CCSP Practice Test 44 — 15 Questions

Question 1

A multinational corporation operates a cloud-based application that stores customer data across multiple regions to comply with local data residency laws. The application is deployed on virtual machines in a Infrastructure as a Service (IaaS) environment. Recently, the compliance team discovered that some user data from the European region was accidentally stored in a storage bucket located in the United States due to a misconfigured storage class. The company needs to immediately ensure that no further data breaches occur and that all future data storage actions comply with regional restrictions. The cloud architect proposes implementing a data loss prevention (DLP) solution, but the compliance team wants a more preventative approach. Which of the following is the BEST course of action to prevent this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a policy to deny creation of storage resources in unauthorized regions at the organizational level.. An organization policy can centrally deny creation of storage resources in unauthorized regions across the entire organization, providing a preventative control that cannot be overridden by users.

Answer

Configure a network firewall to block traffic to the IP addresses of storage endpoints in unauthorized regions.

Answer

Apply a tag to all storage resources that must remain in a specific region and enable a tag-based policy to enforce location.

Answer

Implement a DLP solution that scans all uploads and rejects those not meeting location requirements.

Question 2

A cloud security team wants to automatically detect and remediate S3 buckets that are publicly accessible. Which combination of AWS services can achieve this?

Accepted Answer

AWS Config and AWS Lambda. AWS Config continuously evaluates S3 bucket configurations against rules (e.g., s3-bucket-public-read-prohibited) and can trigger an AWS Lambda function via Amazon EventBridge when a non-compliant change is detected. The Lambda function then automatically applies a remediation action, such as removing the public access block or updating the bucket policy, achieving automated detection and remediation without manual intervention.

Answer

Amazon Inspector and AWS Security Hub

Answer

AWS WAF and Amazon Route 53

Answer

AWS CloudTrail and Amazon GuardDuty

Question 3

You are a cloud security engineer for a financial services company. The company has developed a cloud-native application that processes credit card transactions and stores sensitive financial data. The application is deployed on a Kubernetes cluster in a public cloud provider. The compliance team requires that all data at rest be encrypted using a customer-managed key (CMK) with automatic rotation. The application uses a managed database service (e.g., Amazon RDS) and object storage (e.g., Amazon S3) for storing transaction logs. The current configuration uses cloud-provider-managed keys for both services. The development team is concerned that enabling CMK with automatic rotation might cause application downtime due to key rotation latency. Additionally, the security team wants to ensure that access to the keys is auditable. Which course of action BEST addresses the compliance requirement while minimizing risk?

Accepted Answer

Create a CMK with automatic rotation enabled, grant the database and storage service access via IAM roles, and validate the rotation process in a staging environment before production deployment.. It directly satisfies the compliance requirement for customer-managed keys (CMK) with automatic rotation, while mitigating the risk of downtime by validating the rotation process in a staging environment. Using IAM roles to grant the database and storage service access to the CMK ensures that key access is auditable via CloudTrail, meeting the security team's audit requirement. This approach allows the development team to test and confirm that key rotation latency does not cause application downtime before production deployment.

Answer

Continue using cloud-provider-managed keys and implement additional logging to meet audit requirements.

Answer

Use a CMK with manual rotation to have full control over the rotation schedule and avoid any potential downtime.

Answer

Implement client-side encryption with a key stored in a secure vault and disable server-side encryption.

Question 4

A cloud architect is designing a disaster recovery (DR) solution for a critical application with a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 5 minutes. The application runs on virtual machines in a private cloud. The architect is considering using a colocation facility as the DR site. Which replication method will meet the RPO requirement?

Accepted Answer

Periodic snapshots every 5 minutes. Synchronous replication can achieve an RPO of zero, which surpasses the 5-minute requirement, but it may not be suitable for this scenario due to network latency or cost constraints over a WAN link to a colocation facility. Periodic snapshots every 5 minutes exactly match the RPO and are more practical for a private cloud to colocation DR setup, capturing the VM state at the required interval without the complexity or latency constraints of synchronous replication.

Answer

Synchronous replication

Answer

Periodic snapshots every 15 minutes

Answer

Asynchronous replication with a delay of 10 minutes

Question 5

A cloud architect is designing a cost-optimized architecture for a batch processing job that runs once per day. The job requires high compute capacity for approximately 5 hours. Which cloud service model is most suitable?

Accepted Answer

Spot instances. Spot instances are the most suitable for this batch processing job because they offer significant cost savings (up to 90% compared to on-demand) and are ideal for fault-tolerant, stateless workloads that can handle interruptions. The job runs once per day for only 5 hours, so it can easily be designed to checkpoint progress and resume if a spot instance is reclaimed, making the cost-optimized choice clear.

Answer

Reserved instances

Answer

On-demand instances

Answer

Dedicated hosts

Question 6

A security engineer is evaluating vulnerability management options for cloud workloads and wants to identify vulnerabilities without installing agents on the operating system. Which approach should be used?

Accepted Answer

Agentless scanning using cloud API-based assessment. Agentless scanning leverages cloud provider APIs (e.g., for configuration and asset inventory) to assess the configuration and patch state of cloud workloads without requiring an OS-level agent. This approach directly meets the requirement of identifying vulnerabilities without installing agents on the operating system, as it reads metadata and configuration snapshots from the cloud control plane.

