CCSP Practice Test 42 — 15 Questions

Question 1

Your organization, a healthcare provider subject to HIPAA, has migrated electronic protected health information (ePHI) to a public cloud IaaS provider. The cloud provider offers default encryption at rest using their managed key service. During a recent audit, it was discovered that the encryption keys are generated and stored by the cloud provider without any customer involvement. The auditor states that this arrangement may violate HIPAA requirements because the covered entity does not have exclusive control over the keys. You need to ensure compliance while maintaining cost efficiency. After discussing with the cloud provider, they suggest the following options:
A. Enable client-side encryption using a custom key management system (KMS) on the customer's premises.
B. Use the provider's default encryption and rely on their BAA that states they will protect the keys.
C. Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.
D. Disable encryption and rely on access controls and auditing only.

Which option best addresses the compliance requirement while considering the operational impact?

Accepted Answer

Enable client-side encryption using a custom key management system (KMS) on the customer's premises.. Client-side encryption with a customer-controlled KMS ensures the covered entity retains exclusive control over the encryption keys, meeting HIPAA's requirement that the covered entity must be able to prevent the cloud provider from accessing ePHI. By encrypting data before it leaves the customer premises, the cloud provider never has access to the plaintext keys, and the customer maintains full lifecycle management, including key rotation and revocation. This approach is cost-efficient as it avoids complex third-party integrations and leverages existing on-premises infrastructure.

Answer

Disable encryption and rely on access controls and auditing only.

Answer

Use the provider's default encryption and rely on their BAA that states they will protect the keys.

Answer

Implement a third-party key management solution that stores keys in the cloud but is controlled by the customer.

Question 2

A security architect is designing a container runtime security strategy. Which of the following controls is most effective at preventing a container from compromising the host kernel?

Accepted Answer

Seccomp profile. Seccomp profiles restrict the system calls a container can make, reducing the attack surface against the host kernel.

Answer

Read-only root filesystem

Answer

Resource limits (CPU/memory)

Answer

Image vulnerability scanning

Question 3

A healthcare organization stores patient records in a cloud database. They need to ensure that database administrators cannot view sensitive columns like SSN and diagnosis. Which data masking technique should be applied?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it allows the healthcare organization to mask sensitive columns (e.g., SSN, diagnosis) in real-time at the database query layer, based on user permissions. DDM does not alter the underlying stored data; it transforms the result set on-the-fly for unauthorized users (like DBAs), ensuring they see masked values while authorized personnel see the actual data. This meets the requirement of preventing database administrators from viewing sensitive columns without changing the data at rest.

Answer

Static data masking

Answer

Encryption at rest

Answer

Tokenization

Question 4

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

Accepted Answer

Cloud External Key Manager (EKM). Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Answer

Cloud KMS with software keys

Answer

Cloud KMS with hardware keys

Answer

Cloud HSM

Question 5

A healthcare organization uses a cloud-based electronic health record system. Patient data is encrypted at rest using server-side encryption with AWS KMS keys. The security team notices that during a recent security incident, an attacker used compromised credentials to decrypt and exfiltrate a large number of patient records. The attacker performed decryption operations using the KMS API, which was logged in CloudTrail. The organization wants to implement additional controls to prevent such bulk decryption in the future while still allowing authorized access. Which of the following is the BEST course of action?

Accepted Answer

Implement a key vault with an access broker that requires multi-factor authentication for each decryption request.. A is correct because implementing a key vault with an access broker that requires multi-factor authentication for each decryption request directly addresses the root cause: compromised credentials. By requiring MFA per decryption operation, even if an attacker steals credentials, they cannot perform bulk decryption without also bypassing the MFA challenge for each API call. This control operates at the application layer, independent of the KMS key policy, and provides granular, per-request authorization.

Answer

Change the encryption to client-side encryption using keys stored on-premises.

Answer

Create a KMS key policy that requires a condition for a specific IP range or VPC endpoint.

Answer

Enable automatic key rotation on the KMS key.

Question 6

A multi-national corporation uses a cloud storage service to store files that are subject to data residency requirements. Data must remain within a specific geographic region. Which of the following controls provides the STRONGEST assurance that data does not leave the region?

Accepted Answer

Using the cloud provider's data residency policy with region-restricted storage buckets. Using the cloud provider's data residency policy with region-restricted storage buckets enforces data at rest to be physically stored only in the specified geographic region. This is a technical control implemented at the infrastructure layer, ensuring that the cloud provider's storage service will not replicate or move data outside the designated region, providing the strongest assurance against data leaving the region.

Answer

Contractual clauses with the cloud provider

Answer

Implementing strict IAM policies to limit data access

Answer

Client-side encryption with keys managed on-premises

Question 7

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 8

A company is conducting a risk assessment for a new cloud service. They identify a vulnerability that could lead to a data breach. The likelihood is low, but the impact is high. According to common risk management frameworks, how should this risk be addressed?

Accepted Answer

Implement controls to reduce the risk.. In risk management frameworks like NIST SP 800-37 or ISO 27005, a risk with high impact must be mitigated regardless of low likelihood. The potential for a data breach from this vulnerability means the organization should implement controls (e.g., encryption, access controls, or patching) to reduce the risk to an acceptable level, as the cost of a breach outweighs the low probability.

Answer

Ignore the risk until it materializes.

Answer

Accept the risk because the likelihood is low.

Answer

Transfer the risk to a third party.

Question 9

A small business uses a cloud file storage service to share project files with external partners. They have enabled versioning on the bucket, and each partner has a unique folder. The security team discovers that a former employee, who had administrative access, deleted all files in a partner's folder and then deleted the folder. The bucket's versioning allows restoration of the files, but the folder deletion cannot be undone. The business wants to prevent similar incidents in the future while still allowing external partners to upload and download files. Which approach should be taken?

