CCSP Practice Test 33 — 15 Questions

Question 1

A development team is working with production-like data in a non-production cloud environment. To comply with data privacy regulations, sensitive fields must be obscured without being retrievable. Which technique should they apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Irreversible masking. Irreversible masking (C) is correct because it transforms sensitive data into a non-reversible format, ensuring that the original values cannot be retrieved. This meets the requirement of obscuring production-like data in a non-production environment while complying with data privacy regulations that prohibit reversible transformations. Unlike encryption or tokenization, irreversible masking does not provide any decryption or mapping mechanism, making it suitable for scenarios where data must be permanently de-identified.

Answer

Format-preserving encryption

Answer

Reversible masking

Answer

Tokenization

Question 2

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

Accepted Answer

Enable immutable storage (WORM) on the bucket. Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Answer

Implement data classification labels

Answer

Enable versioning on the storage bucket

Answer

Encrypt data with customer-managed keys

Question 3

A cloud architect is designing a multi-region application to ensure high availability. The application must automatically fail over to a secondary region if the primary region becomes unavailable. Which strategy best meets this requirement?

Accepted Answer

Active-passive with automated failover using health checks. Active-passive with automated failover using health checks is the correct strategy because it ensures that the secondary region automatically takes over when the primary region fails, without manual intervention. Health checks continuously monitor the primary region's endpoints (e.g., via HTTP/HTTPS probes or TCP checks), and upon detecting consecutive failures (e.g., 3 failed health checks), the failover mechanism—such as DNS-based routing with a low TTL (e.g., 60 seconds) or a global load balancer—automatically redirects traffic to the passive secondary region. This meets the high availability requirement by minimizing downtime while keeping the secondary region idle to reduce costs.

Answer

Active-passive with manual failover

Answer

Active-active with load balancing across regions

Answer

Read replicas in secondary region

Question 4

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

Accepted Answer

Use server-side encryption with a customer-provided key (SSE-C).. Server-side encryption with customer-provided keys (SSE-C) allows the organization to encrypt data at rest in the cloud while retaining full control of the encryption keys on-premises. With SSE-C, the customer provides the encryption key with each API request, and the cloud service uses it to encrypt/decrypt the data server-side, but the key is never stored by the provider. This meets the requirement of keeping the key entirely on-premises and never exposed to the cloud provider.

Answer

Use server-side encryption with a key stored in the cloud provider's key management service (KMS).

Answer

Use server-side encryption with a cloud-managed key (SSE-S3).

Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.

Question 5

A company uses a cloud provider's object storage service for backup data. The security policy requires that data be encrypted at rest using keys managed by the company's on-premises hardware security module (HSM). Which encryption method should be used?

Accepted Answer

Client-side encryption. Client-side encryption is the only method where the encryption keys are generated and managed entirely within the customer's on-premises HSM, and data is encrypted before it is sent to the cloud provider's object storage. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, fully satisfying the policy requirement that keys be managed by the company's on-premises HSM.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with cloud provider-managed keys (SSE-S3)

Answer

Server-side encryption with customer-managed keys (SSE-KMS)

Question 6

An organization is adopting a cloud-based data warehouse and needs to ensure data masking is applied to personally identifiable information (PII) for analysts who should not see actual values. Which technique is most appropriate?

Accepted Answer

Dynamic data masking in the data warehouse.. Dynamic data masking (DDM) is the correct choice because it applies masking rules at query runtime directly within the data warehouse, allowing analysts to see obfuscated PII without altering the underlying stored data. This meets the requirement for on-the-fly masking for specific users while preserving the original values for authorized roles.

Answer

Static data masking on the source database.

Answer

Encrypt the PII columns and restrict the decryption key.

Answer

Tokenization of the PII fields.

Question 7

A company is using AWS CloudTrail to log API calls. A security analyst needs to be alerted when an IAM user creates a new access key for another user. Which CloudTrail event should be monitored?

Accepted Answer

CreateAccessKey. The correct event to monitor is 'CreateAccessKey' because this is the CloudTrail event name generated when an IAM user creates a new access key for another user. AWS CloudTrail logs all IAM API calls, and the event name directly corresponds to the API action invoked (CreateAccessKey). Monitoring this event allows the security analyst to detect unauthorized creation of access keys, which is a common privilege escalation or persistence technique.

Answer

DeleteAccessKey

Answer

CreateUser

Answer

UpdateAccessKey

Question 8

A company uses a Cloud Access Security Broker (CASB) to enforce security policies on SaaS applications. They want to ensure that data uploaded to a file-sharing service does not contain Social Security numbers (SSNs). Which CASB capability is most effective?

Accepted Answer

Inline DLP scanning. Inline DLP scanning is the most effective CASB capability for preventing data containing Social Security numbers from being uploaded to a file-sharing service because it inspects the content of files in real time as they are being uploaded. The CASB acts as a proxy, intercepting the HTTP/HTTPS traffic, parsing the file payload, and applying pattern-matching algorithms (e.g., regex for SSN format) to block the upload before it reaches the SaaS application. This proactive, real-time enforcement is essential for data loss prevention (DLP) at the point of upload.

