CCSP Practice Test 34 — 15 Questions

Question 1

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Answer

GDPR

Answer

HIPAA

Answer

ISO 27001

Question 2

A developer is designing a microservices-based application in the cloud. They need to ensure communication between services is loosely coupled and resilient to failures. Which design pattern should they implement?

Accepted Answer

Event-driven messaging. Event-driven messaging (B) is correct because it enables asynchronous, decoupled communication between microservices, allowing them to operate independently and remain resilient to failures. When a service publishes an event, other services consume it at their own pace, preventing cascading failures and ensuring the system can handle partial outages without blocking. This pattern directly supports loose coupling and fault tolerance, which are critical for cloud-based microservices architectures.

Answer

API gateway

Answer

Service mesh

Answer

Database per service

Question 3

A cloud security team is implementing tokenization for a payment system. Which THREE statements correctly describe tokenization characteristics?

Accepted Answer

The original sensitive data is stored in a secure token vault.. Tokenization replaces sensitive data (e.g., credit card numbers) with a token, and the original data is stored securely in a token vault. This vault is isolated and access-controlled, ensuring that only authorized systems can detokenize the data when needed. The vault is the authoritative source for mapping tokens back to original values, which is fundamental to tokenization's security model.

Answer

Tokenization uses encryption algorithms to protect data.

Answer

Tokenization is reversible using the token alone.

Question 4

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Question 5

An administrator notices the log entries in the exhibit from a cloud-hosted server. What is the MOST likely security concern indicated by these logs?

Accepted Answer

A brute-force attack succeeded in logging into the system, and a database password was exposed in the command line. The log entries show a successful SSH login followed by a MySQL command that includes the database password in plaintext on the command line (e.g., `mysql -u root -pPassword123`). This indicates a brute-force attack succeeded, and the password was exposed in the process list or shell history, which is a critical data security concern.

Answer

Data was exfiltrated from the MySQL database

Answer

The MySQL database was accessed by an unauthorized user

Answer

A failed SSH login attempt indicates a misconfigured firewall

Question 6

Which THREE of the following are essential steps in a cloud data discovery process?

Accepted Answer

Map data flows between systems. Mapping data flows between systems is a foundational step in cloud data discovery. It enables organizations to understand how data moves across cloud services, APIs, and storage tiers, which is critical for identifying where sensitive data may be transmitted or stored. Without this mapping, discovery efforts may miss data in transit or in transient storage, leading to incomplete visibility.

Answer

Encrypt all discovered data

Answer

Create backup copies of data

Question 7

An organization is evaluating techniques to protect data while it is being processed in memory. The goal is to prevent unauthorized access even if the operating system or hypervisor is compromised. Which TWO techniques are suitable for protecting data in use?

Accepted Answer

Secure enclaves (e.g., Intel SGX). Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

Answer

Hashing

Answer

Data masking

Answer

Tokenization

Question 8

Which of the following is a key difference between a security group and a network ACL in a VPC?

Accepted Answer

Security groups are stateful, while NACLs are stateless. Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules. NACLs are stateless, requiring explicit inbound and outbound rules.

Answer

Security groups are stateless, while NACLs are stateful

Answer

Security groups are applied at the subnet level, while NACLs are applied at the instance level

Answer

Security groups support both allow and deny rules

Question 9

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

Accepted Answer

A virtual machine missing the Log Analytics agent. The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Answer

A user creating a new Azure subscription

Answer

A SQL database with advanced data security disabled

Answer

A storage account with public network access enabled

Question 10

A multinational corporation is migrating its data to the cloud and needs to ensure that data belonging to EU residents never leaves the EU region due to GDPR data sovereignty requirements. Additionally, the company wants to prevent accidental deletion and protect against ransomware. Which combination of cloud storage features should be implemented to meet these requirements?

Accepted Answer

Bucket policy restricting to EU regions and versioning. Configuring a bucket policy that restricts data storage to EU regions ensures data residency. Enabling versioning protects against accidental deletion and ransomware by allowing recovery of previous object versions.

Answer

IAM policies and access logs

Answer

Cross-region replication and object lock

Answer

Client-side encryption and signed URLs

Question 11

A company uses a cloud-based file storage service and wants to enable client-side encryption to prevent the cloud provider from accessing plaintext data. Which of the following MUST be implemented?

Accepted Answer

Envelope encryption with a master key stored on-premises. Client-side encryption requires that encryption keys are never accessible to the cloud provider. Envelope encryption with a master key stored on-premises ensures the data encryption key (DEK) is encrypted by a master key that remains under the customer's exclusive control, so the cloud service never has the plaintext key or data. This satisfies the requirement of preventing the provider from accessing plaintext data.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for all uploads

Answer

Key management service (KMS) with auto-rotation

Question 12

A cloud security architect is designing a key management strategy for a multi-cloud environment. Which of the following is a BEST practice for key management?

Accepted Answer

Use a centralized key management system that integrates with all clouds. A centralized key management system (KMS) that integrates with all cloud providers enables consistent key lifecycle management, reduces the risk of key sprawl, and ensures uniform access control policies across a multi-cloud environment. This approach aligns with the principle of separation of duties and allows for centralized auditing and rotation without vendor lock-in.

Answer

Use the same key for all data to simplify rotation

Answer

Store keys in each cloud provider's native KMS separately

Answer

Embed keys in application code for simplicity

Question 13

Match each virtualization security concept to its description.

Accepted Answer

Hypervisor: Software that creates and manages virtual machines.. Virtualization is foundational to cloud; security concerns include isolation and hypervisor integrity.

Answer

Hypervisor: A virtual machine running on a host.

Answer

VM Escape: A technique to move workloads between hosts.

Question 14

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

Accepted Answer

Implement OAuth 2.0 with scopes. OAuth 2.0 with scopes is the correct design pattern because it provides a standardized, token-based authorization framework that allows fine-grained access control to API resources. Scopes define specific permissions (e.g., read, write) and are validated by the resource server, ensuring that each API call is both authenticated (via the access token) and authorized (via the scopes). This aligns with the principle of least privilege and is widely adopted for securing cloud APIs.

Answer

Use API keys with IP whitelisting

Answer

Allow basic authentication over HTTPS

Answer

Use shared secrets with HMAC

Question 15

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

Accepted Answer

Agentless scanning using cloud APIs. Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Answer

Deploying a third-party vulnerability scanner on each VM

Answer

Agent-based scanning with AWS Inspector

Answer

Using container image scanning in registry