CCSP Practice Test 38 — 15 Questions

Question 1

An organization is implementing a DevSecOps pipeline for cloud-native applications. Which security testing method should be integrated early in the CI/CD pipeline to analyze source code for vulnerabilities without executing the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) scans source code early in the SDLC, aligning with shift-left security.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 2

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. Option A is correct because using separate keys for different tenants or applications enforces cryptographic isolation, so a compromise or misuse of one key cannot decrypt another tenant's or application's data and it keeps blast radius and access policies scoped per workload. Option D is correct because regularly rotating encryption keys limits the amount of data protected by any single key version, reduces the impact of an undetected key compromise, and is a standard requirement in frameworks such as NIST SP 800-57 and PCI DSS; cloud KMS services like AWS KMS, Azure Key Vault, and Google Cloud KMS support automatic rotation. Option B is wrong because hard-coding keys in source code exposes them to anyone with repository access and prevents secure rotation, violating the principle of keeping keys out of application code. Option C is wrong because key storage should be chosen based on security, compliance, and data-residency requirements, not merely latency; keys can be used cross-region through KMS endpoints, and co-locating keys with data is not itself a best practice. Option E is wrong because a single master key for all encryption operations creates a single point of failure and maximizes the impact of compromise, contradicting the key-separation and least-privilege principles.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.

Question 3

A healthcare organization is migrating its electronic health record (EHR) system to a public cloud. The system stores sensitive patient data subject to HIPAA. The cloud architect has designed a multi-tier architecture with load balancers, web servers, application servers, and a PostgreSQL database. The database contains ePHI. To meet compliance, the architect plans to encrypt the database at rest using AWS RDS encryption with KMS. However, during a security review, the compliance officer notes that the database backups are stored in an S3 bucket that is not encrypted. Additionally, the application logs, which may contain patient data, are sent to CloudWatch Logs without encryption. The compliance officer insists that all data stores containing ePHI must be encrypted at rest. Which action should the architect take to ensure compliance?

Accepted Answer

Enable S3 bucket encryption for backups and enable encryption for CloudWatch Logs using KMS.. HIPAA requires encryption of ePHI at rest in all data stores. The S3 bucket containing unencrypted database backups and the CloudWatch Logs that may contain patient data both need encryption enabled via KMS to meet compliance. AWS RDS encryption protects the live database, but backups and logs are separate storage locations that must also be encrypted.

Answer

Disable automated backups and rely on point-in-time recovery.

Answer

Enable encryption on the RDS instance and use encrypted replicas.

Answer

Enable encryption on the S3 bucket only, since backups are the main concern.

Question 4

Which TWO of the following are secure coding practices that help prevent injection attacks?

Accepted Answer

Using parameterized queries for database calls. Option B is correct because parameterized queries (prepared statements) separate SQL code from user-supplied data, so the database engine treats input as data rather than executable SQL, which neutralizes SQL injection. Option D is correct because validating and sanitizing all user inputs enforces expected formats and strips or escapes dangerous characters, reducing the attack surface for SQL, command, and other injection attacks. Option A is incorrect because printing stack traces in production leaks internal details such as file paths, query fragments, and framework versions that aid attackers, and it does nothing to prevent injection. Option C is incorrect because stored procedures are not inherently safe—if they build dynamic SQL by concatenating user input, they remain vulnerable to injection, so they are not a guaranteed secure coding practice. Option E is incorrect because storing passwords in plaintext is a severe confidentiality failure that enables credential theft and has no bearing on preventing injection attacks.

Answer

Printing stack traces in production error messages

Answer

Using stored procedures exclusively

Answer

Storing user passwords in plaintext

Question 5

Which TWO are effective strategies for securing cloud application data at rest?

Accepted Answer

File-level encryption. File-level encryption (C) is correct because it encrypts individual files or folders on disk, ensuring that data at rest remains unreadable even if the underlying storage or host is compromised. Transparent data encryption (D) is correct because it encrypts database files and backups at rest at the storage engine level, protecting data without requiring application changes. Both directly address the confidentiality of stored data, which is the core goal of securing data at rest. Role-based access control (A) governs who may access resources but does not itself encrypt stored data. Database activity monitoring (B) detects and alerts on suspicious database activity but is a detective control, not a data-at-rest protection. Network segmentation (E) limits lateral movement and exposure but does not protect data at rest on storage media.

Answer

Role-based access control

Answer

Database activity monitoring

Answer

Network segmentation

Question 6

Which THREE are key considerations when designing a secure software development lifecycle (SSDLC) for cloud applications?

