CCSP Practice Test 34 — 15 Questions

Question 1

A cloud security architect is designing a multi-tenant virtualized environment. Which type of hypervisor is considered most secure for cloud deployments due to its reduced attack surface and direct hardware control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Type 1 bare-metal hypervisor. A Type 1 bare-metal hypervisor runs directly on the host's hardware, controlling hardware resources and managing guest VMs without an underlying operating system. This architecture reduces the attack surface because there is no general-purpose OS to exploit, and it provides direct hardware control for performance and security. It is considered the most secure for cloud deployments.

Answer

Type 2 hosted hypervisor

Answer

Emulated hypervisor (e.g., QEMU without KVM)

Answer

Container runtime (e.g., Docker)

Question 2

A cloud security team needs to implement a logging strategy that captures user activity, API calls, and resource changes across multiple cloud services. The logs must be tamper-proof and retained for at least one year. Which combination of actions best meets these requirements?

Accepted Answer

Centralize logs into a dedicated log archive account with write-once-read-many (WORM) storage and enable anomaly detection alerts.. Centralizing logs into a dedicated log archive account with WORM (write-once-read-many) storage ensures tamper-proof retention for at least one year, and enabling anomaly detection alerts provides real-time security monitoring. Option A is incorrect because while streaming to a SIEM is good practice, retaining raw logs on standard storage does not guarantee immutability; logs could be modified or deleted. Option B is incorrect because encrypting logs at rest only protects confidentiality, not integrity; a centralized log management system without WORM may allow tampering. Option C is incorrect because using separate logging accounts for each service creates silos, increases management complexity, and does not inherently provide tamper-proof storage; logs could be altered within individual accounts.

Answer

Stream all logs to a Security Information and Event Management (SIEM) system and retain raw logs for one year on standard storage.

Answer

Enable logging for all services, encrypt logs at rest, and store them in a centralized log management system.

Answer

Use separate logging accounts for each cloud service and retain logs in their native format.

Question 3

A healthcare organization is designing a cloud solution to store and process electronic protected health information (ePHI). The organization must comply with HIPAA and wants to ensure that the cloud service provider (CSP) meets the necessary security and privacy requirements. The organization is evaluating a CSP that offers a Business Associate Agreement (BAA). Which of the following is the MOST critical factor to verify before signing the BAA?

Accepted Answer

The CSP has implemented appropriate administrative, physical, and technical safeguards to protect ePHI.. The HIPAA Security Rule requires covered entities and their business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. Before signing a BAA, the healthcare organization must verify that the CSP has these safeguards in place. While data residency, contractual clauses, and SLAs are relevant, they do not replace the need for comprehensive security controls.

Answer

The CSP's BAA includes a clause allowing the CSP to use ePHI for its own purposes.

Answer

The CSP's data center locations are within the United States.

Answer

The CSP offers a 99.999% uptime service level agreement (SLA).

Question 4

Which TWO of the following are key elements of a cloud service agreement (CSA) for legal compliance?

Accepted Answer

Audit rights. Audit rights (A) are a key legal-compliance element of a cloud service agreement because they contractually grant the customer the right to verify the provider's security controls, often via third-party audits such as SOC 2 or ISO/IEC 27001 reports, which is essential for demonstrating regulatory due diligence. Data processing terms (E), typically embodied in a Data Processing Agreement (DPA), are equally essential because they define the controller-processor relationship, lawful processing purposes, subprocessor approvals, breach notification, and cross-border transfer mechanisms like EU Standard Contractual Clauses required by GDPR and similar laws. The other options, while important operationally, are not the legal-compliance cornerstones asked for: encryption key management (B) is a technical security control, data portability tools (C) are a functional/exit-management capability, and an SLA uptime guarantee (D) is a performance commitment rather than a compliance obligation.

Answer

Encryption key management

Answer

Data portability tools

Answer

Service level agreements (SLA) uptime guarantee

Question 5

Drag and drop the steps for responding to a security incident involving a compromised cloud VM into the correct order.

Accepted Answer

Isolate, then Capture Forensics, then Terminate, then Analyze, then Remediate and Restore. First isolate, then capture forensics, terminate, analyze, and finally remediate and restore.

Answer

Isolate, then Terminate, then Capture Forensics, then Analyze, then Remediate and Restore

Answer

Analyze, then Isolate, then Capture Forensics, then Terminate, then Remediate and Restore

Answer

Isolate, then Capture Forensics, then Terminate, then Remediate and Restore, then Analyze

Question 6

Which TWO statements about data classification are correct?

Accepted Answer

Data classification can be based on context and content.. Data classification can be based on both context (e.g., source, creator, location) and content (e.g., keywords, patterns, data values). This dual approach allows organizations to apply classification rules that consider the environment and the actual data, enabling more accurate and granular protection. For example, a document containing a credit card number (content) created by the finance department (context) could be classified as 'Confidential'.

Answer

Data classification is performed once at creation.

Answer

Data classification must be automated to be effective.

Answer

Data classification is solely based on regulatory requirements.

Question 7

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

Accepted Answer

Enable automatic key rotation and configure detailed audit logging for the key management service.. Enabling automatic key rotation reduces the risk of key compromise by limiting the exposure window of any single key, while detailed audit logging for the key management service (e.g., AWS CloudTrail for KMS, Azure Monitor for Key Vault) provides an immutable record of all key usage and administrative actions. This combination ensures that even if a CMK is exposed, the window of vulnerability is minimized, and any unauthorized access or misuse is detectable through logs. Without these controls, the customer-managed key could remain static for long periods, increasing risk, and access events would not be auditable, violating the policy requirement.

