CCSP Practice Test 32 — 15 Questions

Question 1

An architect reviews this S3 bucket policy. What security concern should be raised?

Accepted Answer

The policy grants access to all users from the specified IP range.. The policy grants s3:GetObject access to all users (Principal: "*") from the specified IP range, which means any unauthenticated user on the internet within that IP range can read objects in the bucket. This violates the principle of least privilege and exposes data to potential unauthorized access, as the policy does not require authentication or additional authorization checks.

Answer

The policy allows s3:GetObject from any source.

Answer

The policy allows s3:GetObject only to the specific bucket.

Answer

The policy does not restrict access to authenticated users.

Question 2

A security engineer is reviewing an S3 bucket policy that grants 's3:GetObject' access to 'Principal: *' and 'Condition: {IpAddress: {aws:SourceIp: ["1.2.3.4/32"]}}'. Despite the IP restriction, why is this policy still considered risky?

Accepted Answer

The bucket is still exposed to anyone who can spoof that IP. The policy grants public access to a specific IP, but if that IP is compromised or the condition is misconfigured, it can lead to data exposure; additionally, the bucket policy may override other controls.

Answer

The policy uses 'GetObject' instead of 'ListBucket'

Answer

The IP address is not properly masked

Answer

The condition uses 'aws:SourceIp' which is deprecated

Question 3

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

Accepted Answer

Up to $500K, the total fees paid in the past 12 months. The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Answer

The amount of direct damages only

Answer

Full $2M because negligence overrides liability caps

Answer

Zero because the customer accepted the terms

Question 4

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

Accepted Answer

The deletion was performed without evidence of compliance team approval. The company policy explicitly requires compliance team approval for all deletion operations, and the CloudTrail log entry does not contain any evidence of such approval (e.g., no MFA context, no approval token, no IAM policy condition key indicating approval). CloudTrail logs record API calls but do not inherently capture external approval workflows; the absence of an approval artifact in the log indicates a policy violation.

Answer

The deletion was performed from an internal IP address

Answer

The deletion was performed by a user who may not have authorization

Answer

The log entry does not include the object's encryption status

Question 5

A cloud administrator is designing a backup strategy for a critical database. Which of the following is the BEST approach to ensure data recoverability in case of a regional outage?

Accepted Answer

Regularly copy backups to a different geographic region.. Replicating backups to a different geographic region ensures data recoverability even if the entire primary region experiences a catastrophic outage. This approach leverages cross-region replication, which provides independent fault domains and meets the recovery point objective (RPO) and recovery time objective (RTO) requirements for regional disaster scenarios. Cloud providers like AWS, Azure, and GCP offer services such as S3 Cross-Region Replication (CRR) or Azure Geo-Redundant Storage (GRS) to automate this process.

Answer

Use tape backups stored in a physical safe in the same building.

Answer

Perform only daily backups without replication.

Answer

Store backups in a different availability zone within the same region.

Question 6

A security team wants to detect container image vulnerabilities before they are pushed to a registry. Which stage of the CI pipeline should container image scanning occur?

Accepted Answer

After build and before push to registry. Scanning container images after build but before push ensures vulnerabilities are caught early and not deployed.

Answer

During runtime in production

Answer

After deployment to production

Answer

After push to registry and before deployment

Question 7

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 8

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 9

During a threat modeling session for a cloud-native application, which cloud-specific attack path is most critical to identify?

Accepted Answer

Server-Side Request Forgery (SSRF) to the metadata service. SSRF targeting cloud metadata endpoints is a critical cloud-specific threat because it can expose IAM credentials, leading to full account compromise. This is a unique cloud attack path not typically present in on-premises environments.

Answer

Cross-Site Scripting (XSS) in a web form

Answer

SQL injection in a legacy database

Answer

Buffer overflow in a compiled binary

Question 10

A company experiences a security breach in its cloud environment, and the security team needs to preserve evidence for legal proceedings. Which of the following is the MOST important step to take first?

Accepted Answer

Isolate the compromised systems from the network to prevent lateral movement.. The immediate priority in a cloud security incident is to contain the breach and prevent lateral movement, which preserves the integrity of the evidence by stopping further compromise. Isolating compromised systems (e.g., via network security groups or virtual network segmentation) ensures that volatile data, such as memory contents and active connections, is not altered by ongoing attacker activity. This step aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before evidence collection.

Answer

Disable all logging to prevent the attacker from seeing detection efforts.

Answer

Notify all affected customers of the breach.

Answer

Contact the legal department to obtain a warrant before any action.

Question 11

Which of the following is a best practice for managing secrets in cloud-native applications?

Accepted Answer

Store secrets in a dedicated secrets management service. Using a cloud secret manager (like AWS Secrets Manager or HashiCorp Vault) to inject secrets at runtime avoids hardcoding and enables rotation. Least privilege IAM and environment variables are also good but using a dedicated service is best.

Answer

Hardcode secrets in environment variables

Answer

Include secrets in container images

Answer

Use the same secret across all environments

Question 12

A cloud-native application stores sensitive user files in an Amazon S3 bucket. Which misconfiguration poses the greatest risk of data exposure?

Accepted Answer

Bucket ACL set to public read. Setting the S3 bucket ACL to public read allows anyone on the internet to access files, leading to data exposure.

Answer

Bucket versioning enabled

Answer

Default encryption enabled

Answer

Bucket policy with a condition for source IP

Question 13

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. A multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 14

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

Accepted Answer

The policy allows GetObject from the internal network only when using HTTPS.. The policy includes an explicit Deny for any request that does not use HTTPS (i.e., aws:SecureTransport is false), which overrides any Allow. The Allow statement grants s3:GetObject only when the source IP is within 10.0.0.0/24. Therefore, the effective result is that GetObject is allowed only from the internal network and only over HTTPS, making option B correct.

Answer

The policy allows access from any IP if the request uses HTTPS.

Answer

The policy allows access from any IP in 10.0.0.0/24, but blocks access from the VPC.

Answer

The policy denies all access to the bucket because of the explicit Deny statement.

Question 15

Drag and drop the steps for implementing a disaster recovery plan using cross-region replication in AWS into the correct order.

Accepted Answer

Enable cross-region replication, then configure IAM roles, then set up automation templates, then test the replication, then document the DR plan.. Start with enabling replication, then IAM roles, automation templates, testing, and documentation.

Answer

Enable cross-region replication, then set up automation templates, then configure IAM roles, then test the replication, then document the DR plan.

Answer

Configure IAM roles, then enable cross-region replication, then set up automation templates, then test the replication, then document the DR plan.

Answer

Document the DR plan, then enable cross-region replication, then configure IAM roles, then set up automation templates, then test the replication.