CCSP Practice Test 41 — 15 Questions

Question 1

Refer to the exhibit. A security auditor is reviewing the security group configuration for a web server. Which change would improve the security posture without breaking the application functionality?

Accepted Answer

Remove Rule 1 because SSH should not be open to the internet.. SSH (port 22) should never be open to the internet (0.0.0.0/0) on a web server. Removing Rule 1 eliminates this unnecessary exposure while the web server's HTTP/HTTPS rules remain intact, preserving application functionality. This aligns with the principle of least privilege and reduces the attack surface.

Answer

Remove Rule 2 because HTTPS should be restricted to a specific IP range.

Answer

Remove Rule 4 because outbound traffic should be restricted.

Answer

Remove Rule 3 because RDP should be allowed from anywhere.

Question 2

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

Accepted Answer

Create a hardened baseline image and store it in a secure repository.. Creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Answer

Use a golden image from the cloud provider's marketplace.

Answer

Rely on host-based firewalls to protect instances.

Answer

Perform vulnerability scanning on running instances only.

Question 3

A company uses this access policy on a cloud storage container containing logs with personally identifiable information (PII). What is the most immediate compliance risk?

Accepted Answer

Anonymous users can read PII. The policy allows anonymous read access to all objects in the storage container, exposing PII. Unencrypted logs are a secondary concern; access logging missing is not the risk; integrity is not directly threatened.

Answer

Data integrity may be compromised

Answer

Data is not encrypted at rest

Answer

Access logging is not enabled

Question 4

A security engineer needs to ensure that all API calls made to cloud resources are logged for auditing. Which cloud auditing feature should be enabled to capture management and data events?

Accepted Answer

Cloud audit logging service. In cloud environments, an audit logging service is the feature designed to log API calls for auditing. It can capture management events (control plane) and data events (data plane) such as object-level operations and function invocations.

Answer

Cloud monitoring and logging service

Answer

Configuration management service

Answer

Threat detection service

Question 5

An organization is setting up a centralized logging solution across multiple accounts in their cloud environment. The security team requires that logs from all accounts be sent to a single security account, with lifecycle policies to transition logs to cheaper storage after 90 days. Which approach should be used?

Accepted Answer

Use the cloud provider's organizational structure and enable a single audit logging configuration that delivers logs to a central storage container in the management account.. For cross-account log aggregation, the cloud provider's organizational structure can be used to centrally manage audit logging. A single audit logging configuration can be enabled that delivers logs from all accounts to a central storage container in the management account. Lifecycle policies on that container can then manage transitions to lower-cost storage classes after 90 days.

Answer

Enable the cloud provider's native audit logging in each account and manually copy logs daily to the security account.

Answer

Create an audit log configuration in each account and export logs to a centralized monitoring service, then use cross-account log forwarding to a central storage container.

Answer

Use a serverless function to copy logs from each account's storage container to the central storage container.

Question 6

A financial services company uses a public IaaS provider to host its customer-facing applications. They have strict compliance requirements (e.g., PCI DSS) mandating that all customer data be encrypted at rest and in transit. The cloud provider recently performed a scheduled hypervisor update that required live migration of all customer VMs to different physical hosts to apply security patches. After the migration, the company's security team discovers that temporary files from one of their VMs remained on the original host's local storage and were accessible by another customer's VM that was subsequently provisioned on that host. Although the files did not contain actual customer data because the VM had encrypted its volumes, the security team is concerned about potential data remanence. Which of the following actions would BEST prevent such data remanence in future hypervisor migrations?

Accepted Answer

Enable full-disk encryption on all VMs.. Full-disk encryption ensures that any residual data left on the original host's local storage after live migration is unreadable without the encryption key. Even if temporary files remain, encryption at rest renders the data inaccessible, directly addressing data remanence concerns without relying on the cloud provider's cleanup processes.

Answer

Request dedicated (single-tenant) hosts for all VMs.

Answer

Perform a secure wipe of the original host after each migration.

Answer

Use encrypted live migration for all VM moves.

Question 7

A security analyst is investigating a potential breach and needs to verify the integrity of audit logs stored in cloud storage. Which feature should the analyst rely on to confirm that logs have not been tampered with?

Accepted Answer

Log file integrity validation. Integrity verification of audit logs is typically achieved through cryptographic hashing (e.g., SHA-256) and digital signatures provided by the cloud service provider's logging service. This allows the analyst to confirm that logs have not been altered since they were created.

Answer

Server-side encryption of logs

Answer

Anomaly detection on logs

Answer

Immutable storage for logs

Question 8

A cloud service provider is designing a new data center. To ensure physical security, which of the following controls is most effective for preventing unauthorized access to the server floor?

