CCSP Practice Test 45 — 15 Questions

Question 1

A financial services company deploys a containerized application on Amazon ECS with Fargate. The application needs to access an encrypted RDS database. The security policy mandates that database credentials must never be stored in the application code or configuration files and must be rotated automatically every 90 days. Which solution should the DevOps team implement to satisfy these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store credentials in AWS Secrets Manager, grant ECS task role access, and enable automatic rotation. AWS Secrets Manager is the correct choice because it is designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 90 days) without storing them in code or configuration. By granting the ECS task role (via IAM) permission to access the secret, the Fargate task can retrieve the credentials at runtime using the AWS SDK or CLI, ensuring they are never hardcoded. This satisfies both the no-storage-in-code and automatic rotation requirements mandated by the security policy.

Answer

Encrypt credentials with AWS KMS and pass them as environment variables during task definition

Answer

Store credentials in AWS Systems Manager Parameter Store (SecureString) and retrieve them at container startup

Answer

Use a secrets vault like Hashicorp Vault deployed on EC2 and mount secrets via sidecar container

Question 2

A company wants to enforce that all API calls to its cloud services are authenticated and authorized. Which design pattern should be implemented?

Accepted Answer

Implement OAuth 2.0 with scopes. OAuth 2.0 with scopes is the correct design pattern because it provides a standardized, token-based authorization framework that allows fine-grained access control to API resources. Scopes define specific permissions (e.g., read, write) and are validated by the resource server, ensuring that each API call is both authenticated (via the access token) and authorized (via the scopes). This aligns with the principle of least privilege and is widely adopted for securing cloud APIs.

Answer

Use API keys with IP whitelisting

Answer

Allow basic authentication over HTTPS

Answer

Use shared secrets with HMAC

Question 3

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 4

A company is migrating to the cloud to reduce capital expenditures. They want to pay only for the resources they consume with no upfront investment. Which financial model does this describe?

Accepted Answer

Opex. The operating expenditure (Opex) model allows a company to pay for cloud resources on a consumption basis without any upfront capital investment. This aligns with the goal of reducing capital expenditures (Capex) by shifting costs to variable, pay-as-you-go operational expenses.

Answer

Amortization

Answer

Capex

Answer

Leasing

Question 5

A cloud application experiences intermittent failures during peak load. Logs show database connection timeouts. Which architecture change would best address this issue?

Accepted Answer

Implement connection pooling. Connection pooling reuses a set of established database connections, avoiding the overhead of repeatedly opening and closing connections during high concurrency. This directly resolves intermittent timeouts caused by connection exhaustion or slow connection establishment under peak load, without requiring additional infrastructure.

Answer

Enable auto-scaling on the application tier

Answer

Use read replicas

Answer

Increase database instance size

Question 6

Which THREE of the following are effective strategies for ensuring data backup integrity and recoverability in the cloud?

Accepted Answer

Maintain at least three copies of data across two different locations.. The 3-2-1 backup rule (three copies, two different media types, one offsite) is a foundational strategy for data durability and recoverability. In cloud environments, this typically means maintaining a primary copy, a local backup in a different availability zone, and a cross-region copy to protect against region-wide failures. This ensures that even if two copies are compromised, a third remains available for recovery.

Answer

Encrypt all backups with a strong algorithm.

Answer

Set backup schedules to run daily for all critical data.

Question 7

Which container image security practice is most effective at reducing the attack surface by removing unnecessary components and lowering the number of CVEs?

Accepted Answer

Using distroless base images. Distroless images contain only the application and its runtime dependencies, minimizing the attack surface.

Answer

Using the :latest tag for base images

Answer

Adding security agents inside the image

Answer

Scanning images only at build time

Question 8

A company stores sensitive data in cloud object storage and wants to protect against ransomware attacks that could encrypt or delete objects. Which TWO measures should they implement? (Choose two.)

Accepted Answer

Implement immutable storage (e.g., Object Lock). Option B (immutable storage such as Object Lock) is correct because it enforces WORM (write once, read many) protection, preventing objects from being modified or deleted for a defined retention period even by compromised or malicious accounts, which directly blocks ransomware encryption or deletion. Option D (object versioning) is correct because it preserves prior versions of each object, so if ransomware overwrites or encrypts the current version, the previous clean versions remain recoverable. Option A (cross-region replication) only copies data to another region and would replicate corrupted or encrypted objects too, so it does not protect against ransomware. Option C (signed URLs) merely grants time-limited access to specific objects and does not prevent an attacker with valid credentials from encrypting or deleting data. Option E (short object lifetimes via lifecycle policies) actually deletes objects sooner, which increases data loss risk rather than protecting against ransomware.

