CCSP Practice Test 33 — 15 Questions

Question 1

A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?

Accepted Answer

Post-build image scanning in registry. Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Answer

Runtime security monitoring

Answer

Pre-commit hook in source control

Answer

Admission controller in Kubernetes

Question 2

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

Accepted Answer

Implement OAuth 2.0 with scopes. OAuth 2.0 with scopes is the correct design pattern because it provides a standardized, token-based authorization framework that allows fine-grained access control to API resources. Scopes define specific permissions (e.g., read, write) and are validated by the resource server, ensuring that each API call is both authenticated (via the access token) and authorized (via the scopes). This aligns with the principle of least privilege and is widely adopted for securing cloud APIs.

Answer

Use API keys with IP whitelisting

Answer

Allow basic authentication over HTTPS

Answer

Use shared secrets with HMAC

Question 3

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

Accepted Answer

Enable transparent data encryption (TDE) with customer-managed keys for the database and its backups.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys encrypts the database at rest and, when properly configured, also encrypts backup files. This ensures that even if backup files are stolen, the data remains unreadable without the decryption keys, providing a strong defense against data breaches involving physical or logical theft of backups.

Answer

Restrict access to the backup files using IAM roles.

Answer

Use a virtual private cloud (VPC) to isolate the database from the internet.

Answer

Implement data tokenization for all sensitive fields.

Question 4

A security auditor is reviewing a cloud application's data encryption strategy. The application stores sensitive data in a cloud database. Which configuration would best ensure data confidentiality in the event of a database dump?

Accepted Answer

Column-level encryption using application-managed keys. Option C is correct because column-level encryption with application-managed keys ensures that even if the entire database is dumped, the sensitive columns remain encrypted and unreadable without the keys held by the application. This approach decouples key management from the cloud provider, preventing the provider from accessing the plaintext data and maintaining confidentiality during a breach or dump.

Answer

Tokenization of sensitive fields with a separate token vault

Answer

Entire database encryption at rest using cloud provider managed keys

Answer

Transport layer security for all connections

Question 5

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Accepted Answer

API keys in URLs are often logged in plaintext in server logs and browser history.. The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Answer

API keys in query strings are not encrypted, even with HTTPS.

Answer

API keys provide weak authentication because they are not tied to a user session.

Answer

API keys are not valid for use in query strings; they require a certificate.

Question 6

An organization is designing a cloud application that must remain available even if an entire AWS availability zone fails. Which architecture pattern should they implement?

Accepted Answer

Single region with multiple AZs active-active. The correct architecture is a single region with multiple Availability Zones (AZs) in an active-active configuration. This ensures that if one AZ fails, the application continues to serve traffic from the remaining AZs without any manual intervention, as all AZs are actively handling requests. AWS Availability Zones are physically separate data centers within a region, and an active-active pattern distributes the workload across them to achieve high availability and fault tolerance.

Answer

Single region with multiple AZs active-standby

Answer

Active-passive in a single region

Answer

Multi-region active-active

Question 7

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Accepted Answer

Automated security scanning with failure conditions. Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.

Answer

Run penetration testing after release

Answer

Dependency scanning only on weekly basis

Answer

Manual code review after deployment

Question 8

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

Accepted Answer

Multi-region active-active. Multi-region active-active is the only strategy that can meet both a 15-minute RTO and a 5-minute RPO because it maintains synchronous or near-synchronous replication between two or more regions, allowing traffic to be instantly redirected with zero or minimal data loss. This approach eliminates the recovery time needed to spin up infrastructure or restore data, as the application is already fully operational in multiple regions.

Answer

Backup and restore

Answer

Pilot light

Answer

Warm standby

Question 9

A cloud architect is evaluating cloud service models for a new application. Which two characteristics are advantages of PaaS over IaaS? (Choose two.)

Accepted Answer

Reduced management of middleware and runtime. Option C is correct because PaaS abstracts away middleware, runtime, and OS management, allowing developers to focus on code rather than patching or configuring these layers. This reduces operational overhead compared to IaaS, where you must manage the OS, runtime, and middleware yourself. Option E is correct because PaaS platforms typically include built-in load balancing, auto-scaling, and redundancy features, whereas in IaaS you must architect and implement these capabilities manually.

