CCSP Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A security analyst discovers this bucket policy attached to an S3 bucket containing sensitive customer data. What is the MOST significant security risk posed by this policy?

Accepted Answer

The policy allows any AWS user to read objects if they are within the specified IP range.. The policy allows any AWS user (Principal: "*") to read objects if they are from the specified IP range. This is overly permissive, granting access to the entire internet at that range, which could include malicious actors. The condition is correctly applied (B is false), encryption is not the main issue (C), and NotPrincipal is not required (D).

Answer

The policy does not require encryption in transit, so data could be intercepted.

Answer

The Condition block is misconfigured and will allow access from any IP address.

Answer

The policy does not include a NotPrincipal element to restrict access further.

Question 2

A company is implementing a SIEM solution and needs to ingest security logs from multiple AWS accounts into a centralized security account. Which AWS service can best aggregate findings from all accounts?

Accepted Answer

AWS Security Hub. AWS Security Hub can be enabled in multiple accounts and configured to send findings to a central administrator account, enabling cross-account aggregation.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

Refer to the exhibit. A cloud administrator is reviewing this storage access policy. What is the most significant security concern?

Accepted Answer

The policy grants access to the entire cloud account administrator [CORRECT]. Granting access to the account administrator of a cloud account is a major security risk because the administrator has unrestricted access and bypasses access management controls. While the policy lacks conditions and allows read access, the principal being the administrator is the most critical issue.

Answer

The policy does not include a condition for encryption [wrong]

Answer

The policy allows read access to the entire storage container [wrong]

Answer

The policy does not specify a source IP [wrong]

Question 4

Which TWO are effective strategies for securing cloud application data at rest?

Accepted Answer

File-level encryption. File-level encryption (C) encrypts individual files or directories, ensuring that data at rest remains protected even if the underlying storage is compromised. This is a direct data-at-rest security control because it applies cryptographic protection to the data itself, independent of the storage layer. Transparent data encryption (D) encrypts data at the database level, typically at the page or file level, without requiring changes to the application, making it another effective strategy for securing data at rest.

Answer

Role-based access control

Answer

Database activity monitoring

Answer

Network segmentation

Question 5

A company is migrating its customer database to a cloud object storage service. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that the company retains exclusive control over the encryption keys. Which solution BEST meets these requirements?

Accepted Answer

Use client-side encryption with customer-managed keys stored on-premises.. Client-side encryption with customer-managed keys stored on-premises ensures that the encryption keys never leave the company's control, and the data is encrypted before it is uploaded to the cloud object storage service. This satisfies both the requirement for encryption at rest and exclusive key control, as the cloud provider never has access to the plaintext keys or the ability to decrypt the data.

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Answer

Use SSL/TLS encryption for data in transit only.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Question 6

A company is implementing a software-defined perimeter (SDP) for their cloud environment. Which THREE characteristics are typical of an SDP? (Choose three.)

Accepted Answer

Dynamic firewall rules based on user identity.. Software-defined perimeter (SDP) architecture uses dynamic firewall rules that are created on-the-fly based on user identity and device posture, rather than static IP addresses. The SDP controller authenticates the user and then dynamically provisions a firewall rule to allow the user's specific IP address to access the requested application, ensuring zero-trust network access.

Answer

Static IP whitelisting.

Answer

Single-factor authentication.

Question 7

Which THREE of the following are key components of a cloud data governance framework?

Accepted Answer

Data retention policies. Data retention policies are a key component of a cloud data governance framework because they define the lifecycle of data, specifying how long data must be kept and when it should be securely deleted. This ensures compliance with legal, regulatory, and business requirements, such as GDPR or HIPAA, and prevents unnecessary storage costs and security risks from outdated data.

Answer

Data masking

Answer

Data encryption at rest

Question 8

An organization is implementing automated remediation for common cloud security misconfigurations using AWS Config and Lambda. Which THREE misconfigurations can be automatically remediated using this approach?

Accepted Answer

S3 bucket with public read access. AWS Config can evaluate S3 bucket public read access against a managed rule (s3-bucket-public-read-prohibited) and trigger a Lambda function to apply a bucket policy that blocks public access. This is a common automated remediation pattern because the fix is deterministic and can be applied via the AWS SDK without manual intervention.

