CCSP Practice Test 30 — 15 Questions

Question 1

A cloud security engineer is responsible for a SaaS application hosted on a public cloud provider. The application uses a relational database to store customer data. The security team recently conducted a vulnerability assessment and discovered that the database can be accessed over the internet without any network restrictions. Additionally, the database admin user has the same password as the root account, and the password has not been changed in 18 months. The company is subject to GDPR and PCI DSS compliance requirements. The engineer needs to remediate these issues immediately. Which of the following actions should be taken FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the database security group to allow traffic only from the application server's IP address range.. The most critical immediate action is to restrict network access to the database, as it is currently exposed to the internet without restrictions. This is the highest risk because it allows anyone to attempt to connect, potentially leading to unauthorized access. Configuring the security group to allow traffic only from the application server's IP range is the first step to remediate the exposure. While changing the password is also important, the network exposure is the most severe and immediate threat.

Answer

Change the database admin password to a complex new password immediately.

Answer

Upgrade the database to the latest version with all security patches applied.

Answer

Enable encryption at rest for the database to protect the data if it is stolen.

Question 2

A cloud security team is implementing a DevSecOps pipeline. Which TWO of the following are examples of shift-left security practices? (Select two.)

Accepted Answer

Scanning Infrastructure as Code with Checkov before deployment. Shift-left security means moving security activities earlier in the software development lifecycle, before code reaches production. Option B is correct because scanning Infrastructure as Code with Checkov before deployment catches misconfigurations in Terraform, CloudFormation, or Kubernetes manifests at the earliest possible stage, preventing insecure infrastructure from ever being provisioned. Option D is correct because running SAST during code commit analyzes source code for vulnerabilities like injection flaws or insecure patterns as developers write it, giving immediate feedback before the code is merged or built. Option A is not shift-left because penetration testing after deployment is a late-stage, post-release activity. Option C is not shift-left because DAST tests a running application, which occurs after the code is deployed to a test or staging environment. Option E is not shift-left because RASP operates at runtime in production, protecting the application only after it is live.

Answer

Conducting penetration testing after deployment

Answer

Performing Dynamic Application Security Testing (DAST) on a running application

Answer

Implementing Runtime Application Self-Protection (RASP) in production

Question 3

A company is migrating healthcare data to the cloud and must comply with HIPAA. They need to sign a Business Associate Agreement (BAA) with the CSP. What key element must be included in the BAA?

Accepted Answer

Permitted uses and disclosures of protected health information (PHI). Under HIPAA, the BAA must specify the permitted uses and disclosures of protected health information (PHI) by the business associate. This is the core contractual element that defines the scope of the CSP's handling of PHI and ensures the CSP only uses or discloses PHI as permitted by the covered entity and HIPAA. Without this, the BAA does not satisfy the HIPAA Privacy Rule requirements for business associate contracts.

Answer

Data encryption requirements for data at rest and in transit

Answer

Audit log retention period for access to PHI

Answer

Breach notification timeframe to the covered entity

Question 4

Which THREE of the following are key components of an incident response plan specific to cloud environments? (Choose three.)

Accepted Answer

Establishing a process for preserving system snapshots and logs as evidence. Options A, C, and E are correct. A: Preserving system snapshots and logs is crucial for evidence collection and analysis in cloud incidents. C: Defining procedures for contacting the cloud provider’s support and security teams ensures timely assistance and coordination. E: Clarifying the shared responsibility model for incident handling clarifies which party is responsible for each aspect of incident response. Option B is incorrect because not every incident requires legal department involvement; legal is typically consulted for specific scenarios such as data breaches or regulatory issues. Option D is incorrect because a detailed forensic analysis procedure for all incident types is impractical; procedures should be scalable and tailored to incident severity and type.

Answer

Requiring involvement of the legal department for every incident

Answer

Including a detailed data forensic analysis procedure for all incident types

Question 5

During a security audit, it is discovered that a cloud service provider's infrastructure-as-a-service (IaaS) environment has virtual machines that were provisioned with default firewall rules allowing all inbound traffic from the internet. The organization's cloud security policy requires that all VM firewall rules follow a least-privilege model. What is the most effective approach to enforce this policy going forward?

Accepted Answer

Implement infrastructure as code templates with built-in security controls that enforce least-privilege firewall rules. Infrastructure as code (IaC) templates with built-in security controls enforce least-privilege firewall rules at provisioning time, preventing non-compliant VMs from ever being created. This shifts security left, making the secure configuration the default and removing reliance on manual review or after-the-fact detection. It is the most effective preventive control for enforcing policy going forward.

Answer

Manually review each VM's firewall rules during deployment

Answer

Use a configuration management tool to periodically audit and correct firewall rules

Answer

Use a cloud security posture management (CSPM) tool that continuously monitors and alerts on non-compliant rules

Question 6

A developer configures an AWS S3 bucket to allow public access by setting a bucket policy that grants 's3:GetObject' to 'Principal: *'. Which vulnerability does this introduce?

Accepted Answer

Exposed S3 bucket. Exposing an S3 bucket to anonymous access allows anyone to read objects, leading to data exposure. This is a common cloud misconfiguration.

Answer

Mass assignment

Answer

SSRF vulnerability

Answer

Over-permissive IAM

Question 7

Drag and drop the steps for conducting a cloud security risk assessment using the NIST CSF framework into the correct order.

