CCSP Practice Test 40 — 15 Questions

Question 1

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the database security group, add an inbound rule allowing TCP/3306 from the security group ID of the web servers.. The most secure approach is to allow inbound traffic to the database security group from the web server security group by referencing its ID (security group ID). This ensures that only instances in the web server security group can reach the database, regardless of IP changes. Option A is correct because it uses a security group ID reference, which is more specific and secure than using a CIDR range. Options B, C, and D are less secure: B involves a VPN and routing, which are not instance-level; C uses a network ACL which is stateless and less granular; D uses a CIDR range which allows any instance in VPC A to connect, not just the web servers.

Answer

Configure a VPN connection between VPCs and use route tables to direct traffic.

Answer

In the network ACL for VPC B's subnet, add an inbound rule allowing TCP/3306 from VPC A CIDR.

Answer

In the database security group, add an inbound rule allowing TCP/3306 from the VPC A CIDR.

Question 2

A cloud application experiences intermittent failures during peak load. Logs show database connection timeouts. Which architecture change would best address this issue?

Accepted Answer

Implement connection pooling. Connection pooling reuses a set of established database connections, avoiding the overhead of repeatedly opening and closing connections during high concurrency. This directly resolves intermittent timeouts caused by connection exhaustion or slow connection establishment under peak load, without requiring additional infrastructure.

Answer

Enable auto-scaling on the application tier

Answer

Use read replicas

Answer

Increase database instance size

Question 3

A cloud security architect is designing a defense-in-depth strategy for a multi-tenant IaaS environment. Which of the following controls would BEST protect against workload isolation failure due to a hypervisor vulnerability?

Accepted Answer

Deploy a dedicated virtual firewall instance for each tenant to enforce network segmentation.. Deploying a dedicated virtual firewall instance for each tenant provides network-level isolation that is independent of the hypervisor, mitigating the risk of workload isolation failure due to a hypervisor vulnerability. Option A is wrong because weekly vulnerability scans are detective, not preventive, and do not actively prevent exploitation. Option C is wrong because while applying patches and disabling services reduces the attack surface, a zero-day hypervisor vulnerability could still exist and be exploited. Option D is wrong because encrypted virtual disks protect data at rest but do not prevent a hypervisor escape or workload isolation failure.

Answer

Perform weekly vulnerability scans of the hypervisor and tenant workloads.

Answer

Apply the latest hypervisor security patches and disable unnecessary services.

Answer

Use encrypted virtual disks for all tenant virtual machines.

Question 4

A company is designing a data at rest encryption strategy for their cloud environment. Which TWO of the following are valid approaches? (Choose two.)

Accepted Answer

Server-side encryption with customer-provided keys. Server-side encryption with customer-provided keys and server-side encryption with cloud-managed keys are both valid approaches for protecting data at rest in the cloud. In the first, the customer controls the encryption keys while the provider handles encryption/decryption. In the second, the provider manages the keys entirely. Both ensure data is encrypted while stored. Client-side encryption, while useful, is not a data-at-rest encryption strategy per se because it is performed before data reaches the provider's storage; it is more accurately described as an encryption-in-transit or client-side protection method. The question asks for data-at-rest encryption approaches, which are server-side by definition.

Answer

Hashing data before storage

Answer

Client-side encryption

Answer

Tokenization of sensitive fields

Question 5

A company uses a cloud provider's organization management with multiple accounts. A security team wants to ensure that a specific storage bucket in the production account cannot be deleted by anyone, including the account administrator. Which control should be implemented?

Accepted Answer

Apply an organization-level policy to deny the delete action on the bucket for the production account.. An organization-level policy can be applied to an account (or organizational unit) to restrict permissions for all users, roles, and even the account administrator. By attaching a policy that denies the action to delete a storage bucket, the security team ensures that no principal in the production account can delete the specified bucket. This provides a preventive control that overrides any allow permissions within the account.

Answer

Use notifications to alert when a delete is attempted.

Answer

Enable versioning on the bucket.

Answer

Enable audit logging to log any deletion attempt.

Question 6

A cloud administrator needs to ensure that all data transferred between an on-premises data center and a cloud VPC is encrypted in transit. Which solution should be used?

Accepted Answer

A site-to-site VPN connection. A site-to-site VPN connection creates an encrypted tunnel between an on-premises data center and a cloud VPC using IPsec (IKEv1/IKEv2) to protect all data in transit. This directly meets the requirement for encryption, as traffic traverses the public internet or a dedicated private connection with encryption enabled.

