CCSP Practice Test 5 — 25 Questions

Question 1

A company's cloud storage bucket policy inadvertently allowed anonymous users to list and read objects. After discovering the exposure, the security team has corrected the policy. Which additional step is critical to prevent recurrence?

Accepted Answer

Implement automated policy validation as part of the infrastructure as code deployment process.. Option D is correct because implementing automated policy validation as part of the infrastructure as code (IaC) deployment process ensures that any bucket policy changes are automatically checked against security rules before they are applied. This prevents misconfigurations like allowing anonymous access from reaching production, addressing the root cause rather than just reacting after exposure. In cloud environments like AWS S3, tools such as AWS CloudFormation with cfn-nag or Terraform with Sentinel can enforce policies programmatically, eliminating human error in manual reviews.

Answer

Enable logging and monitoring to detect similar exposures.

Answer

Assign a dedicated security team to manually approve all policy changes.

Answer

Review all existing bucket policies and correct any other misconfigurations.

Question 2

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. Option A is correct because a multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 3

An enterprise uses a Cloud Access Security Broker (CASB) to monitor cloud application usage. The CASB generates alerts about potential data loss prevention events. What is the primary purpose of the CASB's DLP capabilities?

Accepted Answer

To detect and prevent unauthorized sharing of sensitive data based on policies. The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Answer

To block all uploads of sensitive data to cloud apps

Answer

To classify data automatically using machine learning

Answer

To encrypt data before it is sent to cloud apps

Question 4

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

Accepted Answer

Enable immutable storage (WORM) on the bucket. Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Answer

Implement data classification labels

Answer

Enable versioning on the storage bucket

Answer

Encrypt data with customer-managed keys

Question 5

Which THREE of the following are effective data sanitization methods for cloud environments?

Accepted Answer

Degaussing magnetic media. Degaussing (A) is effective because it uses a strong magnetic field to completely randomize the magnetic domains on hard disk drives (HDDs), rendering all stored data unrecoverable even with advanced forensic tools. This method is approved for the highest security classifications (e.g., NSA/CSS Policy Manual 9-12) but physically destroys the media's ability to store data, making it suitable only for end-of-life disposal.

Answer

Truncating database tables

Answer

Formatting storage volumes

Question 6

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 7

A company uses a cloud-based database that contains personally identifiable information (PII). They need to allow developers to run queries against the database for testing purposes without exposing actual PII. Which technique should they use?

Accepted Answer

Apply dynamic data masking to the PII columns. Option C is correct because dynamic data masking (DDM) allows the database to return masked PII to developers in real time without altering the underlying stored data. This technique applies masking rules at query runtime, so developers can run functional tests against production-like data while sensitive values are obfuscated. It avoids the need for separate sanitized copies and preserves referential integrity for testing.

Answer

Encrypt the PII fields at rest

Answer

Grant developers direct access to a copy of the production data

Answer

Tokenize the PII fields with a one-way hash

Question 8

A developer accidentally uploaded a file containing API credentials to a public cloud storage bucket. The cloud provider states they cannot guarantee deletion of the object. Which practice could have prevented this incident?

Accepted Answer

Data loss prevention for cloud storage. Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Answer

Bucket versioning

Answer

Access control lists

Answer

Server-side encryption

Question 9

An organization is evaluating techniques to protect data while it is being processed in memory. The goal is to prevent unauthorized access even if the operating system or hypervisor is compromised. Which TWO techniques are suitable for protecting data in use?

Accepted Answer

Secure enclaves (e.g., Intel SGX). Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

Answer

Hashing

Answer

Data masking

Answer

Tokenization

Question 10

A cloud customer wants to ensure that their data is encrypted during transmission between their on-premises data center and the cloud provider's service. Which protocol should they use?

Accepted Answer

Transport Layer Security (TLS) 1.2. TLS 1.2 is the correct choice because it is specifically designed to secure data in transit over networks, such as between an on-premises data center and a cloud provider. It operates at the transport layer, providing encryption, authentication, and integrity for HTTP-based traffic (HTTPS), which is the most common method for cloud API interactions. IPSec, while also a valid encryption protocol, is typically used for site-to-site VPN tunnels at the network layer, not for securing individual service-to-service transmissions like those to a cloud provider's REST API.

Answer

Internet Protocol Security (IPSec)

Answer

Secure Shell (SSH)

Answer

Remote Desktop Protocol (RDP)

Question 11

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. Option C is correct because a Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 12

An organization uses a cloud database service and needs to protect data at rest. They enable Transparent Data Encryption (TDE) with a customer-managed key stored in the cloud provider's key management service. Which additional control should they implement to ensure the key cannot be used by unauthorized personnel?

