CCSP Practice Test 34 — 15 Questions

Question 1

A cloud architect is designing a cost-optimized architecture for a batch processing job that runs once per day. The job requires high compute capacity for approximately 5 hours. Which cloud service model is most suitable?

Accepted Answer

Spot instances. Spot instances are the most suitable for this batch processing job because they offer significant cost savings (up to 90% compared to on-demand) and are ideal for fault-tolerant, stateless workloads that can handle interruptions. The job runs once per day for only 5 hours, so it can easily be designed to checkpoint progress and resume if a spot instance is reclaimed, making the cost-optimized choice clear.

Answer

Reserved instances

Answer

On-demand instances

Answer

Dedicated hosts

Question 2

A cloud architect is designing a disaster recovery (DR) solution for a critical application with a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 5 minutes. The application runs on virtual machines in a private cloud. The architect is considering using a colocation facility as the DR site. Which replication method will meet the RPO requirement?

Accepted Answer

Periodic snapshots every 5 minutes. Option C is correct because periodic snapshots every 5 minutes align exactly with the RPO of 5 minutes, ensuring that at most 5 minutes of data is lost in a disaster. This method captures the VM state at the required interval without the complexity or latency constraints of synchronous replication, which is often impractical over long distances or limited bandwidth.

Answer

Synchronous replication

Answer

Periodic snapshots every 15 minutes

Answer

Asynchronous replication with a delay of 10 minutes

Question 3

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The correct answer is D because the scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 4

An Azure application uses a key vault key for client-side encryption of data. The application also communicates with a cloud service over HTTPS. After deploying, the handshake failure occurs. Which of the following is the most likely cause?

Accepted Answer

The client and server do not have a common TLS version or cipher suite. The handshake failure occurs at the transport layer (TLS/SSL), which is independent of client-side encryption using a key vault key. The most likely cause is a mismatch in TLS versions or cipher suites between the client and server, as HTTPS relies on a successful TLS handshake. Options A, B, and D relate to the key vault key's availability or configuration, which would not cause a TLS handshake failure.

Answer

The application is using the wrong key version

Answer

The key vault key is not accessible due to network restrictions

Answer

The key vault key is not enabled for encryption

Question 5

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that requires tags on resource creation.. Option C is correct because AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.

Answer

Use AWS Resource Groups to create a group that filters tagged instances.

Answer

Enable CloudTrail to monitor instance launches and alert on missing tags.

Answer

Configure AWS Config rules to automatically tag untagged instances.

Question 6

A cloud architect is designing a data loss prevention (DLP) solution for a SaaS application. The DLP must inspect data in transit between end users and the cloud as well as data at rest. Which combination of controls is most appropriate?

Accepted Answer

Deploy a cloud DLP service for content inspection and enforce encryption at rest.. Option B is correct because a cloud DLP service (e.g., AWS Macie, Microsoft Purview) can inspect data in transit by analyzing API calls or traffic patterns, and encryption at rest (e.g., AES-256) protects stored data. This combination directly addresses both inspection of data in transit and protection of data at rest, which is the core requirement of the question.

Answer

Use network segmentation and security groups.

Answer

Use encryption at rest and backup retention policies.

Answer

Implement a web application firewall (WAF) and a VPN.

Question 7

An organization is adopting a cloud-based data warehouse and needs to ensure data masking is applied to personally identifiable information (PII) for analysts who should not see actual values. Which technique is most appropriate?

Accepted Answer

Dynamic data masking in the data warehouse.. Dynamic data masking (DDM) is the correct choice because it applies masking rules at query runtime directly within the data warehouse, allowing analysts to see obfuscated PII without altering the underlying stored data. This meets the requirement for on-the-fly masking for specific users while preserving the original values for authorized roles.

Answer

Static data masking on the source database.

Answer

Encrypt the PII columns and restrict the decryption key.

Answer

Tokenization of the PII fields.

Question 8

What does this bucket policy enforce?

Accepted Answer

The policy denies all uploads unless they use SSE-KMS.. The bucket policy uses a Condition block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which means any upload must include the `x-amz-server-side-encryption` header with the value `aws:kms`. If the header is missing or set to any other value (e.g., `AES256` for SSE-S3), the request is denied. This enforces that all uploads use SSE-KMS, but does not require a specific KMS key unless a `kms:EncryptionContext` or `kms:KeyArn` condition is also present.

Answer

All objects must be encrypted with a specific KMS key.

Answer

Any object uploaded without encryption will be denied.

