be used. This ensures that any cryptographic operation (e.g., Encrypt, Decrypt) attempted from an unauthorized region is denied, enforcing regional data sovereignty requirements.

Answer

VPC endpoint for KMS

Answer

CloudTrail logging

Answer

Key rotation policy

Question 17

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. Option A is correct because NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 18

A multinational corporation uses a cloud CASB to enforce data loss prevention (DLP) policies across SaaS applications. The security team discovers that sensitive data is being exfiltrated via encrypted traffic that the CASB cannot inspect. What is the most effective design change to mitigate this risk?

Accepted Answer

Deploy a forward proxy with SSL/TLS interception capabilities.. Option C is correct because a forward proxy with SSL/TLS interception capabilities allows the CASB to decrypt, inspect, and re-encrypt traffic, enabling DLP policy enforcement on data in transit. This design change addresses the root cause—encrypted traffic bypassing inspection—without breaking application functionality or security.

Answer

Implement user training to prevent data exfiltration.

Answer

Block all encrypted traffic at the network perimeter.

Answer

Disable TLS/SSL encryption for all sensitive data transfers.

Question 19

A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?

Accepted Answer

New key material is generated, and the old key material is retained for decryption.. Option C is correct because cloud KMS services (e.g., AWS KMS, Azure Key Vault) implement automatic key rotation by generating new cryptographic key material while retaining the old key material. This allows data encrypted with the previous key version to still be decrypted, as the old key material is not destroyed but simply marked as retired for encryption operations.

Answer

The key ID changes after each rotation.

Answer

The old key is immediately destroyed after rotation.

Answer

All data encrypted with the old key must be re-encrypted.

Question 20

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) for cloud applications?

Accepted Answer

Security regression testing to validate that new code does not reintroduce vulnerabilities.. Security regression testing (C) is essential because it ensures that new code changes do not reintroduce previously fixed vulnerabilities, which is critical in the continuous integration/continuous delivery (CI/CD) pipelines typical of cloud applications. This testing validates that security patches remain effective across rapid iterations, directly supporting the 'verify' phase of the SSDLC.

Answer

Manual penetration testing after every code commit.

Answer

Security awareness training for all developers.