CCSP Practice Test 31 — 15 Questions

Question 1

A cloud security engineer is troubleshooting a failure in automated backups for a production database. The backup job runs nightly but has failed for the past three nights. The logs show permission denied errors when the backup service attempts to write to the storage bucket. Which action should the engineer take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the IAM roles and bucket ACLs assigned to the service account.. The permission denied errors indicate that the service account used by the backup job lacks the necessary permissions to write to the storage bucket. Checking the IAM roles and bucket ACLs is the first logical step to identify and resolve the misconfiguration, as it directly addresses the root cause without introducing unnecessary changes or escalations.

Answer

Open a support ticket with the cloud provider for incident response.

Answer

Restart the backup service and retry the job.

Answer

Rotate the service account keys used for authentication.

Question 2

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Accepted Answer

Continuous improvement process.. The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Answer

Business continuity plan.

Answer

Annual penetration testing.

Answer

Encryption of all data at rest.

Question 3

Which of the following is a cloud-specific vulnerability that can lead to exposure of IAM credentials through the metadata service?

Accepted Answer

SSRF to metadata endpoint. Server-Side Request Forgery (SSRF) that targets the cloud metadata endpoint (e.g., http://169.254.169.254) can retrieve IAM credentials. This is a cloud-specific issue.

Answer

SQL injection

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)

Question 4

A cloud application uses an IAM role with the policy "Action: s3:*" and "Resource: *". Which principle is violated?

Accepted Answer

Least privilege. The policy grants full access to all S3 actions on all resources, violating the principle of least privilege. Wildcard permissions like s3:* and *:* are over-permissive.

Answer

Defense in depth

Answer

Fail secure

Answer

Separation of duties

Question 5

Which TWO of the following are effective measures to prevent dependency confusion attacks? (Select two.)

Accepted Answer

Using a private artifact registry with scoped package names. Using private registries with scoped packages and verifying package names help ensure only intended packages are used. Dependency pinning alone does not prevent confusion if the package is maliciously published with the same name.

Answer

Using a software composition analysis (SCA) tool only after deployment

Answer

Pinning dependency versions in the package manager

Answer

Regularly updating all dependencies to the latest version

Question 6

A cloud operations team has a process for making changes to production environments. Which change management practice is MOST important for reducing the risk of service disruption?

Accepted Answer

Testing all changes in a staging environment before production deployment.. Testing all changes in a staging environment before production deployment is the most important practice because it validates the change's behavior, performance, and compatibility in an isolated replica of production. This directly reduces the risk of service disruption by catching configuration errors, resource conflicts, or software defects that could cause outages. Without staging validation, even well-intentioned changes can introduce silent failures or cascading issues.

Answer

Allowing all changes to be made immediately with no approval process.

Answer

Notifying the security team after the change is completed.

Answer

Ensuring a rollback plan is documented after the change is made.

Question 7

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This is known as:

Accepted Answer

Dependency confusion attack. Dependency confusion attacks exploit package managers that prioritize public registries over private ones, allowing malicious packages to be installed.

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle attack

Answer

Supply chain poisoning

Question 8

Which of the following is a key benefit of using a Software Bill of Materials (SBOM)?

Accepted Answer

It allows for quick identification of vulnerable components. An SBOM provides a list of all components and dependencies in an application, enabling organizations to quickly identify which applications are affected by a newly disclosed vulnerability.

Answer

It automatically fixes vulnerabilities in dependencies

Answer

It prevents all zero-day attacks

Answer

It replaces the need for penetration testing

Question 9

A security team wants to ensure that only signed container images are deployed in production. Which practice should they implement?

Accepted Answer

Image signing and verification. Signing container images with tools like Notary or Sigstore ensures the integrity and authenticity of images, preventing tampered or unauthorized images from being deployed.

Answer

Container image scanning with Trivy

Answer

Implementing a web application firewall (WAF)

Answer

Using a private registry

Question 10

A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?

Accepted Answer

Least privilege principle. The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.

Answer

Change management procedures

Answer

Encryption of data at rest

Answer

Physical access controls

Question 11

A company has a contractual requirement that the CSP must delete all customer data within 30 days of contract termination. Which document should specify this requirement?

Accepted Answer

Data Processing Agreement (DPA). The Data Processing Agreement (DPA) outlines data handling obligations, including deletion requirements. SLAs cover performance, BAAs are for HIPAA, and MOUs are high-level.

Answer

Business Associate Agreement (BAA)

Answer

Memorandum of Understanding (MOU)

Answer

Service Level Agreement (SLA)

Question 12

An organization wants to assess the security controls of a cloud provider before entering into a contract. What is the most efficient method?

Accepted Answer

Review a SOC 2 Type II report. Reviewing a SOC 2 Type II report provides an independent assessment of a provider's controls over time. On-site audits are costly and time-consuming. Vulnerability scanning and penetration test reports may not be available or comprehensive.

Answer

Request a penetration test report

Answer

Conduct an on-site audit

Answer

Perform vulnerability scanning

Question 13

A healthcare organization stores patient records in a cloud-based object storage service. To comply with HIPAA, they must ensure that data is encrypted at rest and that encryption keys are managed by the organization itself. Which key management approach should they implement?

Accepted Answer

Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.. HIPAA requires the organization to maintain control over encryption keys, and a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud allows the healthcare organization to generate, store, and manage their own keys externally while using them for cloud-based encryption. This approach ensures that the cloud provider cannot access the keys, meeting the regulatory requirement for key management by the organization itself.

Answer

Use server-side encryption with S3-managed keys (SSE-S3).

Answer

Use server-side encryption with AWS KMS-managed keys (SSE-KMS).

Answer

Use client-side encryption with customer-supplied encryption keys (CSEKS).

Question 14

Drag and drop the steps for implementing a secure DevOps (DevSecOps) pipeline in a cloud environment into the correct order.

Accepted Answer

SAST at commit, then DAST in staging, then IaC scanning, then policy enforcement, then runtime monitoring. First SAST at commit, then DAST in staging, IaC scanning, policy enforcement, and runtime monitoring.

Answer

DAST in staging first, then SAST at commit, then IaC scanning, then policy enforcement, then runtime monitoring

Answer

Policy enforcement, then SAST at commit, then DAST in staging, then IaC scanning, then runtime monitoring

Answer

Runtime monitoring, then SAST at commit, then DAST in staging, then IaC scanning, then policy enforcement

Question 15

During a security audit of a Kubernetes deployment, a team finds that containers are allowed to run as root with full privilege escalation. Which IaC scanning tool would have detected this misconfiguration before deployment?

Accepted Answer

KICS. KICS (Keeping Infrastructure as Code Secure) is a tool that scans IaC files for security misconfigurations, including Kubernetes manifests. It can detect containers running as root with privilege escalation.

Answer

Snyk

Answer

Checkov

Answer

Dependabot