Answer

A cloud transit hub

Answer

A cloud DNS resolver

Answer

A dedicated private connection

Question 7

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This attack is known as:

Accepted Answer

Dependency confusion. Dependency confusion occurs when an attacker publishes a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as an internal, private package. When a cloud application's build system is configured to fetch dependencies from both public and private registries, the package manager may prioritize the public registry (often due to higher version numbers or default resolution order), causing the malicious package to be installed instead of the legitimate internal one. This exploits the trust in package resolution algorithms and is a specific form of supply chain attack targeting cloud-native CI/CD pipelines.

Answer

Supply chain poisoning

Answer

Man-in-the-middle attack

Answer

Typosquatting

Question 8

An organization is looking for a cloud deployment model that is provisioned for exclusive use by a single organization, but may be owned, managed, and operated by the organization, a third party, or some combination. Which deployment model is this?

Accepted Answer

Private cloud. Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Question 9

A multinational corporation runs its critical applications on a cloud platform. The security team has implemented a Security Information and Event Management (SIEM) solution that collects logs from various cloud services, including virtual machines, storage, and databases. The SIEM is configured to generate alerts based on predefined rules. Recently, the team noticed an increase in false positive alerts, causing alert fatigue among the analysts. Additionally, there is a lack of context in the alerts, making it difficult to triage and prioritize incidents. The team wants to improve the efficiency of the SOC without increasing headcount. Which of the following is the BEST course of action to address these issues?

Accepted Answer

Deploy a user and entity behavior analytics (UEBA) tool to baseline normal behavior and generate alerts based on anomalies.. UEBA uses machine learning to establish baselines of normal user and entity behavior, then generates alerts only when deviations occur. This directly reduces false positives by filtering out benign anomalies and enriches alerts with behavioral context, enabling analysts to triage and prioritize incidents more efficiently without increasing headcount.

Answer

Assign more analysts to manually review and tune the alert rules.

Answer

Implement automated response playbooks for the most common alerts to reduce analyst workload.

Answer

Increase the threshold levels for all alert rules to reduce the number of alerts generated.

Answer

Create additional correlation rules to capture more specific attack patterns.

Question 10

Which TWO of the following are best practices for implementing baseline configuration management in a cloud environment? (Choose two.)

Accepted Answer

Automate the deployment of baseline configurations using orchestration tools. Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.

Answer

Allow administrators to manually adjust configurations as needed to maintain flexibility

Answer

Disable configuration drift detection to reduce alert fatigue

Answer

Grant all users read/write access to configuration repositories for efficiency

Question 11

Which TWO statements about data masking are correct?

Accepted Answer

Data masking replaces sensitive data with realistic fictional data.. Data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Answer

Data masking is a form of encryption.

Answer

Data masking is primarily used for production environments.

Answer

Data masking is reversible.

Question 12

An organization uses a cloud security monitoring service for threat detection. A finding indicates that a virtual machine instance is communicating with a known cryptocurrency mining pool. What type of threat does this represent?

Accepted Answer

Crypto mining on a virtual machine. A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

Answer

Reconnaissance port scanning

Answer

Ransomware activity

Answer

Compromised credentials exfiltration

Question 13

What does this bucket policy enforce?

Accepted Answer

The policy denies all uploads unless they use SSE-KMS.. The bucket policy uses a Condition block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which means any upload must include the `x-amz-server-side-encryption` header with the value `aws:kms`. If the header is missing or set to any other value (e.g., `AES256` for SSE-S3), the request is denied. This enforces that all uploads use SSE-KMS, but does not require a specific KMS key unless a `kms:EncryptionContext` or `kms:KeyArn` condition is also present.

Answer

All objects must be encrypted with a specific KMS key.

Answer

Any object uploaded without encryption will be denied.

Answer

Only objects encrypted with SSE-S3 are allowed.

Question 14

An organization is designing an incident response playbook for a compromised AWS IAM user. Which THREE actions should be included in the containment phase? (Choose three.)

Accepted Answer

Disable the user's access keys.. Containment involves stopping the attacker's access. Revoking credentials, disabling the user's access keys, and attaching a deny-all policy are effective containment steps. Terminating resources is eradication, and taking snapshots is evidence collection.

Answer

Take a snapshot of all EC2 instances for forensic analysis.

Answer

Terminate any EC2 instances launched by the user.

Question 15

Which cloud characteristic refers to the ability to automatically scale resources up or down based on demand?

Accepted Answer

Rapid elasticity. Rapid elasticity allows resources to be provisioned and released automatically in response to demand, giving the appearance of unlimited capacity.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service