Accepted Answer

Use object immutability to prevent object deletion or overwrites.. Object immutability prevents any object from being deleted or overwritten by any user for the specified retention period. This directly addresses the requirement to prevent file deletion while still allowing partners to upload and download files, as versioning remains enabled and folder structure can be recreated.

Answer

Use access policies to prevent deletion of objects by anyone except a specific admin group, and use lifecycle policies to manage temporary files.

Answer

Enable multifactor authentication for deletion on the storage.

Answer

Disable versioning and implement a backup process.

Question 10

An organization wants to ensure compliance with industry regulations by implementing data classification in the cloud. Which two actions should the organization take? (Choose two.)

Accepted Answer

Implement auditing of access to sensitive data.. Auditing access to sensitive data is a fundamental compliance requirement under regulations like GDPR, HIPAA, and PCI DSS. It provides a verifiable record of who accessed what data, when, and from where, enabling detection of unauthorized access and supporting forensic investigations. Without auditing, an organization cannot demonstrate compliance with data protection mandates that require monitoring and reporting of access to classified data.

Answer

Store all data in a single repository for easy management.

Answer

Encrypt all data regardless of classification.

Answer

Automatically tag all data as it is created.

Question 11

A cloud architect is designing a multi-cloud strategy to avoid vendor lock-in. Which three design considerations should be included? (Choose three.)

Accepted Answer

Implement abstraction layers such as containers or cloud-agnostic APIs. Implementing abstraction layers such as containers (e.g., Docker, Kubernetes) or cloud-agnostic APIs (e.g., Terraform, OpenStack) decouples application code from underlying cloud infrastructure. This allows workloads to be migrated between providers without rewriting core logic, directly addressing vendor lock-in by standardizing deployment and orchestration interfaces.

Answer

Standardize on one cloud provider for core services

Answer

Use provider-specific APIs for optimal performance

Question 12

A company uses a private artifact registry for internal packages. An attacker publishes a malicious package with the same name as an internal package to a public registry. Which attack is being described?

Accepted Answer

Dependency confusion attack. This is a dependency confusion attack, where an attacker uploads a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as a private package used internally by the target organization. When a build system or developer's package manager is configured to check public registries first (or as a fallback), it may download the attacker's malicious version instead of the legitimate internal package, leading to code execution or data exfiltration.

Answer

Supply chain poisoning

Answer

Typosquatting

Answer

Man-in-the-middle attack

Question 13

A healthcare organization is migrating to AWS and must protect electronic protected health information (ePHI) stored in S3. They use AWS KMS with a custom key policy that restricts key usage to specific IAM roles. The compliance team discovers that some S3 objects are encrypted with AWS managed keys (SSE-S3) instead of the required SSE-KMS using the custom key. The security architect needs to ensure all future uploads use the customer-managed KMS key. After implementing a bucket policy that denies s3:PutObject if the required encryption is not present, the development team reports that their existing automation scripts fail with access denied errors. The scripts use the AWS SDK and do not explicitly set encryption headers. The security architect must find a solution that enforces encryption with the custom key while minimizing disruption. Which course of action BEST resolves the issue?

Accepted Answer

Modify the bucket policy to use a Deny effect with a condition on the s3:x-amz-server-side-encryption-aws-kms-key-id header being null, and also enable S3 default encryption with the custom KMS key so that objects uploaded without explicit headers are automatically encrypted with the correct key.. It combines a bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption-aws-kms-key-id header is null (ensuring the custom KMS key ID is explicitly provided) with S3 default encryption configured to use the same custom KMS key. This dual approach ensures that even if the SDK scripts do not set encryption headers, the default encryption will automatically apply the required KMS key, making the policy condition pass and avoiding access denied errors. The Deny condition on the null header forces explicit encryption headers when they are set, while default encryption handles the case where no headers are provided, thus enforcing compliance without breaking existing automation.

Answer

Implement AWS Config rules to detect non-compliant objects and automatically re-encrypt them with the correct key, while keeping the bucket policy unchanged.

Answer

Remove the bucket policy and rely solely on S3 default encryption with the custom KMS key, because default encryption applies to all objects.

Answer

Create a new S3 bucket with the required policy and migrate all data using AWS DataSync, then delete the old bucket.

Question 14

A company is migrating its on-premises workloads to a public cloud environment. The security team is concerned about maintaining visibility into network traffic between virtual machines in the same virtual network. Which cloud architecture component should be implemented to address this concern?

Accepted Answer

Virtual network traffic mirroring. Virtual network traffic mirroring (or port mirroring) enables the capture and inspection of all network packets flowing between virtual machines within the same virtual network, including east-west traffic. This provides the security team with the deep packet visibility needed for threat detection, compliance auditing, and troubleshooting without requiring changes to the VM configurations or routing paths.

Answer

Security groups

Answer

Virtual private cloud (VPC) peering

Answer

Network access control lists (NACLs)

Question 15

Which THREE of the following are effective data sanitization methods for cloud environments?

Accepted Answer

Degaussing magnetic media. Degaussing (A) is effective because it uses a strong magnetic field to completely randomize the magnetic domains on hard disk drives (HDDs), rendering all stored data unrecoverable even with advanced forensic tools. This method is approved for the highest security classifications (e.g., NSA/CSS Policy Manual 9-12) but physically destroys the media's ability to store data, making it suitable only for end-of-life disposal.

Answer

Truncating database tables

Answer

Formatting storage volumes