Answer

Use cross-region replication

Answer

Configure signed URLs for access

Answer

Set short object lifetimes using lifecycle policies

Question 9

A financial institution is implementing a data classification scheme for their cloud environment. They have data that, if exposed, could cause severe damage to the organization and is subject to strict regulatory requirements. Which classification level should be applied to this data?

Accepted Answer

Restricted. Restricted data is the highest classification level, typically used for data that, if compromised, could cause severe damage and is subject to strict regulations.

Answer

Confidential

Answer

Public

Answer

Internal

Question 10

A cloud security architect is designing a multi-tier application that processes sensitive customer data. To protect data in transit between the web tier and the application tier, which of the following is the MOST appropriate approach?

Accepted Answer

Use mutual TLS (mTLS) between the tiers. Mutual TLS (mTLS) is the most appropriate approach because it provides bidirectional authentication and encryption between the web tier and application tier. In a multi-tier application processing sensitive customer data, mTLS ensures that both the client (web tier) and server (application tier) present valid certificates, preventing man-in-the-middle attacks and unauthorized inter-tier communication. This is critical for protecting data in transit in zero-trust or internal network segments where simple server-side TLS would not verify the identity of the calling service.

Answer

Use standard TLS with server-side certificates only

Answer

Establish SSH tunnels for all inter-tier communication

Answer

Implement IPsec VPN between the tiers

Question 11

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Accepted Answer

Set the container to run as a non-root user. Option A is correct because configuring the container to run as a non-root user (e.g., via securityContext.runAsUser or runAsNonRoot: true) removes the root privileges that an attacker could leverage to exploit kernel vulnerabilities or access host resources during a container escape attempt. Option D is correct because dropping all Linux capabilities and then adding back only those explicitly required (using securityContext.capabilities.drop: ["ALL"]) follows the principle of least privilege, eliminating dangerous capabilities like CAP_SYS_ADMIN, CAP_NET_ADMIN, and CAP_SYS_PTRACE that are commonly abused in container escape techniques. Option B is incorrect because enabling host networking mode actually increases risk by removing network namespace isolation, allowing the container to access host network interfaces and services directly. Option C is incorrect because privileged containers disable nearly all security mechanisms (seccomp, AppArmor, capability restrictions) and grant full access to host devices, dramatically worsening escape risk. Option E is incorrect because mounting the host filesystem as read-write gives the container direct write access to host files, enabling tampering with system binaries or configuration to facilitate escape and persistence.

Answer

Enable host networking mode

Answer

Use a privileged container

Answer

Mount the host filesystem as read-write

Question 12

A security engineer needs to ensure that all API calls made to AWS resources are logged for auditing purposes. Which AWS service should be enabled to capture management events, data events, and provide log file validation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log API calls and actions taken within an AWS account, capturing management events (e.g., creating or deleting resources) and data events (e.g., S3 object-level operations). It also provides log file validation through digital signatures using SHA-256 hashing and RSA, ensuring the integrity and authenticity of the log files after they have been delivered.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS GuardDuty

Question 13

A client is negotiating a cloud service agreement and wants to conduct on-site audits of the provider's data centers. The provider argues that on-site audits are unnecessary due to SOC 2 reports. Which is the best approach for the client?

Accepted Answer

Request a right to review SOC 2 reports and conduct limited assessments. The client should request a right to review SOC 2 reports and conduct limited assessments because SOC 2 reports provide a point-in-time snapshot of controls, but they do not cover real-time operational changes, custom configurations, or specific contractual requirements. On-site audits may be impractical due to multi-tenancy and shared infrastructure, so a balanced approach of reviewing SOC 2 reports plus targeted assessments (e.g., reviewing evidence of key controls, interviewing staff, or examining specific systems) gives the client sufficient assurance without disrupting the provider's operations.

Answer

Insist on on-site audits

Answer

Terminate negotiations

Answer

Accept SOC 2 reports as sufficient

Question 14

A cloud security engineer is tasked with ensuring that all API calls made to AWS resources are logged for audit purposes. Which AWS service should be enabled to capture management events such as creating or deleting EC2 instances?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to record API activity in an AWS account, including management events such as creating or deleting EC2 instances. It captures the who, what, when, and source IP for every API call, which is essential for audit logging and compliance. AWS Config, by contrast, records resource configuration changes and compliance history, not API call logs.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Security Hub

Question 15

Which of the following is an example of a runtime application self-protection (RASP) capability?

Accepted Answer

Blocking an SQL injection attempt during execution. Runtime Application Self-Protection (RASP) is a security technology that integrates with an application's runtime environment to detect and block attacks in real time. Blocking an SQL injection attempt during execution is a classic RASP capability because it monitors the application's behavior and interrupts malicious activity as it happens. RASP operates within the application, analyzing both the application's logic and the data flow to prevent exploitation.

Answer

Checking for misconfigured S3 buckets

Answer

Analyzing logs after an attack

Answer

Scanning source code for vulnerabilities