CCSP Practice Test 3 — 25 Questions

Question 1

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

Accepted Answer

Create a hardened baseline image and store it in a secure repository.. Creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Answer

Use a golden image from the cloud provider's marketplace.

Answer

Rely on host-based firewalls to protect instances.

Answer

Perform vulnerability scanning on running instances only.

Question 2

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

Accepted Answer

The cloud service provider.. In a cloud shared responsibility model, the hypervisor is part of the underlying infrastructure that the cloud service provider (CSP) manages. The CSP is responsible for patching the hypervisor because it controls the virtualization layer that separates tenant workloads. Customers are responsible only for securing their guest operating systems and applications, not the hypervisor itself.

Answer

The customer.

Answer

The regulatory authority.

Answer

A third-party auditor.

Question 3

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

Accepted Answer

Cloud External Key Manager (EKM). Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Answer

Cloud KMS with software keys

Answer

Cloud KMS with hardware keys

Answer

Cloud HSM

Question 4

A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?

Accepted Answer

Configure the cloud service to require all API requests to go through a proxy that enforces DLP. Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.

Answer

Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN

Answer

Implement a conditional access policy to block non-corporate devices

Answer

Use tokenization to replace sensitive data before allowing API access

Question 5

A cloud security team needs to ensure that an Amazon EC2 instance hosting a regulated workload cannot communicate with the public internet, but the instance must still be able to download OS patches from an internal repository and retrieve secrets from AWS Secrets Manager. The workload runs in a private subnet with no NAT gateway or internet gateway route. Which combination of configurations will meet these requirements with the LEAST operational overhead?

Accepted Answer

Create VPC interface endpoints (AWS PrivateLink) for Secrets Manager and an S3 gateway endpoint for the patch repository, and associate the endpoints with the private subnet's route table and security group.. VPC interface endpoints (AWS PrivateLink) and S3 gateway endpoints let resources in private subnets reach AWS services entirely over the AWS private network, with no internet gateway, NAT, or public IP required. This satisfies the no-internet constraint, supports both patch retrieval and secret access, and requires minimal ongoing operational effort compared to firewall or NAT-based designs.

Answer

Attach an internet gateway to the VPC and use a security group that allows only outbound HTTPS to the patch server and Secrets Manager endpoints.

Answer

Place the instance in a public subnet and use an AWS Network Firewall policy to block all outbound traffic except the patch server and Secrets Manager IP ranges.

Answer

Deploy a NAT gateway in a public subnet and update the private subnet route table to direct 0.0.0.0/0 through the NAT gateway, then restrict outbound traffic using network ACLs.

Question 6

A cloud customer is subject to the EU GDPR and stores personal data with a provider that replicates it across data centers in several countries. The customer's legal team must confirm that appropriate safeguards exist for each international transfer. Which TWO elements are required for a valid transfer under GDPR Chapter V? (Choose two.)

Accepted Answer

A transfer impact assessment documenting the destination country's laws and any supplementary measures. A valid Chapter V transfer needs a legal mechanism, such as an adequacy decision or Standard Contractual Clauses, plus a documented transfer impact assessment that evaluates destination-country laws and any supplementary measures. Certifications and registrations may support due diligence but are not transfer mechanisms. When data is replicated across several countries, both elements must cover every jurisdiction where personal data resides or is accessible.

Answer

A SOC 2 Type II report covering the provider's security controls in each region

Answer

Registration of the cloud provider as a data controller with the customer's supervisory authority

Answer

An ISO/IEC 27701 certification held by the cloud provider

Question 7

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 8

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 9

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 10

Which TWO statements about data masking are correct?

Accepted Answer

Data masking replaces sensitive data with realistic fictional data.. Data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Answer

Data masking is a form of encryption.

Answer

Data masking is primarily used for production environments.

Answer

Data masking is reversible.

Question 11

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Answer

AWS Config configuration history

Answer

AWS CloudTrail management events

Answer

Amazon S3 access logs

Question 12

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

Accepted Answer

Encrypt data client-side before uploading to the cloud.. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Answer

Enable detailed audit logging of all data access.

Answer

Implement strict IAM policies for CSP employees.

Answer

Enable server-side encryption with customer-provided keys.

Question 13

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. A Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 14

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 15

Which practice is most effective for preventing the deployment of container images with known vulnerabilities in a DevSecOps pipeline?

Accepted Answer

Image scanning in CI pipeline before push. Scanning images in the CI pipeline before they are pushed to a registry catches known vulnerabilities (CVEs) at the earliest possible stage, preventing flawed images from ever reaching production. This 'shift-left' approach blocks the build or fails the pipeline when critical vulnerabilities are found, so vulnerable images never get deployed. It is the most effective preventive control because it stops the problem at the source.

Answer

Post-deployment vulnerability scanning

Answer

Using only official base images

Answer

Runtime monitoring with a WAF

Question 16

A cloud customer must comply with GDPR's right to erasure (right to be forgotten). Which TWO of the following are technical challenges the customer faces when the data is stored in a cloud object storage service with versioning and cross-region replication?

Accepted Answer

Removing previous versions of objects. Option B is correct because object storage versioning retains every prior version of an object, so a GDPR erasure request cannot be satisfied by simply deleting the current object; the customer must also enumerate and permanently remove all noncurrent versions (e.g., via S3 versioning delete markers plus explicit version deletion or lifecycle expiration). Option E is correct because cross-region replication creates additional copies in other regions, and the right to erasure requires those replicas to be deleted as well, which is technically challenging due to replication lag, delete-marker propagation behavior, and the need to verify deletion in every target region. Option A is not a right-to-erasure challenge but an access-control/network-restriction concern, typically handled with bucket policies, VPC endpoints, or IP conditions. Option C concerns encryption key management and confidentiality, not the deletion of data. Option D relates to data portability under GDPR Article 20, not the right to erasure under Article 17.

Answer

Ensuring data is accessible only via a specific IP range

Answer

Encrypting the data at rest with customer-managed keys

Answer

Exporting data in a machine-readable format

Question 17

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Answer

VPC Flow Logs

Answer

Cloud DNS logs

Answer

Cloud Monitoring metrics

Question 18

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Answer

GDPR

Answer

HIPAA

Answer

ISO 27001

Question 19

Which risk assessment method uses subjective scales to assign probabilities and impacts?

Accepted Answer

Qualitative risk assessment. Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Answer

Semi-quantitative risk assessment

Answer

Quantitative risk assessment

Answer

Bottom-up risk assessment

Question 20

An organization uses Azure Functions and wants to secure its API endpoints exposed via Azure API Management. Which TWO security controls should they implement at the API Gateway level?

Accepted Answer

Enable TLS enforcement. Option C (Enable TLS enforcement) is correct because enforcing TLS at the API Management gateway ensures all client-to-gateway traffic is encrypted in transit using HTTPS, protecting credentials and tokens from interception, and API Management supports configuring the minimum TLS version and cipher suites on the gateway. Option D (Implement JWT validation) is correct because API Management has a built-in validate-jwt policy that verifies the signature, issuer, audience, and expiration of OAuth 2.0/OpenID Connect bearer tokens at the gateway, so unauthenticated or tampered requests are rejected before reaching the backend Functions. Option A is not a gateway-level authentication control and whitelisting 'all users' is contradictory and impractical for public APIs. Option B is a backend configuration concern for the Function app, not a control applied at the API Gateway. Option E is wrong because disabling API keys removes a subscription-based access control rather than adding security at the gateway.

Answer

Configure IP whitelisting for all users

Answer

Store secrets in Azure Function environment variables

Answer

Disable API keys