CCSP Practice Test 28 — 15 Questions

Question 1

A cloud application allows users to upload profile pictures that are stored in Azure Blob Storage. Which vulnerability is most likely if the application does not validate the content type or size of uploaded files?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unrestricted File Upload. Without validation, an attacker could upload a malicious file (e.g., a web shell) that could be executed on the server, leading to remote code execution.

Answer

Server-Side Request Forgery (SSRF)

Answer

Mass Assignment

Answer

Broken Object Level Authorization (BOLA)

Question 2

Which TWO of the following are recommended practices for securing container images in a cloud environment? (Select TWO)

Accepted Answer

Scanning images for vulnerabilities in the CI pipeline. Signing container images ensures integrity and prevents tampering, and scanning images in the CI pipeline before deployment catches vulnerabilities early.

Answer

Using the latest tag for all images

Answer

Running containers as root user

Answer

Storing images in a public registry for easier access

Question 3

A cloud security operations team is evaluating SIEM solutions. They need to minimize false positives while ensuring critical security events are not missed. Which of the following is the MOST effective technique to achieve this balance?

Accepted Answer

Implement context-aware correlation and tune rules based on feedback loops. Context-aware correlation leverages environmental context (e.g., asset value, user behavior) to reduce false positives while maintaining sensitivity. Feedback loops allow continuous tuning based on actual incidents. Option B is incorrect because aggregating all events into a single rule increases noise and makes analysis difficult. Option C is incorrect because increasing thresholds may cause true positives to be missed. Option D is incorrect because signature-based detection alone cannot detect novel attacks and may miss critical events.

Answer

Aggregate all security events into a single correlation rule

Answer

Increase the alert threshold for all event types to reduce noise

Answer

Rely exclusively on signature-based detection

Question 4

A cloud administrator notices that a storage bucket containing sensitive data is publicly accessible. What is the most likely misconfiguration?

Accepted Answer

The bucket's ACLs are too permissive.. The most likely misconfiguration is that the bucket's ACLs are too permissive, granting public read or write access to the storage bucket. In cloud platforms like AWS S3 or Azure Blob Storage, bucket ACLs or bucket policies can be set to allow public access, which directly exposes sensitive data. Disabling logging, using server-side encryption, or enabling versioning do not inherently make a bucket publicly accessible.

Answer

The bucket has logging disabled.

Answer

The bucket is using server-side encryption.

Answer

The bucket is versioned.

Question 5

A large healthcare organization runs its electronic health records (EHR) system on a private cloud built with VMware vSphere. They have implemented a hybrid cloud strategy with a public cloud provider for disaster recovery. The EHR application is mission-critical and must maintain high availability with zero data loss. During a routine audit, the security team discovers that the replication between the private cloud and the public cloud uses asynchronous replication with a 15-minute recovery point objective (RPO). However, the application requires an RPO of less than 1 minute. Additionally, the replication data is not encrypted in transit. The compliance officer demands immediate remediation. The cloud architect must propose a solution that meets the RPO requirement and ensures encryption of data in transit. Which of the following actions is the most appropriate first step?

Accepted Answer

Switch to synchronous replication between the private cloud and public cloud to achieve near-zero RPO, and enable TLS for replication traffic.. Synchronous replication ensures that data is written to both the primary and secondary sites before acknowledging the write, achieving near-zero RPO (typically sub-second). Enabling TLS for replication traffic encrypts data in transit, directly addressing the compliance requirement. This approach meets the application's mission-critical need for zero data loss and encryption without changing the underlying hybrid architecture.

Answer

Move the entire EHR system to the public cloud and use native replication services.

Answer

Increase the frequency of asynchronous replication to every 30 seconds and use IPsec VPN for encryption.

Answer

Implement a third-party replication tool that uses compression and encryption, and keep asynchronous replication with 15-minute RPO.

Question 6

During a security review, a cloud security architect discovers that a PaaS database service has public network access enabled. The application team claims they need it for external integrations. What is the most secure alternative to allow necessary access?

Accepted Answer

Use Azure Private Link or AWS PrivateLink to connect via private IP within the cloud network.. Azure Private Link or AWS PrivateLink creates a private endpoint within the cloud network, allowing the database to be accessed privately without public internet exposure. This is the most secure alternative as it eliminates the attack surface of a public IP. Option A is incorrect because encryption does not prevent public access; it only protects data confidentiality. Option C is incorrect because moving to a VM-hosted instance introduces additional management overhead and may still require public access depending on configuration. Option D is a less secure alternative because IP whitelisting still exposes the database to the public internet, and IP addresses can be spoofed or change.

Answer

Encrypt all data at rest and in transit to the database.

Answer

Move the database to a VM-hosted instance with a VPN connection.

Answer

Restrict public access using IP whitelisting to only required external IPs.

Question 7

A cloud architect is designing a data classification strategy for a multi-cloud environment. The strategy must automatically tag resources with classification labels and enforce access controls based on those labels. Which THREE components are essential for this automated classification and enforcement?

Accepted Answer

IAM policies that reference classification tags. Automated DLP scanning detects and classifies data, tagging applies labels, and IAM policies enforce access based on those labels.

