CCSP Practice Test 5 — 25 Questions

Question 1

Which TWO of the following are common best practices for securing cloud application APIs? (Choose two.)

Accepted Answer

Implement rate limiting. Rate limiting is a critical best practice for securing cloud application APIs because it prevents abuse by limiting the number of requests a client can make within a specific time window. This mitigates brute-force attacks, denial-of-service (DoS) attacks, and resource exhaustion. By enforcing rate limits, the API maintains availability and protects backend services from being overwhelmed.

Answer

Disable HTTPS to reduce latency

Answer

Return detailed error messages for debugging

Answer

Allow all origins with CORS

Question 2

A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?

Accepted Answer

Automated security testing in CI/CD pipeline. Automated security testing in the CI/CD pipeline (Option C) is the correct practice because it embeds security checks—such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA)—directly into the build and deployment process. This ensures that vulnerabilities are detected and remediated early, aligning with the DevSecOps principle of 'shifting left' and enabling continuous security validation without slowing down development velocity.

Answer

Security awareness training

Answer

Annual penetration testing

Answer

Manual code review before release

Question 3

An organization is using GCP and wants to implement cloud security posture management (CSPM) to continuously monitor configurations against the CIS Benchmark. Which TWO GCP services can be used for this purpose? (Choose two.)

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a historical view of all GCP resources and their configurations, enabling continuous monitoring against compliance frameworks like the CIS Benchmark. Security Command Center offers built-in CSPM capabilities, including automated scanning for CIS Benchmark violations and actionable recommendations to remediate misconfigurations.

Answer

Cloud VPN

Answer

Cloud Audit Logs

Answer

Cloud Functions

Question 4

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

Accepted Answer

Implement server-side antivirus scanning on all uploaded files before saving.. Server-side antivirus scanning detects and prevents malicious files from being stored, protecting the server. Option A is wrong because a CDN only caches and serves static content; it does not inspect file content for malware. Option B is wrong because a maximum file size limit does not address malicious content; a small file can still be harmful. Option D is wrong because file extension validation can be easily bypassed by renaming a malicious file with a valid extension.

Answer

Store files in a CDN that only serves static content.

Answer

Set a maximum file size limit to 2 MB.

Answer

Restrict file uploads to only image file types by checking the file extension.

Question 5

A cloud administrator is rotating encryption keys for a data storage service. The administrator wants to ensure that previously encrypted data remains accessible after the rotation. What is the best practice?

Accepted Answer

Retain the old key and use envelope encryption so the new key can decrypt the old key. Envelope encryption allows the new key to decrypt the old key, which in turn decrypts the data. This ensures that previously encrypted data remains accessible without re-encrypting it, as the old key is retained and protected under the new key. This is the best practice for key rotation in cloud storage services like AWS KMS or Azure Key Vault.

Answer

Delete the old key after rotation

Answer

Re-encrypt all data with the new key immediately

Answer

Disable the old key and only use the new key for new writes

Question 6

A company is migrating sensitive customer data to a public cloud storage service. They want to ensure that even the cloud provider cannot access the plaintext data. Which encryption strategy should they implement?

Accepted Answer

Client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Answer

Server-side encryption with cloud-provider-managed keys

Answer

Tokenization of sensitive fields at the application layer

Answer

Enforcing role-based access control (RBAC) on the storage bucket

Question 7

A client is negotiating a cloud service agreement and wants to conduct on-site audits of the provider's data centers. The provider argues that on-site audits are unnecessary due to SOC 2 reports. Which is the best approach for the client?

Accepted Answer

Request a right to review SOC 2 reports and conduct limited assessments. The client should request a right to review SOC 2 reports and conduct limited assessments because SOC 2 reports provide a point-in-time snapshot of controls, but they do not cover real-time operational changes, custom configurations, or specific contractual requirements. On-site audits may be impractical due to multi-tenancy and shared infrastructure, so a balanced approach of reviewing SOC 2 reports plus targeted assessments (e.g., reviewing evidence of key controls, interviewing staff, or examining specific systems) gives the client sufficient assurance without disrupting the provider's operations.

