CCSP Practice Test 43 — 15 Questions

Question 1

A multinational corporation must ensure that customer data from the European Union is stored and processed only within EU regions to comply with GDPR. They are using a cloud provider with data centers globally. What is the primary mechanism to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Selecting cloud regions located within the EU for all services. The primary mechanism to enforce EU-only data residency is to select cloud regions physically located within the EU for all services that store or process the data, since data residency is fundamentally about where the data at rest and in processing resides. Region selection is a deployment-time architectural decision that determines the physical location of storage, compute, and backups. Other controls (encryption, VPN, IAM) complement but do not substitute for choosing EU regions.

Answer

Client-side encryption with keys stored in the EU

Answer

Using a VPN to route all traffic through an EU gateway

Answer

Configuring IAM policies to restrict access to EU-based administrators

Question 2

An organization uses a cloud-based DLP solution to monitor outbound traffic. They want to prevent the exfiltration of credit card numbers. Which detection technique is most appropriate for this requirement?

Accepted Answer

Regular expression matching for credit card number patterns. Regular expression matching (option D) is the most appropriate technique because credit card numbers follow well-defined, predictable patterns (e.g., 16 digits, specific starting digits for each issuer like 4 for Visa, 5 for MasterCard, and Luhn algorithm validation). This allows the DLP solution to detect credit card numbers in outbound traffic without requiring a pre-populated list or prior training, making it ideal for real-time monitoring of unknown or new card numbers.

Answer

Exact data matching against a list of known card numbers

Answer

Machine learning classification of sensitive data

Answer

Fingerprinting of known credit card documents

Question 3

A cloud customer is negotiating a contract with a new cloud provider. The customer wants to ensure they can maintain control over their data and verify the provider's security posture. Which TWO contractual provisions are most critical for these purposes? (Choose two.)

Accepted Answer

Data ownership clause specifying customer retains all rights to data. Option B is correct because a data ownership clause explicitly stating that the customer retains all rights to their data directly addresses the customer's goal of maintaining control over their data, removing ambiguity about who owns the information stored with the provider. Option E is correct because a right-to-audit provision lets the customer independently verify the provider's security posture through assessments, certifications, or on-site audits, which is exactly the verification capability the customer wants. Option A is not the best fit because data portability addresses avoiding lock-in and migrating data, not ownership control or security verification. Option C is not selected because deletion on termination concerns data disposal, not ongoing control or security posture verification. Option D is not selected because an SLA for uptime and performance covers availability and service quality, not data control or security assurance.

Answer

Data portability clause to export data in a usable format

Answer

Data deletion clause for removal upon contract termination

Answer

Service Level Agreement (SLA) for uptime and performance

Question 4

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Option A is correct because deploying across multiple availability zones within a region protects against a single AZ failure, since AZs have independent power, cooling, and networking, and the application can fail over to another AZ while staying in the same region for low latency. Option D is correct because automated snapshots plus cross-region data replication provide disaster recovery against a full region outage, enabling restoration or failover to a different geographic region with an acceptable RPO. Option B is not appropriate because an active-passive pair in the same availability zone shares the same failure domain, so an AZ outage takes down both instances. Option C is wrong because confining the application to one region removes geographic redundancy and increases the blast radius of a regional failure. Option E is wrong because a single large VM is a single point of failure and cannot provide high availability or disaster recovery.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 5

Which of the following is an example of a cloud interoperability standard that facilitates portability of containerized applications across different cloud environments?

Accepted Answer

Kubernetes. Kubernetes is an open-source container orchestration platform whose API and manifests (pods, deployments, services) are portable across cloud providers, making it the de facto interoperability standard for containerized workloads. It is governed by the CNCF and implemented by AWS EKS, Azure AKS, GCP GKE, and on-prem distributions, enabling workload portability.

Answer

SOC 2 Type II

Answer

CSA STAR

Answer

ISO 27001

Question 6

A DevOps engineer is configuring a Kubernetes cluster and wants to enforce that containers cannot run as root and cannot mount host paths. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) is the built-in Kubernetes admission controller that enforces Pod Security Standards (Privileged, Baseline, Restricted) at the namespace level. The Restricted profile specifically prohibits running as root (via runAsNonRoot and allowPrivilegeEscalation: false) and blocks hostPath volume mounts, which is exactly what the engineer needs. It replaced the deprecated PodSecurityPolicy and is applied via namespace labels like pod-security.kubernetes.io/enforce=restricted.

Answer

Network policies

Answer

RBAC

Answer

Secrets management

Question 7

A financial services company stores customer transaction data in a cloud object storage service. The security team wants to ensure that if a malicious insider gains access to the storage bucket, they cannot read the data. Which encryption approach provides the highest level of protection against the cloud provider and insiders?

