CCSP Practice Test 3 — 30 Questions

Question 1

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Answer

AWS Config configuration history

Answer

AWS CloudTrail management events

Answer

Amazon S3 access logs

Question 2

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

Accepted Answer

Encrypt data client-side before uploading to the cloud.. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Answer

Enable detailed audit logging of all data access.

Answer

Implement strict IAM policies for CSP employees.

Answer

Enable server-side encryption with customer-provided keys.

Question 3

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. A Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 4

A security engineer needs to scan all container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. The scan must be automated whenever a new image is pushed. Which solution meets this requirement?

Accepted Answer

Enable Amazon Inspector continuous scanning for ECR repositories.. Amazon Inspector continuous scanning for Amazon ECR automatically scans container images for software vulnerabilities whenever a new image is pushed to the repository. This feature is natively integrated with ECR, requires no additional infrastructure, and provides findings directly in the Inspector console and via AWS Security Hub. Option D is correct because it is the only AWS-native, automated, and fully managed solution that meets the requirement.

Answer

Use Amazon Macie for image scanning.

Answer

Configure AWS Security Hub to scan images.

Answer

Use AWS Lambda to invoke Clair on each push.

Question 5

Which practice is most effective for preventing the deployment of container images with known vulnerabilities in a DevSecOps pipeline?

Accepted Answer

Image scanning in CI pipeline before push. Scanning images in the CI pipeline before they are pushed to a registry catches known vulnerabilities (CVEs) at the earliest possible stage, preventing flawed images from ever reaching production. This 'shift-left' approach blocks the build or fails the pipeline when critical vulnerabilities are found, so vulnerable images never get deployed. It is the most effective preventive control because it stops the problem at the source.

Answer

Post-deployment vulnerability scanning

Answer

Using only official base images

Answer

Runtime monitoring with a WAF

Question 6

A cloud customer must comply with GDPR's right to erasure (right to be forgotten). Which TWO of the following are technical challenges the customer faces when the data is stored in a cloud object storage service with versioning and cross-region replication?

Accepted Answer

Removing previous versions of objects. Option B is correct because object storage versioning retains every prior version of an object, so a GDPR erasure request cannot be satisfied by simply deleting the current object; the customer must also enumerate and permanently remove all noncurrent versions (e.g., via S3 versioning delete markers plus explicit version deletion or lifecycle expiration). Option E is correct because cross-region replication creates additional copies in other regions, and the right to erasure requires those replicas to be deleted as well, which is technically challenging due to replication lag, delete-marker propagation behavior, and the need to verify deletion in every target region. Option A is not a right-to-erasure challenge but an access-control/network-restriction concern, typically handled with bucket policies, VPC endpoints, or IP conditions. Option C concerns encryption key management and confidentiality, not the deletion of data. Option D relates to data portability under GDPR Article 20, not the right to erasure under Article 17.

Answer

Ensuring data is accessible only via a specific IP range

Answer

Encrypting the data at rest with customer-managed keys

Answer

Exporting data in a machine-readable format

Question 7

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Answer

VPC Flow Logs

Answer

Cloud DNS logs

Answer

Cloud Monitoring metrics

Question 8

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Answer

GDPR

Answer

HIPAA

Answer

ISO 27001

Question 9

Which risk assessment method uses subjective scales to assign probabilities and impacts?

Accepted Answer

Qualitative risk assessment. Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Answer

Semi-quantitative risk assessment

Answer

Quantitative risk assessment

Answer

Bottom-up risk assessment

Question 10

An organization uses Azure Functions and wants to secure its API endpoints exposed via Azure API Management. Which TWO security controls should they implement at the API Gateway level?

Accepted Answer

Enable TLS enforcement. Option C (Enable TLS enforcement) is correct because enforcing TLS at the API Management gateway ensures all client-to-gateway traffic is encrypted in transit using HTTPS, protecting credentials and tokens from interception, and API Management supports configuring the minimum TLS version and cipher suites on the gateway. Option D (Implement JWT validation) is correct because API Management has a built-in validate-jwt policy that verifies the signature, issuer, audience, and expiration of OAuth 2.0/OpenID Connect bearer tokens at the gateway, so unauthenticated or tampered requests are rejected before reaching the backend Functions. Option A is not a gateway-level authentication control and whitelisting 'all users' is contradictory and impractical for public APIs. Option B is a backend configuration concern for the Function app, not a control applied at the API Gateway. Option E is wrong because disabling API keys removes a subscription-based access control rather than adding security at the gateway.

