CCSP Practice Test 4 — 25 Questions

Question 1

A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restricted. In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.

Answer

Internal

Answer

Confidential

Answer

Public

Question 2

Refer to the exhibit. An administrator applies this S3 bucket policy. What is the overall effect?

Accepted Answer

Only requests originating from VPC vpc-12345678 are allowed to retrieve objects. The S3 bucket policy includes an Allow statement that grants s3:GetObject access only to the VPC endpoint vpc-12345678, using the aws:SourceVpce condition key. This means only requests originating from that specific VPC endpoint are permitted to retrieve objects. The Deny statement with a NotPrincipal condition is redundant or misconfigured, but the Allow statement's condition effectively restricts access to the VPC endpoint, making option A correct.

Answer

All requests are denied because the Deny statement overrides the Allow statement

Answer

All requests are allowed because there is an Allow statement

Answer

Only requests made with HTTPS are allowed

Question 3

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 4

A data governance officer wants to classify all data in a cloud environment using a classification scheme. They need to tag resources automatically and enforce access controls based on the tags. Which THREE steps should they take? (Choose three.)

Accepted Answer

Define classification labels (e.g., public, internal, confidential, restricted). Creating tags based on classification levels, applying them automatically using DLP or policy, and using IAM conditions to enforce access based on tags are key steps.

Answer

Enable cross-region replication for tagged resources

Answer

Configure signed URLs for public data

Question 5

A cloud security team is implementing a DevSecOps pipeline for a Kubernetes-based application. Which THREE scanning tools should be integrated to detect IaC misconfigurations before deployment?

Accepted Answer

KICS. KICS (Keeping Infrastructure as Code Secure) is an open-source tool specifically designed to scan IaC files for security misconfigurations, vulnerabilities, and compliance violations before deployment. It supports multiple IaC formats including Terraform, Kubernetes manifests, Dockerfiles, and CloudFormation, making it a strong choice for a DevSecOps pipeline targeting Kubernetes-based applications.

Answer

GitGuardian

Answer

Snyk

Question 6

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 7

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Accepted Answer

Description of tests and results. The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Answer

System description

Answer

Opinion letter

Answer

Management's assertion

Question 8

Which TWO of the following are key components of a secure software development lifecycle (SSDLC) in a cloud environment?

Accepted Answer

Automated static application security testing (SAST) during code commit.. Automated SAST during code commit is a key component of a secure software development lifecycle (SSDLC) in a cloud environment because it enables early detection of vulnerabilities (e.g., injection flaws, buffer overflows) by scanning source code as it is committed to the repository. This shift-left approach integrates security directly into the CI/CD pipeline, preventing flaws from progressing to later stages where remediation is more costly and complex.

Answer

Performing security testing only after deployment to production.

Answer

Mandatory security awareness training for developers.

Answer

Integration of unit tests that check for security functionality.

Question 9

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. SOX requires organizations to maintain ITGCs over systems that support financial reporting. Logical access controls (e.g., user provisioning, authentication) are typically the responsibility of the customer (the financial institution) because they manage who can access the application and data.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines

Question 10

Which TWO of the following are requirements for a cloud service agreement to comply with the European Data Protection Board (EDPB) guidelines on data processing?

Accepted Answer

The processor must only process data on documented instructions from the controller. The EDPB guidelines mandate that a processor may only process personal data on documented instructions from the controller. This ensures the processor’s actions are strictly controlled and auditable, preventing unauthorized processing that could violate GDPR Article 28(3)(a).

Answer

The processor may subcontract processing without notification

Answer

The controller must ensure the processor agrees to audit rights

Answer

The processor must retain data indefinitely

Question 11

An organization uses a multi-cloud strategy and wants to perform a risk assessment that accounts for the shared responsibility model. Which approach is most appropriate?

Accepted Answer

Use cloud-specific risk assessment frameworks like CSA STAR. Cloud-specific frameworks like CSA STAR incorporate the shared responsibility model, making them suitable for multi-cloud risk assessments. Option A is wrong because ISO 27001 is general and not cloud-specific. Option B is wrong because NIST CSF is also general, not tailored to cloud. Option D is wrong because COBIT focuses on governance and management, not risk assessment.

Answer

Use ISO 27001 controls as the sole basis for assessment

Answer

Apply the NIST Cybersecurity Framework across all cloud providers

Answer

Adopt COBIT for risk management alignment

Question 12

Refer to the exhibit. A security analyst finds this access control policy attached to a cloud storage bucket. What is the primary security issue?

