CCSP Practice Test 4 — 25 Questions

Question 1

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk is the risk that arises from over-reliance on a single provider, system, or counterparty — in cloud terms, if one provider fails and the organization cannot operate, that dependency is a concentration risk. It is a well-known concept in financial services (e.g., reliance on a single clearing bank) and applies directly to cloud, where multi-cloud or hybrid strategies are often adopted specifically to mitigate it. The scenario describes exactly this single-point-of-failure dependency.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 2

Drag and drop the steps for managing identity and access in a multi-cloud environment using a centralized identity provider (IdP) into the correct order.

Accepted Answer

Integrate the centralized IdP → Create groups and roles → Configure attribute/role mapping → Assign users with MFA enforcement → Audit and review access. First integrate IdP, then create groups/roles, configure mapping, assign users with MFA, and audit.

Answer

Create groups and roles → Integrate the centralized IdP → Configure attribute/role mapping → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Configure attribute/role mapping → Create groups and roles → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Create groups and roles → Assign users with MFA → Configure attribute/role mapping → Audit

Question 3

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 4

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 5

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Option C is correct because rate limiting and throttling cap the number of requests a client can make in a given time window, mitigating brute-force, credential-stuffing, and denial-of-service abuse against API endpoints. Option D is correct because strong authentication (e.g., OAuth 2.0 tokens, mutual TLS) and authorization (e.g., scopes, RBAC, least privilege) ensure only verified, permitted identities can invoke API operations. Option E is correct because validating and sanitizing all inputs defends against injection flaws such as SQL injection, NoSQL injection, and command injection that arise from untrusted API parameters. Option A is not appropriate because enabling CORS for all domains (wildcard Access-Control-Allow-Origin) exposes the API to cross-origin abuse rather than restricting access to trusted origins. Option B is not appropriate because HTTP Basic authentication over plain HTTP transmits base64-encoded credentials in cleartext, which can be intercepted; it should only be used over TLS.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP

Question 6

Which of the following is an example of a data sovereignty law that directly affects cloud data storage?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is a data sovereignty law because it imposes strict requirements on the storage and processing of personal data of EU residents, mandating that data be stored within the EU or in jurisdictions with equivalent protection, directly affecting where cloud providers can host data. It enforces data localization principles through mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), requiring cloud customers to ensure their provider's storage regions comply with these territorial restrictions. In contrast, the California Consumer Privacy Act (CCPA) is a privacy law that grants consumers rights over their personal data but does not mandate where data must be stored geographically, so it is not a data sovereignty law. The other options (SOX, PCI DSS, HIPAA) are security or sector-specific regulations without territorial storage requirements.

Answer

Sarbanes-Oxley Act (SOX)

Answer

California Consumer Privacy Act (CCPA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Question 7

A cloud architect is evaluating cloud service models for a new application. Which two characteristics are advantages of PaaS over IaaS? (Choose two.)

Accepted Answer

Reduced management of middleware and runtime. Option C is correct because PaaS abstracts the middleware, runtime, and often the OS layer, so the provider handles patching, configuration, and upgrades of components such as application servers, language runtimes, and databases, leaving the customer to focus on code and data. Option E is correct because PaaS platforms typically include built-in autoscaling, load balancing, and high-availability features (e.g., managed instance groups, health checks, and multi-zone deployment) that the customer would otherwise have to architect and operate manually on IaaS. Option A is not an advantage of PaaS over IaaS, since IaaS gives greater control over the guest OS (root/admin access, custom kernels, and OS-level tuning) while PaaS restricts that control. Option B is not inherently true, as PaaS pricing is usually higher per compute unit than raw IaaS VMs because it bundles managed services, and cost depends on workload and usage patterns rather than being automatically lower. Option D is also not an advantage of PaaS, because IaaS offers more flexibility to customize networking (VPCs, subnets, route tables, security groups, and virtual appliances) than the more opinionated networking model of most PaaS offerings.

