CCSP Practice Test 4 — 10 Questions

Question 1

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

One month. GDPR requires the controller to respond to data subject requests without undue delay and in any event within one month of receipt.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 2

A company's cloud security policy mandates strict control over encryption keys used for data at rest. Which THREE practices are recommended for secure key management in the cloud?

Accepted Answer

Rotate encryption keys on a regular schedule.. Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Answer

Use a single master key for all encryption operations.

Answer

Store keys in the same cloud region as the data to reduce latency.

Question 3

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

Accepted Answer

HTTP-only cookies with Secure and SameSite flags. HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Answer

sessionStorage

Answer

URL query parameters

Answer

localStorage

Question 4

During a security audit, a cloud application is found to have numerous container images with critical vulnerabilities. The DevOps team wants to prevent vulnerable images from being deployed to production. Which two controls should be implemented? (Select TWO)

Accepted Answer

Implement image vulnerability scanning in the CI/CD pipeline. Integrating image vulnerability scanning into the CI/CD pipeline ensures that every container image is automatically checked for known Common Vulnerabilities and Exposures (CVEs) before it can be promoted to production. This shift-left approach blocks vulnerable images at build time, preventing them from ever reaching the production environment. Option C is correct because enforcing signed images from a trusted registry (e.g., using Docker Content Trust or Notary) cryptographically verifies the image's integrity and origin, ensuring only authorized, non-tampered images are deployed.

Answer

Regularly update base images

Answer

Use network segmentation to isolate production containers

Answer

Run all containers as non-root users

Question 5

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 6

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 7

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 8

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

Accepted Answer

The policy allows anonymous read access to all objects in the bucket. The S3 bucket policy includes an Allow effect with a Principal of '*' and a condition that only denies unencrypted requests, but it does not explicitly deny anonymous access. Because the Allow statement grants s3:GetObject to all principals (including anonymous users) when the request is encrypted, any unauthenticated user can read objects in the bucket over HTTPS. This is the primary risk: anonymous read access to all objects, exposing sensitive customer data.

Answer

The policy does not restrict access to specific IP addresses

Answer

Any unencrypted request is denied, which could cause data loss if encryption fails

Answer

The policy requires server-side encryption, but does not enforce it for all requests

Question 9

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 10

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. The correct best practices are A (using separate keys per tenant/application) and D (regular key rotation). Option B (hard-coding keys) is a security risk. Option C (storing keys in the same region) is not a security best practice. Option E (single master key) defeats the purpose of encryption key separation.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.