Accepted Answer

Implement biometric access controls and two-factor authentication at all entry points.. Biometric access control combined with two-factor authentication provides strong, layered physical security that effectively prevents unauthorized access. Option B is incorrect: hiring security guards is a deterrent but not the most effective preventive control, as guards can be bypassed or fail due to human error. Option C is incorrect: while mantraps can prevent tailgating, they are most effective when combined with authentication mechanisms; alone they do not address all access vectors. Option D is incorrect: surveillance cameras are a detective control—they record events but do not actively prevent unauthorized access.

Answer

Hire 24/7 security guards to monitor the entrance.

Answer

Use mantraps at the main entrance to catch tailgating.

Answer

Install high-definition surveillance cameras covering all entrances and server aisles.

Question 9

During a security incident involving a compromised virtual machine (VM) in a public cloud, the incident response team needs to preserve evidence for potential legal action. Which of the following actions should be taken FIRST?

Accepted Answer

Create a forensic image of the VM's volumes while it is still running. Creating a forensic image captures both volatile and persistent data while preserving the original state for evidence. Option A is incorrect because stopping the VM first may cause loss of volatile data (e.g., memory, running processes), and a snapshot after stop is less forensically sound than imaging before stop. Option B is incorrect because deleting the VM destroys all evidence immediately. Option C is incorrect because while network isolation is important for containment, it does not directly preserve the VM's state for forensic analysis; the first step should be to capture forensic evidence before any other action.

Answer

Stop the VM and take a snapshot of its disks

Answer

Delete the VM immediately to prevent further damage

Answer

Isolate the VM by removing it from the network

Question 10

During a CI/CD pipeline, a developer wants to automatically block builds if Terraform configuration files contain security misconfigurations. Which tool is best suited for this task?

Accepted Answer

Checkov. Checkov is an open-source IaC scanning tool that checks Terraform, CloudFormation, and Kubernetes configurations for security misconfigurations, making it ideal for blocking builds in CI/CD.

Answer

Snyk

Answer

GitGuardian

Answer

OWASP ZAP

Question 11

An organization attempts to launch an instance in a specific availability zone but the launch fails. What is the most likely cause of the failure?

Accepted Answer

Resource exhaustion in the availability zone. The most likely cause is resource exhaustion in the availability zone. This occurs when the cloud provider has insufficient capacity in a specific zone to fulfill a request, even if the requested resource type is available in the region. This is a transient condition, unlike quotas which are static limits. Instance type availability and region correctness would typically result in different error messages and are less likely to be the cause.

Answer

Instance type not available in that region

Answer

Incorrect region

Answer

Insufficient CPU quota

Question 12

An IAM policy named S3ReadOnlyAccess has DefaultVersionId v3. What does this indicate?

Accepted Answer

The policy is currently using version v3 as the default.. The DefaultVersionId of an IAM policy indicates which version is currently active and enforced when the policy is attached to an IAM user, group, or role. Since the policy is named S3ReadOnlyAccess and has DefaultVersionId v3, version v3 is the default and is being used for access control decisions. This is the standard behavior for IAM policies in AWS, where you can have multiple versions but only one is designated as the default.

Answer

The policy is newly created.

Answer

The policy has three custom versions.

Answer

The policy cannot be attached to any entity.

Question 13

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

Accepted Answer

Man-in-the-middle (MITM) attacks between services. The primary risk of using self-signed certificates in a gRPC mutual TLS environment is that there is no trusted Certificate Authority (CA) to verify the identity of the communicating services. Without proper CA-signed certificates, an attacker can easily perform a man-in-the-middle (MITM) attack by presenting a forged self-signed certificate, intercepting and modifying gRPC traffic between microservices.

Answer

Inability to revoke certificates

Answer

Exposure of private keys in the container image

Answer

Increased latency due to certificate validation

Question 14

A cloud architect needs to protect data in transit between an on-premises data center and a cloud virtual private cloud (VPC). Which solution is MOST appropriate?

Accepted Answer

VPN with IPsec. An IPsec VPN is the most appropriate solution for protecting data in transit between an on-premises data center and a cloud VPC because it provides network-layer encryption and authentication for all IP traffic between the two sites. IPsec operates at Layer 3, securing the entire tunnel without requiring per-application configuration, and is designed specifically for site-to-site connectivity. This ensures confidentiality, integrity, and replay protection for all data traversing the public internet or a direct connect link.

Answer

SSL certificate on web server

Answer

TLS for each application

Answer

Direct Connect without encryption

Question 15

A cloud security team is implementing a DevSecOps pipeline. Which TWO of the following are examples of shift-left security practices? (Select two.)

Accepted Answer

Scanning Infrastructure as Code with Checkov before deployment. Shift-left integrates security early in the SDLC. IaC scanning and SAST are performed before deployment, while DAST and RASP are later stages, and threat modeling is also early but not listed as a tool.

Answer

Conducting penetration testing after deployment

Answer

Performing Dynamic Application Security Testing (DAST) on a running application

Answer

Implementing Runtime Application Self-Protection (RASP) in production