Answer

Insist on on-site audits

Answer

Terminate negotiations

Answer

Accept SOC 2 reports as sufficient

Question 8

Refer to the exhibit. An administrator attaches security group sg-12345 to a web server. Which of the following describes the traffic that will be allowed by the security group?

Accepted Answer

Inbound HTTP and HTTPS from anywhere, and SSH only from the internal network are allowed.. The security group allows inbound HTTP (port 80) and HTTPS (port 443) from anywhere (0.0.0.0/0), and SSH (port 22) only from the internal network (10.0.0.0/8). Outbound all traffic is allowed. Option A is incorrect because it omits HTTP/HTTPS. Option C is incorrect because outbound traffic is allowed. Option D is incorrect because not all inbound traffic is allowed (SSH is restricted).

Answer

Only SSH traffic from the internal network is allowed inbound.

Answer

The server cannot initiate any outbound connections.

Answer

All inbound traffic from the internet is allowed.

Question 9

A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)

Accepted Answer

Anomalous spike in outbound traffic to an unknown IP address. Options A and C are correct. A CASB detects anomalous data movements. An anomalous spike in outbound traffic to an unknown IP address (A) and a large number of file downloads by a single user outside business hours (C) are strong indicators of data exfiltration. Option B, a change in firewall rule configuration, is a configuration change that does not directly indicate exfiltration. Option D, multiple failed login attempts, typically indicates a brute-force attack rather than exfiltration. Option E, an alert for a known malware signature, indicates a malware threat but not necessarily data exfiltration.

Answer

A change in the configuration of a firewall rule

Answer

Multiple failed login attempts to a critical application

Answer

An alert for a known malware signature in an email attachment

Question 10

A cloud operations team is implementing a logging strategy for their hybrid cloud environment. They need to ensure that logs from on-premises systems are collected and stored in a centralized cloud logging service with low latency. Which configuration is most appropriate?

Accepted Answer

Use a VPN connection and forward syslog directly to the cloud endpoint. The most appropriate. Using a VPN connection provides a dedicated, secure, and low-latency path for forwarding syslog from on-premises to the cloud logging endpoint. This meets the requirement for low latency and centralized collection. Option A (email attachments) is unsuitable for real-time logging. Option C (syslog over the internet with TLS) may suffer from internet latency and potential unreliability. Option D (cloud logging agent on-premises that buffers and sends via HTTPS) can introduce buffering delays and is less direct than syslog forwarding.

Answer

Transfer logs via email attachments

Answer

Configure on-premises systems to send logs via syslog over the internet with TLS

Answer

Use a cloud logging agent on-premises that buffers and sends logs via HTTPS

Question 11

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

Accepted Answer

Run automated policy compliance checks as part of the CI/CD pipeline.. Integrating automated policy-as-code compliance checks into the CI/CD pipeline catches non-compliance before deployment. Option A is incorrect because restricting IAM permissions alone does not prevent misconfigurations from authorized users. Option C is incorrect because manual reviews after deployment are error-prone and slow. Option D is incorrect because post-deployment scanning is reactive and may allow non-compliant resources to be deployed.

Answer

Restrict the IAM permissions of developers to only approved roles.

Answer

Conduct manual security reviews after each deployment.

Answer

Deploy resources and then scan for compliance after deployment.

Question 12

A financial services company deploys a containerized application on Amazon ECS with Fargate. The application needs to access an encrypted RDS database. The security policy mandates that database credentials must never be stored in the application code or configuration files and must be rotated automatically every 90 days. Which solution should the DevOps team implement to satisfy these requirements?

Accepted Answer

Store credentials in AWS Secrets Manager, grant ECS task role access, and enable automatic rotation. AWS Secrets Manager is the correct choice because it is designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 90 days) without storing them in code or configuration. By granting the ECS task role (via IAM) permission to access the secret, the Fargate task can retrieve the credentials at runtime using the AWS SDK or CLI, ensuring they are never hardcoded. This satisfies both the no-storage-in-code and automatic rotation requirements mandated by the security policy.

