CCSP Practice Test 35 — 15 Questions

Question 1

A cloud application processes credit card numbers. To reduce PCI DSS scope, the company wants to remove the original PAN from its databases and use a surrogate value that can be reversed only by a privileged application. Which data protection technique should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tokenization using a cloud-based token vault. Tokenization replaces the original PAN with a randomly generated surrogate value (token) that has no mathematical relationship to the original data. The token can be reversed only by a privileged application that has access to the token vault, which stores the mapping between tokens and actual PANs. This effectively removes the PAN from the application's databases, reducing PCI DSS scope because the tokenized data is not considered sensitive cardholder data.

Answer

Truncation of the first 6 and last 4 digits

Answer

Dynamic data masking in the application tier

Answer

Symmetric encryption with a key stored in the database

Question 2

A cloud provider guarantees 99.99% availability for a service. What is the maximum allowed downtime per year (rounded to nearest minute)?

Accepted Answer

52.56 minutes. 99.99% implies 0.01% downtime. 365*24*60 = 525,600 minutes. 0.01% of 525,600 = 52.56 minutes, about 53 minutes.

Answer

1.01 hours

Answer

5.26 minutes

Answer

8.76 hours

Question 3

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.. A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.

Answer

Use shared API keys embedded in each service's configuration.

Answer

Implement TLS termination at the load balancer with internal certificates.

Answer

Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.

Question 4

A security auditor is reviewing a cloud application's data encryption strategy. The application stores sensitive data in a cloud database. Which configuration would best ensure data confidentiality in the event of a database dump?

Accepted Answer

Column-level encryption using application-managed keys. Column-level encryption with application-managed keys ensures that even if the entire database is dumped, the sensitive columns remain encrypted and unreadable without the keys held by the application. This approach decouples key management from the cloud provider, preventing the provider from accessing the plaintext data and maintaining confidentiality during a breach or dump.

Answer

Tokenization of sensitive fields with a separate token vault

Answer

Entire database encryption at rest using cloud provider managed keys

Answer

Transport layer security for all connections

Question 5

An organization stores customer data in a cloud that is subject to GDPR. The organization uses a cloud provider that does not allow audits of its data centers. What is the best way to satisfy GDPR audit requirements?

Accepted Answer

Rely on the provider's SOC 2 Type II report. GDPR requires adequate assurances from processors. If direct audits are not possible, the customer can rely on third-party certifications like SOC 2 Type II or ISO 27001, which provide independent assurance. Waivers and data minimization do not meet audit requirements.

Answer

Minimize data stored to reduce risk

Answer

Request a contractual waiver for audit rights

Answer

Switch to a provider that allows on-site audits

Question 6

A financial services company is migrating a critical application to the cloud. They must ensure that the cloud provider supports the ability to conduct forensic investigations in case of a security incident. Which of the following is the MOST important requirement to include in the contract?

Accepted Answer

The provider must grant the customer access to raw logs and the ability to perform memory captures on virtual instances.. Forensic investigations require access to raw logs and the ability to capture memory from virtual instances to analyze incidents. Option A is incorrect because uptime guarantees (99.999%) relate to availability, not forensic capability. Option B is incorrect because automatic patching is a security measure but not specific to forensics. Option D is incorrect because data residency restrictions address data sovereignty, not forensic access.

Answer

The provider must guarantee 99.999% uptime for all cloud services used.

Answer

The provider must automatically patch all virtual machines within 24 hours of patch release.

Answer

The provider must store data only in data centers located within the country of operation.

Question 7

A cloud security architect is designing an API gateway for a microservices application. The gateway must authenticate requests, enforce rate limiting, and log all transactions for audit. Which of the following security controls is most critical to protect against API abuse?

Accepted Answer

Implement rate limiting and throttling based on client identity and request volume.. Rate limiting and throttling directly prevent API abuse by limiting request frequency based on client identity and volume. Option B is incorrect because encryption protects data in transit but does not prevent abuse. Option C is incorrect because input validation prevents injection attacks but not volume-based abuse. Option D is incorrect because API keys authenticate clients but do not limit usage; rate limiting is required for abuse protection.

Answer

Use TLS 1.3 to encrypt all traffic between clients and the gateway.

Answer

Validate and sanitize all input parameters to prevent injection attacks.

Answer

Require API keys for all requests and revoke keys of suspicious clients.

Question 8

What is the primary purpose of a Data Processing Agreement (DPA) between a data controller and a cloud service provider?

Accepted Answer

To define roles and responsibilities for data processing. A Data Processing Agreement (DPA) is a legally binding contract required under regulations like GDPR. Its primary purpose is to define the roles and responsibilities of the data controller and the data processor (the cloud service provider), ensuring the processor acts only on the controller's documented instructions and meets compliance obligations. Without a DPA, the controller cannot legally transfer data to the processor, as the agreement establishes the lawful basis and accountability for processing activities.