Answer

Implement a VPN for all management traffic to the cloud provider's API.

Answer

Enable multi-factor authentication (MFA) for all cloud console users.

Answer

Use encryption in transit (TLS) for all data transfers to and from the cloud.

Question 8

A security engineer discovers that a cloud application can access the metadata service endpoint at 169.254.169.254. Which vulnerability is most likely being exploited?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) can be used to target the cloud metadata endpoint (169.254.169.254) to retrieve IAM credentials or other sensitive information. This is a cloud-specific vulnerability.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Insecure Deserialization

Question 9

A security architect is designing a logging strategy for a multi-cloud environment using AWS and Azure. Which TWO practices should be implemented to ensure log integrity and prevent tampering? (Choose two.)

Accepted Answer

Enable CloudTrail log file validation. Option C is correct because CloudTrail log file validation generates a digitally signed digest file for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option D is correct because S3 Object Lock (in compliance or governance mode) and Azure Immutable Blob Storage enforce WORM (write once, read many) policies, preventing logs from being modified or deleted during a retention period. Option A is wrong because a publicly readable S3 bucket exposes logs to unauthorized access and tampering, undermining integrity. Option B is wrong because KMS server-side encryption protects confidentiality at rest but does not prevent an authorized user or attacker with write permissions from altering or deleting log objects. Option E is wrong because cross-region replication improves durability and availability but does not prevent tampering with the source or replicated logs.

Answer

Store logs in a publicly readable S3 bucket for transparency

Answer

Encrypt logs using server-side encryption with AWS KMS

Answer

Enable cross-region replication for logs

Question 10

During a cloud migration, a company decides to move a legacy application with no code changes. Which migration strategy are they using?

Accepted Answer

Rehost (lift and shift). Rehost (lift and shift) means moving an application to the cloud without modifying its code or architecture. Since the company is migrating a legacy application with no code changes, this is the definition of a rehost strategy. The other strategies involve varying degrees of modification or replacement.

Answer

Refactor

Answer

Repurchase

Answer

Replatform

Question 11

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

Accepted Answer

Azure Activity connector. The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Answer

Office 365 connector

Answer

Azure Defender connector

Answer

Windows Security Events connector

Question 12

A cloud security engineer is designing a disaster recovery plan for a critical application running on virtual machines. The RTO is 4 hours and RPO is 1 hour. Which approach meets these requirements?

Accepted Answer

Keep a warm standby in another region with continuous data replication.. Meets both the RTO of 4 hours and RPO of 1 hour by maintaining a warm standby in another region with continuous data replication. Continuous replication ensures data is synchronized with minimal lag (well under 1 hour), and the warm standby VM can be activated quickly to meet the 4-hour RTO. This approach balances cost and recovery speed, as a warm standby is partially running and can be promoted to production faster than a cold standby.

Answer

Take daily snapshots and restore to a different region.

Answer

Use synchronous replication to a secondary availability zone.

Answer

Use asynchronous replication with a 1-hour lag to a secondary site.

Question 13

A cloud security team needs to ensure that all data in transit between on-premises systems and the cloud is encrypted. Which TWO options should they consider? (Choose two.)

Accepted Answer

Set up a VPN between on-premises and cloud. Option A is correct because a VPN (typically IPsec or SSL/TLS-based) creates an encrypted tunnel over the public internet between on-premises networks and the cloud, protecting all data in transit at the network layer. Option E is correct because enforcing TLS 1.2 or higher on all API calls encrypts application-layer traffic end-to-end, ensuring data in transit between clients and cloud services is protected with strong ciphers. Option B is incorrect because signed URLs only grant time-limited access to specific resources; they do not encrypt the data in transit. Option C is incorrect because bucket versioning preserves object versions for recovery and durability, not encryption. Option D is incorrect because server-side encryption with CMEK protects data at rest, not data in transit.

Answer

Use signed URLs for access

Answer

Enable bucket versioning

Answer

Enable server-side encryption with CMEK

Question 14

A company plans to deploy a multi-tier application across multiple cloud providers to avoid single points of failure. They need to ensure consistent security policies, including identity federation and network segmentation, across all environments. Which architecture consideration is MOST critical?

Accepted Answer

Implementing a unified security policy management tool. Implementing a unified security policy management tool is most critical for ensuring consistent security policies, including identity federation and network segmentation, across multiple cloud providers. Such a tool centralizes policy definition, translation, and enforcement, providing a single pane of glass for security management. This addresses the complexity of multi-cloud environments where native tools differ. Other options either do not address multi-cloud (single provider) or introduce inconsistency (different encryption standards).

Answer

Using a single cloud provider for all tiers

Answer

Storing all data in a single provider's data center

Answer

Using different encryption standards for each provider

Question 15

A company is adopting shift-left security. Which action best exemplifies this approach?

Accepted Answer

Running SAST scans during code development. Running SAST scans during code development is the best example of shift-left security because it moves security testing into the earliest phase of the SDLC, catching vulnerabilities before code is merged or deployed. Shift-left means integrating security practices earlier in development rather than after deployment. SAST during development directly embodies this principle.

Answer

Monitoring logs for suspicious activity

Answer

Performing security reviews after deployment

Answer

Conducting penetration testing annually