CCSP Practice Test 3 — 10 Questions

Question 1

A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CPU Pinning. CPU Pinning (option A) ensures VM isolation at the hardware level by dedicating specific physical CPU cores exclusively to a particular VM. This prevents other VMs from scheduling on those cores, eliminating CPU-level side-channel attacks and resource contention. It is a hardware-enforced isolation mechanism because the hypervisor uses the CPU's hardware virtualization extensions (e.g., Intel VT-x or AMD-V) to enforce the pinning, ensuring that one tenant's VM cannot access another's CPU resources.

Answer

Hypervisor Introspection

Answer

Security Groups

Answer

Network ACLs

Question 2

A cloud security architect is implementing a CI/CD pipeline for a containerized application on AWS. Which TWO practices should be integrated to enforce container image security?

Accepted Answer

Scan container images for vulnerabilities before push to registry. Scanning container images for vulnerabilities before pushing them to a registry is a critical shift-left security practice. It ensures that known Common Vulnerabilities and Exposures (CVEs) in base images or application dependencies are detected and remediated early in the CI/CD pipeline, preventing insecure images from being deployed. Tools like Trivy, Clair, or AWS ECR image scanning integrate directly into the pipeline to enforce this policy.

Answer

Implement runtime application self-protection (RASP)

Answer

Use a cloud WAF to protect the containerized application

Answer

Run SAST on the application source code

Question 3

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 4

A company uses a cloud KMS with HSM-backed keys for regulatory compliance. They need to allow a cloud service to use a key for encryption while retaining the ability to revoke access at any time. Which TWO key management models satisfy this? (Choose two.)

Accepted Answer

Bring your own key (BYOK). BYOK is correct because it allows the customer to import their own key material into the cloud KMS, which is backed by an HSM, and the customer retains full control over the key's lifecycle, including the ability to revoke access at any time by disabling or deleting the key. CMEK is correct because it gives the customer direct management of the key (e.g., rotation, disabling, deletion) within the cloud KMS, while the HSM provides hardware-level protection, and the customer can revoke the cloud service's access by modifying key permissions or disabling the key.

Answer

Hold your own key (HYOK)

Answer

Customer-supplied keys (CSEK)

Answer

Cloud provider-managed keys

Question 5

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

Accepted Answer

Sub-processor authorization. GDPR requires that data controllers obtain prior authorization before a processor engages a sub-processor. The customer (controller) was not notified, violating the requirement for sub-processor authorization. Other rights like erasure are unrelated to this scenario.

Answer

Data protection by design

Answer

Data breach notification

Answer

Right to erasure

Question 6

An enterprise uses a cloud access security broker (CASB) to protect data in cloud applications. They want to prevent users from uploading files containing credit card numbers to a cloud storage service. Which CASB feature should be configured?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies are the correct CASB feature because they allow the enterprise to define content inspection rules that scan files for sensitive data patterns, such as credit card numbers (matching Luhn algorithm or regex patterns like those in PCI DSS). When a match is detected, the CASB can block the upload, quarantine the file, or trigger an alert, directly preventing data exfiltration to the cloud storage service.

Answer

Encryption in transit settings

Answer

User activity monitoring

Answer

Single sign-on (SSO) integration

Question 7

An organization wants to ensure that its CSP does not access customer data for any purpose other than providing the service. Which clause should be included?

Accepted Answer

Data use restriction. A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

Answer

Right to audit

Answer

Security incident response

Answer

Non-disclosure agreement

Question 8

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 9

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). Type 1 (bare-metal) hypervisors run directly on the hardware, providing better performance and isolation because there is no host OS layer that could be compromised. Type 2 hypervisors run on top of an OS, adding attack surface.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 10

An organization uses a private artifact registry for approved package sources. A developer accidentally publishes a package with a similar name to an internal package to the public registry. This could lead to which type of attack?

Accepted Answer

Dependency confusion. Dependency confusion occurs when a package manager (e.g., npm, pip, Maven) resolves a package name to a public registry instead of a private one, because the public registry has a package with the same or similar name. In this scenario, the developer accidentally published a package with a similar name to the public registry, so internal builds may fetch that malicious public package instead of the intended internal one, leading to arbitrary code execution in the build pipeline.

Answer

Cross-site request forgery (CSRF)

Answer

Denial of service (DoS)

Answer

Man-in-the-middle (MITM)