CCSP Practice Test 3 — 25 Questions

Question 1

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that requires tags on resource creation.. AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.

Answer

Use AWS Resource Groups to create a group that filters tagged instances.

Answer

Enable CloudTrail to monitor instance launches and alert on missing tags.

Answer

Configure AWS Config rules to automatically tag untagged instances.

Question 2

An administrator configured the above key policy for a KMS key used to encrypt S3 backup data. The backup role 'BackupRole' is in the same account. However, when the backup service attempts to use the key to decrypt objects, the operation fails. What is the most likely cause?

Accepted Answer

The 'kms:ViaService' condition restricts calls to those originating from S3, but the backup service uses direct KMS API. The 'kms:ViaService' condition key restricts KMS API calls to those that originate from a specific AWS service, in this case S3. However, the backup service is likely making direct KMS API calls (e.g., Decrypt) rather than having S3 proxy the request, so the condition fails. The key policy explicitly denies access unless the call comes via S3, which is why decryption fails.

Answer

The principal ARN is incorrect because the role name contains uppercase letters

Answer

The key policy requires a grant token that is not being provided

Answer

The action list does not include 'kms:Decrypt' for S3

Question 3

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Accepted Answer

2. The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Answer

12

Answer

4

Answer

3

Question 4

An organization wants to ensure that if they decide to migrate away from their current cloud provider, they can retrieve all data in a usable format and delete it from the provider's systems. Which principle does this best describe?

Accepted Answer

Reversibility. Reversibility is the ability to cleanly exit a cloud service, including data portability and secure deletion of data from the provider's environment.

Answer

Interoperability

Answer

Portability

Answer

Elasticity

Question 5

A company uses a cloud provider's key management service. They want to rotate keys automatically every 90 days. What is the correct way to achieve this?

Accepted Answer

Enable automatic key rotation in the KMS settings.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) offer a built-in automatic key rotation feature that can be configured to rotate the key material every 90 days without any manual intervention. Enabling this setting ensures that new cryptographic material is generated for the key, while the old key material remains available for decrypting data encrypted with it, maintaining seamless security compliance.

Answer

Manually update the key alias each quarter.

Answer

Create a new key and update all applications to use it.

Answer

Use a third-party HSM.

Question 6

A DevOps team is deploying containers in a Kubernetes cluster. They need to ensure that container images are scanned for vulnerabilities before deployment. Which is the most effective approach?

Accepted Answer

Use a container registry with integrated vulnerability scanning and enforce admission controls.. Integrating vulnerability scanning into the container registry (e.g., using tools like Trivy, Clair, or Amazon ECR scanning) combined with admission controllers (e.g., OPA/Gatekeeper or Kyverno) allows automated scanning of images at rest and blocks deployments of non-compliant images before they enter the cluster. This shift-left approach ensures that only images passing security policies are admitted, preventing vulnerable images from reaching production.

Answer

Scan images manually after deployment.

Answer

Rely on the developer's assurance that images are secure.

Answer

Use a runtime security tool.

Question 7

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 8

A security analyst reviews the bucket policy above. What is the primary security concern?

Accepted Answer

The bucket policy allows public read access to all objects. The bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.

Answer

The bucket policy uses an outdated version

Answer

The bucket policy is missing a Condition element

Answer

The bucket policy allows public write access to all objects

Question 9

A cloud application uses an API that allows users to view other users' profile details by changing the user ID in the request. Which vulnerability is this?

Accepted Answer

Broken object level authorization (BOLA). Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), occurs when an application does not properly verify that the user has permission to access a specific object, such as another user's profile.

Answer

Mass assignment

Answer

Broken authentication

Answer

Excessive data exposure

Question 10

Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?

Accepted Answer

Platform as a Service (PaaS). This is the definition of Platform as a Service (PaaS) per NIST SP 800-145. The consumer manages applications and data, while the provider manages everything else.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Question 11

A cloud security administrator needs to ensure that all API calls to the cloud provider's management plane are logged for audit purposes. Which service should be enabled?

Accepted Answer

Cloud audit logging service. The cloud audit logging service (e.g., AWS CloudTrail) records API calls for auditing. Option A (monitoring) focuses on performance metrics. Option B (configuration) tracks resource changes but not all API calls. Option D (threat detection) is for security threats.

Answer

Cloud configuration service

Answer

Cloud threat detection service

Answer

Cloud monitoring service

Question 12

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 13

A company is negotiating a cloud contract and wants to ensure data ownership and deletion. Which TWO clauses should be included? (Select two.)

Accepted Answer

Data ownership clause. Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Answer

Right to audit clause

Answer

Non-disclosure agreement

Answer

Service level agreement

Question 14

During an audit of a containerized application, you notice that containers are running with the --privileged flag. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Container escape to the host. Privileged containers have nearly all capabilities of the host, significantly increasing the risk of container escape and host compromise.

Answer

Increased memory consumption

Answer

Inability to use secure base images

Answer

Excessive network bandwidth usage

Question 15

A financial institution is implementing a data classification scheme for their cloud environment. They have data that, if exposed, could cause severe damage to the organization and is subject to strict regulatory requirements. Which classification level should be applied to this data?

Accepted Answer

Restricted. Restricted data is the highest classification level, typically used for data that, if compromised, could cause severe damage and is subject to strict regulations.

Answer

Confidential

Answer

Public

Answer

Internal

Question 16

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Image signing, vulnerability scanning, and using admission controllers to verify signatures ensure integrity and trust.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag

Question 17

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

Accepted Answer

It enables early detection of vulnerabilities before deployment. Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

Answer

It identifies runtime vulnerabilities such as SQL injection

Answer

It reduces false positives compared to dynamic analysis

Answer

It scans running applications to find configuration issues

Question 18

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for early detection of vulnerabilities during the coding phase of the SSDLC. By integrating SAST into the CI/CD pipeline, developers receive immediate feedback on security flaws such as SQL injection or buffer overflows, enabling remediation before the code is built or deployed. This aligns with the 'shift left' principle, catching issues when they are cheapest and easiest to fix.

Answer

Penetration testing in production

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 19

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Dedicated secrets management services (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provide centralized, auditable, and policy-controlled storage for secrets like API keys and database credentials. These services enforce encryption at rest (e.g., using envelope encryption with AWS KMS) and in transit (TLS 1.2+), and support automatic rotation, reducing the risk of exposure compared to ad-hoc methods.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 20

A startup provides a cloud-based document collaboration platform. They store user-uploaded documents in a cloud object storage bucket. Compliance with data privacy laws requires that when a user deletes an account, all their documents must be permanently deleted within 30 days. The current process uses object versioning and lifecycle policies to expire objects after 30 days. However, during a recent audit, it was discovered that deleted user documents were still accessible via the bucket's previous versions for months after the deletion. The security team needs to ensure that all traces of a user's data are removed immediately upon account deletion. Which solution should be implemented?

Accepted Answer

Use a lifecycle policy to permanently delete current and previous object versions immediately after the user deletion request.. Object versioning in cloud storage (e.g., AWS S3) retains both current and previous versions of objects. A lifecycle policy that immediately expires both current and noncurrent versions upon user deletion ensures that all copies of the data are permanently removed, satisfying the 30-day compliance requirement. Without explicitly targeting previous versions, the default lifecycle policy only deletes current versions, leaving older versions accessible indefinitely.

Answer

Configure bucket policies to deny read access to all objects after the user deletion date.

Answer

Change the bucket's default encryption to use customer-managed keys and delete the key after 30 days.

Answer

Enable MFA Delete on the bucket to require additional authentication for deletions.