CCSP Practice Test 29 — 15 Questions

Question 1

A security analyst is using a cloud security posture management (CSPM) tool that reports a finding of "storage bucket publicly accessible." However, upon manual inspection, the bucket's ACL and bucket policy both restrict access to authorized users only. What is the most likely cause of the false positive?

Accepted Answer

The bucket contains objects with public ACLs. Option D is correct because individual objects within the bucket might have public ACLs, which CSPM might detect. Option A (CSPM misconfigured) is possible but less likely. Option B (policy syntax error) would cause error, not public access. Option C (region mismatch) is irrelevant.

Answer

The bucket is in a different region

Answer

The bucket policy has a syntax error

Answer

The CSPM tool is misconfigured

Question 2

A cloud security architect is designing an API gateway for a microservices application. The gateway must authenticate requests, enforce rate limiting, and log all transactions for audit. Which of the following security controls is most critical to protect against API abuse?

Accepted Answer

Implement rate limiting and throttling based on client identity and request volume.. Option D is correct because rate limiting and throttling directly prevent abuse by limiting request frequency. Option A is wrong because encryption protects data in transit but not abuse. Option B is wrong because input validation prevents injection but not volume-based attacks. Option C is wrong because API keys authenticate but do not limit usage.

Answer

Use TLS 1.3 to encrypt all traffic between clients and the gateway.

Answer

Validate and sanitize all input parameters to prevent injection attacks.

Answer

Require API keys for all requests and revoke keys of suspicious clients.

Question 3

A cloud security operations team is evaluating SIEM solutions. They need to minimize false positives while ensuring critical security events are not missed. Which of the following is the MOST effective technique to achieve this balance?

Accepted Answer

Implement context-aware correlation and tune rules based on feedback loops. Option D is correct because tuning detection rules based on environmental context and using threat intelligence reduces false positives while maintaining sensitivity. Option A is wrong because increasing threshold reduces alerts but may miss true positives. Option B is wrong because aggregating events increases noise. Option C is wrong because using only known signatures misses novel attacks.

Answer

Aggregate all security events into a single correlation rule

Answer

Increase the alert threshold for all event types to reduce noise

Answer

Rely exclusively on signature-based detection

Question 4

A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)

Accepted Answer

Anomalous spike in outbound traffic to an unknown IP address. CASBs are designed to detect anomalous data movements. An anomalous spike in outbound traffic to an unknown IP (A) and a large number of file downloads by a single user outside business hours (C) are strong indicators of exfiltration. Multiple failed logins (B) indicate brute force attempts, not exfiltration. Malware in email (D) is a malware indicator, not exfiltration. Firewall rule change (E) is a configuration change, not a direct exfiltration sign.

Answer

A change in the configuration of a firewall rule

Answer

Multiple failed login attempts to a critical application

Answer

An alert for a known malware signature in an email attachment

Question 5

A security analyst is investigating a data breach in a cloud environment. The analyst needs to preserve evidence for legal proceedings. Which of the following actions is most critical to ensure the chain of custody is maintained?

Accepted Answer

Begin a detailed log documenting all actions, timestamps, and personnel involved.. Chain of custody requires documenting every transfer of evidence. Option B is correct because starting a log of all actions with timestamps and personnel ensures accountability. Option A is wrong because notifying management is important but not the most critical for chain of custody. Option C is wrong because isolating systems can destroy volatile data. Option D is wrong because while important, unique hashing alone does not document custody.

Answer

Calculate cryptographic hashes of all relevant files.

Answer

Isolate all affected systems from the network to prevent further data loss.

Answer

Immediately notify senior management and legal counsel.

Question 6

Which THREE of the following are essential steps in the incident response process for a cloud security incident?

Accepted Answer

Contain the incident to prevent further damage.. Correct answers are A, B, and D. Identification (A), containment (B), and eradication (D) are key phases. Option C is wrong because rewarding staff is not part of incident response. Option E is wrong because forensics typically occurs after containment, but is not an essential step in the core process (it is part of analysis).

Answer

Perform a full forensic analysis of all systems before containment.

Answer

Reward the team that discovered the incident to encourage reporting.