Answer

Greater control over the underlying OS

Answer

Lower cost due to shared infrastructure

Answer

Higher flexibility to customize networking

Question 8

A cloud architect is designing a data classification scheme for a financial services firm. The data includes public marketing materials, internal emails, customer account numbers, and credit card information. Which two data categories should be classified as 'restricted' under PCI DSS and other regulations?

Accepted Answer

Credit card information. Credit card information (B) is correctly classified as restricted because PCI DSS explicitly governs cardholder data, including the Primary Account Number (PAN) and sensitive authentication data, requiring strong encryption, masking, and strict access controls. Customer account numbers (D) also belong in the restricted category because they are regulated non-public personal information (NPI) under financial privacy laws such as GLBA, and their exposure can enable identity theft or account takeover. Public marketing materials (A) are intended for open distribution and carry no confidentiality requirement, so they are not restricted. Internal emails (C) may contain sensitive content, but as a general category they are typically classified as internal or confidential rather than restricted, since not every internal email includes regulated data.

Answer

Public marketing materials

Answer

Internal emails

Question 9

A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?

Accepted Answer

Adopting open standards and open-source APIs like Kubernetes and Terraform. Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.

Answer

Using proprietary APIs from the cloud provider

Answer

Subscribing to a single cloud provider's managed services

Answer

Using proprietary data formats

Question 10

A cloud customer is reviewing a provider's SOC 2 Type II report. What does this report primarily attest to?

Accepted Answer

The design and operating effectiveness of controls over a period. A SOC 2 Type II report attests to the design and operating effectiveness of a service organization's controls over a specified period (typically 3–12 months). It goes beyond a Type I report, which only evaluates control design at a point in time, by testing whether controls operated effectively throughout the audit period.

Answer

The provider's financial controls and accuracy of billing

Answer

Compliance with international data protection regulations like GDPR

Answer

Penetration test results and vulnerability assessments

Question 11

An organization is evaluating cloud service providers and notices that one provider's SLA offers 99.99% availability for a specific service, while another offers 99.9%. If the service costs $100,000 per month, what is the maximum allowable downtime per month for the 99.99% SLA?

Accepted Answer

4.32 minutes. The 99.99% SLA allows for a maximum of 0.01% downtime per month. Assuming a 30-day month (43,200 minutes), 0.01% of 43,200 minutes is 4.32 minutes. Therefore, the correct answer is 4.32 minutes.

Answer

8.64 minutes

Answer

43.2 minutes

Answer

2.16 minutes

Question 12

An API allows users to access their own profile data by providing a user ID. However, an attacker can change the user ID parameter to access another user's data. Which OWASP API Security vulnerability is this?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA), listed as API1:2023 in the OWASP API Security Top 10, occurs when an API fails to verify that the authenticated user is authorized to access the specific object referenced by an identifier. Changing the user ID to retrieve another user's profile is the textbook BOLA example. The fix is to enforce object-level authorization checks on every request, not just authentication.

Answer

Excessive Data Exposure

Answer

Mass Assignment

Answer

Broken User Authentication

Question 13

A healthcare organization is migrating patient records to a public cloud provider. Which of the following is the most critical consideration regarding shared responsibility when using IaaS?

Accepted Answer

The customer is responsible for securing the operating system, applications, and data they deploy on the IaaS platform.. In IaaS, the provider secures the physical hosts, hypervisor, and network fabric, but the customer retains responsibility for the guest OS, middleware, applications, and data — including patching, hardening, and encryption choices. For a healthcare workload, that means the customer must secure the OS and application layer even though the provider owns the hardware.

Answer

The cloud provider is responsible for all security controls because they own the infrastructure.

Answer

The customer has no responsibility for network security because the provider manages the hypervisor.

Answer

The cloud provider automatically encrypts all data at rest and in transit by default.

