CCSP Practice Test 32 — 15 Questions

Question 1

Which THREE statements about cryptographic key lifecycle management are correct?

Accepted Answer

Key usage should be logged and audited.. Auditing key usage is a fundamental requirement for accountability and compliance in cryptographic key management. Logging every key operation (e.g., generation, encryption, decryption, signing) allows detection of unauthorized use or policy violations, and is mandated by standards like NIST SP 800-57 Part 1, which states that audit logs must be protected and reviewed regularly.

Answer

Key backup must be encrypted and stored separately from the keys they protect.

Answer

Key rotation policies must ensure all data is re-encrypted with the new key immediately.

Question 2

Which design principle is most directly aimed at avoiding vendor lock-in and ensuring that workloads can be moved between cloud providers with minimal effort?

Accepted Answer

Portability. Portability is the design principle specifically concerned with avoiding vendor lock-in by ensuring workloads, data, and configurations can be moved between cloud providers with minimal rework. It drives the use of open standards, containerization, and abstraction layers so that an application is not tied to proprietary APIs or services. Reversibility is related but focuses on the ability to exit a provider and bring data back, whereas portability is about the ability to move and run elsewhere.

Answer

Reversibility

Answer

Elasticity

Answer

Multitenancy isolation

Question 3

Which TWO of the following are benefits of using tokenization for credit card data?

Accepted Answer

Maintains data format for existing systems. Tokenization replaces sensitive credit card data with a non-sensitive token that retains the same format (e.g., a 16-digit number) and length, allowing existing systems, databases, and applications to process the token without modification. This format-preserving property ensures that legacy systems, such as payment gateways or CRM platforms, can continue to operate without requiring costly re-engineering. By using a token instead of the actual PAN, the organization reduces the scope of PCI DSS compliance because the tokenized data is not considered cardholder data under the PCI DSS standard.

Answer

Reversible without a key vault

Answer

Eliminates the need for encryption

Answer

Slows down database queries

Question 4

A development team is adopting a DevSecOps approach for a cloud-native application. Which practice best exemplifies the shift-left security principle?

Accepted Answer

Scanning Infrastructure as Code (IaC) templates with Checkov before deployment. Scanning Infrastructure as Code (IaC) templates with Checkov before deployment embodies the shift-left security principle by identifying and remediating misconfigurations early in the development lifecycle. This proactive approach prevents security issues from reaching production, reducing risk and cost compared to post-deployment fixes.

Answer

Reviewing logs for security incidents weekly

Answer

Configuring a cloud WAF after the application is live

Answer

Performing runtime penetration testing after deployment

Question 5

Which THREE of the following are typical requirements for compliance with eDiscovery in a cloud environment?

Accepted Answer

Documentation of chain of custody. Option A is correct because eDiscovery requires an auditable chain of custody documenting who collected, handled, and preserved electronically stored information (ESI), so its integrity and admissibility can be proven. Option B is correct because compliance demands search and retrieval capabilities across all relevant data sources (mailboxes, SharePoint/OneDrive, Teams, etc.) so responsive ESI can be identified and produced under FRCP rules. Option C is correct because the ability to place a legal hold is essential to prevent deletion or alteration of potentially relevant data once litigation or investigation is reasonably anticipated. Option D does not belong because encryption at rest is a general data-protection control, not an eDiscovery-specific requirement, and Option E does not belong because data minimization is a privacy principle (e.g., GDPR) rather than an eDiscovery capability.

Answer

Encryption of data at rest

Answer

Data minimization principles

Question 6

A SaaS provider stores customer data in a multi-tenant database. A new regulation requires that data of former customers be completely erased within 30 days of account closure. Which process should the provider implement?

Accepted Answer

Encrypt each customer's data with a unique key and delete the key upon account closure.. It implements cryptographic erasure, which renders the data permanently inaccessible by deleting the unique encryption key. This approach satisfies the regulation's requirement for complete erasure within 30 days without physically destroying hardware or risking data remnants, as the encrypted data becomes irrecoverable without the key. In a multi-tenant SaaS environment, this method is efficient, scalable, and avoids service disruption to other tenants sharing the same storage.

Answer

Physically destroy the hard drives containing the data.

Answer

Mark the data as deleted and exclude it from query results.

Answer

Overwrite the data with zeros using a secure delete tool.

Question 7

A cloud customer wants to ensure that when the contract ends, the cloud provider deletes all customer data, including from backups. Which contractual clause is essential?

Accepted Answer

Data deletion clause. A data deletion clause is essential because it contractually obligates the cloud provider to securely erase all customer data—including replicas and backups—upon contract termination or at the customer's request. Without this clause, data may persist indefinitely in provider backups, snapshots, or archival storage, creating confidentiality and compliance exposure. CCSP emphasizes that the right to deletion must be explicitly negotiated, since default provider terms rarely guarantee backup purging.

Answer

Right to audit clause

Answer

Data portability clause

Answer

Service Level Agreement

Question 8

A cloud administrator applies the bucket policy shown in the exhibit to an S3 bucket. What is the expected outcome?

Accepted Answer

All objects uploaded must be encrypted using server-side encryption with S3-managed keys (SSE-S3). The bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

Answer

All upload requests will be denied unless they include encryption metadata

Answer

All objects must be encrypted with AWS KMS keys

Answer

All objects uploaded must be client-side encrypted before uploading

Question 9

An organization wants to ensure that if they decide to migrate away from their current cloud provider, they can retrieve all data in a usable format and delete it from the provider's systems. Which principle does this best describe?

Accepted Answer

Reversibility. Reversibility is the principle that ensures an organization can fully exit a cloud provider relationship — retrieving all data in a usable format and confirming its deletion from the provider's systems. It directly addresses the exit/termination scenario described, covering both data extraction and verified destruction. This is a core cloud governance concept tied to avoiding vendor lock-in and satisfying data lifecycle obligations.

Answer

Interoperability

Answer

Portability

Answer

Elasticity

Question 10

A cloud security administrator needs to ensure that all API calls to the cloud provider's management plane are logged for audit purposes. Which service should be enabled?

Accepted Answer

Cloud audit logging service. The cloud audit logging service should be enabled to log all API calls to the management plane for audit purposes. This service captures API activity, including who made the call, when, and from where, providing an audit trail. It is specifically designed for compliance and security auditing.

Answer

Cloud configuration service

Answer

Cloud threat detection service

Answer

Cloud monitoring service

Question 11

A cloud security team wants to automatically block malicious requests to a web application before they reach the application servers. Which solution should they implement?

Accepted Answer

Cloud Web Application Firewall (WAF). A Cloud Web Application Firewall (WAF) is the correct solution because it operates at the application layer (Layer 7) to inspect HTTP/HTTPS traffic and block malicious requests—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—before they reach the application servers. Unlike an IDS, a WAF can actively block traffic in real time, and it is deployed at the network edge or cloud gateway, providing inline prevention without requiring changes to the application code.

Answer

Intrusion Detection System (IDS)

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Question 12

A company is moving a legacy application to the cloud. The application uses hard-coded passwords for database connections. Which secure development practice should be implemented to address this issue?

Accepted Answer

Secrets management. Hard-coded passwords in application code violate the principle of least privilege and create a persistent security risk if the code is exposed. Secrets management (D) addresses this by storing database credentials in a secure, centralized vault (e.g., HashiCorp Vault, AWS Secrets Manager) and retrieving them at runtime via API calls, eliminating the need to embed passwords in source code or configuration files.

Answer

Multi-factor authentication

Answer

Input validation

Answer

Encryption at rest

Question 13

Which characteristic of cloud computing allows a user to provision resources automatically without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the cloud characteristic defined by NIST SP 800-145 that allows a consumer to unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This exactly matches the scenario of automatic provisioning without provider interaction.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 14

A cloud security team wants to automatically remediate misconfigured S3 buckets that are publicly accessible. Which combination of AWS services can be used to detect and automatically fix this issue?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously monitors and records resource configurations, including S3 bucket policies and ACLs, and can evaluate them against desired rules. When a bucket is found to be publicly accessible, AWS Config can trigger an AWS Lambda function to automatically remediate the misconfiguration, such as by applying a restrictive bucket policy or blocking public access. This combination provides detection and automated remediation.

Answer

AWS GuardDuty and AWS Lambda

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS Security Hub and AWS CloudTrail

Question 15

A cloud architect is designing VPC connectivity for a global organization with multiple AWS accounts. They need a central hub for connecting many VPCs together, supporting transitive routing. Which service should they use?

Accepted Answer

Transit Gateway. AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks, supporting transitive routing between all attached VPCs. It simplifies network architecture by eliminating the need for complex full-mesh VPC peering and allows scalable, hub-and-spoke connectivity. For a global organization with many VPCs across accounts, Transit Gateway is the designed solution.

Answer

Private Link

Answer

VPN Connection

Answer

VPC Peering