CCSP Practice Test 26 — 15 Questions

Question 1

Which cloud service model provides the customer with the most control over the underlying infrastructure, including operating systems and applications?

Accepted Answer

IaaS. IaaS gives the customer control over the operating system, middleware, runtime, and applications while the provider manages the physical host, hypervisor, and networking fabric. This is the highest level of customer control among the four models listed. PaaS, SaaS, and FaaS progressively abstract away more of the stack, reducing customer control.

Answer

PaaS

Answer

SaaS

Answer

FaaS

Question 2

A serverless function needs to access a private RDS database inside a VPC. What configuration is required to enable this without using public IP addresses?

Accepted Answer

Place the Lambda function inside the VPC using VPC configuration. Serverless functions can be configured with VPC integration to access resources inside a VPC via private IP.

Answer

Store database credentials in the function code

Answer

Use a NAT Gateway to allow inbound traffic

Answer

Attach an Internet Gateway to the VPC

Question 3

Which THREE of the following are key components of a secure cloud SDLC that support shift-left security? (Select THREE)

Accepted Answer

Infrastructure as Code (IaC) security scanning. Option B is correct because IaC security scanning (e.g., tools like Checkov, tfsec, or KICS) detects misconfigurations in Terraform, CloudFormation, or ARM templates before resources are provisioned, embedding security controls early in the development lifecycle as shift-left demands. Option D is correct because threat modeling during the design phase (using frameworks such as STRIDE or PASTA) identifies architectural weaknesses and attack surfaces before any code is written, which is the earliest possible point to remediate design-level risks. Option E is correct because automated SAST and DAST integrated into the CI/CD pipeline (e.g., SonarQube, Checkmarx, OWASP ZAP) continuously analyze source code and running applications on every build, providing fast feedback to developers rather than waiting for release. Option A does not belong because post-deployment penetration testing occurs after the application is live, which is a reactive, right-side activity rather than shift-left. Option C does not belong because annual security awareness training is a periodic, organization-wide control that is not a technical component of the cloud SDLC pipeline and does not provide continuous, code-level security feedback.

Answer

Post-deployment penetration testing

Answer

Annual security awareness training

Question 4

A company uses a cloud key management service (KMS) and wants to ensure that keys can be used only within a specific geographic region. Which of the following should be configured?

Accepted Answer

Key policy with a condition for allowed regions. A key policy with a condition using the `kms:CallerRegion` or `aws:RequestRegion` condition key can explicitly restrict the geographic region where the KMS key can be used. This ensures that any cryptographic operation (e.g., Encrypt, Decrypt) attempted from an unauthorized region is denied, enforcing regional data sovereignty requirements.

Answer

VPC endpoint for KMS

Answer

CloudTrail logging

Answer

Key rotation policy

Question 5

Which THREE of the following are typical data privacy principles found in most regulations?

Accepted Answer

Data minimization. Data minimization, purpose limitation, and accountability are common principles in privacy regulations like GDPR. Data retention is a practice derived from principles, and data monetization is not a privacy principle but a business activity.

Answer

Data retention

Answer

Data monetization

Question 6

A financial services company uses a hybrid cloud environment with an on-premises data center and AWS. They have deployed a Cloud Access Security Broker (CASB) to enforce data loss prevention (DLP) policies for SaaS applications. Recently, the security team noticed that sensitive customer data is being exfiltrated via encrypted traffic to a sanctioned cloud storage application. The CASB logs show the traffic is identified as HTTPS, but the DLP policy is not blocking it. The team verifies that the CASB is configured with a forward proxy and SSL inspection is enabled. Which action should the security team take to prevent this exfiltration?

Accepted Answer

Ensure the CASB's SSL certificate is deployed to all endpoint devices. The CASB is configured as a forward proxy with SSL inspection enabled, but for SSL inspection to work, the CASB's certificate must be trusted by the endpoint devices. Without the CASB's certificate deployed to the endpoints, the SSL inspection fails (the CASB cannot decrypt the traffic), so the DLP policy cannot inspect the payload of HTTPS traffic, allowing sensitive data to be exfiltrated. Deploying the CASB's certificate to all endpoint devices ensures that the endpoints trust the CASB's man-in-the-middle decryption, enabling the CASB to decrypt, inspect, and enforce DLP policies on encrypted traffic.

