CCSP Practice Test 3 — 10 Questions

Question 1

A company is implementing a cloud key management system (KMS) to control encryption keys for sensitive data. Which practice is essential to ensure the security of the keys?

Accepted Answer

Periodically rotate the encryption keys.. Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Answer

Use a single key for all encryption operations to simplify management.

Answer

Export keys to the cloud provider's hardware security module (HSM).

Answer

Store encryption keys in the same region as the encrypted data.

Question 2

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 3

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 4

A security analyst reviews the bucket policy above. What is the primary security concern?

Accepted Answer

The bucket policy allows public read access to all objects. The bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.

Answer

The bucket policy uses an outdated version

Answer

The bucket policy is missing a Condition element

Answer

The bucket policy allows public write access to all objects

Question 5

During an eDiscovery process, a company needs to preserve data stored in AWS S3 that may be relevant to a lawsuit. Which AWS feature should be used to implement a legal hold?

Accepted Answer

S3 Object Lock. S3 Object Lock is the AWS feature designed to implement legal holds. It allows you to place a legal hold on an object version, preventing it from being overwritten or deleted for a specified period or indefinitely. This is specifically used for compliance and legal scenarios like eDiscovery.

Answer

AWS CloudTrail

Answer

S3 Versioning

Answer

AWS Config

Question 6

A company is subject to PCI DSS and plans to use a cloud provider to process credit card transactions. The cloud provider has been assessed by a Qualified Security Assessor (QSA). According to PCI DSS, what must the company obtain from the provider to demonstrate compliance?

Accepted Answer

The provider's PCI DSS Attestation of Compliance (AOC) and Responsibility Matrix. Under PCI DSS, when a customer uses a cloud provider to process cardholder data, the provider must be assessed by a QSA and issue an Attestation of Compliance (AOC) along with a Responsibility Matrix (also called a Shared Responsibility Matrix or PCI DSS Responsibility Matrix). The AOC documents the provider's validated compliance status, and the Responsibility Matrix defines which PCI DSS requirements are met by the provider versus the customer. Together they let the customer demonstrate its own compliance to its acquirer or QSA.

Answer

A signed Business Associate Agreement

Answer

An ISO 27001 certificate

Answer

A SOC 2 Type II report

Question 7

A healthcare organization has deployed a cloud-based application that handles protected health information (PHI). The application runs on virtual machines in a virtual private cloud (VPC). The security team has implemented security groups to control traffic to the VMs. Recently, an external penetration test revealed that a web server VM is accessible from the internet on port 22 (SSH) from any IP address (0.0.0.0/0). The security team also discovered that the SSH key pair used for the web server was created with a weak algorithm (1024-bit RSA). The team needs to remediate these issues without causing downtime for the application. Additionally, the application logs must be sent to a centralized logging solution that is encrypted in transit and at rest. Which combination of actions should the security team take?

Accepted Answer

Restrict inbound SSH access to only a bastion host's IP address, generate a new 2048-bit RSA key pair, configure the application to send logs via TLS to a centralized logging service, and enable server-side encryption for the logging bucket.. It addresses both critical vulnerabilities without downtime: restricting SSH to a bastion host's IP eliminates internet-wide exposure, and generating a new 2048-bit RSA key pair replaces the weak 1024-bit key. For logging, TLS ensures encryption in transit, and server-side encryption for the logging bucket ensures encryption at rest, meeting compliance requirements for PHI.

Answer

Implement a VPN connection for all administrative access, keep the existing key pair, and use a third-party logging tool with TLS.

Answer

Change the SSH port to a non-standard port, keep the existing key pair, and enable logging to a cloud storage bucket without encryption.

Answer

Disable SSH access entirely and use a serial console for administration, keep the existing key pair, and send logs via plaintext syslog to a logging server.

Question 8

A cloud security architect is designing an API gateway for a microservices application. The gateway must authenticate requests, enforce rate limiting, and log all transactions for audit. Which of the following security controls is most critical to protect against API abuse?

Accepted Answer

Implement rate limiting and throttling based on client identity and request volume.. Rate limiting and throttling directly prevent API abuse by limiting request frequency based on client identity and volume. Option B is incorrect because encryption protects data in transit but does not prevent abuse. Option C is incorrect because input validation prevents injection attacks but not volume-based abuse. Option D is incorrect because API keys authenticate clients but do not limit usage; rate limiting is required for abuse protection.

Answer

Use TLS 1.3 to encrypt all traffic between clients and the gateway.

Answer

Validate and sanitize all input parameters to prevent injection attacks.

Answer

Require API keys for all requests and revoke keys of suspicious clients.

Question 9

A DevSecOps team is implementing security scanning in the CI/CD pipeline for a cloud application. Which THREE tools or practices should be included to shift security left?

Accepted Answer

Infrastructure-as-Code (IaC) security scanning. Infrastructure-as-Code (IaC) security scanning (A) is correct because it detects misconfigurations in templates such as Terraform, CloudFormation, or Kubernetes manifests before deployment, catching issues like open security groups or unencrypted storage early in the pipeline. Static Application Security Testing (SAST) (B) is correct because it analyzes source code without executing it to find vulnerabilities such as SQL injection or hardcoded secrets during the build phase, which is the essence of shifting security left. Dependency scanning (E), for example with Snyk, is correct because it identifies known CVEs in third-party libraries and open-source packages before they reach production, a critical early-stage control in DevSecOps. Web Application Firewall (C) deployment is not included because a WAF is a runtime, perimeter defense that filters HTTP traffic in production rather than a shift-left pipeline practice. Runtime Application Self-Protection (D) is not included because RASP instruments the running application to detect and block attacks at execution time, which is a runtime control, not an early CI/CD scanning activity.

Answer

Web Application Firewall (WAF) deployment

Answer

Runtime Application Self-Protection (RASP)

Question 10

A cloud security architect is implementing a CI/CD pipeline for a containerized application on AWS. Which TWO practices should be integrated to enforce container image security?

Accepted Answer

Scan container images for vulnerabilities before push to registry. Option B is correct because scanning container images for vulnerabilities before pushing them to the registry (e.g., using Amazon ECR image scanning, Clair, or Trivy) catches known CVEs in OS packages and application dependencies at build time, preventing vulnerable images from ever entering the pipeline. Option D is correct because signing container images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) and verifying signatures at deploy time ensures image integrity and provenance, blocking tampered or unauthorized images from running. Option A is not appropriate here because RASP protects a running application from attacks at runtime and does not secure the image build/supply chain. Option C is not appropriate because a cloud WAF filters HTTP/S traffic to the application and does not inspect or validate container images. Option E is not appropriate because SAST analyzes source code for flaws, not the built container image and its layers.

Answer

Implement runtime application self-protection (RASP)

Answer

Use a cloud WAF to protect the containerized application

Answer

Run SAST on the application source code