Accepted Answer

Implement key rotation with a short rotation interval. Option C is correct because implementing key rotation with a short interval ensures that even if a customer-managed key is compromised or accessed by unauthorized personnel, the window of exposure is minimized. TDE with a customer-managed key in a cloud KMS relies on the key's secrecy; frequent rotation invalidates older key material, reducing the risk of long-term unauthorized decryption of data at rest.

Answer

Enable SSL/TLS for all database connections

Answer

Enable audit logging on key management operations

Answer

Disable automatic key rotation and rely on manual rotation

Question 13

Which THREE of the following are key considerations when designing a key management lifecycle for cloud data encryption?

Accepted Answer

Key rotation. Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

Answer

Key usage monitoring

Answer

Key escrow

Question 14

A company is deploying a multi-tier application in a public cloud and needs to restrict traffic between tiers. The web tier must only accept HTTPS from the internet, and the app tier must only accept HTTP from the web tier. Which cloud networking feature should be used to enforce this?

Accepted Answer

Network access control lists (ACLs) attached to the subnets.. Network ACLs are stateless, meaning they filter traffic based on source and destination IP addresses, ports, and protocols at the subnet level. By configuring inbound rules on the web tier subnet to allow HTTPS (TCP/443) from the internet and outbound rules to allow HTTP (TCP/80) to the app tier subnet, and inbound rules on the app tier subnet to allow HTTP only from the web tier subnet, you enforce the required traffic restrictions without maintaining session state. This stateless behavior is essential for explicitly controlling traffic between tiers in a multi-tier architecture.

Answer

Security groups applied to each tier’s instances.

Answer

Internet gateway with appropriate routes.

Answer

VPC peering connection between tier subnets.

Question 15

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

Accepted Answer

Create a hardened baseline image and store it in a secure repository.. Option D is correct because creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Answer

Use a golden image from the cloud provider's marketplace.

Answer

Rely on host-based firewalls to protect instances.

Answer

Perform vulnerability scanning on running instances only.

Question 16

Which TWO of the following are best practices for monitoring a cloud environment to detect security incidents?

Accepted Answer

Centralize logs from all cloud services into a single analytics platform.. Centralizing logs from all cloud services into a single analytics platform (e.g., SIEM like Splunk or AWS Security Hub) enables correlation across disparate data sources, which is essential for detecting multi-vector attacks. This practice aligns with the NIST SP 800-92 log management guidelines and the CCSP domain of Cloud Security Operations, as it provides a unified view for threat detection and incident response.

Answer

Enable all available log sources to ensure complete visibility.

Answer

Monitor only network flow logs to reduce data volume.

Answer

Conduct manual log reviews on a weekly basis to identify anomalies.

Question 17

What is the primary purpose of a Data Processing Agreement (DPA) between a data controller and a cloud service provider?

Accepted Answer

To define roles and responsibilities for data processing. A Data Processing Agreement (DPA) is a legally binding contract required under regulations like GDPR. Its primary purpose is to define the roles and responsibilities of the data controller and the data processor (the cloud service provider), ensuring the processor acts only on the controller's documented instructions and meets compliance obligations. Without a DPA, the controller cannot legally transfer data to the processor, as the agreement establishes the lawful basis and accountability for processing activities.

Answer

To set data retention periods for processed data

Answer

To specify encryption algorithms to be used

Answer

To establish data backup and recovery procedures

Question 18

An organization experiences a data breach in the cloud. The CSP claims they are not liable because the breach was due to customer misconfiguration. The customer disagrees. What document should be reviewed to determine liability?

Accepted Answer

The shared responsibility matrix in the service contract. The shared responsibility matrix (SRM) is the definitive contractual document that delineates which security controls are managed by the cloud service provider (CSP) and which are the customer's obligation. In a breach caused by misconfiguration, the SRM specifies whether the configuration of the affected resource (e.g., an S3 bucket ACL or a security group rule) falls under the customer's responsibility. Without reviewing the SRM, liability cannot be determined because the matrix explicitly maps each control layer (e.g., network, compute, data) to the responsible party.

Answer

The CSP's privacy policy

Answer

The SOC 2 Type II report from the CSP

Answer

The incident response plan

Question 19

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 20

A company uses a cloud database that stores customer financial information. To ensure compliance with PCI DSS, which control is required?

Accepted Answer

Encryption of cardholder data stored in the database. PCI DSS Requirement 3.4 specifically mandates that stored cardholder data must be rendered unreadable anywhere it is stored, including in cloud databases. Encryption at rest (e.g., AES-256) is the primary control to achieve this, as it directly protects the confidentiality of Primary Account Numbers (PANs) if the storage layer is compromised. Without encryption, the data remains in clear text, violating PCI DSS compliance.

Answer

Network segmentation between the database and other systems

Answer

Annual external vulnerability scans of the database

Answer

Multi-factor authentication for database administrators