CCSP Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A security analyst finds this IAM policy attached to an S3 bucket. What is the primary security issue?

Accepted Answer

The policy grants public read access to all objects.. Option D is correct because the IAM policy statement includes `"Principal": "*"` and `"Effect": "Allow"` without any condition restricting access, which grants public read access to all objects in the S3 bucket. This violates the principle of least privilege and exposes sensitive data to anyone on the internet, making it a critical security misconfiguration.

Answer

The policy is missing a condition for encryption.

Answer

The policy does not specify a source IP.

Answer

The policy allows all actions.

Question 2

Refer to the exhibit. A security engineer attaches this bucket policy to an S3 bucket. What does this policy accomplish?

Accepted Answer

It denies all requests to the bucket that are not using HTTPS.. The bucket policy uses a `Condition` block with `aws:SecureTransport` set to `false` and an explicit `Deny` effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit. The `NotPrincipal` and `NotAction` elements are used to apply the denial broadly, but the core effect is to block non-HTTPS requests.

Answer

It allows only requests from a specific VPC endpoint.

Answer

It denies requests from IP addresses outside a specific range.

Answer

It denies all requests to the bucket.

Question 3

Refer to the exhibit. A cloud administrator sees this error when trying to provision an EC2 instance. Which is the best course of action?

Accepted Answer

Launch the instance in a different Availability Zone.. The error indicates an 'InsufficientInstanceCapacity' failure, which means the specific Availability Zone lacks enough resources (e.g., CPU, memory, or network capacity) to launch the requested EC2 instance type. The best course of action is to launch the instance in a different Availability Zone within the same region, as capacity constraints are typically zone-specific and not region-wide. This approach avoids unnecessary VPC creation or waiting, and it directly addresses the resource scarcity at the zone level.

Answer

Create a new VPC and try again.

Answer

Wait 24 hours for capacity to become available.

Answer

Increase the instance size to a larger type.

Question 4

Which THREE components are essential for establishing a secure baseline configuration for a cloud virtual machine? (Choose three.)

Accepted Answer

Removing unnecessary software and services from the OS.. Option B is correct because removing unnecessary software and services from the OS reduces the attack surface by eliminating potential vulnerabilities and backdoors. A secure baseline configuration must minimize the number of running components to only those required for the VM's intended function, following the principle of least functionality.

Answer

Running applications as a service account.

Answer

Configuring network security groups at the subnet level.

Question 5

A company experiences a security breach in its cloud environment, and the security team needs to preserve evidence for legal proceedings. Which of the following is the MOST important step to take first?

Accepted Answer

Isolate the compromised systems from the network to prevent lateral movement.. Option B is correct because the immediate priority in a cloud security incident is to contain the breach and prevent lateral movement, which preserves the integrity of the evidence by stopping further compromise. Isolating compromised systems (e.g., via network security groups or virtual network segmentation) ensures that volatile data, such as memory contents and active connections, is not altered by ongoing attacker activity. This step aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before evidence collection.

Answer

Disable all logging to prevent the attacker from seeing detection efforts.

Answer

Notify all affected customers of the breach.

Answer

Contact the legal department to obtain a warrant before any action.

Question 6

A cloud administrator is configuring log retention for a financial application that must comply with PCI DSS. What is the minimum log retention period required by PCI DSS?

Accepted Answer

At least one year with the most recent three months available online.. PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.

Answer

At least 90 days.

Answer

At least six months.

Answer

At least five years.

Question 7

An organization uses a cloud key management service (KMS) for encryption keys. The security policy requires automatic rotation of keys every 90 days. Which rotation strategy best balances security and operational impact?

Accepted Answer

Configure the KMS to automatically generate new key versions and retire old ones with no application changes.. Option C is correct because cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.

Answer

Retain the original key for decryption and use a new key only for new data.

Answer

Have administrators manually create new keys every 90 days and update applications.

Answer

Re-encrypt all data with a new master key each rotation to ensure full key separation.

Question 8

Which THREE of the following are effective strategies for ensuring data backup integrity and recoverability in the cloud?

Accepted Answer

Maintain at least three copies of data across two different locations.. Option A is correct because the 3-2-1 backup rule (three copies, two different media types, one offsite) is a foundational strategy for data durability and recoverability. In cloud environments, this typically means maintaining a primary copy, a local backup in a different availability zone, and a cross-region copy to protect against region-wide failures. This ensures that even if two copies are compromised, a third remains available for recovery.

Answer

Encrypt all backups with a strong algorithm.

Answer

Set backup schedules to run daily for all critical data.

Question 9

Refer to the exhibit. An IAM policy is attached to a user. Which action is the user allowed to perform?

Accepted Answer

Read an existing object from the bucket.. The IAM policy grants the `s3:GetObject` action, which allows the user to read (download) an existing object from the specified S3 bucket. The policy explicitly allows this action for the bucket `my-bucket` and its objects, so the user can perform read operations on objects within that bucket.

Answer

Change the bucket's policy.

Answer

Upload a new object to the bucket.

Answer

Delete an object from the bucket.

Question 10

A global e-commerce platform uses AWS API Gateway to expose REST APIs to third-party developers. The security team notices that a malicious user is repeatedly sending large payloads to a /submit endpoint, causing high CPU usage on backend Lambda functions. The API uses a simple API key for authentication. Which combination of controls should be implemented to mitigate this attack while preserving legitimate access?

Accepted Answer

Configure API Gateway throttling and request body size validation. Option A is correct because it directly addresses the two attack vectors: large payloads causing CPU exhaustion and excessive request volume. API Gateway request body size validation (up to 10 MB by default, configurable) rejects oversized payloads before they reach the backend Lambda, while throttling (e.g., 10,000 requests per second with a burst limit) prevents a single user from overwhelming the system. Together, these controls preserve legitimate access by only limiting anomalous traffic, not blocking all users.

Answer

Subscribe to AWS Shield Advanced for DDoS protection

Answer

Change authentication to IAM roles with temporary credentials

Answer

Enable AWS WAF with a rate-based rule and block IP addresses

Question 11

A financial services company deploys a containerized application on Amazon ECS with Fargate. The application needs to access an encrypted RDS database. The security policy mandates that database credentials must never be stored in the application code or configuration files and must be rotated automatically every 90 days. Which solution should the DevOps team implement to satisfy these requirements?

Accepted Answer

Store credentials in AWS Secrets Manager, grant ECS task role access, and enable automatic rotation. AWS Secrets Manager is the correct choice because it is designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 90 days) without storing them in code or configuration. By granting the ECS task role (via IAM) permission to access the secret, the Fargate task can retrieve the credentials at runtime using the AWS SDK or CLI, ensuring they are never hardcoded. This satisfies both the no-storage-in-code and automatic rotation requirements mandated by the security policy.

Answer

Encrypt credentials with AWS KMS and pass them as environment variables during task definition

Answer

Store credentials in AWS Systems Manager Parameter Store (SecureString) and retrieve them at container startup

Answer

Use a secrets vault like Hashicorp Vault deployed on EC2 and mount secrets via sidecar container

Question 12

A multinational corporation operates a cloud-based application that stores customer data across multiple regions to comply with local data residency laws. The application is deployed on virtual machines in a Infrastructure as a Service (IaaS) environment. Recently, the compliance team discovered that some user data from the European region was accidentally stored in a storage bucket located in the United States due to a misconfigured storage class. The company needs to immediately ensure that no further data breaches occur and that all future data storage actions comply with regional restrictions. The cloud architect proposes implementing a data loss prevention (DLP) solution, but the compliance team wants a more preventative approach. Which of the following is the BEST course of action to prevent this issue?

Accepted Answer

Use a service control policy (SCP) to deny access to storage resources outside the approved regions.. A service control policy (SCP) can centrally deny access to storage resources in unauthorized regions across the entire organization, providing a preventative control that cannot be overridden by users.

Answer

Configure a network firewall to block traffic to the IP addresses of storage endpoints in unauthorized regions.

Answer

Apply a tag to all storage resources that must remain in a specific region and enable a tag-based policy to enforce location.

Answer

Implement a DLP solution that scans all uploads and rejects those not meeting location requirements.

Question 13

A financial services company is required to maintain audit trails of all user activities in its cloud environment for regulatory compliance. The company uses multiple cloud services and wants a centralized logging solution. The current architecture sends logs to a central storage bucket, but some logs are being lost due to high volume and insufficient throughput. Additionally, the logs must be immutable to prevent tampering. The company needs to ensure that all logs are captured and stored in a tamper-proof manner. Which of the following solutions BEST meets the requirements?

Accepted Answer

Configure the cloud provider's logging service to send logs to a dedicated bucket with versioning and object lock enabled, and set a high throughput.. Option A is correct because enabling Object Lock with retention modes (Governance or Compliance) on the cloud storage bucket ensures immutability, preventing log tampering. Versioning provides an additional safeguard by preserving all object versions, and configuring a high throughput setting (e.g., increasing the bucket's request rate limits or using a dedicated endpoint) addresses the log loss due to insufficient throughput.

Answer

Cache logs locally on each server and have a background job upload them to a bucket.

Answer

Use multiple log streams with different destinations and aggregate them using a third-party SIEM.

Answer

Use a message queue to decouple log generation from storage, and store logs in a bucket with immutability settings.

Question 14

A cloud security architect is designing a data classification and labeling solution for a multinational corporation with offices in multiple countries. The corporation uses various SaaS applications (Office 365, Salesforce, etc.) and IaaS services. They require automatic classification of documents based on content (e.g., credit card numbers, social security numbers) and enforcement of protection policies (e.g., encryption, access restrictions) based on the classification. The solution must work across all cloud services and provide a unified management console. The corporation also needs to maintain data residency—data must not be stored in a different geographic region than where it was classified. Which cloud security solution BEST meets these requirements?

Accepted Answer

Deploy a cloud access security broker (CASB) with integrated DLP capabilities that can classify and enforce policies across multiple cloud apps.. Option A is correct. A CASB with integrated DLP can classify content across multiple cloud apps and enforce policies from a single console, while also supporting data residency through policy configuration. Option B lacks unified management. Option C is complex and may not scale. Option D does not provide classification.

Answer

Use each cloud provider's native DLP service (e.g., Microsoft Information Protection, AWS Macie) and manage them individually.

Answer

Use a third-party encryption gateway that encrypts all data leaving the on-premises network.

Answer

Implement a custom data classification system running on a virtual machine that inspects data via APIs.

Question 15

A cloud security engineer is responsible for a SaaS application hosted on a public cloud provider. The application uses a relational database to store customer data. The security team recently conducted a vulnerability assessment and discovered that the database can be accessed over the internet without any network restrictions. Additionally, the database admin user has the same password as the root account, and the password has not been changed in 18 months. The company is subject to GDPR and PCI DSS compliance requirements. The engineer needs to remediate these issues immediately. Which of the following actions should be taken FIRST?

Accepted Answer

Configure the database security group to allow traffic only from the application server's IP address range.. Option B is correct because restricting network access to authorized sources only is the most immediate way to reduce the attack surface and prevent unauthorized access over the internet. Option A is wrong because changing the password is important but should follow the network restriction to ensure the database is not exposed during the change. Option C is wrong while enabling encryption is a best practice, it does not prevent an attacker from connecting directly. Option D is wrong because upgrading the database might not be immediately available and does not address the access issue.

Answer

Change the database admin password to a complex new password immediately.

Answer

Upgrade the database to the latest version with all security patches applied.

Answer

Enable encryption at rest for the database to protect the data if it is stolen.

CCSP Practice Test 36 — 15 Questions

Exhibit

CCSP Practice Test 36 — 15 Questions

Exhibit