Accepted Answer

Static code analysis during development. Static code analysis during development (A) is correct because SAST tools scan source code for vulnerabilities such as injection flaws and insecure API usage before deployment, shifting security left in the SSDLC. Threat modeling at the design phase (B) is correct because it identifies trust boundaries, data flows, and potential attack vectors (e.g., STRIDE) early, when architectural changes are cheapest to make. Secure coding standards (E) are correct because they give developers concrete, enforceable rules (e.g., OWASP ASVS, input validation, output encoding) that reduce the introduction of common vulnerabilities in cloud-native code. Security testing in production (C) is not a core SSDLC design consideration; while runtime monitoring and DAST may occur post-deployment, production testing is an operational activity rather than a lifecycle design principle. Using a single cloud provider (D) is irrelevant to SSDLC security design and may even increase lock-in and single-point-of-failure risk, so it is not a key consideration.

Answer

Security testing in production

Answer

Using a single cloud provider

Question 7

Which of the following is a key benefit of using a Software Bill of Materials (SBOM)?

Accepted Answer

It allows for quick identification of vulnerable components. An SBOM provides a list of all components and dependencies in an application, enabling organizations to quickly identify which applications are affected by a newly disclosed vulnerability.

Answer

It automatically fixes vulnerabilities in dependencies

Answer

It prevents all zero-day attacks

Answer

It replaces the need for penetration testing

Question 8

A security team wants to ensure that only signed container images are deployed in production. Which practice should they implement?

Accepted Answer

Image signing and verification. Signing container images with tools like Notary or Sigstore ensures the integrity and authenticity of images, preventing tampered or unauthorized images from being deployed.

Answer

Container image scanning with Trivy

Answer

Implementing a web application firewall (WAF)

Answer

Using a private registry

Question 9

An organization uses a cloud-based SIEM solution. Which cloud service provides native integration to stream audit logs into the SIEM?

Accepted Answer

Centralized logging service. A centralized logging service is the cloud service that natively aggregates audit logs from multiple sources and can stream them into a SIEM, because its core function is to collect, store, and forward log data. Native integration to stream audit logs into a SIEM is a defining capability of centralized logging services such as AWS CloudTrail with CloudWatch Logs, Azure Monitor Logs, or Google Cloud Logging. The other options describe different security functions that do not provide the log-streaming pipeline the SIEM needs.

Answer

Security monitoring service

Answer

Policy management service

Answer

Recommendation service

Question 10

Which of the following is a primary benefit of using immutable tags for container images in a production registry?

Accepted Answer

Consistent and reproducible deployments. Immutable tags prevent accidental overwriting of image tags, ensuring that the same tag always refers to the same image, which aids in traceability and rollback.

Answer

Improved build performance

Answer

Automatic vulnerability scanning

Answer

Reduced storage cost

Question 11

A company wants to migrate a legacy application to the cloud with minimal re-architecture. They need control over the operating system and middleware but do not want to manage physical hardware. Which service model is most suitable?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking where the customer controls the OS and middleware but does not manage physical hardware, matching the requirement for minimal re-architecture with OS-level control. It is the lowest-level cloud service model that still abstracts hardware.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 12

Which API Gateway security feature limits the number of requests from a client to prevent abuse or DoS attacks?

Accepted Answer

Rate limiting. Rate limiting (also called throttling) caps the number of requests a client can make within a defined time window, protecting backend services from abuse, brute-force attempts, and denial-of-service floods. API gateways implement this with token bucket or leaky bucket algorithms, returning HTTP 429 Too Many Requests when the limit is exceeded. It is the primary control for request-volume abuse.

Answer

JWT validation

Answer

WAF integration

Answer

Mutual TLS

Question 13

Which TWO cloud monitoring tools are used primarily for detecting anomalous behavior that may indicate a security incident? (Choose two.)

Accepted Answer

Intrusion detection system (IDS).. An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and system activities for signs of malicious activity or policy violations, making it a primary tool for detecting anomalous behavior indicative of a security incident. A Security Information and Event Management (SIEM) system aggregates and correlates logs from multiple sources, using rules and analytics to identify patterns of suspicious activity that may signal a security breach.

Answer

Infrastructure monitoring tool.

Answer

Cloud cost management tool.

Answer

Application performance monitoring (APM).

Question 14

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

Accepted Answer

Validate serialized objects before deserialization. Option D is correct because validating serialized objects before deserialization ensures that the data being processed matches expected types, structures, and values, which prevents attackers from injecting malicious payloads that exploit deserialization logic. Option E is correct because restricting deserialization to a whitelist of allowed classes ensures that only pre-approved, safe classes can be instantiated, blocking gadget-chain attacks that rely on unexpected or dangerous classes. Option A is incorrect because allowing deserialization from untrusted sources directly enables insecure deserialization attacks. Option B is incorrect because strong encryption protects data confidentiality in transit or at rest but does not prevent malicious payloads from being deserialized after decryption. Option C is incorrect because implementing custom deserialization without validation removes the safety checks needed to reject malicious or unexpected objects.

Answer

Allow deserialization from untrusted sources

Answer

Use strong encryption for all serialized data

Answer

Implement custom deserialization without validation

Question 15

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

Accepted Answer

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".. Modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer

Add a Deny statement for the 10.0.0.0/16 range.

Answer

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Answer

Remove the Condition element to allow access from any IP.