CCSP Practice Test 38 — 15 Questions

Question 1

Which THREE of the following are commonly required when conducting a cloud vendor risk assessment?

Accepted Answer

Security certifications (e.g., ISO 27001). Financial stability, certifications, and incident response plans are standard vendor risk assessment items. Pricing comparison is procurement, not risk; marketing materials are irrelevant.

Answer

Pricing compared to competitors

Answer

Marketing materials and brand reputation

Question 2

A customer relies on this SOC 2 Type II report to assess a cloud provider's controls. What is the primary limitation of this report?

Accepted Answer

The report only covers controls up to Dec 31, 2023. The report covers controls tested from Jan to Dec 2023, not current. Controls may have changed since. The report is not predictive, but the time lag is the key limitation. Scope is per provider, unbiased.

Answer

The report includes subjective opinions

Answer

The report does not cover the entire provider's infrastructure

Answer

The report is biased in favor of the provider

Question 3

A development team is migrating a legacy application to the cloud. Which security testing approach should be adopted early in the CI/CD pipeline to catch vulnerabilities as code is written?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binary code without executing the application, making it ideal for integration early in the CI/CD pipeline to catch vulnerabilities like SQL injection, buffer overflows, and XSS as code is written. This 'white-box' approach provides immediate feedback to developers, aligning with the shift-left security principle for cloud-native development.

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Answer

Runtime application self-protection (RASP)

Question 4

A cloud security engineer is tasked with automating the response to a detected malware infection on a virtual machine. The engineer wants to isolate the VM from the network immediately upon detection. Which cloud-native feature should be used?

Accepted Answer

Modify the VM's security group to deny all inbound and outbound traffic.. Modifying the VM's security group to deny all inbound and outbound traffic is the correct cloud-native method to immediately isolate the VM from the network. Security groups act as a virtual firewall at the instance level, and by removing all allow rules, you effectively block all traffic to and from the VM, containing the malware without deleting or powering off the instance.

Answer

Take a snapshot of the VM for forensic analysis.

Answer

Attach the VM to a different load balancer.

Answer

Create a site-to-site VPN connection for the VM.

Question 5

A security analyst notices that an IAM user from a cloud account has logged in from two different countries within a span of 10 minutes. Which type of detection mechanism is most likely to flag this activity as suspicious?

Accepted Answer

A correlation rule in a SIEM. A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

Answer

A cloud configuration management database (CMDB)

Answer

A vulnerability scanner

Answer

An agent-based intrusion detection system (IDS)

Question 6

What is the primary purpose of cloud security posture management (CSPM) tools?

Accepted Answer

To assess and improve the security configuration of cloud resources against benchmarks.. CSPM tools are designed to continuously monitor cloud environments, assess configurations against industry benchmarks (e.g., CIS, NIST, PCI DSS), and provide remediation guidance. Their primary purpose is to identify misconfigurations and compliance gaps, not to perform real-time threat detection or centralized logging.

Answer

To provide a centralized log storage solution.

Answer

To detect real-time threats like malware and intrusions.

Answer

To manage user identities and access permissions.

Question 7

An organization is using GCP Security Command Center with Event Threat Detection. Which type of event is most likely to generate a finding for 'exfiltration'?

Accepted Answer

A large number of objects being downloaded from a Cloud Storage bucket. Event Threat Detection (ETD) in GCP Security Command Center monitors Cloud Storage access logs for anomalous data access patterns. A large number of object downloads from a single bucket within a short time window is a strong indicator of data exfiltration, as it matches the behavioral signature of bulk data extraction. ETD uses machine learning models trained on normal access baselines to flag such volume-based anomalies as 'exfiltration' findings.

Answer

A service account creating a new VM

Answer

A user logging in from a new IP address

Answer

A firewall rule change allowing all inbound traffic

Question 8

Which TWO of the following are effective methods to protect against server-side request forgery (SSRF) in a cloud application? (Choose two.)

Accepted Answer

Whitelist allowed outbound destinations. Whitelisting allowed outbound destinations is a primary defense against SSRF. By explicitly permitting only trusted external hosts (e.g., specific API endpoints or internal services), the application cannot be tricked into making requests to arbitrary internal or external targets, even if an attacker controls the URL parameter.

