CCSP Practice Test 29 — 15 Questions

Question 1

A multinational corporation is deploying a containerized microservices application on a public cloud Kubernetes cluster. The cluster spans three availability zones in a single region. The application consists of a front-end service, a payment service, and a database service. The security team requires that the payment service must not be directly accessible from the internet, but must be accessible from the front-end service. The database must only be accessible from the payment service. Additionally, all inter-service communication must be encrypted, and the cluster must be able to scale up to 500 nodes during peak load. The cloud provider's container orchestration service is used. After deployment, the security team discovers that the payment service is still reachable from the internet via a public load balancer that was configured for testing. The team needs to remediate this issue immediately without disrupting the front-end service. Which of the following actions should the team take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a Kubernetes NetworkPolicy that denies ingress to the payment service pods from all sources except the front-end service's pod label.. A Kubernetes NetworkPolicy can enforce fine-grained ingress rules at the pod level, allowing only traffic from the front-end service's pod label to reach the payment service pods. This directly addresses the requirement to block internet access while preserving front-end-to-payment communication, without modifying the service type or disrupting the front-end service. NetworkPolicies operate at Layer 3/4 and are native to Kubernetes, making them the immediate and precise remediation.

Answer

Change the payment service type from LoadBalancer to ClusterIP and update the front-end configuration.

Answer

Delete the public load balancer that was used for testing.

Answer

Apply a security group to the node instances to block inbound traffic on the payment service port.

Question 2

A healthcare provider is subject to HIPAA regulations. They are planning to use a public cloud provider. Which design consideration is most important to ensure compliance?

Accepted Answer

Data residency. Data residency is the most critical design consideration for a healthcare provider subject to HIPAA when using a public cloud, because HIPAA requires that protected health information (PHI) be stored and processed only in jurisdictions where the cloud provider can guarantee compliance with the HIPAA Privacy and Security Rules. If the cloud provider replicates data across regions or countries without explicit control, the organization may violate the HIPAA requirement to ensure that PHI is not exposed to unauthorized access or disclosure, and may also breach the Breach Notification Rule if data crosses borders into regions with weaker protections.

Answer

Containerization

Answer

Cost optimization

Answer

Multi-cloud strategy

Question 3

A company is moving a legacy application to a public cloud. The application requires low latency and high throughput between two application tiers. Which two cloud design principles should be applied? (Choose two.)

Accepted Answer

Use dedicated network connections between tiers.. Dedicated network connections, such as AWS Direct Connect or Azure ExpressRoute, provide consistent low latency and high throughput by bypassing the public internet and reducing jitter. This ensures predictable performance for latency-sensitive inter-tier communication, which is critical for legacy applications with strict performance requirements.

Answer

Deploy both tiers in the same region but different availability zones.

Answer

Use a single large instance for both tiers.

Answer

Place the tiers in different VPCs with a transit gateway.

Question 4

Drag and drop the steps for setting up a virtual private cloud (VPC) with public and private subnets in AWS into the correct order.

Accepted Answer

Create VPC, then create subnets, then create Internet Gateway, then configure route tables, then launch instances.. First create VPC, then subnets, Internet Gateway, route tables, and finally launch instances.

Answer

Create VPC, then create Internet Gateway, then create subnets, then configure route tables, then launch instances.

Answer

Create subnets, then create VPC, then create Internet Gateway, then configure route tables, then launch instances.

Answer

Create VPC, then create subnets, then configure route tables, then create Internet Gateway, then launch instances.

Question 5

Which THREE of the following are required components of a cloud data lifecycle policy?

Accepted Answer

Data deletion procedures. Data deletion procedures are a required component of a cloud data lifecycle policy because they define how data is securely and irreversibly removed at the end of its useful life. This includes methods such as cryptographic erasure, overwriting with patterns (e.g., NIST SP 800-88), or degaussing, ensuring compliance with legal and regulatory requirements. Without explicit deletion procedures, data may persist in cloud storage, leading to unauthorized access or retention violations.

Answer

Legal hold process

Answer

Data encryption algorithm selection

Question 6

Which of the following is an example of a data sovereignty law that directly affects cloud data storage?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is a data sovereignty law because it imposes strict requirements on the storage and processing of personal data of EU residents, mandating that data be stored within the EU or in jurisdictions with equivalent protection, directly affecting where cloud providers can host data. It enforces data localization principles through mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), requiring cloud customers to ensure their provider's storage regions comply with these territorial restrictions. In contrast, the California Consumer Privacy Act (CCPA) is a privacy law that grants consumers rights over their personal data but does not mandate where data must be stored geographically, so it is not a data sovereignty law. The other options (SOX, PCI DSS, HIPAA) are security or sector-specific regulations without territorial storage requirements.

Answer

Sarbanes-Oxley Act (SOX)

Answer

California Consumer Privacy Act (CCPA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Question 7

A cloud architect is designing a data classification scheme for a financial services firm. The data includes public marketing materials, internal emails, customer account numbers, and credit card information. Which two data categories should be classified as 'restricted' under PCI DSS and other regulations?