Answer

Contextual access control

Answer

API-based data discovery

Answer

Encryption of data in transit

Question 9

Refer to the exhibit. A security analyst reviews this CloudTrail log entry. What is the most immediate concern?

Accepted Answer

A security group rule was added that allows unrestricted SSH access.. The CloudTrail log entry shows an AuthorizeSecurityGroupIngress API call that added a rule allowing SSH (port 22) from source 0.0.0.0/0, which grants unrestricted internet access. This is a critical security misconfiguration that exposes the EC2 instance to potential brute-force attacks or unauthorized access, making it the most immediate concern.

Answer

A user named john.doe is not authorized to modify security groups.

Answer

An EC2 instance was launched without approval.

Answer

The user john.doe failed to authenticate.

Question 10

A financial institution uses a cloud data warehouse to store transaction data. The data is classified into three tiers: public, internal, and confidential. The current architecture stores all data in a single dataset with column-level encryption for confidential fields. A recent internal penetration test revealed that an analyst with access to the data warehouse could query aggregated statistics that inadvertently revealed confidential individual transactions. The security team needs to implement a solution that prevents such data leakage while preserving analytical capabilities. Which solution BEST addresses this?

Accepted Answer

Deploy a differential privacy framework that adds noise to query results.. Differential privacy is the correct solution because it directly addresses the core issue: aggregated statistics can be reverse-engineered to infer individual records. By adding calibrated noise to query results, it ensures that the output of any query does not reveal whether a specific individual's data is present, thus preventing leakage from aggregate queries while still allowing analysts to derive meaningful trends and patterns.

Answer

Implement row-level security to restrict each analyst to only view data related to their assigned region.

Answer

Use dynamic data masking to obscure confidential fields based on the user's clearance.

Answer

Encrypt the entire dataset with a key that is only available to a privileged group.

Question 11

A cloud architect is evaluating cloud service models for a new application. Which two characteristics are advantages of PaaS over IaaS? (Choose two.)

Accepted Answer

Reduced management of middleware and runtime. PaaS abstracts away middleware, runtime, and OS management, allowing developers to focus on code rather than patching or configuring these layers. This reduces operational overhead compared to IaaS, where you must manage the OS, runtime, and middleware yourself. Option E is correct because PaaS platforms typically include built-in load balancing, auto-scaling, and redundancy features, whereas in IaaS you must architect and implement these capabilities manually.

Answer

Greater control over the underlying OS

Answer

Lower cost due to shared infrastructure

Answer

Higher flexibility to customize networking

Question 12

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Accepted Answer

Assess current environment, set up target cloud environment, replicate applications and data, transfer data, test and cut over. First assess, then set up target, replicate, transfer data, and finally test and cut over.

Answer

Set up target cloud environment, assess current environment, replicate applications and data, transfer data, test and cut over

Answer

Assess current environment, replicate applications and data, transfer data, set up target cloud environment, test and cut over

Answer

Assess current environment, set up target cloud environment, transfer data, replicate applications and data, test and cut over

Question 13

A multinational corporation uses a cloud access security broker (CASB) to enforce data protection policies across multiple SaaS applications. They discover that sensitive data tagged with 'Confidential' is being shared externally via a file-sharing application. The CASB currently only logs activities. Which action should the security team take to prevent such data loss in the future?

Accepted Answer

Implement a DLP policy that automatically blocks sharing of documents with the 'Confidential' label.. A CASB with Data Loss Prevention (DLP) capabilities can enforce real-time policies to block sharing of documents tagged with a specific sensitivity label (e.g., 'Confidential'). Since the CASB currently only logs activities, implementing a DLP policy that automatically blocks the sharing action addresses the root cause—preventing the data loss at the point of egress—rather than merely detecting it after the fact.

Answer

Encrypt all files stored in the file-sharing application.

Answer

Revoke user access to the file-sharing application for all employees.

Answer

Train employees on data handling policies.

Question 14

A company's cloud storage bucket policy inadvertently allowed anonymous users to list and read objects. After discovering the exposure, the security team has corrected the policy. Which additional step is critical to prevent recurrence?

Accepted Answer

Implement automated policy validation as part of the infrastructure as code deployment process.. Implementing automated policy validation as part of the infrastructure as code (IaC) deployment process ensures that any bucket policy changes are automatically checked against security rules before they are applied. This prevents misconfigurations like allowing anonymous access from reaching production, addressing the root cause rather than just reacting after exposure. In cloud environments like AWS S3, tools such as AWS CloudFormation with cfn-nag or Terraform with Sentinel can enforce policies programmatically, eliminating human error in manual reviews.

Answer

Enable logging and monitoring to detect similar exposures.

Answer

Assign a dedicated security team to manually approve all policy changes.

Answer

Review all existing bucket policies and correct any other misconfigurations.

Question 15

Which THREE controls help protect data in use within a cloud environment? (Choose three.)

Accepted Answer

Confidential computing. Confidential computing protects data in use by executing computations within a hardware-based Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, which isolates the data and code from the host operating system and hypervisor. This ensures that even privileged users or cloud administrators cannot access the plaintext data while it is being processed in memory.

Answer

Tokenization

Answer

Access control lists