CCSP Practice Test 43 — 15 Questions

Question 1

A company is migrating sensitive customer data to the cloud. They need to classify data according to the organization's data classification policy, which includes public, internal, confidential, and restricted categories. Which of the following is the MOST important step to ensure data classification is effective in the cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate classification labels with DLP and access control policies. Integrating classification labels with DLP and access control policies ensures that the classification scheme is enforced automatically, not just documented. This allows the cloud infrastructure to apply appropriate protections (e.g., blocking unauthorized access or preventing data exfiltration) based on the label, making classification actionable and effective in a dynamic cloud environment.

Answer

Assign a data custodian to manually tag data objects

Answer

Implement encryption for all data at rest and in transit

Answer

Store each classification level in separate cloud regions

Question 2

An API endpoint returns user profile data including fields like 'credit_card_number' even when the client application does not need it. Which OWASP API security risk does this represent?

Accepted Answer

Excessive Data Exposure. The API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Answer

Injection

Answer

Broken Object Level Authorization

Answer

Mass Assignment

Question 3

A cloud architect is designing a disaster recovery (DR) plan for a financial services application hosted on a public cloud. The plan must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. The application uses a relational database and stores files in object storage. Which TWO strategies should the architect recommend to meet these objectives?

Accepted Answer

Deploy a hot standby environment in a different availability zone with automated failover.. A hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Answer

Take daily snapshots of the database and object storage.

Answer

Maintain a cold standby server that is provisioned only during a disaster.

Answer

Use asynchronous replication for the database to reduce latency.

Question 4

A cloud security engineer is reviewing incident response procedures for a hybrid cloud environment. During a security incident, the team needs to collect forensic evidence from a compromised virtual machine while preserving its state. Which of the following actions should be taken first?

Accepted Answer

Disconnect the virtual machine from the network. The first step in forensic collection is to preserve the state and prevent further compromise. Disconnecting the VM from the network (option C) isolates it, stopping any ongoing malicious activity or data exfiltration. Taking a snapshot (option A) is important but should be done after isolation to preserve the isolated state. Notifying the cloud provider (option B) is a parallel step but not the first technical action. Installing a forensic agent (option D) could alter evidence and should be avoided initially. Therefore, option C is the correct first action.

Answer

Take a snapshot of the virtual machine's disk

Answer

Notify the cloud provider

Answer

Install a forensic agent on the virtual machine

Question 5

Refer to the exhibit. A cloud administrator sees this error when trying to provision a virtual machine instance. Which is the best course of action?

Accepted Answer

Launch the instance in a different zone.. The error indicates a resource capacity failure, which means the specific zone lacks enough resources (e.g., CPU, memory, or network capacity) to launch the requested virtual machine instance type. The best course of action is to launch the instance in a different zone within the same region, as capacity constraints are typically zone-specific and not region-wide. This approach avoids unnecessary virtual network creation or waiting, and it directly addresses the resource scarcity at the zone level.

Answer

Create a new virtual network and try again.

Answer

Wait 24 hours for capacity to become available.

Answer

Increase the instance size to a larger type.

Question 6

An organization ingests AWS CloudTrail logs into a centralized SIEM for correlation. They want to detect an attacker who exfiltrates data by downloading large volumes from an S3 bucket. Which SIEM correlation rule would best detect this?

Accepted Answer

Alert on high volume of GetObject requests from a single IP. Exfiltration of data from S3 typically involves a high volume of GetObject API calls from a single source IP. A SIEM correlation rule that triggers on a threshold of GetObject requests from the same IP address directly detects this anomalous download behavior, which is a key indicator of data exfiltration.

Answer

Alert on multiple failed login attempts

Answer

Alert on root account usage

Answer

Alert when a new IAM user is created

Question 7

A company is required by a data sovereignty law to ensure that all data generated by its EU customers is stored and processed within the EU. The company uses a cloud provider with data centers in multiple regions. Which cloud storage configuration should they implement?

Accepted Answer

Select a cloud region located in the EU and disable cross-region replication.. Data residency is achieved by choosing a specific geographic region (e.g., EU) for storage and processing. Cross-region replication would copy data to other regions, potentially violating sovereignty. Data classification and encryption help protect data but do not restrict location.

Answer

Enable cross-region replication to a region in the same country.

Answer

Use client-side encryption for all EU data.

Answer

Apply data classification labels to all EU data.

Question 8

A company is migrating a legacy application to the cloud. The application uses hardcoded database credentials. Which secure development practice should be implemented to address this?

Accepted Answer

Use a secrets management service. Hardcoded database credentials in application code create a severe security risk because they are exposed in version control, logs, and static analysis. Using a secrets management service (e.g., AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) allows credentials to be stored securely, rotated automatically, and accessed at runtime via API calls, eliminating the need to embed secrets in code. This aligns with the principle of least privilege and secure credential management in cloud application security.

Answer

Use code signing for all deployments

Answer

Implement input validation on all user inputs

Answer

Enable encryption at rest for the database

Question 9

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

Accepted Answer

Multi-region active-active. Multi-region active-active is the only strategy that can meet both a 15-minute RTO and a 5-minute RPO because it maintains synchronous or near-synchronous replication between two or more regions, allowing traffic to be instantly redirected with zero or minimal data loss. This approach eliminates the recovery time needed to spin up infrastructure or restore data, as the application is already fully operational in multiple regions.

