CCSP Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. A security engineer has attached the above IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user can upload objects only if they specify server-side encryption with AES256.. Option D is correct because the IAM policy uses a `Condition` block with `s3:x-amz-server-side-encryption` set to `AES256`. This condition ensures that any `s3:PutObject` request must include the `x-amz-server-side-encryption` header with the value `AES256`. Without this header or with a different encryption value, the request is denied. The `Deny` effect overrides any `Allow` that might exist, so the user is forced to specify SSE-S3 (AES-256) encryption on every upload.

Answer

The user can upload objects only to the my-bucket bucket with no restrictions.

Answer

The user can upload objects only if they use customer-managed KMS keys.

Answer

The user is denied from uploading objects without encryption.

Question 2

A cloud application processes credit card numbers. To reduce PCI DSS scope, the company wants to remove the original PAN from its databases and use a surrogate value that can be reversed only by a privileged application. Which data protection technique should they use?

Accepted Answer

Tokenization using a cloud-based token vault. Tokenization replaces the original PAN with a randomly generated surrogate value (token) that has no mathematical relationship to the original data. The token can be reversed only by a privileged application that has access to the token vault, which stores the mapping between tokens and actual PANs. This effectively removes the PAN from the application's databases, reducing PCI DSS scope because the tokenized data is not considered sensitive cardholder data.

Answer

Truncation of the first 6 and last 4 digits

Answer

Dynamic data masking in the application tier

Answer

Symmetric encryption with a key stored in the database

Question 3

A cloud architect is designing a data classification scheme for a SaaS application. Data must be classified based on sensitivity and regulatory requirements. Which of the following is the PRIMARY reason to classify data?

Accepted Answer

To apply appropriate security controls based on data sensitivity. The primary reason to classify data in a cloud environment is to enable the application of appropriate security controls based on data sensitivity. Classification drives the selection of encryption standards, access control policies, and data loss prevention (DLP) rules, ensuring that sensitive data receives stronger protection while lower-sensitivity data is handled with less restrictive measures. Without classification, security controls would be applied uniformly, leading to either over-protection of trivial data or under-protection of critical data.

Answer

To reduce storage costs by identifying obsolete data

Answer

To comply with a specific data protection regulation

Answer

To improve data access speeds for high-priority data

Question 4

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 5

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

Accepted Answer

It enables early detection of vulnerabilities before deployment. Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

Answer

It identifies runtime vulnerabilities such as SQL injection

Answer

It reduces false positives compared to dynamic analysis

Answer

It scans running applications to find configuration issues

Question 6

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is the correct legal framework because it specifically governs the processing of personally identifiable information (PII) of European Union citizens, regardless of where the data is stored or processed. As the cloud customer is moving a customer database containing EU PII to a public cloud provider, GDPR imposes strict requirements on the data controller (the customer) for data protection, consent, breach notification, and cross-border data transfer safeguards.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Question 7

A cloud architect is designing a data classification scheme for a financial services firm. The data includes public marketing materials, internal emails, customer account numbers, and credit card information. Which two data categories should be classified as 'restricted' under PCI DSS and other regulations?

Accepted Answer

Credit card information. Credit card information (Option B) is classified as 'restricted' because PCI DSS explicitly mandates strict controls for cardholder data, including primary account numbers (PANs), expiration dates, and CVV codes. This data requires encryption at rest and in transit, access controls, and regular security audits to comply with the Payment Card Industry Data Security Standard.

Answer

Public marketing materials

Answer

Internal emails

Question 8

A cloud security architect is designing a multi-tier application that processes sensitive customer data. To protect data in transit between the web tier and the application tier, which of the following is the MOST appropriate approach?

Accepted Answer

Use mutual TLS (mTLS) between the tiers. Mutual TLS (mTLS) is the most appropriate approach because it provides bidirectional authentication and encryption between the web tier and application tier. In a multi-tier application processing sensitive customer data, mTLS ensures that both the client (web tier) and server (application tier) present valid certificates, preventing man-in-the-middle attacks and unauthorized inter-tier communication. This is critical for protecting data in transit in zero-trust or internal network segments where simple server-side TLS would not verify the identity of the calling service.

Answer

Use standard TLS with server-side certificates only

Answer

Establish SSH tunnels for all inter-tier communication

Answer

Implement IPsec VPN between the tiers

Question 9

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers a complete application managed entirely by the cloud provider, so the customer only needs to use the software without managing underlying infrastructure, platforms, or runtime. For a small business with limited IT expertise, this model minimizes operational overhead because the provider handles maintenance, patching, and availability.

Answer

IaaS

Answer

PaaS

Answer

FaaS

Question 10

A company is deploying a new application that processes sensitive personal data. The cloud provider operates in a specific region that adheres to the EU General Data Protection Regulation (GDPR). The company requires that data never leave the region. Which combination of cloud architecture controls should be implemented?

Accepted Answer

Use data sovereignty policies, restrict geographic deployment to the region, and disable cross-region replication.. Option B is correct because data sovereignty policies explicitly enforce that data remains within a specific jurisdiction, restricting geographic deployment to the region ensures all cloud resources are provisioned only in that region, and disabling cross-region replication prevents any automated or manual data transfer to other regions. This combination directly addresses the GDPR requirement that data never leave the designated region, as it controls both resource placement and data movement at the infrastructure level.

Answer

Use a virtual private cloud (VPC) with a route table that only allows egress to the internet through a NAT gateway.

