CCSP Practice Test 39 — 15 Questions

Question 1

Match each compliance framework to its primary jurisdiction or industry.

Accepted Answer

GDPR: European Union. Compliance frameworks are often region- or industry-specific; cloud providers must support customer compliance.

Answer

ISO 27001: European Union

Answer

SOC 2: US healthcare

Question 2

A company is deploying a serverless function in AWS Lambda that needs to access a private RDS database. Which TWO configurations are necessary for secure access?

Accepted Answer

Configure VPC integration for the Lambda function. Lambda functions must be attached to a VPC using VPC integration to access resources inside a private subnet, such as an RDS database. Without VPC integration, the Lambda function runs in an AWS-managed VPC and cannot reach resources in the customer’s VPC. This configuration requires the Lambda function to be associated with the same VPC, subnets, and security groups as the RDS instance.

Answer

Disable TLS for the database connection

Answer

Attach an Internet Gateway to the Lambda function

Answer

Assign a public IP address to the Lambda function

Question 3

A company uses a private artifact registry for internal packages. An attacker could perform a dependency confusion attack by uploading a malicious package to a public registry with the same name as an internal package. Which THREE measures help mitigate this attack?

Accepted Answer

Use verified publisher names in the public registry. Verified publisher names in a public registry (e.g., npm verified publishers or PyPI trusted publishers) allow the package manager to cryptographically verify that a package was published by a trusted identity. This prevents an attacker from impersonating an internal package name, as the malicious upload would lack the verified publisher claim and be rejected during resolution.

Answer

Generate an SBOM for each application

Answer

Sign all internal packages with a private key

Question 4

A company has implemented a centralized logging solution for its cloud environment. The security team notices that logs from a critical application are missing for the past hour. What is the MOST likely cause?

Accepted Answer

The logging agent on the application server stopped working. The most likely cause of missing logs from a critical application is that the logging agent on the application server stopped working. Logging agents are responsible for collecting and forwarding logs to the centralized solution; if they fail, logs are not generated or sent. Option A is incorrect because a retention policy of 0 days would delete logs immediately after collection, but logs would still be generated briefly. Option B is incorrect because log encryption does not cause delays that result in missing logs; it may add processing time but not prevent generation. Option C is incorrect because the security team's lack of read permission would prevent viewing logs, not stop logs from being generated or sent.

Answer

The log retention policy was set to 0 days

Answer

Log encryption was enabled causing a delay

Answer

The security team does not have read permission on the log bucket

Question 5

Refer to the exhibit. An organization has attached this IAM policy to a role used by a backup application to access encrypted objects in an S3 bucket. The application is failing with an access denied error when trying to download objects. What is the most likely cause?

Accepted Answer

The policy does not specify the SSE-KMS key ARN in the KMS action.. The policy grants kms:Decrypt using a wildcard resource ("arn:aws:kms:*:*:key/*") instead of specifying the exact KMS key ARN used to encrypt the S3 objects. When an S3 object is encrypted with SSE-KMS, the backup application must have explicit permission to use that specific KMS key. Without the correct key ARN in the KMS action's Resource element, KMS denies the decryption request, causing the access denied error.

Answer

The policy uses wildcard resource for KMS, which is not allowed.

Answer

The policy does not grant s3:GetObject on the bucket itself.

Answer

The policy omits kms:DescribeKey permission.

Question 6

Refer to the exhibit. A data sync job fails with the error shown. The IAM role 'data-sync-role' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:*:*:data-bucket-2024/*"
    }
  ]
}

What is the MOST likely cause of the failure?

Accepted Answer

The resource ARN in the policy is incorrectly formatted, causing the action to not be applied.. The resource ARN in the policy uses an invalid format: 'arn:aws:s3:*:*:data-bucket-2024/*'. S3 bucket object ARNs should be 'arn:aws:s3:::bucket-name/*'. The extra wildcards in the partition and account sections make the ARN malformed, so the policy does not actually grant any permissions. Without valid permissions, the sync job fails with an access denied error. Options B, C, and D are incorrect because the error is specifically due to the malformed ARN, not role attachment, bucket existence, or an explicit deny.

Answer

The role 'data-sync-role' is not attached to the sync job.

Answer

The bucket 'data-bucket-2024' does not exist.

Answer

There is an explicit Deny policy blocking the action.

Question 7

During a security audit, it is discovered that a cloud service provider's infrastructure-as-a-service (IaaS) environment has virtual machines that were provisioned with default firewall rules allowing all inbound traffic from the internet. The organization's cloud security policy requires that all VM firewall rules follow a least-privilege model. What is the most effective approach to enforce this policy going forward?

Accepted Answer

Implement infrastructure as code templates with built-in security controls that enforce least-privilege firewall rules. Implementing infrastructure as code (IaC) templates with built-in security controls enforces least-privilege firewall rules by design, preventing non-compliant deployments from the start. Option A (manual review) is error-prone and does not scale. Option B (configuration management) is reactive, detecting issues after deployment. Option D (CSPM) is also detective, only alerting on non-compliance. IaC provides a proactive, automated approach that ensures policy compliance at deployment time.