Answer

Backup and restore

Answer

Pilot light

Answer

Warm standby

Question 10

A company uses a cloud-based file sharing service and wants to prevent sensitive data from being shared externally. Which cloud data security capability is most appropriate?

Accepted Answer

Scanning data at rest in cloud storage with DLP. Data Loss Prevention (DLP) scanning of data at rest in cloud storage directly identifies and blocks sensitive content (e.g., PII, PCI-DSS data) stored in files before it can be shared externally. This capability is purpose-built for preventing unauthorized sharing by inspecting the actual content of files in the cloud repository, such as Amazon S3 or Azure Blob Storage, using pattern matching and fingerprinting.

Answer

Inspecting data in use within applications

Answer

Monitoring network traffic for data exfiltration

Answer

Encrypting data in transit

Question 11

A financial services company is migrating sensitive customer data to a cloud environment. The compliance team requires that all data at rest be encrypted using a key managed by the organization, not the cloud provider. Which solution should the company implement?

Accepted Answer

Client-side encryption using a customer-managed key. Client-side encryption ensures that data is encrypted before it leaves the organization's control, and the customer retains sole possession of the encryption key. This satisfies the compliance requirement that the cloud provider never has access to the key, as the provider only stores the encrypted ciphertext. In contrast, server-side encryption options (like SSE-S3) involve the provider managing or having access to the key material.

Answer

Enforce TLS 1.2 for all data transfers

Answer

Implement tokenization for all sensitive fields

Answer

Server-side encryption with AWS S3 managed keys (SSE-S3)

Question 12

A cloud customer needs to comply with PCI DSS for a cardholder data environment (CDE) hosted on an IaaS platform. According to PCI DSS Appendix A3, which document is critical to define the security responsibilities between the customer and the cloud provider?

Accepted Answer

Cloud Provider Responsibility Matrix. PCI DSS Appendix A3 requires cloud customers and providers to clearly define and document their respective security responsibilities for the cardholder data environment (CDE). The Cloud Provider Responsibility Matrix (often called a Shared Responsibility Matrix) is the critical document that delineates which party is responsible for each security control, such as firewall management, patch management, and access controls, ensuring compliance with PCI DSS requirements.

Answer

Service Organization Control (SOC) 2 report

Answer

Business Associate Agreement (BAA)

Answer

Data Processing Agreement (DPA)

Question 13

A healthcare organization uses a cloud-based electronic health record (EHR) system that stores protected health information (PHI). They recently enabled direct API access for a new mobile application. Shortly after, the security team detected that a large volume of PHI was being exfiltrated through the API by an attacker who obtained valid API keys from a compromised developer workstation. The organization has data loss prevention (DLP) tools but they were not inspecting API traffic. The EHR system supports attribute-based access control (ABAC) and has logging for all API calls. The organization needs to prevent similar incidents while maintaining the functionality of the mobile app. Which course of action should be taken first?

Accepted Answer

Rotate all API keys and implement key management best practices such as regular rotation and short-lived keys. The immediate priority is to revoke the compromised API keys and prevent further unauthorized access. Rotating all keys and implementing key management best practices, such as short-lived keys and regular rotation, directly addresses the root cause—the attacker's possession of valid keys from a compromised workstation. This action stops the exfiltration immediately while preserving the mobile app's functionality, as new keys can be issued to legitimate clients.

Answer

Enable DLP on API gateway to inspect outgoing data

Answer

Restrict API access to specific IP addresses used by the mobile app's backend

Answer

Implement ABAC policies to limit which data each API key can access

Question 14

The exhibit shows a policy applied to a cloud storage bucket. After applying this policy, the security team notices that objects in the bucket are publicly accessible. Which additional condition should be added to restrict access to only authorized applications?

Accepted Answer

Add a condition that limits access to specific IP addresses or virtual network endpoints.. The bucket policy already grants public access via 'Principal': '*', so removing that principal or changing actions won't fix the underlying exposure. By adding a condition that restricts access to specific IP addresses or virtual network endpoints, you ensure that only requests originating from authorized network sources can access the bucket, effectively overriding the broad principal wildcard.

Answer

Remove the wildcard principal statement to make the bucket private.

Answer

Change the Action to PutObject to limit exposure.

Answer

Add a condition to require Multi-Factor Authentication (MFA).

Question 15

A security team is implementing Data Loss Prevention (DLP) for a SaaS application that stores customer PII. They want to detect when sensitive data is shared externally via email. Which is the best approach?

Accepted Answer

Use the SaaS application's API DLP rules to scan email content and attachments. SaaS application API DLP rules can inspect email content and attachments directly within the application, effectively detecting sensitive data shared externally via email. Option A is wrong because database DLP monitors queries to the database, not email communications. Option B is wrong because endpoint DLP agents on user devices may not be able to inspect cloud-based email traffic that is accessed via browser. Option D is wrong because network DLP at the cloud provider's perimeter cannot inspect encrypted email traffic (e.g., TLS) and is less effective for SaaS-based email.

Answer

Implement database DLP to monitor queries to the PII database

Answer

Install endpoint DLP agents on all user devices

Answer

Deploy network DLP at the cloud provider's network perimeter