CCSP Practice Test 40 — 15 Questions

Question 1

A company wants to enforce data classification in its cloud environment. They need to automatically identify and label sensitive data such as credit card numbers in cloud storage. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud DLP. Cloud DLP (Data Loss Prevention) is designed to automatically discover, classify, and label sensitive data such as credit card numbers, social security numbers, and personally identifiable information in cloud storage and other services. It uses built-in and custom infoType detectors (including regex and checksum validation for credit cards) to identify and tag sensitive content, directly fulfilling the requirement to automatically identify and label sensitive data.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 2

A data classification scheme for a cloud environment defines labels such as Public, Internal, Confidential, and Restricted. Which label should be applied to data that, if disclosed, would cause severe damage to the organization and is subject to regulatory fines?

Accepted Answer

Restricted. The Restricted label is reserved for the most sensitive data whose unauthorized disclosure would cause severe damage and trigger regulatory penalties. Data classification schemes typically escalate from Public → Internal → Confidential → Restricted, with Restricted representing the highest tier requiring the strictest controls (encryption, least privilege, audit logging). Because the question specifies 'severe damage' plus 'regulatory fines,' this maps directly to the top classification tier.

Answer

Public

Answer

Confidential

Answer

Internal

Question 3

A financial institution requires a cloud environment that is shared by multiple organizations with common regulatory compliance needs, such as PCI DSS. Which deployment model is most appropriate?

Accepted Answer

Community cloud. A community cloud is shared by multiple organizations that have common regulatory or compliance requirements, such as PCI DSS, making it the ideal model for a financial institution needing a compliant shared environment. It provides the cost and scalability benefits of multi-tenancy while meeting sector-specific controls. This matches the definition of community cloud in NIST SP 800-145.

Answer

Private cloud

Answer

Public cloud

Answer

Hybrid cloud

Question 4

A financial services company is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. They need to identify and classify data containing personally identifiable information (PII) such as credit card numbers and social security numbers. Which three capabilities should the DLP solution provide? (Choose three.)

Accepted Answer

Classification of data based on content. Option B is correct because a DLP solution must classify data based on content, inspecting files and objects to determine whether they contain regulated data types such as PII, credit card numbers, or social security numbers. Option C is correct because de-identification transforms such as masking and tokenization are core DLP remediation capabilities that replace or obscure sensitive values so the data can be used or shared while reducing exposure. Option E is correct because automated scanning for sensitive data patterns (for example, regex or pattern matching for 16-digit card numbers and SSN formats) is how the solution discovers and inventories sensitive data across cloud storage at scale. Option A does not belong because AES-256 encryption at rest protects confidentiality but does not identify or classify PII content. Option D does not belong because blocking public access to buckets is an access-control hardening measure, not a data identification or classification capability.

Answer

Encryption at rest using AES-256

Answer

Blocking public access to buckets

Question 5

In a Kubernetes environment, a security team wants to enforce that only images signed by a trusted authority can be deployed. Which component can be used to validate image signatures at admission time?

Accepted Answer

Admission controller (e.g., OPA Gatekeeper). An admission controller such as OPA Gatekeeper can intercept requests to the Kubernetes API server before objects are persisted, allowing it to validate image signatures. By integrating with tools like Cosign or Notary, the admission controller can reject pods that use unsigned or untrusted images, enforcing the policy at deployment time.

Answer

Network policies

Answer

RBAC policies

Answer

Secrets management with Vault

Question 6

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. Option A is correct because HSMs backing a cloud KMS are validated to FIPS 140-2 (or FIPS 140-3) Level 3 or higher, which requires physical tamper resistance, identity-based authentication, and role separation — directly satisfying the regulatory key-separation and tamper-evidence requirements described. Option E is correct because HSM hardware is tamper-resistant and tamper-evident: keys are generated and used inside the cryptographic boundary and cannot be extracted in plaintext, with mechanisms that zeroize keys and leave evidence if the module is physically breached. Option B is wrong because HSMs protect keys but do not remove the need for customer-managed keys — in fact, customer-managed keys are often used with HSM-backed KMS to meet separation-of-duties requirements. Option C is wrong because HSM-backed operations typically add network and hardware round-trip latency compared with software-only key stores, not reduce it. Option D is wrong because automatic key rotation is a KMS policy feature, not an inherent benefit of HSM backing, and many regulations still require customer-controlled or explicitly configured rotation.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 7

A cloud security team is implementing data loss prevention (DLP) for sensitive data in a cloud data warehouse. They need to detect and classify Social Security numbers (SSNs) stored in tables. Which cloud service capability is most appropriate for this task?

Accepted Answer

Cloud DLP API. Cloud DLP API is purpose-built to discover, classify, and de-identify sensitive data such as SSNs, credit card numbers, and PHI across storage and data warehouses using built-in and custom infoType detectors. It can scan BigQuery tables, Cloud Storage, and Datastore directly, making it the correct tool for detecting and classifying SSNs in a cloud data warehouse. The other options are access-control or key-management services that do not perform content inspection.

Answer

Object storage bucket policies

Answer

Key management service

Answer

Identity and access management (IAM)

Question 8

An organization is migrating a legacy application to the cloud and requires reversibility. Which THREE of the following should be considered to ensure the application can be migrated away from the cloud provider in the future?

Accepted Answer

Using containerization with Kubernetes for workload portability. Option A is correct because containerizing workloads with Kubernetes abstracts the application from the underlying cloud infrastructure, so the same container images and manifests can be redeployed on another provider or on-premises cluster, directly supporting reversibility. Option B is correct because designing with open standards such as OAuth for authentication and REST for service interfaces avoids dependence on a single vendor's proprietary protocols, making it feasible to re-host or re-integrate the application elsewhere. Option E is correct because ensuring data can be exported in standard formats like CSV or JSON prevents data lock-in, allowing the organization to move its data to another platform without loss or costly transformation. Option C is incorrect because proprietary storage and compute APIs increase vendor lock-in and make migration away from the provider harder, which is the opposite of the goal. Option D is incorrect because auto-scaling policies address elasticity and performance, not portability or the ability to exit the cloud provider.

