CCSP Practice Test 32 — 15 Questions

Question 1

A client is negotiating a cloud service agreement and wants to conduct on-site audits of the provider's data centers. The provider argues that on-site audits are unnecessary due to SOC 2 reports. Which is the best approach for the client?

Accepted Answer

Request a right to review SOC 2 reports and conduct limited assessments. The client should request a right to review SOC 2 reports and conduct limited assessments because SOC 2 reports provide a point-in-time snapshot of controls, but they do not cover real-time operational changes, custom configurations, or specific contractual requirements. On-site audits may be impractical due to multi-tenancy and shared infrastructure, so a balanced approach of reviewing SOC 2 reports plus targeted assessments (e.g., reviewing evidence of key controls, interviewing staff, or examining specific systems) gives the client sufficient assurance without disrupting the provider's operations.

Answer

Insist on on-site audits

Answer

Terminate negotiations

Answer

Accept SOC 2 reports as sufficient

Question 2

Refer to the exhibit. A cloud administrator discovers this Azure role assignment in the Finance resource group. The role definition ID corresponds to 'Storage Blob Data Contributor'. What is the immediate compliance concern?

Accepted Answer

The assignment provides unconstrained access without any condition. Option D is correct because the role assignment 'Storage Blob Data Contributor' grants full read, write, and delete permissions on blob data within the scope, without any Azure attribute-based access control (ABAC) conditions. This violates the principle of least privilege, as it allows unconstrained access to all blob containers and blobs in the storage account, which is a compliance concern under frameworks like SOC 2 or ISO 27001 that require fine-grained access controls.

Answer

The principal ID is not a human-readable name

Answer

The assignment is scoped to a storage account

Answer

The assignment has no expiration date

Question 3

Which TWO of the following are examples of data sovereignty laws that directly affect cloud data storage?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is a data sovereignty law because it imposes strict requirements on the storage and processing of personal data of EU residents, mandating that data be stored within the EU or in jurisdictions with equivalent protection, directly affecting where cloud providers can host data. It enforces data localization principles through mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), requiring cloud customers to ensure their provider's storage regions comply with these territorial restrictions.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Question 4

A security architect is designing a cloud-native application using microservices. They decide to implement mutual TLS (mTLS) for service-to-service communication in a Kubernetes cluster with hundreds of services. What is the primary challenge in managing mTLS certificates in this dynamic environment?

Accepted Answer

Certificate revocation and rotation. In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Answer

High latency due to encryption overhead

Answer

Incompatibility with HTTP/2

Answer

Increased complexity in load balancer configuration

Question 5

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Option A is correct because integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users

Question 6

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. Option C is correct because the most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 7

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

Accepted Answer

Implement rate limiting on the authentication endpoint. Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.

Answer

Require API keys for all requests

Answer

Use TLS to encrypt the communication channel

Answer

Add input validation for all parameters

Question 8

A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?

Accepted Answer

Implement a secrets detection tool in the pipeline. A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.

Answer

Use environment variables in the pipeline configuration

Answer

Use a separate build server

Answer

Encrypt the Git repository

Question 9

A company is implementing a hybrid cloud architecture. Which two components are essential for establishing a secure connection between on-premises and cloud environments? (Choose two.)

Accepted Answer

Direct connect or dedicated interconnect. A Direct Connect or dedicated interconnect provides a private, dedicated network connection from on-premises to the cloud provider, bypassing the public internet for lower latency and more consistent bandwidth. A VPN gateway establishes an encrypted tunnel over the public internet using protocols like IPsec (IKEv2) to secure data in transit. Together, these two components form the essential hybrid connectivity layer: the dedicated circuit for primary, high-throughput traffic and the VPN as a secure backup or for lower-cost, lower-bandwidth needs.

Answer

Identity and access management (IAM)

Answer

Cloud access security broker (CASB)

Answer

Web application firewall (WAF)

Question 10

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

Accepted Answer

Configure a SecurityContext with runAsNonRoot: true and readOnlyRootFilesystem: true. Option D is correct because Kubernetes SecurityContext allows fine-grained control over container permissions at the pod or container level. Setting `runAsNonRoot: true` ensures the container cannot run as UID 0, and `readOnlyRootFilesystem: true` mounts the container's root filesystem as read-only, preventing unauthorized writes at runtime. This directly satisfies the security team's requirements without relying on external policies or image-level configurations.

Answer

Use a RuntimeClass that disables root capabilities

Answer

Set the container's user to a non-root user in the Dockerfile

Answer

Apply a PodSecurityPolicy that blocks privileged containers

Question 11

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 12

Which TWO of the following are secure coding practices that help prevent injection attacks?

Accepted Answer

Using parameterized queries for database calls. Option B is correct because parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver treats the user-supplied values strictly as data, never as executable code, which prevents an attacker from injecting malicious SQL commands even if the input contains special characters like `' OR 1=1 --`.

Answer

Printing stack traces in production error messages

Answer

Using stored procedures exclusively

Answer

Storing user passwords in plaintext

Question 13

Which TWO are effective strategies for securing cloud application data at rest?

Accepted Answer

File-level encryption. File-level encryption (C) encrypts individual files or directories, ensuring that data at rest remains protected even if the underlying storage is compromised. This is a direct data-at-rest security control because it applies cryptographic protection to the data itself, independent of the storage layer. Transparent data encryption (D) encrypts data at the database level, typically at the page or file level, without requiring changes to the application, making it another effective strategy for securing data at rest.

Answer

Role-based access control

Answer

Database activity monitoring

Answer

Network segmentation

Question 14

Which TWO measures are effective for securing container images in a cloud environment?

Accepted Answer

Sign images to ensure integrity. Signing container images (e.g., using Docker Content Trust or Notary) ensures integrity and authenticity by cryptographically verifying that the image has not been tampered with since it was signed. This prevents man-in-the-middle attacks and the deployment of malicious images, which is a critical security measure in cloud environments where images are pulled from remote registries.

Answer

Store images in a public registry without scanning

Answer

Use latest tags without version pinning

Answer

Run containers with root privileges

Question 15

A developer receives the above error when trying to create a route in an API Gateway. Which action should the developer take to resolve the issue?

Accepted Answer

Delete the existing route or use a different route key. The error indicates that a route with the same key already exists in the API Gateway. API Gateway enforces unique route keys within an API; attempting to create a duplicate route key (e.g., the same HTTP method and path combination) will fail. Deleting the existing route or using a different route key resolves the conflict by ensuring each route key is unique.

Answer

Change the endpoint type to private

Answer

Add an authentication mechanism to the API

Answer

Verify that the API is deployed to the correct stage