CCSP Practice Test 33 — 15 Questions

Question 1

An organization is adopting a hybrid cloud strategy. Which THREE considerations are vital for maintaining consistent security across environments? (Select THREE.)

Accepted Answer

Unified identity and access management (IAM). Unified IAM (B) is vital because a hybrid cloud requires a single, consistent authentication and authorization model—using standards like SAML, OAuth 2.0, or OIDC and centralized directory services—so that identities and permissions behave identically across on-premises and cloud environments rather than fragmenting into separate trust domains. Consistent network segmentation and firewall rules (C) are essential because traffic flows between private and public environments must be governed by the same security zones, ACLs, and microsegmentation policies; otherwise lateral movement and misconfigured cross-cloud connectivity create exploitable gaps. Harmonized data encryption and key management (D) is critical because data moving between or stored across environments must use compatible algorithms and centrally governed keys (e.g., via a KMS or HSM with consistent rotation and access policies) to avoid weak links and unmanageable key sprawl. Option A is not required—separate security teams per environment actually undermine consistency by creating divergent policies and fragmented accountability, whereas a unified governance model with shared standards is preferred. Option E is incorrect because using different encryption standards for public versus private clouds introduces interoperability, compliance, and key-management problems; encryption should be harmonized, not differentiated by environment.

Answer

Dedicated security team for each environment

Answer

Different encryption standards for public and private clouds

Question 2

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Option C (Unified agent software installed on each VM) is essential because a CWPP must have a consistent enforcement point on every workload regardless of location; the same agent binary running on on-premises VMs and public cloud instances provides uniform visibility, vulnerability assessment, and runtime protection across the hybrid estate. Option D (Centralized policy management console) is essential because it is the single control plane where policies are authored once and pushed to all agents, ensuring identical rules are applied in both environments rather than being configured separately per platform. Together, the agent provides distributed enforcement while the console provides centralized definition and orchestration, which is the core CWPP pattern for hybrid cloud. Option A (SDP) is a network-centric zero-trust access model, not a workload protection mechanism, and does not itself apply host security policies. Option B (VPC network ACLs) are stateless subnet-level filters that exist only in the public cloud and cannot enforce policy on on-premises VMs. Option E (IaC templates) automate provisioning and configuration but do not deliver continuous runtime policy enforcement across existing VMs.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 3

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies — no package manager, shell, or OS utilities — which dramatically reduces the attack surface and the number of exploitable CVEs. Because there is no shell or package manager, attackers who gain code execution have far fewer tools to pivot or escalate with. This makes distroless the strongest choice when the explicit goal is minimizing vulnerabilities in a container image.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 4

Which THREE of the following are key components of a data protection impact assessment (DPIA) under GDPR?

Accepted Answer

Measures to address risks. Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.

Answer

List of all data subjects' names

Answer

Copy of the encryption algorithm

Question 5

An attacker exploits a cloud application to make HTTP requests to an internal metadata service and retrieve temporary credentials. Which control would be most effective in preventing this attack?

Accepted Answer

Network-level egress filtering to block 169.254.169.254. The attack exploits the cloud metadata service at the link-local address 169.254.169.254 (RFC 3927). Network-level egress filtering blocks outbound traffic to this IP, preventing the attacker from reaching the metadata service even if the application is compromised. This is a fundamental defense-in-depth control for cloud workloads.

Answer

Using signed URLs for all requests

Answer

Web Application Firewall (WAF) rules

Answer

Input validation on URL parameters

Question 6

Which THREE of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Resource pooling. Resource pooling is correct because NIST SP 800-145 defines it as one of the five essential characteristics, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. This enables economies of scale and location independence, as the customer generally has no control or knowledge over the exact location of the provided resources.

Answer

Multi-tenancy

Answer

Virtualization

Question 7

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 8

A cloud security engineer is hardening container runtime environments. Which TWO of the following are effective measures to prevent container escape?

Accepted Answer

Dropping all Linux capabilities except those required. Option D is correct because dropping all Linux capabilities except those strictly required follows the principle of least privilege and removes the powerful capabilities (such as CAP_SYS_ADMIN, CAP_NET_ADMIN, or CAP_SYS_PTRACE) that container-escape exploits typically abuse to break out of the namespace and interact with the host. Option E is correct because Seccomp profiles restrict the set of system calls a container process can invoke, blocking dangerous syscalls (e.g., ptrace, mount, unshare, keyctl) that are commonly leveraged in kernel-exploit-based escapes. Option A is not a preventive control for container escape: keeping the kernel patched reduces known vulnerabilities but does not by itself constrain a container's privileges or syscall surface. Option B is not effective as stated because mounting the host filesystem read-only does not prevent escape — an attacker can still gain host access and then remount or exploit writable paths; the real mitigation is not exposing the host filesystem to the container at all. Option C is incorrect because privileged mode disables the very isolation mechanisms (capabilities, seccomp, AppArmor/SELinux, device cgroup) that prevent escape, making it the opposite of a hardening measure.

