CCSP Practice Test 37 — 15 Questions

Question 1

A company uses a cloud KMS service with an HSM backing for key storage. The security policy requires that keys be rotated automatically every 90 days and that old keys be retained for at least one year to decrypt archived data. Which key management feature should be configured to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Key versioning with rotation schedule. Key versioning with a rotation schedule allows the KMS to automatically rotate keys every 90 days while retaining old key versions for decryption of archived data. Each rotation creates a new key version, and old versions remain available for decryption but are not used for new encryption. This meets both the rotation and retention requirements without manual intervention.

Answer

Key hierarchy with root key separation

Answer

Key policy with conditions for automatic rotation

Answer

Key import with manual rotation

Question 2

A cloud operations team is implementing a disaster recovery plan. Which of the following are valid strategies for data replication in a cloud environment? (Choose three.)

Accepted Answer

Asynchronous replication across regions. Asynchronous replication across regions is a valid DR strategy because it allows data to be copied to a geographically distant region without requiring an immediate acknowledgment from the target, which minimizes latency impact on the primary site. This approach is suitable for cloud environments where recovery point objectives (RPOs) of minutes to hours are acceptable, and it leverages the cloud provider's high-latency inter-region network links without stalling write operations.

Answer

Periodic snapshots to object storage

Answer

Active-active replication with load balancing

Question 3

Which NIST-defined cloud characteristic ensures that resources can be scaled up and down rapidly based on demand?

Accepted Answer

Rapid elasticity. Rapid elasticity is the NIST-defined essential characteristic that allows cloud resources to be provisioned and released automatically, scaling outward and inward commensurate with demand. It enables the cloud consumer to scale capabilities elastically, often in near real-time, without human intervention. This characteristic directly addresses the ability to scale up and down rapidly based on demand, as stated in the question.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 4

A financial services company uses a cloud DLP API to scan data stored in Cloud Storage and BigQuery. They need to reduce the risk of exposing credit card numbers in reports by replacing the first 12 digits with asterisks while preserving the last four. Which de-identification technique should they apply?

Accepted Answer

Masking. Masking replaces sensitive data with a redacted or partially obscured version while preserving the format and often the last few characters for referential purposes. Replacing the first 12 digits of a credit card number with asterisks while keeping the last four is the textbook definition of masking — it preserves usability (e.g., for customer service verification) while removing the sensitive payload. Cloud DLP APIs such as Google Cloud DLP provide a masking transformation (e.g., 'maskingCharacter' with 'numberToMask') that performs exactly this operation.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 5

Which characteristic of cloud computing allows a user to automatically provision computing resources without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the essential cloud characteristic that enables a consumer to unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This is exactly what the question describes: automatic provisioning without human interaction. Rapid elasticity, broad network access, and resource pooling are related but distinct characteristics that do not specifically address the automatic provisioning aspect.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 6

A company wants to migrate its customer relationship management (CRM) system to the cloud and requires that the provider manages the underlying infrastructure, operating system, and middleware, while the company manages only the application and data. Which cloud service model best meets these requirements?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a managed platform where the provider handles the underlying infrastructure, operating system, and middleware (runtime, databases, web servers), while the customer manages only the application and data. This exactly matches the requirement that the company manages only the application and data. Examples include AWS Elastic Beanstalk, Google App Engine, and Azure App Service.

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 7

Which cloud service model allows customers to manage only their data and user access, while the provider manages everything else including the infrastructure, operating system, and applications?

Accepted Answer

SaaS. SaaS (Software as a Service) is the cloud service model where the provider manages the entire stack — infrastructure, operating system, runtime, middleware, and the application itself — leaving the customer responsible only for their data and user access management. Examples include Microsoft 365, Salesforce, and Google Workspace, where the customer configures users and manages data but never touches the underlying platform.

Answer

IaaS

Answer

CaaS

Answer

PaaS

Question 8

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

Accepted Answer

Implement a software composition analysis (SCA) tool in the pipeline. A Software Composition Analysis (SCA) tool is specifically designed to automatically scan open-source libraries for known vulnerabilities, licensing issues, and version compliance. By integrating SCA into the CI/CD pipeline, the team can enforce a policy that only approved libraries (e.g., those passing a security and license review) are allowed in production builds, blocking unapproved or vulnerable components before deployment.