Answer

Pre-signed URLs for temporary access

Answer

HSM-backed key generation

Question 8

A financial services firm uses a hybrid cloud architecture with a VPN connection to AWS. They need to comply with PCI DSS requirements for network segmentation. Which design is best?

Accepted Answer

Implement a DMZ with a firewall appliance in a transit VPC.. A DMZ with a firewall appliance in a transit VPC provides a controlled, inspectable boundary between the on-premises network and AWS, enabling network segmentation that meets PCI DSS Requirement 1 (firewall configuration) and Requirement 1.3 (DMZ to isolate cardholder data from untrusted networks). The transit VPC design allows centralized egress/ingress inspection and prevents direct lateral movement between environments, which is critical for compliance.

Answer

Use AWS Direct Connect with multiple VLANs to separate traffic.

Answer

Create separate VPCs for cardholder data and corporate systems, connected via VPC peering.

Answer

Use a single VPC with security groups to isolate workloads.

Question 9

Refer to the exhibit. A cloud administrator ran the Azure CLI command to list virtual machines. One VM shows a ProvisioningState of 'Failed'. What is the most likely cause of this state?

Accepted Answer

The VM failed to start due to a resource quota limit or configuration error.. A 'ProvisioningState' of 'Failed' in Azure indicates that the VM could not be created or started due to a resource quota limit (e.g., vCPU quota exceeded) or a configuration error (e.g., invalid network interface, unsupported VM size). This state is set by the Azure Resource Manager when the deployment or update operation fails, and it persists until the underlying issue is resolved and the VM is redeployed or reconfigured.

Answer

The VM's resource group has been moved to another subscription.

Answer

The VM is in a deallocated state.

Answer

The VM was deleted by another administrator.

Question 10

Which cloud service model provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware?

Accepted Answer

Platform as a Service (PaaS). In PaaS, the customer manages applications and data, while the provider manages the runtime, OS, and infrastructure. IaaS gives more control; SaaS gives less.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 11

An organization uses cloud databases and needs to protect sensitive fields such as credit card numbers. They want to preserve the ability to perform exact match searches and joins on these fields. Which data protection technique best meets these requirements?

Accepted Answer

Tokenization with a secure token vault. Tokenization with a secure token vault is correct because it replaces sensitive data (e.g., credit card numbers) with unique, randomly generated tokens that have no mathematical relationship to the original values. The token vault stores the mapping, allowing exact match searches and joins on the tokens while keeping the original data secure, as the tokens are consistent for the same input value.

Answer

Format-preserving encryption (FPE)

Answer

Dynamic data masking

Answer

Deterministic encryption

Question 12

An organization is using GCP and wants to implement automated remediation of security misconfigurations. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

Cloud Functions. Cloud Functions (D) is correct because it can be triggered by events from Cloud Security Command Center (Cloud SCC) to automatically remediate security misconfigurations. Cloud SCC detects vulnerabilities and misconfigurations, and Cloud Functions can execute remediation logic such as modifying IAM policies, enabling logging, or updating firewall rules. Together, they enable event-driven, automated security response without manual intervention.

Answer

Cloud Build

Answer

Cloud Audit Logs

Answer

Cloud Storage

Question 13

What additional security benefit does a private network endpoint provide?

Accepted Answer

It ensures data is not traversing the public internet.. A private network endpoint (such as an interface or gateway endpoint) allows instances within a virtual network to privately connect to supported cloud services without requiring an internet gateway, NAT device, VPN connection, or dedicated connection. The core security benefit is that all traffic between the virtual network and the service stays entirely within the cloud provider's internal network and never traverses the public internet, eliminating exposure to internet-based threats.

Answer

It encrypts data in transit.

Answer

It provides an additional layer of authentication.

Answer

It enables cross-region replication.

Question 14

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Accepted Answer

1. Classify data, 2. Define retention periods, 3. Configure lifecycle policies, 4. Enable immutability (S3 Object Lock), 5. Test and validate. First classify data, then define retention, configure lifecycle, enable immutability, and test.

Answer

1. Configure lifecycle policies, 2. Define retention periods, 3. Classify data, 4. Enable immutability, 5. Test and validate

Answer

1. Enable immutability, 2. Classify data, 3. Define retention periods, 4. Configure lifecycle policies, 5. Test and validate

Answer

1. Test and validate, 2. Classify data, 3. Define retention periods, 4. Configure lifecycle policies, 5. Enable immutability

Question 15

A financial services company is migrating its on-premises data center to a public cloud IaaS environment. During the transition, the security team must ensure that the same network segmentation and firewall rules are maintained. Which of the following is the BEST approach to replicate the on-premises network security controls in the cloud?

Accepted Answer

Use virtual private clouds (VPCs) with subnets and security groups to enforce segmentation and firewall rules.. VPCs with subnets and security groups provide native, software-defined network segmentation and stateful firewall rules that directly replicate on-premises network segmentation and ACLs. Security groups act as virtual firewalls at the instance level, while network ACLs provide subnet-level stateless filtering, together enabling granular control without extending the on-premises network.

Answer

Configure a site-to-site VPN between on-premises and cloud to extend the existing network.

Answer

Implement an intrusion detection and prevention system (IDPS) to monitor traffic.

Answer

Deploy a software-defined WAN (SD-WAN) to manage network traffic between cloud resources.