Answer

Using the latest kernel version

Answer

Mounting the host filesystem as read-only

Answer

Running containers in privileged mode

Question 9

A cloud security architect is designing a data loss prevention (DLP) strategy for a cloud environment that stores sensitive customer data. Which TWO techniques should be implemented to proactively identify and protect sensitive data? (Select TWO.)

Accepted Answer

De-identification transforms. Option B (de-identification transforms) is correct because techniques such as tokenization, masking, pseudonymization, and generalization remove or obscure personally identifiable information (PII) so that sensitive customer data is protected even when accessed or processed, directly supporting a proactive DLP strategy. Option C (automated DLP scanning for sensitive data) is correct because continuous automated discovery and classification of sensitive data (e.g., using pattern matching, regex, and ML-based classifiers) lets the organization proactively locate and tag PII across storage and data flows so protection controls can be applied. Option A (cross-region replication) is not a DLP control; it improves durability and availability but can actually widen the data exposure footprint. Option D (bucket policies blocking all public access) is a useful access control, but it is reactive perimeter hardening rather than a technique for identifying sensitive data. Option E (enabling object versioning) supports recovery and immutability but does nothing to discover, classify, or de-identify sensitive data.

Answer

Cross-region replication

Answer

Bucket policies blocking all public access

Answer

Enabling object versioning

Question 10

Under GDPR, a cloud data controller must notify the supervisory authority of a personal data breach within what timeframe?

Accepted Answer

72 hours. GDPR Article 33 mandates that a data controller notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. This 72-hour window is a strict requirement unless the breach is unlikely to result in a risk to data subjects' rights and freedoms.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 11

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. Cloud audit logging service (e.g., AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) is the correct feature because it captures API calls made to cloud resources, including management and data events, for auditing purposes. It records who made the call, when, from where, and what was done, providing the necessary audit trail. This is the standard service for logging API activity across cloud providers.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service

Question 12

A company uses a cloud KMS to manage encryption keys for its cloud storage buckets. The security team wants to ensure that keys are rotated automatically every 90 days and that access to keys is restricted based on user roles. Which key management feature should they configure?

Accepted Answer

Key rotation policy and access control key policies. A cloud KMS rotation policy lets the security team schedule automatic key rotation (e.g., every 90 days) without manual intervention, while key policies (IAM/resource policies attached to the key) enforce role-based access control over who can use, manage, or view the key. Together these two features directly satisfy both stated requirements: automatic 90-day rotation and role-restricted key access.

Answer

Key versioning and deletion policies

Answer

Key import and export policies

Answer

Key expiration and renewal policies

Question 13

A cloud customer is concerned about the right to erasure under GDPR because the cloud provider replicates data across multiple regions and keeps backups. What technical challenge does this create for complying with a erasure request?

Accepted Answer

The cloud provider may not be able to delete data from all replicas and backups within the required time frame.. The right to erasure (Article 17) requires controllers to delete personal data without undue delay. However, in cloud environments, data is often replicated across multiple regions for availability and durability, and backups may be retained for disaster recovery or legal compliance. Ensuring deletion from all replicas and backups within the required timeframe is technically challenging because backups are typically immutable and may not be immediately overwritten.

Answer

The data must be anonymized instead of deleted.

Answer

The customer must notify all other users who may have accessed the data.

Answer

The cloud provider must retain the data for audit purposes.

Question 14

A cloud security engineer is reviewing an AWS IAM policy that includes the following statement: 'Effect: Allow, Action: iam:*, Resource: *'. Which two security concerns does this configuration create? (Choose TWO.)

Accepted Answer

Over-permissive IAM role. Option A (Over-permissive IAM role) is correct because Action: iam:* with Resource: * grants every IAM action on every IAM resource, far exceeding what any single role should hold and violating least privilege. Option E (Privilege escalation risk) is correct because iam:* includes actions like iam:CreatePolicyVersion, iam:AttachUserPolicy, iam:PutRolePolicy, and iam:PassRole, which let an identity grant itself or others broader permissions and effectively escalate to administrator. Option B is wrong because S3 bucket exposure depends on S3 bucket policies, ACLs, or Block Public Access settings, not an IAM statement. Option C is wrong because hardcoded credentials are a code/secret-management issue, not something created by an IAM policy statement. Option D is wrong because SSRF is an application-layer vulnerability, not a property of an IAM policy.

Answer

Exposed S3 bucket

Answer

Hardcoded credentials

Answer

SSRF vulnerability

Question 15

Which THREE of the following are commonly required when conducting a cloud vendor risk assessment?

Accepted Answer

Security certifications (e.g., ISO 27001). Financial stability, certifications, and incident response plans are standard vendor risk assessment items. Pricing comparison is procurement, not risk; marketing materials are irrelevant.

Answer

Pricing compared to competitors

Answer

Marketing materials and brand reputation