Answer

Segment the build network to limit internet access

Answer

Perform static code analysis after each build

Answer

Require manual approval for all library updates

Question 9

A company is considering moving its customer relationship management (CRM) system to the cloud. The CRM is accessed through a web browser and the provider handles all maintenance, security, and infrastructure. Which cloud service model is being used?

Accepted Answer

SaaS. SaaS (Software as a Service) is the correct model because the provider delivers a complete, ready-to-use application (the CRM) over the web while managing all underlying infrastructure, platform, security patching, and maintenance. The customer only interacts with the application through a browser and does not manage servers, middleware, or runtime environments. This matches the classic SaaS definition where the consumer uses the provider's application running on cloud infrastructure.

Answer

IaaS

Answer

FaaS

Answer

PaaS

Question 10

A healthcare company stores patient records in a cloud storage bucket. They need to encrypt the data at rest using encryption keys that they manage themselves, but they want to generate the keys within the cloud provider's key management service. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) means the cloud provider's KMS generates and stores the key material, but the customer controls the key's lifecycle — rotation, disabling, and deletion — and the key is used by the provider's service to encrypt data at rest. This matches the requirement of keys managed by the customer but generated within the provider's KMS.

Answer

Client-side encryption

Answer

Server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 11

Which of the following is a key consideration when defining a cloud provider's liability for data breaches?

Accepted Answer

The limitation of liability clause in the contract. The limitation of liability clause in the contract defines the maximum liability of the provider in the event of a breach. Provider's insurance, incident response plan, and history of breaches may influence negotiations but are not the contractual definition of liability.

Answer

The provider's incident response plan

Answer

The provider's insurance policy limits

Answer

The number of previous breaches

Question 12

A container image is built and scanned in a CI pipeline. Which practice should be implemented to ensure that the image has not been tampered with before deployment?

Accepted Answer

Signing the image with a private key and verifying the signature. Signing the image with a private key and verifying the signature before deployment provides cryptographic assurance of integrity and authenticity. The signature proves the image was produced by a trusted builder and has not been altered since signing. This directly addresses tampering, which scanning and registry controls do not detect after the fact.

Answer

Using a minimal base image

Answer

Scanning the image with a vulnerability scanner

Answer

Storing the image in a private registry

Question 13

A multinational corporation must comply with data residency requirements that mandate certain data must remain within the European Union. Additionally, the company needs to ensure high availability and disaster recovery for this data. Which TWO measures should be implemented? (Select TWO.)

Accepted Answer

Configure cross-region replication to another EU region. Option D is correct because selecting cloud regions physically located within the EU is the foundational measure that ensures data is stored and processed inside EU territory, directly satisfying data residency mandates. Option A is correct because configuring cross-region replication to another EU region provides high availability and disaster recovery while keeping all replicated data within EU boundaries, so residency is not violated. Option B is not correct because IAM policies with region conditions control access authorization but do not by themselves guarantee that data is stored or replicated only within the EU. Option C is not correct because replicating to a region outside the EU would violate the data residency requirement. Option E is not correct because enabling public access to the bucket weakens security and does nothing to meet residency or availability requirements.

Answer

Implement IAM policies with conditions restricting data access to EU regions

Answer

Use cross-region replication to a region outside the EU

Answer

Enable public access to the bucket for all users

Question 14

A company wants to ensure that its cloud infrastructure can automatically add capacity during traffic spikes and remove capacity during low demand. Which cloud characteristic is primarily needed?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that enables automatic scaling of resources up or down in response to demand, often leveraging orchestration tools like AWS Auto Scaling or Azure VM Scale Sets. This ensures that capacity matches workload spikes and troughs without manual intervention, directly addressing the requirement for dynamic capacity adjustment.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 15

Which runtime security control monitors application behavior and can block attacks by analyzing application logic and context?

Accepted Answer

Runtime application self-protection (RASP). C is correct because Runtime Application Self-Protection (RASP) is a security technology that is integrated into an application's runtime environment, allowing it to monitor actual application behavior and context (e.g., input validation, SQL queries, API calls) in real time. Unlike external controls, RASP can understand the application's logic and data flow, enabling it to block attacks such as SQL injection or command injection by analyzing the specific context of each request.

Answer

Web application firewall (WAF)

Answer

Intrusion detection system (IDS)

Answer

Static application security testing (SAST)