CCSP Practice Test 42 — 15 Questions

Question 1

A financial institution uses a cloud data warehouse to store transaction data. The data is classified into three tiers: public, internal, and confidential. The current architecture stores all data in a single dataset with column-level encryption for confidential fields. A recent internal penetration test revealed that an analyst with access to the data warehouse could query aggregated statistics that inadvertently revealed confidential individual transactions. The security team needs to implement a solution that prevents such data leakage while preserving analytical capabilities. Which solution BEST addresses this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a differential privacy framework that adds noise to query results.. Differential privacy is the correct solution because it directly addresses the core issue: aggregated statistics can be reverse-engineered to infer individual records. By adding calibrated noise to query results, it ensures that the output of any query does not reveal whether a specific individual's data is present, thus preventing leakage from aggregate queries while still allowing analysts to derive meaningful trends and patterns.

Answer

Implement row-level security to restrict each analyst to only view data related to their assigned region.

Answer

Use dynamic data masking to obscure confidential fields based on the user's clearance.

Answer

Encrypt the entire dataset with a key that is only available to a privileged group.

Question 2

A cloud security architect is designing a multi-tenant environment on a hypervisor. Which hypervisor type provides the most robust isolation between tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 bare-metal hypervisor (e.g., VMware ESXi). A Type 1 bare-metal hypervisor (e.g., VMware ESXi) runs directly on the hardware without an underlying host operating system, providing the most robust isolation between tenant VMs. This architecture reduces the attack surface and ensures that each VM is isolated from others and from the hypervisor management layer.

Answer

Type 2 hosted hypervisor (e.g., VirtualBox)

Answer

Paravirtualized hypervisor (e.g., Xen)

Answer

Container runtime (e.g., Docker)

Question 3

Which of the following is a benefit of enabling log file validation for cloud audit logs?

Accepted Answer

It ensures the integrity of log files by allowing you to confirm that they have not been modified.. Log file validation uses a hash-based digital signature (such as SHA-256) to create a digest file for each log file. This allows you to verify that the log files have not been tampered with, deleted, or modified after they were delivered, ensuring their integrity for forensic analysis and compliance.

Answer

It automatically deletes old log files based on a retention policy.

Answer

It encrypts log files at rest.

Answer

It compresses log files to save storage space.

Question 4

A company is migrating sensitive customer data to the cloud. They need to classify data according to the organization's data classification policy, which includes public, internal, confidential, and restricted categories. Which of the following is the MOST important step to ensure data classification is effective in the cloud?

Accepted Answer

Integrate classification labels with DLP and access control policies. Integrating classification labels with DLP and access control policies ensures that the classification scheme is enforced automatically, not just documented. This allows the cloud infrastructure to apply appropriate protections (e.g., blocking unauthorized access or preventing data exfiltration) based on the label, making classification actionable and effective in a dynamic cloud environment.

Answer

Assign a data custodian to manually tag data objects

Answer

Implement encryption for all data at rest and in transit

Answer

Store each classification level in separate cloud regions

Question 5

A cloud security engineer is implementing API Gateway security for a public-facing API. Which combination of controls best protects against both injection attacks and excessive usage?

Accepted Answer

WAF integration and rate limiting. WAF integration (C) inspects and filters HTTP requests to block injection attacks like SQLi and XSS, while rate limiting throttles excessive usage to prevent abuse and DoS. Together they address both the content-based threat (injection) and the volume-based threat (excessive usage) in a single combination. This pairing is the standard API Gateway protection pattern for public-facing APIs.

Answer

IAM authentication and VPC endpoint

Answer

JWT validation and WAF integration

Answer

API keys and TLS enforcement

Question 6

A company uses AWS and needs to allow a Lambda function in a VPC to access an S3 bucket without traversing the internet. Which solution meets this requirement securely?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the Lambda's VPC. A VPC endpoint for S3 (gateway endpoint) allows resources in a VPC, including Lambda functions, to reach S3 privately without traversing the internet, NAT, or an internet gateway. Traffic stays on the AWS backbone and can be controlled with endpoint policies.

Answer

Configure a NAT gateway in the VPC and route traffic through it

Answer

Use VPC peering to connect to the S3 bucket's VPC

Answer

Assign a public IP to the Lambda and use an internet gateway

Question 7

Which of the following is a key benefit of using containers, such as Docker, in a cloud environment to achieve portability?

Accepted Answer

Containers package applications with dependencies to run consistently across environments. Containers bundle the application code together with its libraries, runtime, and configuration into a single immutable image, so the same image runs identically on a developer laptop, on-premises servers, or any cloud VM/container service. This decoupling from the underlying host OS and infrastructure is precisely what delivers portability across cloud environments.