Answer

Greater control over the underlying OS

Answer

Lower cost due to shared infrastructure

Answer

Higher flexibility to customize networking

Question 10

An administrator notices the log entries in the exhibit from a cloud-hosted server. What is the MOST likely security concern indicated by these logs?

Accepted Answer

A brute-force attack succeeded in logging into the system, and a database password was exposed in the command line. The log entries show a successful SSH login followed by a MySQL command that includes the database password in plaintext on the command line (e.g., `mysql -u root -pPassword123`). This indicates a brute-force attack succeeded, and the password was exposed in the process list or shell history, which is a critical data security concern.

Answer

Data was exfiltrated from the MySQL database

Answer

The MySQL database was accessed by an unauthorized user

Answer

A failed SSH login attempt indicates a misconfigured firewall

Question 11

A cloud administrator applies the bucket policy shown in the exhibit to an S3 bucket. What is the expected outcome?

Accepted Answer

All objects uploaded must be encrypted using server-side encryption with S3-managed keys (SSE-S3). Option A is correct because the bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

Answer

All upload requests will be denied unless they include encryption metadata

Answer

All objects must be encrypted with AWS KMS keys

Answer

All objects uploaded must be client-side encrypted before uploading

Question 12

Which THREE controls help protect data in use within a cloud environment? (Choose three.)

Accepted Answer

Confidential computing. Confidential computing protects data in use by executing computations within a hardware-based Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, which isolates the data and code from the host operating system and hypervisor. This ensures that even privileged users or cloud administrators cannot access the plaintext data while it is being processed in memory.

Answer

Tokenization

Answer

Access control lists

Question 13

A company is migrating sensitive customer data to the cloud. They need to classify data according to the organization's data classification policy, which includes public, internal, confidential, and restricted categories. Which of the following is the MOST important step to ensure data classification is effective in the cloud?

Accepted Answer

Integrate classification labels with DLP and access control policies. Integrating classification labels with DLP and access control policies ensures that the classification scheme is enforced automatically, not just documented. This allows the cloud infrastructure to apply appropriate protections (e.g., blocking unauthorized access or preventing data exfiltration) based on the label, making classification actionable and effective in a dynamic cloud environment.

Answer

Assign a data custodian to manually tag data objects

Answer

Implement encryption for all data at rest and in transit

Answer

Store each classification level in separate cloud regions

Question 14

A company is moving a legacy application to a public cloud. The application requires low latency and high throughput between two application tiers. Which two cloud design principles should be applied? (Choose two.)

Accepted Answer

Use dedicated network connections between tiers.. Option A is correct because dedicated network connections, such as AWS Direct Connect or Azure ExpressRoute, provide consistent low latency and high throughput by bypassing the public internet and reducing jitter. This ensures predictable performance for latency-sensitive inter-tier communication, which is critical for legacy applications with strict performance requirements.

Answer

Deploy both tiers in the same region but different availability zones.

Answer

Use a single large instance for both tiers.

Answer

Place the tiers in different VPCs with a transit gateway.

Question 15

An administrator configured the above key policy for a KMS key used to encrypt S3 backup data. The backup role 'BackupRole' is in the same account. However, when the backup service attempts to use the key to decrypt objects, the operation fails. What is the most likely cause?

Accepted Answer

The 'kms:ViaService' condition restricts calls to those originating from S3, but the backup service uses direct KMS API. The 'kms:ViaService' condition key restricts KMS API calls to those that originate from a specific AWS service, in this case S3. However, the backup service is likely making direct KMS API calls (e.g., Decrypt) rather than having S3 proxy the request, so the condition fails. The key policy explicitly denies access unless the call comes via S3, which is why decryption fails.

Answer

The principal ARN is incorrect because the role name contains uppercase letters

Answer

The key policy requires a grant token that is not being provided

Answer

The action list does not include 'kms:Decrypt' for S3