Answer

Configure IP whitelisting for all users

Answer

Store secrets in Azure Function environment variables

Answer

Disable API keys

Question 11

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

Accepted Answer

Run automated policy compliance checks as part of the CI/CD pipeline.. Running automated policy compliance checks inside the CI/CD pipeline enforces security policies before resources are deployed, shifting compliance left. Tools like Terraform Sentinel, Checkov, or OPA/Conftest evaluate the IaC against policy and fail the pipeline on violations, preventing non-compliant infrastructure from ever reaching the cloud. This is the most effective because it is preventive, automated, and repeatable.

Answer

Restrict the IAM permissions of developers to only approved roles.

Answer

Conduct manual security reviews after each deployment.

Answer

Deploy resources and then scan for compliance after deployment.

Question 12

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. Option B (AWS WAF integrated with Application Load Balancer) is correct because AWS WAF inspects HTTP/HTTPS requests at Layer 7 and can block common web exploits such as SQL injection and cross-site scripting using managed rule groups attached to an ALB, directly satisfying the requirement to protect the application layer. Option C (Security groups between application tiers) is correct because security groups are stateful, instance-level virtual firewalls whose inbound rules can reference other security groups, allowing precise tier-to-tier traffic restriction (for example, permitting only the app tier's SG to reach the database tier on port 3306). Option A is not appropriate here because PrivateLink provides private connectivity to services and endpoints, not application-layer attack filtering or inter-tier traffic control. Option D is wrong because VPC peering only connects networks for routing and does not filter or restrict traffic between application tiers. Option E is less suitable because network ACLs are stateless, subnet-level filters that cannot reference security groups or enforce granular per-tier application rules as cleanly as security groups.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 13

An API endpoint returns user profile data including fields like 'credit_card_number' even when the client application does not need it. Which OWASP API security risk does this represent?

Accepted Answer

Excessive Data Exposure. The API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Answer

Injection

Answer

Broken Object Level Authorization

Answer

Mass Assignment

Question 14

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

Accepted Answer

To provide centralized protection against common web exploits before traffic reaches the microservices.. Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Answer

To reduce latency by caching responses at the API gateway.

Answer

To offload authentication from the microservices to the API gateway.

Answer

To monitor API usage and detect anomalies in traffic patterns.

Question 15

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Accepted Answer

Apply a cloud governance policy at the organization level that denies the services.. Cloud governance policies at the organization level are the correct mechanism because they operate across all accounts, allowing centrally defined whitelists or blacklists of services. Unlike account-level access control policies, organizational policies set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Answer

Configure each account's access control policy to deny the services.

Answer

Enable a cloud configuration monitoring service to detect and disable non-approved services.

Answer

Use resource-specific access policies on each resource to restrict usage.

Question 16

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk is the risk that arises from over-reliance on a single provider, system, or counterparty — in cloud terms, if one provider fails and the organization cannot operate, that dependency is a concentration risk. It is a well-known concept in financial services (e.g., reliance on a single clearing bank) and applies directly to cloud, where multi-cloud or hybrid strategies are often adopted specifically to mitigate it. The scenario describes exactly this single-point-of-failure dependency.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 17

Drag and drop the steps for managing identity and access in a multi-cloud environment using a centralized identity provider (IdP) into the correct order.

Accepted Answer

Integrate the centralized IdP → Create groups and roles → Configure attribute/role mapping → Assign users with MFA enforcement → Audit and review access. First integrate IdP, then create groups/roles, configure mapping, assign users with MFA, and audit.

Answer

Create groups and roles → Integrate the centralized IdP → Configure attribute/role mapping → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Configure attribute/role mapping → Create groups and roles → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Create groups and roles → Assign users with MFA → Configure attribute/role mapping → Audit

Question 18

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 19

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 20

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Option C is correct because rate limiting and throttling cap the number of requests a client can make in a given time window, mitigating brute-force, credential-stuffing, and denial-of-service abuse against API endpoints. Option D is correct because strong authentication (e.g., OAuth 2.0 tokens, mutual TLS) and authorization (e.g., scopes, RBAC, least privilege) ensure only verified, permitted identities can invoke API operations. Option E is correct because validating and sanitizing all inputs defends against injection flaws such as SQL injection, NoSQL injection, and command injection that arise from untrusted API parameters. Option A is not appropriate because enabling CORS for all domains (wildcard Access-Control-Allow-Origin) exposes the API to cross-origin abuse rather than restricting access to trusted origins. Option B is not appropriate because HTTP Basic authentication over plain HTTP transmits base64-encoded credentials in cleartext, which can be intercepted; it should only be used over TLS.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP