CCSP Practice Test 37 — 15 Questions

Question 1

During a cloud security incident, the incident response team needs to contain a compromised cloud instance. Which action should be taken FIRST to prevent further malicious activity while preserving evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the network security rule associated with the instance to deny all traffic.. Modifying the network security rule to deny all traffic immediately isolates the compromised cloud instance, preventing further malicious network activity while preserving the instance's state for forensic analysis. This containment step is reversible and does not destroy volatile data or system processes, unlike termination or snapshot creation, which can alter evidence.

Answer

Revoke the role associated with the instance.

Answer

Create a snapshot of the instance volume for forensic analysis.

Answer

Terminate the instance immediately.

Question 2

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 3

Which TWO of the following are effective strategies for protecting sensitive data in a public cloud environment?

Accepted Answer

Data masking to obscure sensitive fields in non-production environments.. Data masking (option D) and tokenization (option E) are both effective data protection techniques for public cloud environments. Data masking obscures sensitive fields in non-production environments, while tokenization replaces sensitive data with non-sensitive placeholders. Options A, B, and C are insecure or poor practices.

Answer

Using the same encryption key for all data to simplify key management.

Answer

Storing encryption keys in the same storage bucket as the encrypted data.

Answer

Consolidating all sensitive data into a single storage bucket for easier management.

Question 4

A cloud architect is designing a multi-cloud solution that must maintain high availability and disaster recovery across two cloud providers. Which three key considerations should be included in the architecture? (Choose three.)

Accepted Answer

Rely on each provider's native high-availability features.. Relying on each provider's native high-availability features (e.g., AWS Auto Scaling and Multi-AZ deployments, Azure Availability Zones) allows the architecture to leverage built-in fault tolerance and automatic failover within each cloud. This avoids reinventing the wheel and ensures that each provider handles its own infrastructure failures, which is a foundational principle for multi-cloud HA/DR design.

Answer

Use a single networking interface to simplify connectivity.

Answer

Use a single DNS provider for failover.

Question 5

A company uses a hybrid cloud model where sensitive data resides in a private cloud, while compute-intensive analytics run in a public cloud using anonymized data. What is the primary security consideration for this architecture?

Accepted Answer

Maintaining consistent security policies and secure connectivity between environments. In hybrid cloud, consistent security policies must apply across both environments, and secure connectivity (e.g., VPN or dedicated connection) is essential to protect data in transit and prevent leakage.

Answer

Using the same hypervisor in both clouds

Answer

Implementing network segmentation only in the public cloud

Answer

Ensuring the public cloud provider has SOC 2 certification

Question 6

A customer requires complete control over encryption keys used to protect data at rest in the cloud. Which cloud service model provides the most direct control?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS gives customers control over the entire infrastructure stack, including encryption key management. PaaS and SaaS abstract away much of that control, limiting customer-managed key options.

Answer

Anything as a Service (XaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 7

A cloud security team needs to implement a logging strategy that captures user activity, API calls, and resource changes across multiple cloud services. The logs must be tamper-proof and retained for at least one year. Which combination of actions best meets these requirements?

Accepted Answer

Centralize logs into a dedicated log archive account with write-once-read-many (WORM) storage and enable anomaly detection alerts.. Centralizing logs into a dedicated log archive account with WORM (write-once-read-many) storage ensures tamper-proof retention for at least one year, and enabling anomaly detection alerts provides real-time security monitoring. Option A is incorrect because while streaming to a SIEM is good practice, retaining raw logs on standard storage does not guarantee immutability; logs could be modified or deleted. Option B is incorrect because encrypting logs at rest only protects confidentiality, not integrity; a centralized log management system without WORM may allow tampering. Option C is incorrect because using separate logging accounts for each service creates silos, increases management complexity, and does not inherently provide tamper-proof storage; logs could be altered within individual accounts.

Answer

Stream all logs to a Security Information and Event Management (SIEM) system and retain raw logs for one year on standard storage.

Answer

Enable logging for all services, encrypt logs at rest, and store them in a centralized log management system.

Answer

Use separate logging accounts for each cloud service and retain logs in their native format.

Question 8

A cloud security administrator is reviewing the security controls for a SaaS application. Which of the following are typically the responsibility of the cloud customer (tenant) in a SaaS model? (Choose two.)

Accepted Answer

Managing user access and identity. In a SaaS model, the customer is responsible for managing user access and identity (B) and data classification and encryption at rest (E). The provider handles physical security (A), network infrastructure security (C), and patching the underlying operating system (D).

Answer

Physical security of data center

Answer

Network infrastructure security

Answer

Patching the underlying operating system

Question 9

A cloud security architect is designing a forensics capability for a multi-tenant infrastructure-as-a-service (IaaS) environment. Which of the following is the MOST significant challenge when performing forensic acquisition of virtual machine (VM) memory?

Accepted Answer

Inability to access the hypervisor-level memory of other tenants due to isolation. In a multi-tenant IaaS environment, the most significant challenge for forensic acquisition of VM memory is the inability to access the hypervisor-level memory of other tenants due to the strong isolation boundaries enforced by the cloud provider. Option A is not the most significant because memory acquisition overhead is typically manageable and can be performed with tools. Option C is true that memory content is volatile, but the primary challenge for acquisition is access, not volatility. Option D is less significant because tools for capturing memory from running VMs (e.g., LiME) do exist; the real constraint is that the cloud provider restricts tenant access to hypervisor-level memory for security and multi-tenancy isolation.

Answer

High performance overhead caused by memory acquisition

Answer

Memory content is not available after the VM is powered off

Answer

Lack of tools that can capture memory from a running VM in the cloud

Question 10

A company has deployed a mission-critical application in the cloud and needs to ensure that it remains available even if an entire cloud region fails. Which architecture pattern should they adopt?

Accepted Answer

Active-passive across regions. (active-passive across regions) is correct because this architecture ensures that if an entire cloud region fails, the passive standby in another region can take over, providing disaster recovery and high availability. Option A (regular backups to a different region) provides data recovery but not immediate failover or service continuity. Option C (vertical scaling within a single region) increases capacity but does not protect against region failure. Option D (horizontal scaling within a single availability zone) improves scalability within a zone but does not address region-level outages.

Answer

Regular backups to a different region

Answer

Vertical scaling within a single region

Answer

Horizontal scaling within a single availability zone

Question 11

An incident response team is investigating a potential breach in a cloud environment. They have collected logs from various sources. Which of the following is the MOST critical factor to ensure the admissibility of digital evidence in court?

Accepted Answer

Maintaining a documented chain of custody for all evidence. Maintaining the chain of custody ensures evidence integrity and admissibility. Option B is wrong while important for investigation, admissibility depends on custody. Option C is wrong because logs may not be original but certified copies can be used if chain of custody is maintained. Option D is wrong because encryption does not guarantee authenticity.

Answer

Encrypting all evidence during collection and transport

Answer

Using automated tools for log analysis

Answer

Ensuring logs are in their original format

Question 12

A healthcare organization is migrating patient data to a public cloud. Which legal framework most directly governs the protection of this data?

Accepted Answer

Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to protected health information (PHI) in the US, making it the most directly relevant legal framework for healthcare data. GDPR is broader but less specific to US healthcare, and PCI DSS is for payment card data.

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Answer

Sarbanes-Oxley Act (SOX)

Answer

General Data Protection Regulation (GDPR)

Question 13

A company is required to retain logs for 7 years per regulation. The cloud provider's default retention is 90 days. What is the most effective approach?

Accepted Answer

Export logs to an external storage with a 7-year retention policy. The customer is responsible for compliance. Configuring log export to an external storage with 7-year retention ensures data is preserved. Relying on provider's default violates regulation, disabling retention breaks compliance, and encryption doesn't affect retention duration.

Answer

Disable log retention completely to avoid risk

Answer

Rely on the provider's default retention

Answer

Encrypt logs and store them in the same provider

Question 14

A global e-commerce company must store customer payment data in a specific geographic region to comply with local data residency laws. Which cloud configuration ensures that data never leaves the required region?

Accepted Answer

Select a specific cloud region for the storage and disable cross-region replication. Data residency is achieved by selecting a cloud region (e.g., 'EU-West-1') and configuring storage buckets or databases with region-specific policies. Additionally, bucket policies can explicitly deny access from outside the region, and replication features should be disabled or configured to stay within the region.

Answer

Use a global load balancer to route traffic

Answer

Enable cross-region replication to a secondary region for disaster recovery

Answer

Store data in a private cloud on-premises

Question 15

Which of the following is a key consideration when defining a cloud provider's liability for data breaches?

Accepted Answer

The limitation of liability clause in the contract. The limitation of liability clause in the contract defines the maximum liability of the provider in the event of a breach. Provider's insurance, incident response plan, and history of breaches may influence negotiations but are not the contractual definition of liability.

Answer

The provider's incident response plan

Answer

The provider's insurance policy limits

Answer

The number of previous breaches