CCSP Practice Test 30 — 15 Questions

Question 1

Which THREE of the following are typical data privacy principles found in most regulations?

Accepted Answer

Data minimization. Data minimization, purpose limitation, and accountability are common principles in privacy regulations like GDPR. Data retention is a practice derived from principles, and data monetization is not a privacy principle but a business activity.

Answer

Data retention

Answer

Data monetization

Question 2

A financial services company must store customer transaction data in a cloud that complies with PCI DSS. Which of the following is a primary requirement for the cloud environment?

Accepted Answer

Segmentation of cardholder data from other tenants. PCI DSS requires segmentation or compensating controls to isolate cardholder data from other tenants. While encryption and testing are also required, segmentation is a key design requirement specific to multi-tenant environments. Public auditing of all access logs is not a requirement.

Answer

Annual penetration testing by a qualified assessor

Answer

Public auditing of all access logs

Answer

Encryption of data at rest using AES-256

Question 3

A company needs to ensure that its cloud-stored data is retained only for a specific period due to legal requirements. Which process should be automated?

Accepted Answer

Data lifecycle management. Data lifecycle management (DLM) focuses on managing data throughout its lifecycle, including retention and deletion. Data classification categorizes data, encryption protects it, and backup creates copies, but none directly automate retention periods.

Answer

Data classification

Answer

Data encryption

Answer

Data backup

Question 4

Drag and drop the steps for setting up a cloud access security broker (CASB) in a SaaS environment into the correct order.

Accepted Answer

Define security policies, then deploy CASB, then configure CASB, then test CASB, then full rollout.. Start with policy definition, then deploy, configure, test, and finally full rollout.

Answer

Deploy CASB, then configure CASB, then define security policies, then test CASB, then full rollout.

Answer

Define security policies, then deploy CASB, then test CASB, then configure CASB, then full rollout.

Answer

Deploy CASB, then define security policies, then configure CASB, then full rollout, then test CASB.

Question 5

During a cloud migration, a company discovers that its existing virtual machine images contain embedded credentials and proprietary software that must not be exposed to the cloud provider's administrators. Which of the following is the BEST strategy to protect this sensitive data while maintaining the ability to create new instances?

Accepted Answer

Encrypt the virtual machine images using a customer-provided key (CMK) integrated with the cloud provider's key management service.. Encrypting the virtual machine images with a customer-provided key (CMK) integrated with the cloud provider's key management service ensures that the cloud provider's administrators cannot access the embedded credentials and proprietary software. The encryption is performed client-side or using envelope encryption where the CMK wraps a data encryption key, and only the customer holds the master key material. This allows the customer to create new instances from the encrypted image while maintaining full control over access to the sensitive data.

Answer

Use a VPN to encrypt data in transit between the on-premises environment and the cloud.

Answer

Use a cryptographic hash of the image to ensure integrity, and store the image in object storage with access controls.

Answer

Tokenize the embedded credentials and replace them with placeholders in the image.

Question 6

A company is evaluating cloud providers for compliance with the GDPR. Which TWO of the following are mandatory data protection roles under the GDPR?

Accepted Answer

Data Processor. The GDPR defines the Data Controller and Data Processor as mandatory roles. The Data Protection Officer (DPO) is required only under certain conditions (e.g., large-scale monitoring). Cloud Security Architect and Data Steward are not GDPR-defined roles.

Answer

Data Protection Officer (DPO)

Answer

Cloud Security Architect

Answer

Data Steward

Question 7

A cloud service provider (CSP) is designing a multi-tenant infrastructure and needs to ensure that a security incident in one tenant's environment does not compromise the confidentiality or integrity of other tenants. The CSP plans to use a combination of network segmentation, hypervisor isolation, and encryption. Which additional control is MOST critical to prevent side-channel attacks that could leak cryptographic keys or other sensitive data across tenants?