Answer

Using proprietary APIs for storage and compute

Answer

Implementing auto-scaling policies

Question 9

A cloud security architect is designing a key management strategy for a hybrid cloud environment. The organization requires that encryption keys never leave their on-premises hardware security module (HSM) due to strict regulatory mandates, yet cloud services must be able to perform encryption operations on data at rest. Which key management approach meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) keeps the master key material inside the customer's on-premises HSM and never exports it to the cloud provider. The cloud service sends cryptographic operations (encrypt/decrypt) to the on-prem HSM via a secure channel, so keys never leave the customer's control while still enabling encryption of cloud data at rest. This satisfies the regulatory mandate that keys remain on-premises.

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud provider default encryption

Answer

Bring Your Own Key (BYOK)

Question 10

An organization must implement encryption for data in transit between its on-premises data center and a cloud provider. The data is sensitive and the organization requires a dedicated, encrypted tunnel. Which solution should be used?

Accepted Answer

VPN connection. A VPN connection provides a dedicated, encrypted tunnel between the on-premises data center and the cloud provider, ensuring data in transit is protected. It uses protocols like IPsec or SSL/TLS to encrypt all traffic, meeting the requirement for a dedicated encrypted tunnel for sensitive data.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for API communication

Answer

Cloud KMS for key exchange

Question 11

A cloud architect is implementing data loss prevention (DLP) for a data lake containing PII. They want to automatically detect and transform sensitive data like Social Security numbers and medical record numbers. Which THREE actions should they take? (Choose three.)

Accepted Answer

Apply de-identification transforms such as masking or tokenization. Option C is correct because the cloud DLP API (e.g., Google Cloud DLP / Sensitive Data Protection) is the service that inspects data lake content and identifies predefined infoTypes such as US_SOCIAL_SECURITY_NUMBER and medical record numbers, which is the required detection step. Option A is correct because de-identification transforms like masking, tokenization, or format-preserving encryption are exactly the mechanisms DLP provides to irreversibly or reversibly transform the detected PII before it is stored or shared. Option D is correct because automated classification labels derived from DLP findings let the architect tag and govern the data lake objects by sensitivity level, enabling downstream policy enforcement and audit. Option B is not correct because bucket versioning only preserves object versions for recovery and does not detect or transform PII. Option E is not correct because cross-region replication addresses durability and availability, not data loss prevention or sensitive-data transformation.

Answer

Enable bucket versioning

Answer

Set up cross-region replication for durability

Question 12

A cloud security engineer is configuring network security for a multi-tier application in AWS. The web servers must be accessible from the internet on port 443, the application servers should only receive traffic from the web servers, and the database servers should only accept traffic from the application servers on port 3306. Which combination of security controls should be used?

Accepted Answer

Security groups with source referencing the web server security group for app tier, and app server security group for DB tier. In AWS, security groups are stateful virtual firewalls that can reference other security groups as sources. For the web tier, allow inbound 443 from 0.0.0.0/0. For the app tier, allow inbound from the web server security group. For the DB tier, allow inbound on 3306 from the app server security group. This creates a least-privilege, layered defense without hardcoding IP addresses.

Answer

NACLs on each subnet with rules referencing source IP ranges

Answer

A single NACL applied to all subnets with layer 7 filtering

Answer

Route tables with deny rules to restrict inter-subnet traffic

Question 13

A container runtime is configured to drop all Linux capabilities, use a read-only root filesystem, and apply a Seccomp profile. Which primary security goal does this configuration achieve?

Accepted Answer

Prevention of container escape. Dropping all Linux capabilities, using a read-only root filesystem, and applying a Seccomp profile collectively harden the container against privilege escalation and syscall-based attacks that are commonly used in container escape techniques. These controls limit what a compromised process can do, making it much harder to break out of the container and access the host. Thus, the primary security goal is prevention of container escape.

Answer

Image integrity verification

Answer

Ensuring immutability of containers

Answer

Network segmentation between pods

Question 14

An organization is moving sensitive customer data to the cloud and must ensure that data is encrypted before being sent to the cloud provider. They want to maintain full control over the encryption keys and not rely on the cloud provider for any key management. Which approach should they use?

Accepted Answer

Client-side encryption. Client-side encryption means the organization encrypts data before it ever leaves their environment, so the cloud provider only ever receives ciphertext and never has access to the plaintext or the keys. This satisfies both requirements: data is encrypted prior to transmission and the customer retains full control of key management (often via their own HSM or KMS). Because the provider never holds the keys, it cannot decrypt the data even if compelled or breached.

Answer

VPN encryption

Answer

Server-side encryption with AWS KMS

Answer

Transparent Data Encryption (TDE)

Question 15

An organization uses a cloud-based data analytics platform with data stored in a data warehouse. The security team discovers that some tables contain unencrypted personally identifiable information (PII). They need to automatically scan the data warehouse for PII and apply pseudonymization to protect sensitive columns. Which cloud service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is designed to discover, classify, and protect sensitive data such as PII across cloud storage and data warehouses. It can automatically scan tables, identify PII using built-in infoType detectors, and apply de-identification transformations like pseudonymization (e.g., replacing values with surrogate tokens) directly. This matches the requirement to automatically scan and pseudonymize sensitive columns without manual intervention.

Answer

Cloud Storage bucket policies

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Key Management Service (KMS)