Accepted Answer

Credit card information. Credit card information (Option B) is classified as 'restricted' because PCI DSS explicitly mandates strict controls for cardholder data, including primary account numbers (PANs), expiration dates, and CVV codes. This data requires encryption at rest and in transit, access controls, and regular security audits to comply with the Payment Card Industry Data Security Standard.

Answer

Public marketing materials

Answer

Internal emails

Question 8

During a threat modeling session for a cloud application, the team identifies a risk where an attacker could trick the application into making HTTP requests to the cloud metadata endpoint (e.g., http://169.254.169.254). What is the most critical impact of this attack?

Accepted Answer

Retrieval of temporary IAM credentials for the instance. Server-Side Request Forgery (SSRF) to the cloud metadata endpoint can retrieve IAM credentials, granting the attacker access to cloud resources.

Answer

Denial of service to the metadata service

Answer

Modification of the cloud instance's configuration

Answer

Exposure of the application's source code

Question 9

An API endpoint returns user profile details including email, phone, and address. The response includes fields that are not needed for the client application. Which OWASP API Security risk does this represent?

Accepted Answer

Excessive Data Exposure. Excessive data exposure occurs when an API returns more data than necessary, increasing the risk of sensitive information leakage.

Answer

Mass Assignment

Answer

Broken Object Level Authorization

Answer

Lack of Rate Limiting

Question 10

Which cloud-specific vulnerability involves an attacker making a server-side request to the cloud metadata endpoint (e.g., 169.254.169.254) to retrieve temporary credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) attacks can target cloud metadata endpoints to obtain IAM credentials.

Answer

Cross-Site Scripting (XSS)

Answer

Broken Object Level Authorization (BOLA)

Answer

SQL Injection

Question 11

Which of the following is an example of a runtime application self-protection (RASP) capability?

Accepted Answer

Blocking an SQL injection attempt during execution. RASP operates within the application runtime to detect and block attacks in real-time. Blocking an SQL injection attempt during execution is a typical RASP function.

Answer

Checking for misconfigured S3 buckets

Answer

Analyzing logs after an attack

Answer

Scanning source code for vulnerabilities

Question 12

Which of the following is a best practice for managing secrets in a cloud-native application?

Accepted Answer

Using a cloud secrets manager to retrieve secrets at runtime. Using a cloud secrets manager (e.g., AWS Secrets Manager) allows applications to retrieve secrets dynamically, avoiding hardcoded credentials.

Answer

Encrypting secrets and storing them in a configuration file

Answer

Storing secrets in environment variables inside container images

Answer

Hardcoding secrets in the application source code

Question 13

During a cloud incident response, a security team needs to collect memory from a compromised EC2 instance for forensic analysis. Which method is most appropriate for acquiring a memory dump?

Accepted Answer

Use AWS Systems Manager to run a memory acquisition script on the instance.. Memory (RAM) is volatile and not captured by disk snapshots or logs. Collecting a memory dump requires live forensic acquisition while the instance is running. AWS Systems Manager (SSM) allows remote execution of scripts, such as a memory capture tool (e.g., LiME or DumpIt), on the target instance. This method is efficient, forensically sound, and minimizes disruption. CloudTrail logs API calls, not memory. EBS snapshots only capture persistent storage. VPC Flow Logs record network metadata, not memory content. Therefore, D is the correct answer.

Answer

Analyze CloudTrail logs for the instance's API calls.

Answer

Take a snapshot of the EBS volumes attached to the instance.

Answer

Review VPC Flow Logs for network traffic.

Question 14

A company is deploying a multi-tier application in a public cloud and needs to restrict traffic between tiers. The web tier must only accept HTTPS from the internet, and the app tier must only accept HTTP from the web tier. Which cloud networking feature should be used to enforce this?

Accepted Answer

Network access control lists (ACLs) attached to the subnets.. Network ACLs are stateless, meaning they filter traffic based on source and destination IP addresses, ports, and protocols at the subnet level. By configuring inbound rules on the web tier subnet to allow HTTPS (TCP/443) from the internet and outbound rules to allow HTTP (TCP/80) to the app tier subnet, and inbound rules on the app tier subnet to allow HTTP only from the web tier subnet, you enforce the required traffic restrictions without maintaining session state. This stateless behavior is essential for explicitly controlling traffic between tiers in a multi-tier architecture.

Answer

Security groups applied to each tier’s instances.

Answer

Internet gateway with appropriate routes.

Answer

VPC peering connection between tier subnets.

Question 15

A SaaS provider stores customer data in a multi-tenant database. A new regulation requires that data of former customers be completely erased within 30 days of account closure. Which process should the provider implement?

Accepted Answer

Encrypt each customer's data with a unique key and delete the key upon account closure.. It implements cryptographic erasure, which renders the data permanently inaccessible by deleting the unique encryption key. This approach satisfies the regulation's requirement for complete erasure within 30 days without physically destroying hardware or risking data remnants, as the encrypted data becomes irrecoverable without the key. In a multi-tenant SaaS environment, this method is efficient, scalable, and avoids service disruption to other tenants sharing the same storage.

Answer

Physically destroy the hard drives containing the data.

Answer

Mark the data as deleted and exclude it from query results.

Answer

Overwrite the data with zeros using a secure delete tool.