Answer

Network-based vulnerability scanning

Answer

Agent-based scanning using a cloud-specific vulnerability scanner

Answer

Container image scanning in a registry

Question 7

During a forensic investigation of a compromised AWS account, the incident response team needs to determine the exact time an attacker created a new IAM user and what permissions were assigned. Which log source would provide the most reliable evidence?

Accepted Answer

AWS CloudTrail management events. AWS CloudTrail management events capture all API calls made to the AWS Management Console, SDKs, CLI, and AWS services, including IAM CreateUser and AttachUserPolicy actions. These events record the exact timestamp, source IP, user agent, and the identity of the principal making the call, making them the definitive source for determining when an IAM user was created and what permissions were assigned.

Answer

AWS Config configuration history for the IAM user

Answer

S3 access logs for the bucket containing IAM policy files

Answer

VPC Flow Logs for the management console IP

Question 8

Match each IAM term to its definition.

Accepted Answer

Federation: A trust relationship between two or more domains that allows users to access resources using their home domain credentials.. IAM concepts are fundamental to cloud security; federation enables cross-domain authentication.

Answer

Federation: A method of access control based on user roles.

Answer

SSO: A system requiring multiple authentication factors.

Question 9

Which THREE components are essential for establishing a secure baseline configuration for a cloud virtual machine? (Choose three.)

Accepted Answer

Removing unnecessary software and services from the OS.. Removing unnecessary software and services from the OS reduces the attack surface by eliminating potential vulnerabilities and backdoors. A secure baseline configuration must minimize the number of running components to only those required for the VM's intended function, following the principle of least functionality.

Answer

Running applications as a service account.

Answer

Configuring network security groups at the subnet level.

Question 10

A security architect is designing access controls for a cloud-based microservices application. Which approach best aligns with the principle of least privilege for service-to-service authentication?

Accepted Answer

Implement mutual TLS with unique certificates per service. Mutual TLS (mTLS) with unique certificates per service enforces least privilege by ensuring each microservice authenticates with a distinct identity, and access can be scoped to specific certificates. This prevents a compromised service from impersonating others, as each service has its own private key and certificate, and the TLS handshake requires both sides to present and validate certificates.

Answer

Use long-lived bearer tokens

Answer

Assign IAM roles with broad permissions

Answer

Use a shared API key across all services

Question 11

A financial services firm is designing a cloud environment that must comply with PCI DSS. The security architect proposes using a virtual private cloud (VPC) with subnets, security groups, and network ACLs. However, the compliance officer is concerned about the risk of data exposure due to misconfiguration. Which additional control would BEST address this concern?

Accepted Answer

Integrate Cloud Security Posture Management (CSPM). CSPM tools continuously monitor cloud infrastructure configurations against compliance frameworks like PCI DSS, automatically detecting misconfigurations such as overly permissive security group rules or network ACLs that could expose cardholder data. This directly addresses the compliance officer's concern about data exposure due to misconfiguration by providing real-time visibility and remediation guidance, which is more proactive than the other options.

Answer

Use a Web Application Firewall (WAF)

Answer

Implement a Security Information and Event Management (SIEM) system

Answer

Deploy Data Loss Prevention (DLP) tools

Question 12

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

Accepted Answer

Implement a process to request immediate deletion from the provider and verify completion within 30 days.. The bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Answer

Store all customer data on-premises and only use the cloud for non-sensitive data.

Answer

Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

Answer

Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

Question 13

A cloud application uses AWS Lambda functions in a serverless architecture. The security team wants to enforce least privilege access for these functions. Which THREE practices should be implemented?

Accepted Answer

Use AWS Parameter Store or Secrets Manager for sensitive data. AWS Parameter Store or Secrets Manager are correct because they provide secure, auditable storage for sensitive data like database credentials and API keys. Lambda functions can retrieve these values at runtime via the AWS SDK, avoiding hard-coded secrets in code or environment variables. This aligns with the principle of least privilege by granting the Lambda IAM role only the specific permissions needed to access the secret, not the secret value itself in plaintext.

Answer

Store secrets in Lambda environment variables encrypted with KMS

Answer

Use a single IAM role for all Lambda functions for simplicity

Question 14

Which TWO of the following are best practices for monitoring a cloud environment to detect security incidents?

Accepted Answer

Centralize logs from all cloud services into a single analytics platform.. Centralizing logs from all cloud services into a single analytics platform (e.g., SIEM like Splunk or AWS Security Hub) enables correlation across disparate data sources, which is essential for detecting multi-vector attacks. This practice aligns with the NIST SP 800-92 log management guidelines and the CCSP domain of Cloud Security Operations, as it provides a unified view for threat detection and incident response.

Answer

Enable all available log sources to ensure complete visibility.

Answer

Monitor only network flow logs to reduce data volume.

Answer

Conduct manual log reviews on a weekly basis to identify anomalies.

Question 15

A developer wants to ensure that sensitive data in a cloud database is protected even if the database backup files are stolen. Which best practice should be implemented?

Accepted Answer

Enable transparent data encryption (TDE) with customer-managed keys for the database and its backups.. Transparent Data Encryption (TDE) with customer-managed keys encrypts the database at rest and, when properly configured, also encrypts backup files. This ensures that even if backup files are stolen, the data remains unreadable without the decryption keys, providing a strong defense against data breaches involving physical or logical theft of backups.

Answer

Restrict access to the backup files using IAM roles.

Answer

Use a virtual private cloud (VPC) to isolate the database from the internet.

Answer

Implement data tokenization for all sensitive fields.