Answer

Encrypt credentials with AWS KMS and pass them as environment variables during task definition

Answer

Store credentials in AWS Systems Manager Parameter Store (SecureString) and retrieve them at container startup

Answer

Use a secrets vault like Hashicorp Vault deployed on EC2 and mount secrets via sidecar container

Question 13

A company is adopting shift-left security. Which action best exemplifies this approach?

Accepted Answer

Running SAST scans during code development. Integrating security testing into the development phase (e.g., SAST, dependency scanning) before code is committed or deployed is the essence of shift-left security.

Answer

Monitoring logs for suspicious activity

Answer

Performing security reviews after deployment

Answer

Conducting penetration testing annually

Question 14

What is the effective permission for a request coming from IP address 10.1.2.3?

Accepted Answer

Access allowed only for GetObject. The effective permission for a request from IP 10.1.2.3 is 'Access allowed only for GetObject' because the bucket policy includes an explicit allow for the s3:GetObject action when the source IP matches 10.1.2.3, and no explicit deny applies to that IP. Since there is no explicit deny for this specific request, the explicit allow grants access only to the GetObject action, not to other actions like PutObject or DeleteObject.

Answer

Access allowed for all actions

Answer

Access denied due to explicit deny

Answer

Access denied because no explicit allow

Question 15

A cloud security architect is designing a secure CI/CD pipeline for a containerized application deployed on a Kubernetes cluster. The pipeline must ensure that only approved images are deployed. Which TWO of the following controls should be implemented? (Choose two.)

Accepted Answer

Configure the Kubernetes admission controller to reject pods that use unsigned images.. Kubernetes admission controllers can enforce policies such as rejecting pods that use unsigned images, ensuring only images with verified signatures are deployed. This directly addresses the requirement to deploy only approved images by validating image integrity at admission time.

Answer

Implement role-based access control (RBAC) to restrict who can push images to the registry.

Answer

Use network policies to restrict pod-to-pod communication.

Answer

Scan all container images for vulnerabilities in the CI pipeline.

Question 16

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. A Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 17

Which THREE of the following are valid techniques to protect application programming interfaces (APIs) from abuse?

Accepted Answer

Use API gateways to enforce authentication and authorization policies.. API gateways act as a centralized policy enforcement point, intercepting all API traffic to validate authentication (e.g., OAuth 2.0, SAML) and authorization (e.g., RBAC, ABAC) before requests reach backend services. This prevents unauthorized access and ensures that only authenticated clients with proper permissions can invoke protected endpoints, directly mitigating abuse such as credential stuffing or privilege escalation.

Answer

Use JSON Web Tokens (JWT) without encryption.

Answer

Use only HTTP GET requests for all API calls.

Question 18

A container image is built and scanned in a CI pipeline. Which practice should be implemented to ensure that the image has not been tampered with before deployment?

Accepted Answer

Signing the image with a private key and verifying the signature. Signing container images provides cryptographic verification of image integrity, ensuring they have not been altered since signing.

Answer

Using a minimal base image

Answer

Scanning the image with a vulnerability scanner

Answer

Storing the image in a private registry

Question 19

An organization uses GCP and wants to detect container threats such as privilege escalation attempts within Kubernetes Engine. Which GCP service is designed specifically for this purpose?

Accepted Answer

Container Threat Detection. Container Threat Detection (CTD) is a GCP service purpose-built to identify threats within Google Kubernetes Engine (GKE) containers, including privilege escalation attempts, by analyzing runtime behavior and Kubernetes audit logs. It uses machine learning and rule-based detection to spot anomalies like container breakout, unauthorized system calls, and attempts to escalate privileges via capabilities or security contexts. This makes it the correct choice for detecting container-specific threats in GKE.

Answer

Cloud Security Scanner

Answer

Event Threat Detection

Answer

Cloud Audit Logs

Question 20

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Security Hub