Accepted Answer

Client-side encryption using a customer-managed key. Client-side encryption with a customer-managed key ensures data is encrypted before it leaves the customer's environment, so the cloud provider never possesses the plaintext or the key. This provides the highest protection against both the cloud provider and malicious insiders because even with bucket access, the ciphertext is useless without the customer-held key. This is the strongest option for isolating data from provider and insider threats.

Answer

Server-side encryption with AES-256 (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for data in transit

Question 8

A security analyst discovers that a container running in a Kubernetes cluster has been compromised. The attacker escalated privileges and accessed the host's kernel. Which of the following misconfigurations most likely allowed this container escape?

Accepted Answer

The container was run with the --privileged flag. Running a container with the --privileged flag disables container isolation and gives the container almost all capabilities of the host, including access to host devices and kernel. This allows an attacker who compromises the container to easily escape and access the host kernel, as seen in the scenario.

Answer

The container was run with a default Seccomp profile

Answer

The container was run with a read-only root filesystem

Answer

The container was run with an AppArmor profile in enforce mode

Question 9

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Object versioning retains every prior version of an object, so when ransomware overwrites or encrypts the current version, the original unencrypted versions remain accessible. Recovery is performed by restoring the previous version (or promoting it to current) via the object versioning API or console.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 10

An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?

Accepted Answer

Portability. Portability is the design principle of avoiding dependence on a specific vendor's proprietary services so workloads can move between environments. Using containers orchestrated by Kubernetes is a classic portability strategy because container images and Kubernetes manifests are largely vendor-neutral. This directly addresses the goal of minimizing vendor lock-in.

Answer

Elasticity

Answer

Multitenancy isolation

Answer

Reversibility

Question 11

A security team is reviewing container image supply chain security. Which tool is specifically designed for signing container images to ensure integrity and provenance?

Accepted Answer

Cosign. Cosign (C) is a tool from the Sigstore project specifically designed to sign, verify, and attach attestations to container images, providing integrity and provenance guarantees in the supply chain. It supports keyless signing via OIDC and integrates with registries and admission controllers. This makes it the purpose-built answer for image signing.

Answer

Kube-bench

Answer

Clair

Answer

Trivy

Question 12

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

Accepted Answer

Extended Page Tables (EPT). Extended Page Tables (EPT) is a hardware virtualization feature (Intel VT-x) that provides second-level address translation, isolating guest physical memory from host physical memory. It ensures that a VM's memory accesses are translated through nested page tables controlled by the hypervisor, preventing one tenant VM from accessing another tenant's memory. EPT, along with AMD's Nested Page Tables (NPT), is specifically designed for memory isolation in virtualized environments.

Answer

Seccomp profiles

Answer

CPU pinning

Answer

IOMMU

Question 13

A cloud security professional is concerned about VM escape attacks. Which mitigation is most effective?

Accepted Answer

Regular patching of the hypervisor. VM escape attacks exploit vulnerabilities in the hypervisor to break out of a guest VM and access the host or other guests. Regularly patching the hypervisor closes known vulnerabilities (e.g., Xen, KVM, VMware ESXi CVEs) that attackers use to escape, making it the most direct and effective mitigation. Since the hypervisor is the isolation boundary, keeping it current is foundational to VM security.

Answer

Encryption of VM disks

Answer

Use of Type 2 hypervisors

Answer

Network segmentation between VMs

Question 14

A cloud architect is designing a multi-tenant environment. To ensure that a tenant's virtual machine cannot access another tenant's memory, which resource isolation technique should be enforced at the hypervisor level?

Accepted Answer

Memory isolation via hardware-enforced page tables. Memory isolation via hardware-enforced page tables (using CPU features like Intel VT-x EPT or AMD-V NPT) ensures that each VM's memory is mapped in separate address spaces managed by the hypervisor, so a guest cannot address or read another guest's physical memory. This is the fundamental hypervisor-level mechanism that enforces memory isolation between tenants. It directly addresses the requirement that one tenant's VM cannot access another's memory.

Answer

IOMMU for device isolation

Answer

CPU pinning

Answer

Network segmentation with VLANs

Question 15

Which of the following is the primary benefit of using client-side encryption for data stored in the cloud?

Accepted Answer

Maximum control over encryption keys. Client-side encryption means the data is encrypted before it is sent to the cloud, and the customer retains full control over the encryption keys. This gives the customer maximum control over key management, including key generation, rotation, and storage, ensuring that the cloud provider never has access to the plaintext data or the keys.

Answer

Automatic key rotation

Answer

Simplified key management

Answer

Reduced latency for data access