CCSP Practice Test 29 — 15 Questions

Question 1

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Log file integrity validation. Log file integrity validation is the cloud-native feature (e.g., AWS CloudTrail log file integrity validation) that uses cryptographic hashing and digital signatures to prove that log files have not been altered or deleted after delivery. It produces a digest file for each log delivery containing SHA-256 hashes and a signature, allowing the analyst to verify tamper-evidence. This directly answers the requirement to 'confirm logs have not been tampered with.'

Answer

Server-side encryption of logs

Answer

Anomaly detection on logs

Answer

Immutable storage for logs

Question 2

A DevOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and prevent tampering?

Accepted Answer

Sign container images using Cosign. Option A is correct because Cosign (part of the Sigstore project) cryptographically signs container images, producing a signature that can later be verified to prove the image was built by a trusted identity and has not been altered. Option B is correct because admission controllers such as Kyverno (or OPA Gatekeeper, Connaisseur) enforce policy at the Kubernetes API server, rejecting any pod whose image lacks a valid Cosign signature, thereby blocking tampered or unsigned images from running. Option E is correct because in-toto attestations capture signed, verifiable metadata about the build process (e.g., SLSA provenance), letting the team prove how and from what source an image was produced, which is central to supply-chain integrity. Option C is not appropriate because the mutable 'latest' tag provides no immutability or version pinning, making it impossible to guarantee which image is deployed and undermining tamper detection. Option D is not appropriate because a public registry exposes images to unauthorized pulls and potential tampering, whereas a private, access-controlled registry with immutable tags is the secure choice.

Answer

Use the 'latest' tag for base images

Answer

Store images in a public registry

Question 3

A security engineer is reviewing a cloud application that uses AWS S3 buckets. Which vulnerability is most specific to cloud environments and is often exploited to access sensitive data?

Accepted Answer

Exposed S3 buckets with public read access. Exposed S3 buckets with public read access are a cloud-specific misconfiguration vulnerability because they rely on the AWS S3 bucket policy or ACL settings that grant unauthenticated access to objects. Unlike traditional on-premises vulnerabilities, this arises from improper cloud resource configuration, allowing attackers to enumerate and download sensitive data directly via HTTP/HTTPS requests without any authentication.

Answer

Buffer overflow

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 4

A cloud architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms are essential to prevent tenant data leakage? (Choose two.)

Accepted Answer

Network isolation (e.g., VLANs, VPCs). Option B (Network isolation, e.g., VLANs, VPCs) is correct because segmenting tenant traffic at Layer 2/Layer 3 with VLANs or cloud VPCs and security groups prevents cross-tenant lateral movement and unauthorized access to another tenant's resources, which is a foundational control against data leakage in multi-tenant SaaS. Option D (Logical data isolation, e.g., database per tenant) is correct because separating tenant records through per-tenant databases, schemas, or tenant-ID row-level filtering ensures that queries and application logic cannot read or modify another tenant's data even if a request is misrouted. Option A (Geographic isolation) is not essential here because placing tenants in different regions addresses residency and latency, not the core logical separation needed to stop data leakage between tenants sharing the same application. Option C (Shared storage volume encryption) is insufficient because encrypting a shared volume protects data at rest but does not prevent one tenant's application context from accessing another tenant's records on that same volume. Option E (Hypervisor isolation) is not the essential mechanism for this scenario because it separates VMs at the virtualization layer, whereas multi-tenant SaaS typically shares application and database tiers where network and logical data isolation are the decisive controls.

Answer

Geographic isolation

Answer

Shared storage volume encryption

Answer

Hypervisor isolation

Question 5

A company uses a cloud-based intrusion detection system (IDS) that generates logs containing IP addresses. The company is headquartered in a country with data localization laws. What is the primary compliance risk?

Accepted Answer

Log data containing personal data may be processed in a different jurisdiction. The primary compliance risk is that log data containing personal data (such as IP addresses, which can be considered personal data under GDPR and other laws) may be processed in a different jurisdiction. Data localization laws require that certain data be stored and processed within the country's borders. If the cloud-based IDS processes logs outside the country, it could violate these laws.

Answer

The logs may be tampered with in transit

Answer

The IDS logs consume too much storage

Answer

The IDS may miss certain attack patterns

Question 6

An organization uses a cloud security monitoring service for threat detection. A finding indicates that a virtual machine instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

Accepted Answer

Crypto mining on a virtual machine. A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Answer

Reconnaissance port scanning

Answer

Ransomware activity

Answer

Compromised credentials exfiltration

Question 7

An organization wants to assess the security controls of a cloud provider before entering into a contract. What is the most efficient method?

Accepted Answer

Review a SOC 2 Type II report. Reviewing a SOC 2 Type II report provides an independent assessment of a provider's controls over time. On-site audits are costly and time-consuming. Vulnerability scanning and penetration test reports may not be available or comprehensive.

Answer

Request a penetration test report

Answer

Conduct an on-site audit

Answer

Perform vulnerability scanning

Question 8

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

Accepted Answer

SQL injection. Directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)

Question 9

A company is negotiating a cloud contract and wants to ensure data ownership and deletion. Which TWO clauses should be included? (Select two.)

Accepted Answer

Data ownership clause. Option C, the data ownership clause, is correct because it contractually establishes that the company retains legal ownership of its data stored or processed by the cloud provider, preventing the provider from claiming rights over that data. Option E, the data deletion clause, is correct because it specifies the provider's obligations to securely and verifiably delete the company's data upon contract termination or on request, including timelines and certification of destruction. Option A, the right to audit clause, is not among the marked correct answers because while it supports compliance verification, it does not directly address ownership or deletion of data. Option B, the non-disclosure agreement, is not marked correct because it protects confidentiality of shared information but does not establish data ownership or mandate deletion. Option D, the service level agreement, is not marked correct because it defines performance metrics such as uptime and availability, not data ownership or deletion rights.