Answer

Only objects encrypted with SSE-S3 are allowed.

Question 9

Which TWO of the following are valid data states that must be protected in cloud computing?

Accepted Answer

Data at rest. In cloud computing, data exists in three primary states: at rest (stored on disk or in memory), in transit (moving across networks), and in use (being processed). The CCSP exam specifically identifies 'data at rest' and 'data in transit' as the two fundamental data states that require protection through encryption, access controls, and integrity mechanisms. Option B is correct because data at rest refers to inactive data stored physically on any digital device, such as databases, backups, or archives, and must be safeguarded against unauthorized access or theft.

Answer

Data encryption

Answer

Data integrity

Answer

Data in database

Question 10

An enterprise uses a cloud access security broker (CASB) to protect data in cloud applications. They want to prevent users from uploading files containing credit card numbers to a cloud storage service. Which CASB feature should be configured?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies are the correct CASB feature because they allow the enterprise to define content inspection rules that scan files for sensitive data patterns, such as credit card numbers (matching Luhn algorithm or regex patterns like those in PCI DSS). When a match is detected, the CASB can block the upload, quarantine the file, or trigger an alert, directly preventing data exfiltration to the cloud storage service.

Answer

Encryption in transit settings

Answer

User activity monitoring

Answer

Single sign-on (SSO) integration

Question 11

A company uses a Cloud Access Security Broker (CASB) to enforce security policies on SaaS applications. They want to ensure that data uploaded to a file-sharing service does not contain Social Security numbers (SSNs). Which CASB capability is most effective?

Accepted Answer

Inline DLP scanning. Inline DLP scanning is the most effective CASB capability for preventing data containing Social Security numbers from being uploaded to a file-sharing service because it inspects the content of files in real time as they are being uploaded. The CASB acts as a proxy, intercepting the HTTP/HTTPS traffic, parsing the file payload, and applying pattern-matching algorithms (e.g., regex for SSN format) to block the upload before it reaches the SaaS application. This proactive, real-time enforcement is essential for data loss prevention (DLP) at the point of upload.

Answer

Contextual access control

Answer

API-based data discovery

Answer

Encryption of data in transit

Question 12

A company uses a cloud-based file sharing service and wants to prevent sensitive data from being shared externally. Which cloud data security capability is most appropriate?

Accepted Answer

Scanning data at rest in cloud storage with DLP. Option C is correct because Data Loss Prevention (DLP) scanning of data at rest in cloud storage directly identifies and blocks sensitive content (e.g., PII, PCI-DSS data) stored in files before it can be shared externally. This capability is purpose-built for preventing unauthorized sharing by inspecting the actual content of files in the cloud repository, such as Amazon S3 or Azure Blob Storage, using pattern matching and fingerprinting.

Answer

Inspecting data in use within applications

Answer

Monitoring network traffic for data exfiltration

Answer

Encrypting data in transit

Question 13

A SaaS provider stores customer data in a multi-tenant database. A new regulation requires that data of former customers be completely erased within 30 days of account closure. Which process should the provider implement?

Accepted Answer

Encrypt each customer's data with a unique key and delete the key upon account closure.. Option D is correct because it implements cryptographic erasure, which renders the data permanently inaccessible by deleting the unique encryption key. This approach satisfies the regulation's requirement for complete erasure within 30 days without physically destroying hardware or risking data remnants, as the encrypted data becomes irrecoverable without the key. In a multi-tenant SaaS environment, this method is efficient, scalable, and avoids service disruption to other tenants sharing the same storage.

Answer

Physically destroy the hard drives containing the data.

Answer

Mark the data as deleted and exclude it from query results.

Answer

Overwrite the data with zeros using a secure delete tool.

Question 14

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

Accepted Answer

Cloud External Key Manager (EKM). Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Answer

Cloud KMS with software keys

Answer

Cloud KMS with hardware keys

Answer

Cloud HSM

Question 15

A company needs to ensure that data stored in the cloud is securely deleted when no longer needed. Which TWO of the following are secure deletion methods? (Choose two.)

Accepted Answer

Cryptographic erasure (destroying encryption keys). Cryptographic erasure renders data unrecoverable by securely destroying the encryption keys used to encrypt the data at rest. Without the keys, the ciphertext becomes effectively indecipherable, even if the underlying storage blocks remain intact. This method is recognized by NIST SP 800-88 as a valid sanitization technique for cloud environments where physical access to storage is limited.

Answer

Deleting the file metadata

Answer

Wiping the swap space

Answer

Degaussing the storage medium