Question 7

An incident response team is investigating a potential breach in a cloud environment. They have collected logs from various sources. Which of the following is the MOST critical factor to ensure the admissibility of digital evidence in court?

Accepted Answer

Maintaining a documented chain of custody for all evidence. Option A is correct because maintaining the chain of custody ensures evidence integrity and admissibility. Option B is wrong while important for investigation, admissibility depends on custody. Option C is wrong because logs may not be original but certified copies can be used if chain of custody is maintained. Option D is wrong because encryption does not guarantee authenticity.

Answer

Encrypting all evidence during collection and transport

Answer

Using automated tools for log analysis

Answer

Ensuring logs are in their original format

Question 8

A cloud security architect is designing a defense-in-depth strategy for a multi-tenant IaaS environment. Which of the following controls would BEST protect against workload isolation failure due to a hypervisor vulnerability?

Accepted Answer

Deploy a dedicated virtual firewall instance for each tenant to enforce network segmentation.. Option D is correct because a dedicated firewall instance for each tenant provides network-level isolation independent of the hypervisor. Option A is wrong because hypervisor hardening is necessary but does not guarantee isolation if a vulnerability exists. Option B is wrong because vulnerability scanning is detective, not preventive. Option C is wrong while encryption protects data at rest, it does not prevent a hypervisor escape.

Answer

Perform weekly vulnerability scans of the hypervisor and tenant workloads.

Answer

Apply the latest hypervisor security patches and disable unnecessary services.

Answer

Use encrypted virtual disks for all tenant virtual machines.

Question 9

A company uses a cloud provider's managed database service. The security team is concerned about the shared responsibility model for patching the operating system and database engine. According to the shared responsibility model, who is responsible for applying security patches to the database engine?

Accepted Answer

The cloud provider, because it is a managed service. Option C is correct because for managed services, the cloud provider is responsible for patching the underlying database engine. Option A is wrong because the customer is responsible for the data and access, not the engine. Option B is wrong because both parties do not share this responsibility. Option D is wrong because the database engine is part of the service.

Answer

The customer, because they control the database configuration

Answer

A third-party vendor contracted by the customer

Answer

Both the customer and the cloud provider equally

Question 10

An organization stores customer data in a cloud that is subject to GDPR. The organization uses a cloud provider that does not allow audits of its data centers. What is the best way to satisfy GDPR audit requirements?

Accepted Answer

Rely on the provider's SOC 2 Type II report. GDPR requires adequate assurances from processors. If direct audits are not possible, the customer can rely on third-party certifications like SOC 2 Type II or ISO 27001, which provide independent assurance. Waivers and data minimization do not meet audit requirements.

Answer

Minimize data stored to reduce risk

Answer

Request a contractual waiver for audit rights

Answer

Switch to a provider that allows on-site audits

Question 11

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated. Consent is not generally practical for all data subjects.

Answer

Consent from all data subjects

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield

Question 12

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring IAM policies to control access to their data. The provider is responsible for the infrastructure that enforces the policy. Both are not equally responsible for the policy content. The auditor is not responsible for configuration.

Answer

The third-party auditor

Answer

Both equally

Answer

The cloud provider

Question 13

A healthcare organization is migrating patient data to a public cloud. Which legal framework most directly governs the protection of this data?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to protected health information (PHI) in the US, making it the most directly relevant legal framework for healthcare data. GDPR is broader but less specific to US healthcare, and PCI DSS is for payment card data.

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Sarbanes-Oxley Act (SOX)

Answer

General Data Protection Regulation (GDPR)

Question 14

During a cloud migration, a company discovers that data stored in a specific region must remain there per contract. The cloud provider offers data replication across regions. What is the best practice to ensure compliance?

Accepted Answer

Use data residency controls provided by the cloud provider. Configuring data residency controls (like tagging and policies) ensures data stays within the required region. Disabling replication across regions is too restrictive and may affect availability; contract negotiation is less efficient than technical controls.

Answer

Negotiate a new contract to allow replication

Answer

Disable all data replication features

Answer

Encrypt data before storing it

Question 15

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

Accepted Answer

Up to $500K, the total fees paid in the past 12 months. The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Answer

The amount of direct damages only

Answer

Full $2M because negligence overrides liability caps

Answer

Zero because the customer accepted the terms