Answer

Right to audit clause

Answer

Non-disclosure agreement

Answer

Service level agreement

Question 10

An organization is developing a mobile app that communicates with a cloud API. To ensure secure authentication, which of the following should be used?

Accepted Answer

OAuth 2.0 with OpenID Connect. OAuth 2.0 with OpenID Connect (OIDC) is the correct choice because it provides a delegated authorization framework (OAuth 2.0) combined with an identity layer (OIDC) that enables secure authentication and single sign-on (SSO) for mobile apps communicating with cloud APIs. This combination issues short-lived access tokens and ID tokens (typically JWTs) rather than exposing long-lived credentials, and supports token refresh, scoped permissions, and PKCE (Proof Key for Code Exchange) to prevent authorization code interception on mobile devices.

Answer

Session cookies for state management

Answer

Basic authentication with username and password

Answer

API keys sent in HTTP headers

Question 11

A company is required by a data sovereignty law to ensure that all data generated by its EU customers is stored and processed within the EU. The company uses a cloud provider with data centers in multiple regions. Which cloud storage configuration should they implement?

Accepted Answer

Select a cloud region located in the EU and disable cross-region replication.. Data sovereignty requires that data remains within a specific legal jurisdiction. By selecting a cloud region physically located in the EU and disabling cross-region replication, the company ensures that data is stored and processed only within EU borders, satisfying the legal requirement. Cross-region replication, even within the same country, could still violate the law if the replication target is outside the EU or if the law requires strict in-region processing. Encryption and classification do not change the physical location of data, so they do not address sovereignty.

Answer

Enable cross-region replication to a region in the same country.

Answer

Use client-side encryption for all EU data.

Answer

Apply data classification labels to all EU data.

Question 12

A cloud security auditor is reviewing container runtime configurations. Which TWO practices help prevent a container from compromising the host operating system?

Accepted Answer

Using a read-only root filesystem. Option A, using a read-only root filesystem, is correct because it prevents a compromised container process from writing malicious files, modifying binaries, or persisting changes to the container's filesystem, which limits the ability to tamper with the host through mounted volumes or writable layers. Option D, dropping all Linux capabilities, is correct because Linux capabilities grant fine-grained kernel privileges (e.g., CAP_SYS_ADMIN, CAP_NET_ADMIN); dropping all of them removes the ability to perform privileged operations like mounting filesystems, loading kernel modules, or manipulating network stacks that could be leveraged to escape the container and affect the host. Option B is wrong because disabling SELinux removes a mandatory access control layer that confines container processes, weakening host protection rather than strengthening it. Option C is wrong because privileged mode gives the container nearly all host capabilities and device access, dramatically increasing the risk of host compromise. Option E is wrong because mapping the host's Docker socket into a container effectively grants control over the Docker daemon, allowing the container to launch privileged containers or access the host, which is a well-known container escape vector.

Answer

Disabling SELinux inside the container

Answer

Running containers in privileged mode

Answer

Mapping the host's Docker socket into the container

Question 13

Which CSA STAR tier involves a third-party assessment against ISO 27001?

Accepted Answer

Tier 2 – Third-party assessment. The CSA STAR (Security, Trust, Assurance, and Risk) program has three tiers: Tier 1 (Self-Assessment), Tier 2 (Third-Party Assessment), and Tier 3 (Continuous Monitoring). Tier 2 specifically requires a third-party assessment against the ISO/IEC 27001 standard, where an accredited certification body audits the cloud service provider's Information Security Management System (ISMS) for compliance. This tier provides a higher level of assurance than self-assessment, as it involves independent validation of security controls.

Answer

Tier 4 – Peer review

Answer

Tier 1 – Self-assessment

Answer

Tier 3 – Continuous monitoring

Question 14

An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?

Accepted Answer

A large number of objects being downloaded from a Cloud Storage bucket. Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.

Answer

A service account creating a new VM

Answer

A user logging in from a new IP address

Answer

A firewall rule change allowing all inbound traffic

Question 15

A multinational corporation uses a hybrid cloud model with on-premises data centers and the AWS cloud. They have implemented a Cloud Access Security Broker (CASB) to enforce security policies. Recently, the security team noticed that users are accessing cloud applications from unusual geographic locations and downloading large volumes of data. The CASB logs show that the users authenticated using single sign-on (SSO) with valid credentials. The company has not enabled multi-factor authentication (MFA) for all users due to a previous pushback from the user community. The security team suspects a credential theft incident. What is the BEST course of action to mitigate the risk and respond to the potential incident?

Accepted Answer

Revoke the suspicious sessions and require all users to re-authenticate with MFA before granting access to cloud applications.. The best course of action is to immediately revoke the suspicious sessions and enforce MFA for all users before granting further access. This contains the potential breach by invalidating stolen credentials and adds a strong authentication factor to prevent unauthorized access. Since the CASB logs show valid SSO credentials, simply changing passwords may not be sufficient if the attacker has session tokens.

Answer

Ask the affected users to change their passwords and monitor their accounts for further suspicious activity.

Answer

Lock all user accounts and require the IT team to manually verify each user's identity before unlocking.

Answer

Disable SSO immediately and require users to authenticate directly with the cloud applications.