Accepted Answer

Identification, then threat/vulnerability assessment, then risk analysis, then treatment, then monitoring. Start with identification, then threat/vulnerability assessment, risk analysis, treatment, and monitoring.

Answer

Threat/vulnerability assessment, then identification, then risk analysis, then treatment, then monitoring

Answer

Identification, then risk analysis, then threat/vulnerability assessment, then treatment, then monitoring

Answer

Identification, then threat/vulnerability assessment, then treatment, then risk analysis, then monitoring

Question 8

Which of the following is the primary security risk associated with VM escape in a cloud environment?

Accepted Answer

Unauthorized access to other tenants' VMs and the hypervisor. VM escape occurs when an attacker breaks out of the guest VM's isolation boundary and gains access to the hypervisor or other tenants' VMs. The primary security risk is therefore unauthorized access to other tenants' workloads and the hypervisor itself, which can lead to full compromise of the multi-tenant host. This breaks the fundamental isolation guarantee that cloud providers rely on.

Answer

Performance degradation of the VM

Answer

Loss of network connectivity

Answer

Data corruption within the VM

Question 9

An organization uses Azure Defender for Cloud to protect their hybrid environment. They want to receive alerts about suspicious activities on their Azure Key Vault. Which Defender plan should they enable?

Accepted Answer

Defender for Key Vault. Defender for Key Vault is the specific plan designed to provide advanced threat protection for Azure Key Vault. It monitors access patterns and operations on the vault to detect suspicious activities such as unauthorized access attempts, credential theft, or anomalous secret retrieval, and generates security alerts accordingly.

Answer

Defender for Databases

Answer

Defender for Containers

Answer

Defender for Servers

Question 10

Which TWO data states must be encrypted to meet common compliance requirements for data in the cloud? (Choose two.)

Accepted Answer

Data at rest. Data at rest (C) must be encrypted because compliance frameworks like PCI DSS, HIPAA, and GDPR require protection of stored data against unauthorized access. Encryption at rest typically uses AES-256 or similar algorithms to secure data on disks, databases, or object storage, ensuring that even if physical media is compromised, the data remains unreadable.

Answer

Data in audit logs

Answer

Data in backup

Answer

Data in use

Question 11

Which TWO of the following are effective strategies for protecting sensitive data in a public cloud environment?

Accepted Answer

Data masking to obscure sensitive fields in non-production environments.. Data masking (option D) and tokenization (option E) are both effective data protection techniques for public cloud environments. Data masking obscures sensitive fields in non-production environments, while tokenization replaces sensitive data with non-sensitive placeholders. Options A, B, and C are insecure or poor practices.

Answer

Using the same encryption key for all data to simplify key management.

Answer

Storing encryption keys in the same storage bucket as the encrypted data.

Answer

Consolidating all sensitive data into a single storage bucket for easier management.

Question 12

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Accepted Answer

Horizontal auto-scaling for the web tier and a fixed database tier. It separates the stateless web tier, which can safely scale horizontally using auto-scaling groups triggered by CPU utilization thresholds, from the stateful database tier, which must remain fixed to avoid consistency issues such as split-brain or replication lag. Horizontal scaling adds or removes identical web server instances without affecting session state, while a fixed database tier preserves ACID properties and prevents conflicts from concurrent writes across multiple database nodes.

Answer

Manual scaling for both tiers

Answer

Vertical scaling of all tiers

Answer

Single-tier architecture with auto-scaling

Question 13

A company stores PII in the cloud and needs to ensure compliance with GDPR. What is the first step they should take?

Accepted Answer

Perform data classification and mapping. The first step is to perform data classification and mapping to identify what PII is held, where it resides, and how it flows. This foundational activity informs all subsequent GDPR compliance actions. Option A is incorrect because deleting data may be part of data minimization but not the first step. Option B is incorrect because encryption is a security control, not the initial step. Option C is incorrect because a Data Processing Agreement is signed after identifying and understanding data processing activities.

Answer

Delete all data older than the required retention period

Answer

Implement encryption for all stored data

Answer

Sign a Data Processing Agreement with the CSP

Question 14

A cloud customer is evaluating a provider's service level agreement (SLA) that guarantees 99.99% availability. What is the maximum allowable downtime per year (in minutes) before the SLA is violated?

Accepted Answer

52.56 minutes. An SLA of 99.99% availability allows 0.01% downtime per year. A year has 365 days × 24 hours × 60 minutes = 525,600 minutes. 0.01% of 525,600 is 52.56 minutes, so the maximum allowable downtime is 52.56 minutes per year. This is the correct calculation.

Answer

8.76 hours

Answer

5.26 minutes

Answer

87.6 hours

Question 15

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Accepted Answer

1. Classify data, 2. Define retention periods, 3. Configure lifecycle policies, 4. Enable immutability (S3 Object Lock), 5. Test and validate. First classify data, then define retention, configure lifecycle, enable immutability, and test.

Answer

1. Configure lifecycle policies, 2. Define retention periods, 3. Classify data, 4. Enable immutability, 5. Test and validate

Answer

1. Enable immutability, 2. Classify data, 3. Define retention periods, 4. Configure lifecycle policies, 5. Test and validate

Answer

1. Test and validate, 2. Classify data, 3. Define retention periods, 4. Configure lifecycle policies, 5. Enable immutability