CCSP Practice Test 26 — 15 Questions

Question 1

A company is evaluating the risk of using a single cloud provider for all critical workloads. Which risk is most directly associated with this scenario?

Accepted Answer

Concentration risk. Concentration risk refers to the over-reliance on a single provider, leading to high impact if that provider suffers an outage or data loss.

Answer

Inherent risk of shared infrastructure

Answer

Third-party risk

Answer

Control effectiveness risk

Question 2

A company is adopting a multi-cloud strategy to reduce concentration risk. Which two benefits are directly associated with this approach? (Choose two.)

Accepted Answer

Reduced vendor lock-in. Multi-cloud reduces dependency on a single provider (concentration risk) and allows flexibility to use best-of-breed services.

Answer

Simplified compliance management

Answer

Unified security controls

Answer

Lower network latency

Question 3

A company is subject to a legal hold order and uses a cloud storage service with object replication across multiple regions. Which cloud feature should the company use to prevent deletion or modification of relevant data?

Accepted Answer

Legal hold policies (e.g., S3 Object Lock). Legal hold features like S3 Object Lock (AWS) or Azure Immutable Blob prevent data from being deleted or modified during the hold period, even if replication exists.

Answer

Versioning of objects

Answer

Cross-region replication

Answer

Backup to another provider

Question 4

A company subject to PCI DSS is considering a cloud provider to process credit card transactions. What must the cloud provider present to demonstrate compliance with PCI DSS?

Accepted Answer

A PCI DSS Attestation of Compliance (AOC) from a QSA. PCI DSS allows cloud providers to be assessed by a QSA; the resulting Attestation of Compliance (AOC) demonstrates compliance.

Answer

A CSA STAR Level 1 self-assessment

Answer

A SOC 2 Type II report

Answer

An ISO 27001 certificate

Question 5

A cloud customer wants to ensure that when the contract ends, the cloud provider deletes all customer data, including from backups. Which contractual clause is essential?

Accepted Answer

Data deletion clause. A data deletion clause should specify the obligation to delete customer data, including backups, upon termination.

Answer

Right to audit clause

Answer

Data portability clause

Answer

Service Level Agreement

Question 6

Under the CSA STAR program, which tier involves a third-party assessment resulting in a certification based on ISO 27001?

Accepted Answer

Tier 2: Third-party assessment. CSA STAR Tier 2 includes STAR Certification, which builds on ISO 27001 certification and includes cloud-specific controls.

Answer

Tier 4: Nonexistent

Answer

Tier 1: Self-assessment

Answer

Tier 3: Continuous monitoring

Question 7

A cloud customer is considering adopting a multi-cloud strategy to avoid vendor lock-in. Which risk is this strategy primarily intended to mitigate?

Accepted Answer

Concentration risk. Multi-cloud reduces dependency on a single provider, thus mitigating concentration risk.

Answer

Third-party risk from a specific provider

Answer

Residual risk after controls

Answer

Inherent risk of data leaving premises

Question 8

A cloud security team wants to automatically remediate misconfigured S3 buckets that are publicly accessible. Which combination of AWS services can be used to detect and automatically fix this issue?

Accepted Answer

AWS Config and AWS Lambda. AWS Config evaluates resource configurations against rules (e.g., 's3-bucket-public-read-prohibited'). When a non-compliant resource is detected, AWS Config can trigger a Lambda function via a custom remediation action to modify the bucket policy. GuardDuty detects threats but does not remediate. Security Hub aggregates findings but does not automatically fix issues. CloudTrail logs events but does not evaluate configurations.

Answer

AWS GuardDuty and AWS Lambda

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS Security Hub and AWS CloudTrail

Question 9

A company is drafting a cloud service contract and wants to ensure it can exit the provider without losing access to its data. Which TWO clauses are most important to include?

Accepted Answer

Data deletion clause requiring deletion of all data, including backups, after termination. Data portability ensures the customer can export data in a usable format. Data deletion ensures the provider deletes all copies of customer data after termination. These clauses are critical for a clean exit.

Answer

Service Level Agreement (SLA) for availability

Answer

Non-disclosure agreement (NDA)

Answer

Right to audit clause

Question 10

Under GDPR, a cloud data controller must notify the supervisory authority of a personal data breach within what timeframe?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 11

A cloud customer is concerned about the right to erasure under GDPR because the cloud provider replicates data across multiple regions and keeps backups. What technical challenge does this create for complying with a erasure request?

Accepted Answer

The cloud provider may not be able to delete data from all replicas and backups within the required time frame.. Under GDPR, the right to erasure requires deletion of all copies of the data. In cloud environments, data may be replicated across regions and stored in backups with different retention periods, making it technically difficult to ensure complete deletion from all locations.

Answer

The data must be anonymized instead of deleted.

Answer

The customer must notify all other users who may have accessed the data.

Answer

The cloud provider must retain the data for audit purposes.

Question 12

A company that must comply with SOX is migrating its financial systems to a cloud service. Which of the following IT general controls is most critical for SOX compliance in the cloud?

Accepted Answer

Change management controls. SOX requires strong controls over financial data; change management ensures changes to systems are authorized and tested.

Answer

Multi-factor authentication

Answer

Data encryption at rest

Answer

Automated backup procedures

Question 13

A covered entity under HIPAA is moving electronic protected health information (ePHI) to a public cloud. What is the primary requirement before the cloud provider hosts ePHI?

Accepted Answer

The cloud provider must sign a Business Associate Agreement (BAA). HIPAA requires a Business Associate Agreement (BAA) between the covered entity and the cloud provider to ensure PHI is handled appropriately.

Answer

The cloud provider must be located within the United States

Answer

The cloud provider must be certified under ISO 27001

Answer

The covered entity must obtain written authorization from each patient

Question 14

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection typically uses sign-in logs (source IP, geolocation) and event timestamps to identify logins from distant locations within a short time.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 15

Which CSA STAR tier involves a third-party assessment and results in a certification based on ISO 27001?

Accepted Answer

Tier 2: Third-party assessment. CSA STAR Tier 2 includes STAR Certification, which is based on ISO 27001 plus cloud-specific controls.

Answer

Tier 4: Auditing

Answer

Tier 3: Continuous monitoring

Answer

Tier 1: Self-assessment