CCSP Practice Test 31 — 15 Questions

Question 1

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 2

Which TWO of the following are required for GDPR compliance when processing personal data in the cloud?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk. Option D is correct because GDPR Article 35 mandates a Data Protection Impact Assessment (DPIA) whenever a type of processing—especially using new technologies and on a large scale—is likely to result in a high risk to the rights and freedoms of natural persons, and cloud processing of personal data frequently meets this threshold. Option E is correct because GDPR Article 30 requires controllers (and, in many cases, processors) to maintain records of processing activities, documenting purposes, categories of data and recipients, retention periods, and security measures. Option A is wrong because a DPO is mandatory only under Article 37 conditions (public authority, large-scale regular and systematic monitoring, or large-scale special-category data), not for all organizations. Option B is wrong because GDPR permits transfers of personal data outside the EU under Chapter V mechanisms such as adequacy decisions, Standard Contractual Clauses, or Binding Corporate Rules; EU-only storage is not required. Option C is wrong because ISO 27001 certification is not a GDPR legal requirement—compliance rests on meeting GDPR obligations, and other frameworks or certifications may also demonstrate appropriate safeguards.

Answer

Appoint a Data Protection Officer (DPO) for all organizations

Answer

Store data only within the European Union

Answer

Use only ISO 27001 certified cloud service providers

Question 3

A security architect is designing a multi-tenant cloud environment. Which type of hypervisor provides the strongest isolation for tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 hypervisor. A Type 1 hypervisor runs directly on the hardware without a host operating system, providing stronger isolation for tenant virtual machines. This bare-metal architecture reduces the attack surface and prevents tenant VMs from interfering with each other through a host OS. Therefore, it is the correct answer for the strongest isolation in a multi-tenant cloud environment.

Answer

Type 2 hypervisor

Answer

Virtual machine monitor in user space

Answer

Container runtime

Question 4

A cloud security architect is designing a data retention and deletion strategy for a multi-tenant SaaS application hosted in a public cloud. The application stores customer data in a combination of object storage, block storage, and a managed database. Regulatory requirements mandate that data be irrecoverably deleted upon customer request. Which TWO of the following measures are MOST effective to ensure secure data disposal in the cloud? (Choose two.)

Accepted Answer

Use a cloud provider's secure deletion API that performs a cryptographic erase on the storage volume.. Cryptographic erasure by deleting keys and using provider secure deletion APIs are both effective because they render data irrecoverable without relying on physical media destruction. Overwriting is unreliable in cloud environments, retention policies do not ensure immediate deletion, and provider media sanitization is not on-demand.

Answer

Rely on the cloud provider's media sanitization processes when storage is decommissioned.

Answer

Overwrite the data with zeros or random patterns multiple times.

Answer

Implement a data retention policy that automatically deletes data after a set period.

Question 5

An organization uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to prevent misconfigurations such as open security groups from being deployed. Which two practices should be integrated into the IaC pipeline? (Select TWO)

Accepted Answer

Implement policy-as-code to enforce security rules. Policy-as-code (D) allows security rules to be defined in a machine-readable format (e.g., using Open Policy Agent or HashiCorp Sentinel) and automatically evaluated during the IaC pipeline, preventing non-compliant configurations from being deployed. Automated security scanning tools (E) analyze IaC templates (e.g., Terraform, CloudFormation) for known misconfigurations, such as overly permissive security group rules, before they reach production. Together, these practices enforce security guardrails early in the development lifecycle.

Answer

Limit access to the cloud management console

Answer

Perform manual code reviews for every change

Answer

Segment the network using security groups

Question 6

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

Accepted Answer

Implement server-side antivirus scanning on all uploaded files before saving.. Server-side antivirus scanning inspects the actual file content after upload and before it is persisted or served, which is the only control here that detects malicious payloads regardless of file type or extension. It catches malware embedded in files that pass superficial checks, including polyglot files and weaponized images. Because scanning happens on the server, attackers cannot bypass it by manipulating client-side validation.

Answer

Store files in a CDN that only serves static content.

Answer

Set a maximum file size limit to 2 MB.

Answer

Restrict file uploads to only image file types by checking the file extension.

Question 7

Which THREE of the following are common risk treatment options in cloud risk management?

Accepted Answer

Transference. In cloud risk management, risk treatment follows the standard ISO 27005 / NIST RMF model, and the three marked options are core treatment strategies. B (Transference) is correct because risk can be shifted to another party, typically via cyber-insurance or by contractual allocation of liability to a cloud provider under a shared responsibility model. C (Avoidance) is correct because an organization can eliminate a risk by not performing the activity that creates it, such as choosing not to deploy a workload in the cloud or not using a specific service. E (Acceptance) is correct because a risk may be knowingly retained when its likelihood or impact is within the organization's risk appetite, documented in a risk register with management sign-off. A (Ignorance) is not a valid treatment because failing to identify or acknowledge a risk does not mitigate it and violates governance requirements. D (Deletion) is not a risk treatment option; deleting data or resources is a technical action that may support avoidance or mitigation, but it is not one of the recognized treatment categories.

Answer

Ignorance

Answer

Deletion

Question 8

A company runs its production workloads on a cloud platform. The security team wants to ensure that all compute instances are patched within 30 days of a patch release. Which of the following is the BEST approach to enforce this requirement?