Question 14

A global e-commerce company must store customer payment data in a specific geographic region to comply with local data residency laws. Which cloud configuration ensures that data never leaves the required region?

Accepted Answer

Select a specific cloud region for the storage and disable cross-region replication. Data residency is achieved by selecting a cloud region (e.g., 'EU-West-1') and configuring storage buckets or databases with region-specific policies. Additionally, bucket policies can explicitly deny access from outside the region, and replication features should be disabled or configured to stay within the region.

Answer

Use a global load balancer to route traffic

Answer

Enable cross-region replication to a secondary region for disaster recovery

Answer

Store data in a private cloud on-premises

Question 15

In the NIST SP 800-145 definition, which deployment model is described as infrastructure provisioned for exclusive use by a single organization comprising multiple consumers?

Accepted Answer

Private cloud. NIST SP 800-145 defines the private cloud deployment model as infrastructure provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). The key characteristic is exclusive use by one organization, whether owned/operated by the organization or a third party, and whether on-premises or off-premises.

Answer

Public cloud

Answer

Community cloud

Answer

Hybrid cloud

Question 16

A small business uses a cloud provider's default server-side encryption (SSE) to encrypt data at rest in their cloud storage. They are concerned about key management overhead. Which statement best describes the key management responsibility for SSE?

Accepted Answer

The cloud provider manages the keys entirely.. With default SSE (e.g., SSE-S3 in AWS), the cloud provider manages the encryption keys entirely. The customer is not involved in key generation, rotation, or storage. CMEK and CSEK require customer involvement. BYOK involves importing customer keys.

Answer

The customer and provider share key management responsibilities.

Answer

Keys are not used; encryption is transparent.

Answer

The customer generates and manages the keys.

Question 17

A cloud architect is designing a data lifecycle policy for a SaaS application. According to the cloud data lifecycle, which phase immediately follows the 'Share' phase?

Accepted Answer

Archive. In the CSA cloud data lifecycle (Create, Store, Use, Share, Archive, Destroy), the Archive phase immediately follows Share. Archiving moves data that is no longer actively used but must be retained for compliance or business reasons into long-term, lower-cost storage.

Answer

Store

Answer

Use

Answer

Destroy

Question 18

In a hybrid cloud deployment, which of the following is a critical security consideration?

Accepted Answer

Ensuring consistent security policy across environments. Consistent security policy across environments is critical in hybrid cloud because workloads and data span on-premises and cloud boundaries, and inconsistent controls create gaps attackers can exploit. Unified policy ensures identity, encryption, logging, and access controls are applied uniformly. This is a foundational governance requirement for hybrid architectures.

Answer

Using only public cloud for sensitive data

Answer

Avoiding any use of APIs for integration

Answer

Eliminating all private cloud resources

Question 19

An organization needs to migrate a legacy application to the cloud. The application requires full control over the operating system, middleware, and runtime. The team wants to minimize management overhead while retaining OS-level access. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking where the customer manages the OS, middleware, and runtime while the provider manages the underlying physical infrastructure. This matches the requirement for full OS-level control with reduced management overhead compared to on-premises. SaaS, PaaS, and FaaS abstract away the OS, so they cannot satisfy the need for OS-level access.

Answer

SaaS

Answer

FaaS

Answer

PaaS

Question 20

During incident response in a cloud environment, a team needs to collect evidence from a compromised EC2 instance without altering the system. Which of the following is the best method to obtain a forensic memory dump?

Accepted Answer

Use the AWS CLI to execute a memory dump script on the instance (e.g., via AWS Systems Manager Run Command). Using AWS Systems Manager Run Command to execute a memory dump script on the instance allows the team to capture volatile memory (RAM) while the instance is still running, preserving the system state. This method does not require stopping or modifying the instance, and it can be done remotely via the AWS CLI, making it the best option for forensic memory acquisition.

Answer

Create an AMI of the instance

Answer

Enable detailed billing reports

Answer

Take a snapshot of the root EBS volume