Answer

Use SSL inspection to check for malicious payloads

Answer

Block all outbound network traffic from the application

Answer

Sanitize all user input for URL parameters

Question 9

An organization wants to ensure that all resources are compliant with CIS benchmarks. Which cloud service provides a unified view of compliance posture and recommendations?

Accepted Answer

Cloud Security Posture Management (CSPM) tool. A cloud security posture management (CSPM) tool provides a unified, centralized view of an organization's security and compliance posture, including specific recommendations aligned with CIS benchmarks. It aggregates findings from various security controls into a single score and actionable guidance, making it the correct service for monitoring compliance against CIS standards.

Answer

Security Information and Event Management (SIEM) tool

Answer

Cloud monitoring and logging service

Answer

Policy-as-code enforcement service

Question 10

A multinational financial services company uses a hybrid cloud environment with workloads in AWS and Azure. They recently acquired a smaller firm and must integrate their data while maintaining compliance with GDPR and PCI DSS. The acquired firm stores customer payment data in an on-premises Oracle database and wants to migrate it to the cloud. During the migration, they must ensure that the data is encrypted at all times—at rest, in transit, and during processing. The security team has implemented TLS for data in transit and plans to use cloud-native encryption for at-rest data. However, they are concerned about data being processed in memory or temporary storage. They also need to maintain key separation so that the cloud provider cannot access the encryption keys. The CISO wants to implement a solution that minimizes performance impact while meeting compliance requirements. Which of the following is the BEST course of action?

Accepted Answer

Implement a cloud-based HSM (Hardware Security Module) for key management and use confidential computing for processing.. It addresses the requirement for data to be encrypted during processing (in memory) via confidential computing, which uses hardware-based trusted execution environments (TEEs) to protect data in use. A cloud-based HSM ensures key separation by keeping encryption keys under the customer's exclusive control, preventing the cloud provider from accessing them, and minimizes performance impact compared to software-based encryption.

Answer

Use the cloud provider's native KMS with automatic key rotation and rely on encryption at rest.

Answer

Encrypt data with client-side encryption before upload and store keys in the cloud KMS.

Answer

Use tokenization for all sensitive data and store tokens in a separate cloud database.

Question 11

Match each data state to its encryption requirement in cloud environments.

Accepted Answer

Data at Rest: Encrypted when stored on disks or SSDs using symmetric encryption like AES-256. Different data states require specific encryption mechanisms; data in use is challenging and requires advanced techniques.

Answer

Data at Rest: Encrypted only when data is moved

Answer

Data in Transit: Protected using access controls on storage

Question 12

A developer receives the above error when trying to encrypt an object using a customer-managed KMS key. What is the MOST likely cause?

Accepted Answer

The KMS key policy does not grant encrypt permission to the user. The error indicates the user lacks permission to encrypt with the specified KMS key. Since the key is customer-managed, its key policy must explicitly grant the `kms:Encrypt` action to the user or role. Without this permission, AWS KMS denies the request, even if the user has other IAM permissions.

Answer

The S3 bucket policy denies KMS actions

Answer

The user is not in the same region as the key

Answer

The KMS key is disabled

Question 13

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

Accepted Answer

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".. Modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer

Add a Deny statement for the 10.0.0.0/16 range.

Answer

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Answer

Remove the Condition element to allow access from any IP.

Question 14

A security team is configuring AWS CloudTrail to enable detection of unauthorized API calls. They want to ensure that log files cannot be tampered with after delivery. Which CloudTrail feature should they enable?

Accepted Answer

CloudTrail Log File Validation. CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

Answer

CloudTrail Insights

Answer

CloudTrail Multi-Region Trail

Answer

CloudTrail Event History

Question 15

Drag and drop the steps for conducting a cloud security risk assessment using the NIST CSF framework into the correct order.

Accepted Answer

Identification, then threat/vulnerability assessment, then risk analysis, then treatment, then monitoring. Start with identification, then threat/vulnerability assessment, risk analysis, treatment, and monitoring.

Answer

Threat/vulnerability assessment, then identification, then risk analysis, then treatment, then monitoring

Answer

Identification, then risk analysis, then threat/vulnerability assessment, then treatment, then monitoring

Answer

Identification, then threat/vulnerability assessment, then treatment, then risk analysis, then monitoring