Answer

EC2 instance type not compliant with corporate standard

Answer

VPC with default security group allowing all traffic

Question 9

A cloud security team implements correlation rules in their SIEM to detect 'impossible travel' scenarios. Which combination of log sources is essential for detecting a user logging in from two different countries within a short time frame?

Accepted Answer

CloudTrail management events and AWS CloudTrail authentication events. Detecting impossible travel requires authentication logs (who logged in and from where) and timestamps. Cloud provider authentication logs (e.g., AWS CloudTrail for console logins, Azure AD sign-in logs) provide the necessary data.

Answer

Amazon GuardDuty findings and Security Hub

Answer

AWS Config history and resource inventory

Answer

VPC Flow Logs and DNS logs

Question 10

Which of the following is a key practice for secure management of cloud credentials in application code?

Accepted Answer

Use IAM roles or managed identities. Using IAM roles or managed identities eliminates the need to embed long-term credentials in application code. This approach relies on temporary, automatically rotated credentials obtained via the cloud provider's metadata service (e.g., AWS IMDSv2, Azure Instance Metadata Service), which significantly reduces the risk of credential leakage and simplifies credential management.

Answer

Hardcode credentials in environment variables

Answer

Store credentials in source code comments

Answer

Encrypt credentials with a static key in the codebase

Question 11

What is the primary purpose of a Software Bill of Materials (SBOM) in cloud application security?

Accepted Answer

To list all third-party components and dependencies. The primary purpose of a Software Bill of Materials (SBOM) is to provide a formal, machine-readable inventory of all third-party components, libraries, and dependencies used in a cloud application. This enables automated vulnerability scanning, license compliance checks, and supply chain risk management, which are critical for securing cloud-native applications against known exploits in transitive dependencies.

Answer

To track user access permissions

Answer

To monitor runtime application performance

Answer

To document the software architecture

Question 12

A cloud security team wants to automatically block malicious requests to a web application before they reach the application servers. Which solution should they implement?

Accepted Answer

Cloud Web Application Firewall (WAF). A Cloud Web Application Firewall (WAF) is the correct solution because it operates at the application layer (Layer 7) to inspect HTTP/HTTPS traffic and block malicious requests—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—before they reach the application servers. Unlike an IDS, a WAF can actively block traffic in real time, and it is deployed at the network edge or cloud gateway, providing inline prevention without requiring changes to the application code.

Answer

Intrusion Detection System (IDS)

Answer

Runtime Application Self-Protection (RASP)

Answer

Static Application Security Testing (SAST)

Question 13

Which security testing approach is most effective at identifying vulnerabilities early in the cloud software development lifecycle (SDLC) by analyzing source code without executing the application?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) is the correct approach because it analyzes source code, bytecode, or binary code without executing the application, making it ideal for identifying vulnerabilities early in the SDLC (shift-left). Unlike dynamic or runtime tools, SAST scans the codebase statically, catching issues like SQL injection, buffer overflows, and insecure cryptographic implementations before compilation or deployment.

Answer

Interactive Application Security Testing (IAST)

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Question 14

A developer accidentally hardcodes AWS access keys in a public GitHub repository. Which tool is specifically designed to detect such secrets in code repositories?

Accepted Answer

GitGuardian. GitGuardian is a purpose-built tool for detecting secrets (e.g., AWS access keys, API tokens) in code repositories, including public GitHub repos. It scans commit history and uses pattern matching to identify hardcoded credentials, alerting developers in real time. This directly addresses the scenario of accidental exposure in a public repository.

Answer

Checkov

Answer

Snyk

Answer

tfsec

Question 15

A security engineer is reviewing a cloud application that uses AWS S3 buckets. Which vulnerability is most specific to cloud environments and is often exploited to access sensitive data?

Accepted Answer

Exposed S3 buckets with public read access. Exposed S3 buckets with public read access are a cloud-specific misconfiguration vulnerability because they rely on the AWS S3 bucket policy or ACL settings that grant unauthenticated access to objects. Unlike traditional on-premises vulnerabilities, this arises from improper cloud resource configuration, allowing attackers to enumerate and download sensitive data directly via HTTP/HTTPS requests without any authentication.

Answer

Buffer overflow

Answer

SQL injection

Answer

Cross-site scripting (XSS)