Answer

Use encryption at rest and in transit with keys stored in a cloud HSM.

Answer

Use a cloud provider's CDN service to cache content within the region.

Question 11

A multinational corporation uses a cloud access security broker (CASB) to enforce data protection policies across multiple SaaS applications. They discover that sensitive data tagged with 'Confidential' is being shared externally via a file-sharing application. The CASB currently only logs activities. Which action should the security team take to prevent such data loss in the future?

Accepted Answer

Implement a DLP policy that automatically blocks sharing of documents with the 'Confidential' label.. Option D is correct because a CASB with Data Loss Prevention (DLP) capabilities can enforce real-time policies to block sharing of documents tagged with a specific sensitivity label (e.g., 'Confidential'). Since the CASB currently only logs activities, implementing a DLP policy that automatically blocks the sharing action addresses the root cause—preventing the data loss at the point of egress—rather than merely detecting it after the fact.

Answer

Encrypt all files stored in the file-sharing application.

Answer

Revoke user access to the file-sharing application for all employees.

Answer

Train employees on data handling policies.

Question 12

A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?

Accepted Answer

allowPrivilegeEscalation: false. Option D is correct because setting `allowPrivilegeEscalation: false` in the pod's security context directly blocks any attempt by a container process to gain more privileges than its parent process, such as through setuid binaries or syscalls like `setuid()`. This satisfies the requirement to prevent privilege escalation within the container, aligning with the least privilege principle.

Answer

runAsNonRoot: true

Answer

capabilities: drop: ['ALL']

Answer

readOnlyRootFilesystem: true

Question 13

An organization uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to prevent misconfigurations such as open security groups from being deployed. Which two practices should be integrated into the IaC pipeline? (Select TWO)

Accepted Answer

Implement policy-as-code to enforce security rules. Policy-as-code (D) allows security rules to be defined in a machine-readable format (e.g., using Open Policy Agent or HashiCorp Sentinel) and automatically evaluated during the IaC pipeline, preventing non-compliant configurations from being deployed. Automated security scanning tools (E) analyze IaC templates (e.g., Terraform, CloudFormation) for known misconfigurations, such as overly permissive security group rules, before they reach production. Together, these practices enforce security guardrails early in the development lifecycle.

Answer

Limit access to the cloud management console

Answer

Perform manual code reviews for every change

Answer

Segment the network using security groups

Question 14

Refer to the exhibit. A developer reports that users are being denied access to a cloud application. The error log shows the above. What is the most likely cause of the denial?

Accepted Answer

The token's expiration time has passed. The error log indicates that the token's expiration time has passed, which is a standard validation check in OAuth 2.0 and OpenID Connect (OIDC) flows. When a token's `exp` claim is less than the current server time, the authorization server or resource server rejects the request with an 'access denied' or similar error. This is the most direct cause of the denial shown in the exhibit.

Answer

The token was issued by an untrusted issuer

Answer

The token lacks required permissions

Answer

The token's signature is invalid

Question 15

A company is adopting a serverless architecture using AWS Lambda. The security team is concerned about potential injection attacks via event payloads. Which practice is most effective at mitigating such attacks?

Accepted Answer

Validate and sanitize all input data from event sources. Option C is correct because serverless functions like AWS Lambda are directly invoked by event payloads, and without input validation and sanitization, an attacker can inject malicious code (e.g., SQL, NoSQL, OS commands) that the function executes. This is the most effective mitigation as it addresses the root cause at the application layer, regardless of any perimeter controls.

Answer

Use a web application firewall (WAF) in front of the API Gateway

Answer

Assign the least privilege IAM role to each Lambda function

Answer

Encrypt environment variables containing sensitive configuration

Question 16

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. Option C is correct because HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 17

A cloud application uses AWS Lambda functions in a serverless architecture. The security team wants to enforce least privilege access for these functions. Which THREE practices should be implemented?

Accepted Answer

Use AWS Parameter Store or Secrets Manager for sensitive data. AWS Parameter Store or Secrets Manager are correct because they provide secure, auditable storage for sensitive data like database credentials and API keys. Lambda functions can retrieve these values at runtime via the AWS SDK, avoiding hard-coded secrets in code or environment variables. This aligns with the principle of least privilege by granting the Lambda IAM role only the specific permissions needed to access the secret, not the secret value itself in plaintext.

Answer

Store secrets in Lambda environment variables encrypted with KMS

Answer

Use a single IAM role for all Lambda functions for simplicity

Question 18

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

Accepted Answer

Private cloud. Private cloud (Option C) is correct because it is a single-tenant environment where the cloud infrastructure is dedicated exclusively to one organization, providing the highest level of isolation between tenants. In a private cloud, network segmentation is achieved through technologies such as VLANs (IEEE 802.1Q), VXLANs (RFC 7348), and dedicated hypervisor-level resource pools, ensuring that no other tenant's workloads share the same physical or virtual resources. This eliminates the multi-tenancy risks inherent in public and community clouds, where isolation relies on shared infrastructure and logical separation mechanisms like hypervisor-enforced memory isolation and network overlays.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 19

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Accepted Answer

Description of tests and results. The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Answer

System description

Answer

Opinion letter

Answer

Management's assertion

Question 20

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Option A is correct because client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

CCSP Practice Test 4 — 25 Questions

Exhibit

CCSP Practice Test 4 — 25 Questions

Exhibit