CCSP Practice Test 44 — 15 Questions

Question 1

A cloud security team is reviewing container security practices. Which of the following is the most effective way to minimize the attack surface of a container image?

Accepted Answer

Using a minimal base image such as distroless. Using a minimal base image such as distroless is the most effective way to reduce a container image's attack surface because it strips the package manager, shell, and unnecessary OS utilities, leaving only the application and its runtime dependencies. Fewer installed packages means fewer libraries that can contain exploitable CVEs, and the absence of a shell makes post-exploitation pivoting much harder. Distroless images, maintained by Google, include only the runtime (e.g., a JRE or Python interpreter) and the app itself.

Answer

Using the latest version of a base image

Answer

Using the :latest tag to ensure freshness

Answer

Scanning the image for CVEs after deployment

Question 2

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

Accepted Answer

Role and RoleBinding in the 'dev' namespace. RBAC uses Role and RoleBinding for namespace-scoped permissions. ClusterRole and ClusterRoleBinding are cluster-scoped. A Role with permissions to create pods in the 'dev' namespace, bound via RoleBinding, achieves the goal.

Answer

ClusterRole and ClusterRoleBinding

Answer

PodSecurityPolicy (deprecated)

Answer

NetworkPolicy

Question 3

A security engineer is concerned about a scenario where a malicious process inside a VM breaks out of the virtualized environment to compromise the hypervisor. What is this attack called and what is the primary mitigation?

Accepted Answer

VM escape; regularly patch the hypervisor. A VM escape is the class of attack where code running inside a guest VM exploits a vulnerability in the hypervisor (or virtual hardware emulation) to execute on the host. Because the hypervisor is the trust boundary, the primary mitigation is keeping it patched against known escape CVEs (e.g., VENOM, Xen XSA advisories). Regular hypervisor patching closes the specific flaws attackers leverage to break isolation.

Answer

VM sprawl; use resource limits

Answer

Side-channel attack; disable hyperthreading

Answer

Privilege escalation; enable SELinux inside VM

Question 4

During a security assessment of a Kubernetes cluster, you discover that a container is running as root with privileged mode enabled. Which of the following is the most critical risk associated with this configuration?

Accepted Answer

Potential for container escape to the host OS. Running a container as root with privileged mode enabled grants the container almost all the capabilities of the host's root user, including access to host devices and kernel features. This significantly increases the attack surface, making it easier for an attacker to exploit kernel vulnerabilities or misconfigurations to escape the container and gain control of the host OS. While other risks exist, container escape is the most critical because it compromises the entire node and potentially the whole cluster.

Answer

Network policy bypass allowing unauthorized pod communication

Answer

Increased memory consumption due to lack of resource limits

Answer

Inability to mount volumes for persistent storage

Question 5

A healthcare organization is storing patient records in a cloud object storage service. They must encrypt data at rest with keys they control and rotate regularly, but they do not want to manage the encryption process themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the organization to control the encryption keys (including rotation) while the cloud provider manages the encryption/decryption process. This meets the requirement of using keys they control without managing the encryption process itself. CMEK is supported by major cloud providers (e.g., AWS KMS, Azure Key Vault, Google Cloud KMS) and integrates with object storage services. The organization retains control over key lifecycle but delegates cryptographic operations to the provider.

Answer

Server-side encryption with cloud provider default keys

Answer

Customer-supplied encryption keys (CSEK)

Answer

Client-side encryption

Question 6

A security engineer is reviewing container security practices. Which tool is specifically designed to scan container images for Common Vulnerabilities and Exposures (CVEs)?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner specifically designed to scan container images, filesystems, and Git repositories for CVEs and misconfigurations. It integrates directly with container registries and CI/CD pipelines, making it the go-to tool for image security in cloud-native environments. Unlike the other options, Trivy's core function is vulnerability detection, not access control or runtime enforcement.

Answer

Kubernetes RBAC

Answer

Seccomp

Answer

OPA Gatekeeper

Question 7

What additional security benefit does a private network endpoint provide?

Accepted Answer

It ensures data is not traversing the public internet.. A private network endpoint (such as an interface or gateway endpoint) allows instances within a virtual network to privately connect to supported cloud services without requiring an internet gateway, NAT device, VPN connection, or dedicated connection. The core security benefit is that all traffic between the virtual network and the service stays entirely within the cloud provider's internal network and never traverses the public internet, eliminating exposure to internet-based threats.

Answer

It encrypts data in transit.

Answer

It provides an additional layer of authentication.

Answer

It enables cross-region replication.

Question 8

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

Accepted Answer

Modify the bucket policy to deny access from all IP addresses except trusted ranges.. The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Answer

Enable bucket logging to track access attempts.

Answer

Notify the security team and wait for a formal change request.

Answer

Enable server-side encryption on the bucket.