Accepted Answer

The policy grants public read access to all objects.. The policy statement includes "Principal": "*" and "Effect": "Allow" without any condition restricting access, which grants public read access to all objects in the cloud storage bucket. This violates the principle of least privilege and exposes sensitive data to anyone on the internet, making it a critical security misconfiguration.

Answer

The policy is missing a condition for encryption.

Answer

The policy does not specify a source IP.

Answer

The policy allows all actions.

Question 13

A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

Accepted Answer

It denies access to objects over HTTP, but allows HTTPS.. The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Answer

It allows all access to the bucket.

Answer

It denies access to objects over HTTPS, but allows HTTP.

Answer

It denies all access to the bucket.

Question 14

A company is subject to PCI DSS and plans to use a cloud provider to process credit card transactions. The cloud provider has been assessed by a Qualified Security Assessor (QSA). According to PCI DSS, what must the company obtain from the provider to demonstrate compliance?

Accepted Answer

The provider's PCI DSS Attestation of Compliance (AOC) and Responsibility Matrix. PCI DSS requires that the service provider's responsibilities are mapped in a Cloud Provider Responsibility Matrix, typically in Appendix A3. Additionally, the customer must obtain evidence of the provider's QSA assessment.

Answer

A signed Business Associate Agreement

Answer

An ISO 27001 certificate

Answer

A SOC 2 Type II report

Question 15

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware

Question 16

A company uses a cloud object storage service to host a public website. The website content is static and needs to be accessible to anyone on the internet, but the company wants to prevent direct listing of the bucket contents. Which combination of access controls should be configured?

Accepted Answer

Bucket ACLs set to public and block public access disabled. Setting bucket ACLs to public and disabling block public access allows anonymous read access to objects. However, to prevent listing of bucket contents, the ACL must grant only object-level read (GetObject) and not bucket-level list (ListBucket). In cloud storage services like AWS S3, a bucket ACL with READ grants list access, so a bucket policy is typically used instead. In this scenario, with the given options, C is the only choice that enables public access while attempting to prevent listing, though it may not fully achieve it in all providers.

Answer

IAM policies granting public access to the bucket

Answer

Enable versioning and cross-region replication

Answer

Block public access to the bucket and use pre-signed URLs for objects

Question 17

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 18

Which type of threat is this log most likely indicating?

Accepted Answer

Data exfiltration. The log shows a large volume of outbound data transfers from a cloud storage bucket to an external IP address, which is characteristic of data exfiltration. In cloud environments, such activity often involves unauthorized copying of sensitive data to an attacker-controlled location, bypassing normal access controls.

Answer

Account takeover

Answer

Malware infection

Answer

Insider threat

Question 19

A multinational corporation with its headquarters in the United States processes personal data of European Union data subjects using a cloud-based customer relationship management (CRM) system hosted in the United States. According to the General Data Protection Regulation (GDPR), which of the following is the company's primary obligation regarding the protection of that data?

Accepted Answer

The company must appoint a representative in the EU and ensure that any data transfers outside the EU are covered by an adequacy decision, standard contractual clauses, or binding corporate rules.. GDPR applies to any organization processing personal data of EU data subjects, regardless of where the processing occurs. The company is a data controller and must comply with all GDPR requirements, including data subject rights and breach notification.

Answer

The company must delete all personal data within 30 days of collection.

Answer

The company is not subject to GDPR because its headquarters and the cloud server are located outside the EU.

Answer

The company must obtain explicit consent from each data subject before processing their data.

Question 20

A company is adopting DevSecOps and wants to incorporate security testing into their continuous integration pipeline. They have decided to run SAST (static analysis) and SCA (software composition analysis) tools. Which of the following is the PRIMARY reason for including SCA in addition to SAST?

Accepted Answer

To identify known vulnerabilities in third-party libraries and dependencies. SCA (Software Composition Analysis) is specifically designed to identify known vulnerabilities in third-party libraries and dependencies by comparing their versions against public vulnerability databases like the National Vulnerability Database (NVD) or OWASP Dependency-Check. SAST (Static Application Security Testing) analyzes custom source code for security flaws but cannot inspect external libraries that are often pulled in via package managers (e.g., npm, Maven, pip). Including SCA ensures that the organization addresses supply chain risks, which is a primary goal in DevSecOps pipelines.

Answer

To detect insecure runtime behavior

Answer

To reduce false positives identified by SAST

Answer

To scan for vulnerabilities in custom APIs