CCSP Practice Test 35 — 15 Questions

Question 1

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the service account key. The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Answer

Create a new service account

Answer

Delete the service account

Answer

Rotate the key and monitor

Question 2

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines five essential characteristics of cloud computing, and broad network access (A) is one of them because capabilities must be available over the network through standard mechanisms that promote use by heterogeneous thin or thick client platforms. On-demand self-service (B) is also essential, as consumers must be able to unilaterally provision computing capabilities such as server time and network storage automatically without requiring human interaction with each service provider. Rapid elasticity (E) is the third correct characteristic, since capabilities must be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. Location independence (C) is not one of the five NIST essential characteristics, although resource pooling does mention that resources are pooled and location-independent in a multi-tenant model. Dedicated hardware per tenant (D) is incorrect because cloud computing relies on resource pooling with multi-tenancy, not dedicated hardware per tenant.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 3

A small business recently migrated its file server to a cloud storage service like Amazon S3. They use bucket policies to control access. The IT manager, who is not a security expert, configured the bucket policy to allow all users within the company's AWS account to have read and write access. During an internal audit, it was discovered that the bucket also had a public ACL that allowed 'Everyone' to read objects. The security analyst needs to fix the misconfiguration and prevent future occurrences. Which of the following actions should the analyst take first?

Accepted Answer

Remove the public ACL and update the bucket policy to enforce least privilege.. The immediate priority is to remediate the active vulnerability by removing the public ACL that grants 'Everyone' read access, then updating the bucket policy to enforce least privilege for the company's AWS account. This directly addresses the misconfiguration and aligns with the principle of denying public access by default, which is a core security best practice for cloud storage services like Amazon S3.

Answer

Delete the bucket and recreate it with default private settings.

Answer

Set up a notification to alert when bucket policies change.

Answer

Enable bucket versioning to recover from accidental public exposure.

Question 4

A cloud security analyst is reviewing access logs and notices that a pre-signed URL for an object was used after its expiration time. What should be the outcome of such an access attempt?

Accepted Answer

The request is denied with an access denied error. Pre-signed URLs embed an expiration timestamp (the X-Amz-Expires parameter, capped at 7 days for SigV4) that the storage service validates on every request. Once the current time exceeds that expiry, the signature is treated as invalid and the service returns HTTP 403 AccessDenied. The credentials used to generate the URL are irrelevant at access time — only the signed expiry governs validity.

Answer

The request is redirected to a new URL automatically

Answer

The request is allowed because the URL was generated with valid credentials

Answer

The request is logged but still granted

Question 5

An organization is evaluating a cloud provider's SLA for a critical application. The provider offers a 99.95% uptime SLA with a 10% service credit for each 30-minute downtime period exceeding the threshold. The organization's business impact analysis requires a maximum downtime of 4.38 hours per year. Does the provider's SLA meet this requirement, and what is the annual allowed downtime based on the SLA?

Accepted Answer

Yes, because the SLA guarantees 99.95% uptime, which equals 4.38 hours of downtime per year.. 99.95% uptime translates to 0.05% of a year. A standard 365-day year has 8,760 hours, so 8,760 × 0.0005 = 4.38 hours of allowed downtime per year. Since the business impact analysis requires a maximum of 4.38 hours, the SLA exactly meets the requirement. The 10% service credit is a financial remedy, not an uptime guarantee, so it does not change the calculation.

Answer

No, because service credits only apply after 30 minutes of downtime, so actual uptime is lower.

Answer

Yes, because the 10% credit effectively increases the uptime commitment.

Answer

No, because 99.95% uptime allows 5 hours of downtime per year.

Question 6

A SOC analyst notices an alert for 'impossible travel' where a user logged in from New York and then from London within 15 minutes. The SIEM correlation rule likely compares which log fields?

Accepted Answer

Source IP address and timestamp. Impossible travel detection correlates the geographic location derived from the source IP address with the login timestamp to compute whether the physical distance between two logins could be traveled in the elapsed time. If the implied speed exceeds a threshold (e.g., faster than commercial air travel), the SIEM flags the event as impossible travel.

Answer

User agent and browser type

Answer

Destination IP and port

Answer

Volume of data transferred and timestamp

Question 7

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

Accepted Answer

Sub-processor authorization. GDPR requires that data controllers obtain prior authorization before a processor engages a sub-processor. The customer (controller) was not notified, violating the requirement for sub-processor authorization. Other rights like erasure are unrelated to this scenario.

Answer

Data protection by design

Answer

Data breach notification

Answer

Right to erasure

Question 8

A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?