Question 9

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel

Question 10

An organization uses a multi-cloud strategy and wants to perform a risk assessment that accounts for the shared responsibility model. Which approach is most appropriate?

Accepted Answer

Use cloud-specific risk assessment frameworks like CSA STAR. CSA STAR (Security, Trust, Assurance, and Risk) is purpose-built for cloud environments and directly incorporates the shared responsibility model, providing a cloud-specific control framework (Cloud Controls Matrix) that maps to ISO 27001, NIST, and other standards. Because the organization operates multi-cloud, CSA STAR's provider-neutral, cloud-native controls allow consistent assessment across AWS, Azure, and GCP while explicitly delineating customer vs. provider responsibilities. This makes it the most appropriate basis for a shared-responsibility-aware risk assessment.

Answer

Use ISO 27001 controls as the sole basis for assessment

Answer

Apply the NIST Cybersecurity Framework across all cloud providers

Answer

Adopt COBIT for risk management alignment

Question 11

An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?

Accepted Answer

Enforcing security policies across cloud applications and controlling access. The primary function of a CASB is to enforce security policies and control access across cloud applications, acting as an intermediary between users and cloud providers. It provides visibility into cloud usage, applies data loss prevention (DLP) rules, and enforces authentication and authorization policies, which directly addresses the need to secure a legacy application migrated to the cloud.

Answer

Performing vulnerability scans on cloud infrastructure

Answer

Encrypting data at rest in cloud storage

Answer

Protecting against distributed denial-of-service (DDoS) attacks

Question 12

A cloud architect is designing a multi-cloud strategy to avoid vendor lock-in. Which three design considerations should be included? (Choose three.)

Accepted Answer

Implement abstraction layers such as containers or cloud-agnostic APIs. Option A is correct because abstraction layers such as containers (e.g., Docker images orchestrated by Kubernetes) and cloud-agnostic APIs (e.g., S3-compatible object storage, OpenTofu/Terraform) decouple workloads from any single provider's proprietary interfaces, making migration between clouds feasible. Option B is correct because designing applications as loosely coupled microservices, ideally packaged in portable containers and communicating over standard protocols like HTTP/REST or gRPC, allows individual services to be redeployed on another provider without rewriting the whole application. Option C is correct because using cloud-agnostic data formats and storage interfaces (e.g., Parquet, JSON, SQL, or S3-compatible APIs) prevents data from being trapped in a proprietary store and keeps it readable and movable across providers. Option D is incorrect because standardizing on a single cloud provider for core services increases vendor lock-in rather than avoiding it. Option E is incorrect because provider-specific APIs, while sometimes offering better performance or deeper feature integration, tightly couple the application to that vendor and undermine portability.

Answer

Standardize on one cloud provider for core services

Answer

Use provider-specific APIs for optimal performance

Question 13

A company is migrating its on-premises workloads to a public cloud environment. The security team is concerned about maintaining visibility into network traffic between virtual machines in the same virtual network. Which cloud architecture component should be implemented to address this concern?

Accepted Answer

Virtual network traffic mirroring. Virtual network traffic mirroring (or port mirroring) enables the capture and inspection of all network packets flowing between virtual machines within the same virtual network, including east-west traffic. This provides the security team with the deep packet visibility needed for threat detection, compliance auditing, and troubleshooting without requiring changes to the VM configurations or routing paths.

Answer

Security groups

Answer

Virtual private cloud (VPC) peering

Answer

Network access control lists (NACLs)

Question 14

A security analyst is investigating a data breach in a cloud environment. The analyst needs to preserve evidence for legal proceedings. Which of the following actions is most critical to ensure the chain of custody is maintained?

Accepted Answer

Begin a detailed log documenting all actions, timestamps, and personnel involved.. Maintaining a detailed log documenting all actions, timestamps, and personnel involved is the most critical action to ensure chain of custody. Chain of custody requires an unbroken record of who handled the evidence, when, and what they did, so that it is admissible in legal proceedings. While hashing, isolation, and notification are important, the log is the foundational element that ties everything together.

Answer

Calculate cryptographic hashes of all relevant files.

Answer

Isolate all affected systems from the network to prevent further data loss.

Answer

Immediately notify senior management and legal counsel.

Question 15

An organization attempts to launch an instance in a specific availability zone but the launch fails. What is the most likely cause of the failure?

Accepted Answer

Resource exhaustion in the availability zone. The most likely cause is resource exhaustion in the availability zone. This occurs when the cloud provider has insufficient capacity in a specific zone to fulfill a request, even if the requested resource type is available in the region. This is a transient condition, unlike quotas which are static limits. Instance type availability and region correctness would typically result in different error messages and are less likely to be the cause.

Answer

Instance type not available in that region

Answer

Incorrect region

Answer

Insufficient CPU quota