Answer

To set data retention periods for processed data

Answer

To specify encryption algorithms to be used

Answer

To establish data backup and recovery procedures

Question 9

A cloud architect is designing a data loss prevention (DLP) solution for a SaaS application. The DLP must inspect data in transit between end users and the cloud as well as data at rest. Which combination of controls is most appropriate?

Accepted Answer

Deploy a cloud DLP service for content inspection and enforce encryption at rest.. A cloud DLP service (e.g., AWS Macie, Microsoft Purview) can inspect data in transit by analyzing API calls or traffic patterns, and encryption at rest (e.g., AES-256) protects stored data. This combination directly addresses both inspection of data in transit and protection of data at rest, which is the core requirement of the question.

Answer

Use network segmentation and security groups.

Answer

Use encryption at rest and backup retention policies.

Answer

Implement a web application firewall (WAF) and a VPN.

Question 10

A cloud customer is terminating its contract with a cloud provider and needs to ensure all data, including backups, is permanently deleted. Which contractual clause is most relevant?

Accepted Answer

Data deletion clause. Data deletion clauses specify the provider's obligation to delete customer data, including from backups, upon termination.

Answer

Service Level Agreement

Answer

Data portability clause

Answer

Right to audit clause

Question 11

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

Accepted Answer

Use a secrets management service such as HashiCorp Vault to inject secrets at runtime.. A secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Answer

Hardcode secrets in the application code and obfuscate with encryption.

Answer

Pass secrets as environment variables during container deployment.

Answer

Store secrets in a separate configuration file within the image.

Question 12

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

Accepted Answer

Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.. IAM policies can enforce preventive controls by denying the ec2:AuthorizeSecurityGroupIngress action when the CIDR is 0.0.0.0/0, which blocks the action at the API level before any rule is created. This is a preventive control because it stops the insecure configuration from being applied, rather than detecting or remediating it after the fact. By attaching this policy to developer roles, the team ensures that even if a developer attempts to add an overly permissive SSH rule, the request is denied by AWS IAM.

Answer

Grant developers full access to EC2 and rely on training.

Answer

Use AWS Systems Manager to automatically remediate open SSH rules.

Answer

Enable AWS Config rules to detect and alert on open SSH.

Question 13

A cloud customer is migrating a legacy application to a cloud platform. The application currently runs on physical servers and uses local storage. The migration plan involves rehosting the application on virtual machines (VMs) in the cloud. The security team wants to ensure that the VMs are properly hardened before deployment. During the migration testing, the team discovers that the base image used for the VMs contains several unnecessary services and default credentials. The team is concerned that these vulnerabilities could be exploited. The cloud provider offers a shared responsibility model where the customer is responsible for securing the OS. Which of the following is the BEST course of action to address this issue?

Accepted Answer

Create a custom golden image with necessary hardening and approved software only. Creating a custom golden image allows the customer to enforce a hardened baseline that removes unnecessary services, disables default credentials, and includes only approved software before any VM is deployed. This aligns with the shared responsibility model, where the customer controls OS-level security, and prevents vulnerabilities from ever reaching production. Pre-hardening the image is more secure and efficient than fixing issues post-deployment, as it eliminates the window of exposure during initial boot and configuration.

Answer

Deploy the VMs and run vulnerability scans to identify and fix issues after deployment

Answer

Ask the cloud provider to provide a hardened OS image

Answer

Deploy the VMs and manually apply security patches and remove services after deployment

Question 14

A cloud customer is evaluating a provider's service level agreement (SLA) that guarantees 99.99% availability. What is the maximum allowable downtime per year (in minutes) before the SLA is violated?

Accepted Answer

52.56 minutes. 99.99% means 0.01% downtime per year. 365 days * 24 hours * 60 minutes = 525,600 minutes. 0.01% of that is 52.56 minutes, approximately 53 minutes.

Answer

8.76 hours

Answer

5.26 minutes

Answer

87.6 hours

Question 15

A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?

Accepted Answer

Inspecting HTTP traffic for malicious payloads. A WAF operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic for malicious payloads such as SQL injection, cross-site scripting (XSS), and JSON-based attacks. For a REST API using JSON, the WAF can parse and validate the JSON structure, blocking malformed or malicious payloads before they reach the application server. This is the primary benefit because it directly protects the application logic from web-based exploits.

Answer

Scanning for data loss prevention (DLP) violations

Answer

Preventing network-layer DDoS attacks

Answer

Encrypting data in transit between client and server