Answer

Containers are always stateless

Answer

Containers require a specific hypervisor to run

Answer

Containers provide hardware-level virtualization

Question 8

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

Accepted Answer

The customer. Under the cloud shared responsibility model, the customer is always responsible for the security 'in' the cloud — including identity and access management (IAM) policies, user permissions, and access controls. The cloud provider secures the infrastructure 'of' the cloud, but configuring IAM policies to correctly restrict access is squarely a customer responsibility.

Answer

The third-party auditor

Answer

Both equally

Answer

The cloud provider

Question 9

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault is a platform-agnostic secrets management solution that runs on any cloud or on-premises environment, supports dynamic secrets, and provides automated secret rotation via leases and rotation policies. It is the only option that natively spans AWS and Azure with consistent APIs and automated rotation.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 10

An administrator applies the above bucket policy to an S3 bucket containing sensitive data. What is the EFFECT of this policy?

Accepted Answer

Denies access if the request does not use HTTPS. The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Answer

Allows public read access

Answer

Allows access only from specific IP addresses

Answer

Denies access if the request uses HTTPS

Question 11

A company using a SaaS application for HR management receives a data subject access request (DSAR) under GDPR from an employee. The cloud provider is the data processor. The company as data controller must respond within what timeframe?

Accepted Answer

One month. Under GDPR Article 12(3), the data controller must respond to a data subject access request (DSAR) without undue delay and in any event within one month of receipt of the request. This one-month period can be extended by two further months for complex requests, but the baseline deadline is one month. The cloud provider as processor must assist the controller, but the controller bears the legal obligation to respond within that timeframe.

Answer

90 days

Answer

45 days

Answer

72 hours

Question 12

An organization wants to prevent secrets from being exposed in source code. Which two practices should they adopt? (Choose TWO.)

Accepted Answer

Implement secret scanning in the CI/CD pipeline. Option A is correct because implementing secret scanning in the CI/CD pipeline automatically detects hardcoded credentials (API keys, tokens, passwords) in commits and pull requests before they are merged or deployed, using tools like GitGuardian, TruffleHog, or GitHub secret scanning to fail the build and alert developers. Option D is correct because a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores credentials centrally and injects them at runtime via API calls or environment variables, so secrets never appear in source code or version control. Option B is not appropriate because encrypting source files does not prevent secrets from being committed and exposed; the plaintext secrets still exist in the repository and can be decrypted or leaked via build artifacts. Option C is wrong because a firewall controls network access to repositories but does nothing to stop developers from hardcoding secrets into code that is later pushed. Option E is incorrect because disabling git history destroys auditability and collaboration, and it does not prevent secrets from being written into new commits in the first place.

Answer

Encrypt all source code files

Answer

Use a firewall to block access to code repositories

Answer

Disable git history

Question 13

A multinational corporation uses a cloud access security broker (CASB) to enforce data protection policies across multiple SaaS applications. They discover that sensitive data tagged with 'Confidential' is being shared externally via a file-sharing application. The CASB currently only logs activities. Which action should the security team take to prevent such data loss in the future?

Accepted Answer

Implement a DLP policy that automatically blocks sharing of documents with the 'Confidential' label.. A CASB with Data Loss Prevention (DLP) capabilities can enforce real-time policies to block sharing of documents tagged with a specific sensitivity label (e.g., 'Confidential'). Since the CASB currently only logs activities, implementing a DLP policy that automatically blocks the sharing action addresses the root cause—preventing the data loss at the point of egress—rather than merely detecting it after the fact.

Answer

Encrypt all files stored in the file-sharing application.

Answer

Revoke user access to the file-sharing application for all employees.

Answer

Train employees on data handling policies.

Question 14

A cloud security team is implementing VPC peering between two VPCs in the same region. Which statement about VPC peering is correct?

Accepted Answer

VPC peering enables private IP connectivity across VPCs without internet. VPC peering creates a direct, private network route between two VPCs using their private IPv4 or IPv6 CIDR blocks, so instances communicate as if on the same network without traversing the public internet, VPN, or a NAT device. Traffic stays on the cloud provider's backbone, which is why it is considered private connectivity. This is the defining characteristic of VPC peering and the reason it is used for cross-VPC application tiers, shared services, and multi-account architectures.

Answer

VPC peering requires VPN gateways to establish connectivity

Answer

VPC peering automatically encrypts all traffic between VPCs

Answer

VPC peering supports transitive routing through intermediate VPCs

Question 15

A cloud architect is designing a multi-tier application in a public cloud. The web tier must be accessible from the internet, while the application and database tiers must only be reachable from the web tier. The architect needs to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which architecture BEST meets this requirement?

Accepted Answer

Place the web tier in a public subnet with a security group allowing HTTP/HTTPS from 0.0.0.0/0, and place the app and database tiers in private subnets with security groups allowing traffic only from the web tier's security group.. It implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Answer

Place all tiers in the same subnet and use a single security group to control inbound traffic.

Answer

Place all tiers in the same VPC but different subnets, and use network ACLs to restrict traffic.

Answer

Use a VPN to connect the tiers and rely on IPsec policies for segmentation.