Answer

Manually review each VM's firewall rules during deployment

Answer

Use a configuration management tool to periodically audit and correct firewall rules

Answer

Use a cloud security posture management (CSPM) tool that continuously monitors and alerts on non-compliant rules

Question 8

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Accepted Answer

S3 server access logs. S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. AWS CloudTrail data events for S3 capture API-level activities such as PutObject, GetObject, and DeleteObject. Together, they offer comprehensive monitoring of S3 data access at both the request level and API activity level.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 9

A company runs its production workloads on a cloud platform. The security team wants to ensure that all compute instances are patched within 30 days of a patch release. Which of the following is the BEST approach to enforce this requirement?

Accepted Answer

Use an automated patch management tool that deploys patches to all instances within 30 days. An automated patch management tool ensures that patches are deployed to all instances within the specified timeline, enabling enforcement of the 30-day requirement. Option B is wrong because vulnerability scanning only identifies unpatched instances but does not apply the patches. Option C is wrong because a change management process requiring approval can introduce delays that may prevent patching within 30 days. Option D is wrong because a manual patching policy lacks enforcement and may result in missed deadlines due to human error or negligence.

Answer

Configure vulnerability scanning to identify unpatched instances and notify administrators

Answer

Create a change management process that requires approval for all patches

Answer

Implement a manual patching policy and require each team to submit a patch report monthly

Question 10

Which THREE of the following are essential steps in the incident response process for a cloud security incident?

Accepted Answer

Contain the incident to prevent further damage.. Correct answers are B, D, and E. The essential steps in the incident response process for a cloud security incident include identification and classification (E), containment (B), and eradication (D). Option A is incorrect because a full forensic analysis should not be performed before containment; forensics typically occurs after containment. Option C is incorrect because rewarding staff is not part of the incident response process.

Answer

Perform a full forensic analysis of all systems before containment.

Answer

Reward the team that discovered the incident to encourage reporting.

Question 11

During a security incident, the security team suspects that an attacker has tampered with the cloud audit logs to cover their tracks. Which feature would the team use to verify that the log files have not been modified since they were delivered?

Accepted Answer

Log file integrity validation. Log file integrity validation uses a cryptographic hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of cloud audit logs.

Answer

Automated anomaly detection for audit logs

Answer

Storage access logs

Answer

Configuration compliance rules

Question 12

An analyst receives the above error when trying to download a file from a cloud storage bucket. The bucket policy and user permissions appear correct. What is the most likely cause?

Accepted Answer

The user lacks permission to decrypt the object using the customer-managed encryption key. When a cloud storage object is encrypted with a customer-managed encryption key (CMEK), the GetObject API call requires the user to have both GetObject permission on the bucket policy and Decrypt permission on the specific encryption key. Even if the bucket policy and user IAM permissions appear correct for storage actions, the absence of the decrypt permission on the key will cause an access denied error. This is a common misconfiguration because the error message does not explicitly mention the key, leading analysts to overlook the key permission.

Answer

The object is encrypted with server-side encryption using a provider-managed key, which requires additional grants

Answer

The bucket is configured to block all public access

Answer

The bucket policy denies all GetObject actions

Question 13

A security engineer needs to automate the remediation of any S3 bucket that is publicly accessible. The solution should work within a single AWS account and not require manual intervention. Which combination of services is MOST appropriate?

Accepted Answer

AWS Config rule + AWS Lambda auto-remediation. AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Answer

Amazon GuardDuty + AWS Step Functions

Answer

AWS CloudTrail + Amazon SNS

Answer

AWS Trusted Advisor + AWS Systems Manager

Question 14

A security analyst is configuring Azure Defender for Cloud to protect a hybrid environment. Which THREE resource types can be protected by enabling Azure Defender plans? (Choose three.)

Accepted Answer

Azure SQL databases (Defender for Databases). Azure Defender for Cloud provides integrated security protections for Azure resources. Enabling the 'Defender for Databases' plan specifically protects Azure SQL databases by detecting anomalous activities, SQL injection attempts, and potential vulnerabilities. This plan extends to other database types like Azure SQL Managed Instance and Azure Synapse SQL pools, ensuring comprehensive database security.

Answer

Azure AD identities

Answer

Azure DNS zones

Question 15

A company is using Azure and wants to implement cloud security posture management (CSPM) to detect misconfigurations. Which TWO services can provide CSPM capabilities? (Choose two.)

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces organizational standards and assesses compliance at scale, providing CSPM capabilities by evaluating Azure resources against defined rules to detect misconfigurations. It integrates with Microsoft Defender for Cloud to offer continuous monitoring and remediation of security posture issues.

Answer

Azure Key Vault

Answer

Azure Monitor

Answer

Azure Sentinel