Answer

Block all HTTPS traffic to the cloud storage application

Answer

Configure the CASB to log only metadata for encrypted traffic

Answer

Disable HTTPS for the cloud storage application and force HTTP

Question 7

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

Accepted Answer

Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.. The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Answer

Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

Answer

Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

Answer

Implement a data classification policy to label all data assets according to sensitivity.

Question 8

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

Accepted Answer

Implement rate limiting on the authentication endpoint. Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.

Answer

Require API keys for all requests

Answer

Use TLS to encrypt the communication channel

Answer

Add input validation for all parameters

Question 9

A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

Accepted Answer

It denies access to objects over HTTP, but allows HTTPS.. The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Answer

It allows all access to the bucket.

Answer

It denies access to objects over HTTPS, but allows HTTP.

Answer

It denies all access to the bucket.

Question 10

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using a cloud-native service

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 11

A team is adopting DevSecOps. Which practice best integrates security into the development lifecycle?

Accepted Answer

Automated security testing in CI/CD pipeline. Automated security testing in the CI/CD pipeline (Option C) is the correct practice because it embeds security checks—such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA)—directly into the build and deployment process. This ensures that vulnerabilities are detected and remediated early, aligning with the DevSecOps principle of 'shifting left' and enabling continuous security validation without slowing down development velocity.

Answer

Security awareness training

Answer

Annual penetration testing

Answer

Manual code review before release

Question 12

Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?

Accepted Answer

Check the source IP address against the company's approved IP ranges.. The first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.

Answer

Immediately revoke all admin privileges for the user.

Answer

Review the key pair's usage to see if it was used to launch instances.

Answer

Delete the key pair immediately to prevent any misuse.

Question 13

A cloud customer is preparing for litigation and needs to place a legal hold on specific data stored in an object storage service. The cloud provider offers features such as object lock and retention policies. What is the primary challenge the customer must address to ensure the legal hold is effective across all copies of the data?

Accepted Answer

Ensuring that the legal hold is applied to all copies of the data, including replicas and backups, and that the hold prevents modification as well as deletion.. In cloud environments, data may be replicated across multiple regions or stored in backups. A legal hold must prevent deletion or alteration of all copies, including replicas and backups. Failure to apply hold to all copies can result in spoliation.

Answer

Ensuring that the legal hold is time-limited and automatically expires after 90 days.

Answer

Verifying that the cloud provider has a backup of the data in a different geographic region.

Answer

Obtaining a court order that specifically authorizes the cloud provider to preserve the data.

Question 14

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

Accepted Answer

Enable transparent data encryption (TDE) with customer-managed keys for the database and its backups.. Transparent Data Encryption (TDE) with customer-managed keys encrypts the database at rest and, when properly configured, also encrypts backup files. This ensures that even if backup files are stolen, the data remains unreadable without the decryption keys, providing a strong defense against data breaches involving physical or logical theft of backups.

Answer

Restrict access to the backup files using IAM roles.

Answer

Use a virtual private cloud (VPC) to isolate the database from the internet.

Answer

Implement data tokenization for all sensitive fields.

Question 15

A company runs its production workloads on a cloud infrastructure-as-a-service (IaaS) platform. The security operations team uses a SIEM to monitor security events. Over the past week, they have observed an increasing number of alerts indicating failed login attempts to a critical database server. The source IP addresses are varied and originate from different geographic regions. The team has also noticed that the database server's CPU usage has spiked during non-business hours. The database is not exposed to the internet; it is in a private subnet. The security team suspects that the database credentials have been compromised. Which of the following actions should the security team take FIRST to mitigate the risk?

Accepted Answer

Rotate the database credentials immediately. The scenario indicates compromised database credentials: failed logins from diverse geographic sources and off-hours CPU spikes on a non-internet-facing database. The FIRST mitigation action is to rotate the database credentials immediately, which invalidates the compromised credentials and stops the attacker's access. This is a containment action that takes precedence over investigation or perimeter blocking because the attacker already has valid credentials that bypass network controls.

Answer

Conduct a forensic investigation to determine how the credentials were compromised

Answer

Block the source IP ranges identified in the SIEM alerts at the network firewall

Answer

Enable multi-factor authentication on the database server