Accepted Answer

Ensure cryptographic operations use constant-time algorithms.. Side-channel attacks, such as timing attacks, exploit variations in execution time to infer sensitive data like cryptographic keys. Constant-time algorithms ensure that cryptographic operations execute in a fixed duration regardless of input, eliminating timing variations that could be measured across shared physical hardware. This is critical in multi-tenant environments where tenants share CPU caches and memory buses, as it prevents an attacker from extracting key material through precise timing measurements.

Answer

Implement virtual LANs (VLANs) and firewall rules between tenants.

Answer

Use hardware security modules (HSMs) for key management.

Answer

Enforce strict API rate limiting for each tenant.

Question 8

A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?

Accepted Answer

Encrypt the data and then destroy the encryption keys (cryptographic erasure). Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.

Answer

Overwrite the data with multiple patterns of zeros and ones

Answer

Tokenize the data and retain the token mapping

Answer

Delete the data using the cloud provider's API and remove pointers

Question 9

A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?

Accepted Answer

New key material is generated, and the old key material is retained for decryption.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault) implement automatic key rotation by generating new cryptographic key material while retaining the old key material. This allows data encrypted with the previous key version to still be decrypted, as the old key material is not destroyed but simply marked as retired for encryption operations.

Answer

The key ID changes after each rotation.

Answer

The old key is immediately destroyed after rotation.

Answer

All data encrypted with the old key must be re-encrypted.

Question 10

A cloud application uses IAM roles with wildcard permissions (e.g., iam:* or *:*). Which TWO risks are directly associated with such over-permissive IAM policies?

Accepted Answer

Privilege escalation to administrative roles. Wildcard permissions can lead to privilege escalation and data exfiltration. DoS and cost overruns are possible but not direct risks of over-permissive IAM; logging impact is indirect.

Answer

Denial of service against other cloud services

Answer

Increased cost due to unnecessary resource usage

Answer

Difficulty in auditing permissions due to logging overhead

Question 11

A company wants to use a cloud service to store financial records. Which compliance framework most likely applies?

Accepted Answer

Sarbanes-Oxley Act (SOX). SOX applies to financial records of publicly traded companies in the US. GDPR is for EU personal data, HIPAA for healthcare, PCI for payment card data.

Answer

PCI DSS

Answer

GDPR

Answer

HIPAA

Question 12

A cloud customer receives a legal hold notice for pending litigation. The data resides in multi-tenant storage. What is the most appropriate initial action?

Accepted Answer

Preserve the relevant data using customer-accessible tools. Preserving all relevant data from the customer's tenant is required. Alerting other tenants violates privacy; relying solely on provider backup may be insufficient as backups might not be retained indefinitely; doing nothing is non-compliant.

Answer

Do nothing until the provider issues a notice

Answer

Rely on the provider's backup retention cycle

Answer

Alert all other tenants about the hold

Question 13

A company is contracting with a cloud provider and wants to ensure they have visibility into the provider's security controls. Which contract clause is most important to include?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the ability to review the provider's security controls, policies, and procedures. The SLA for uptime focuses on availability, not security. Data portability is about moving data. Indemnification covers liability, not visibility.

Answer

Indemnification clause

Answer

Service Level Agreement (SLA) for uptime

Answer

Data portability clause

Question 14

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Answer

SOX

Answer

HIPAA

Answer

PCI DSS

Question 15

A cloud application uses a third-party identity provider (IdP) for SSO. The security team notices that tokens are being reused across different applications. Which token binding mechanism should be implemented?

Accepted Answer

Token binding to TLS session. Token binding cryptographically ties an access token to a specific TLS session, preventing token export and replay across different applications. This directly addresses the reuse of tokens across applications by binding the token to the TLS layer, so even if an attacker intercepts the token, it cannot be used with a different TLS connection. RFC 8471 defines token binding for OAuth 2.0, ensuring the token is only valid when presented over the same TLS channel that was established during issuance.

Answer

Use of bearer tokens without additional protection

Answer

Short token expiration times

Answer

Audience restriction