Accepted Answer

Support for open APIs and industry standards. Option A is correct because support for open APIs and industry standards directly enables portability, allowing the company to avoid vendor lock-in and migrate or integrate workloads across providers using well-defined interfaces. Option B is correct because independent audit reports such as SOC 2 and ISO 27001 provide verifiable assurance that the provider's security, availability, and operational controls meet recognized compliance frameworks, which is essential for a critical workload. Option D is correct because SLA guarantees for uptime and availability define the provider's contractual commitment to high availability and provide measurable remedies if service levels are missed, directly supporting the HA/DR requirement. Option C is not a primary evaluation factor here because customer support tiers affect responsiveness and service experience but do not by themselves deliver high availability, disaster recovery, or portability. Option E is also not a primary factor because the number of data center locations alone does not guarantee HA/DR or portability; what matters is how those locations are architected, replicated, and exposed through standards and SLAs.

Answer

Provider's customer support tiers

Answer

Number of data center locations

Question 9

Which TWO of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Measured service. NIST SP 800-145 defines five essential characteristics of cloud computing, and 'Measured service' (A) is one of them: cloud systems automatically control and optimize resource use via metering capabilities, providing transparency for both provider and consumer. 'Resource pooling' (E) is also an essential characteristic, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with resources dynamically assigned and reassigned according to demand. Multitenancy (B) is a consequence of resource pooling but is not itself listed as a separate essential characteristic in NIST SP 800-145. Virtualization (C) is a common enabling technology for cloud computing but is not one of the five NIST essential characteristics. Auditability (D) is a desirable governance property but is not included in the NIST definition of essential cloud characteristics.

Answer

Multitenancy

Answer

Virtualization

Answer

Auditability

Question 10

Which of the following is a key requirement for data portability under the General Data Protection Regulation (GDPR)?

Accepted Answer

Data must be provided in a structured, commonly used, and machine-readable format.. GDPR Article 20 requires that when data portability applies, the controller must provide the personal data 'in a structured, commonly used and machine-readable format.' This ensures the data can be transmitted to another controller without hindrance, typically using formats such as JSON, XML, or CSV. The right applies to data processed by automated means based on consent or contract.

Answer

Data must be transferred directly to the data subject's own device.

Answer

Data portability applies only to pseudonymized data.

Answer

Data must be deleted within 30 days of a portability request.

Question 11

A multinational corporation must comply with GDPR and local data residency laws. They are designing a cloud storage architecture that will store customer data in the EU region. However, to improve disaster recovery, they want to replicate data to a secondary region outside the EU. Which approach meets compliance requirements?

Accepted Answer

Use same-region replication within the EU and disable cross-region replication. GDPR and data residency laws restrict transferring EU personal data to non-EU regions without an adequate legal mechanism, and cross-region replication to a non-EU region constitutes such a transfer. Keeping replication within the EU (same-region or intra-EU) and disabling cross-region replication to non-EU locations satisfies residency while still providing redundancy. This is the only option that avoids an unlawful transfer entirely.

Answer

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Answer

Use cross-region replication to a US region and encrypt data with SSE-S3

Answer

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Question 12

During a security review of a serverless application, you notice that a Lambda function's execution role has permissions to delete all S3 buckets in the account. What is the most appropriate remediation to align with the principle of least privilege?

Accepted Answer

Create a custom IAM role that grants only the necessary actions on a specific S3 bucket. The correct remediation is to replace the overly permissive execution role with a custom IAM role scoped to only the specific S3 actions and the specific bucket the Lambda function actually needs. This directly enforces least privilege by eliminating the wildcard delete permissions across all buckets. AWS IAM evaluates the policy attached to the Lambda execution role on every API call, so narrowing the Resource ARN and Action list constrains the blast radius if the function is compromised.

Answer

Store S3 bucket names in environment variables instead of hardcoding

Answer

Attach the AWS managed policy 'AmazonS3ReadOnlyAccess'

Answer

Remove the Lambda function's VPC integration

Question 13

A cloud customer is negotiating a contract and wants to ensure they have the right to verify the cloud provider's security controls. Which contractual provision is most important?

Accepted Answer

Right to audit clause. The right to audit clause is a contractual provision that grants the cloud customer the ability to verify the provider's security controls, either through direct audits or by accepting third-party audit reports. It is essential for ensuring compliance and trust in the cloud provider's security posture.

Answer

Data portability clause

Answer

Data deletion clause

Answer

Service Level Agreement (SLA) for uptime

Question 14

During a supply chain security review, a team discovers that container images are not being verified at admission time. Which Kubernetes-native tool should be implemented to ensure only signed images are deployed?

Accepted Answer

Admission controller (e.g., Kyverno) with image signature verification. An admission controller like OPA Gatekeeper or Kyverno can enforce policies that verify image signatures before allowing pod creation.

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Answer

ResourceQuota

Question 15

A company is implementing a SIEM solution and needs to ingest security logs from multiple AWS accounts into a centralized security account. Which AWS service can best aggregate findings from all accounts?

Accepted Answer

AWS Security Hub. AWS Security Hub is purpose-built to aggregate and normalize findings from multiple AWS accounts and services (GuardDuty, Inspector, Macie, Config, Firewall Manager, and third-party tools) into a single pane of glass. Using AWS Organizations integration, a delegated administrator account can centrally view and manage findings across all member accounts, which is exactly the SIEM-ingestion pattern described.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config