Accepted Answer

Use an automated patch management tool that deploys patches to all instances within 30 days. An automated patch management tool ensures that patches are deployed consistently and within the required timeframe across all instances, reducing human error and providing centralized control. This is the best approach to enforce the 30-day patching requirement because it can schedule and apply patches automatically, and provide reporting on compliance.

Answer

Configure vulnerability scanning to identify unpatched instances and notify administrators

Answer

Create a change management process that requires approval for all patches

Answer

Implement a manual patching policy and require each team to submit a patch report monthly

Question 9

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

Accepted Answer

In the database security group, add an inbound rule allowing TCP/3306 from the security group ID of the web servers.. Referencing the web tier's security group ID as the source in the database security group's inbound rule creates a dynamic, identity-based trust relationship. Only instances that are members of that specific security group can initiate connections to port 3306, regardless of their IP addresses. This follows the principle of least privilege and is the most secure, maintainable approach in AWS VPC peering scenarios.

Answer

Configure a VPN connection between VPCs and use route tables to direct traffic.

Answer

In the network ACL for VPC B's subnet, add an inbound rule allowing TCP/3306 from VPC A CIDR.

Answer

In the database security group, add an inbound rule allowing TCP/3306 from the VPC A CIDR.

Question 10

During a threat modeling session for a cloud-native application, which cloud-specific attack path is most critical to identify?

Accepted Answer

Server-Side Request Forgery (SSRF) to the metadata service. SSRF targeting cloud metadata endpoints is a critical cloud-specific threat because it can expose IAM credentials, leading to full account compromise. This is a unique cloud attack path not typically present in on-premises environments.

Answer

Cross-Site Scripting (XSS) in a web form

Answer

SQL injection in a legacy database

Answer

Buffer overflow in a compiled binary

Question 11

Which of the following is a key difference between a security group and a network ACL in a VPC?

Accepted Answer

Security groups are stateful, while NACLs are stateless. Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules. NACLs are stateless, requiring explicit inbound and outbound rules.

Answer

Security groups are stateless, while NACLs are stateful

Answer

Security groups are applied at the subnet level, while NACLs are applied at the instance level

Answer

Security groups support both allow and deny rules

Question 12

A security team is hardening a Kubernetes cluster for production workloads. Which THREE measures should they implement to improve runtime container security?

Accepted Answer

Enable AppArmor or SELinux profiles. AppArmor and SELinux are Linux Security Modules (LSMs) that enforce mandatory access control (MAC) policies on containers. By applying these profiles, you restrict what processes inside a container can do—such as file access, network operations, and capability use—beyond the default discretionary access controls. This significantly reduces the attack surface and limits the impact of a container breakout.

Answer

Mount the host filesystem as read-write in containers

Answer

Use privileged containers for system daemons

Question 13

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

Accepted Answer

Configure the serverless function with virtual private cloud integration. Virtual private cloud (VPC) integration allows the serverless function to be deployed inside a VPC, enabling private access to resources like a database service. Internet access is not required.

Answer

Assign a public IP to the serverless function

Answer

Enable public access on the database service

Answer

Use a network address translation gateway to route traffic

Question 14

A cloud security team is implementing a data discovery and classification program for their SaaS applications. Which TWO statements accurately describe best practices for data classification in the cloud?

Accepted Answer

Automated tools can scan cloud storage and apply classification labels based on content inspection.. Option C is correct because automated discovery tools (such as CASB or native cloud DLP scanners) can crawl SaaS storage, inspect content using pattern matching, regex, keywords, and ML classifiers, and then apply classification labels (e.g., Public, Confidential, PII) at scale, which is essential in large cloud environments where manual labeling is impractical. Option D is correct because DLP policies consume classification labels and content inspection results to monitor and control data in motion (email, uploads, API traffic) and at rest (SaaS repositories), enforcing rules such as blocking exfiltration of labeled sensitive data, thereby operationalizing the classification scheme. Option A is not correct because manual user classification is inconsistent, error-prone, and unscalable in large cloud environments, so automated methods are preferred. Option B is not correct because tokenization is a data protection technique that substitutes sensitive values with tokens; it still requires identifying and classifying the sensitive data first, so it cannot replace classification. Option E is not correct because classification labels are typically applied by the data owner or via automated tools under the organization's governance, not by the cloud service provider, since the provider does not know the business context or sensitivity of the customer's data.

Answer

Manual classification by users is more accurate than automated methods in large-scale cloud environments.

Answer

Tokenization can replace data classification by eliminating the need to identify sensitive data.

Answer

Data classification labels must be applied by the cloud service provider to ensure consistency.

Question 15

Which practice is essential for securing cloud application secrets such as database passwords and API tokens?

Accepted Answer

Use a secrets management service like Vault or cloud secret manager. A dedicated secrets management service such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault centralizes storage, enforces access control, supports automatic rotation, and audits secret access. This removes hardcoded credentials from code and configuration, which is the essential practice for securing cloud application secrets. These services also integrate with IAM and support dynamic, short-lived credentials.

Answer

Store secrets in environment variables in the source code

Answer

Encrypt secrets with a hardcoded key

Answer

Share secrets via encrypted email