CCSP Practice Test 45 — 15 Questions

Question 1

Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the source IP address against the company's approved IP ranges.. The first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.

Answer

Immediately revoke all admin privileges for the user.

Answer

Review the key pair's usage to see if it was used to launch instances.

Answer

Delete the key pair immediately to prevent any misuse.

Question 2

An enterprise uses a cloud-based relational database service (e.g., AWS RDS) to store customer order data. The database is encrypted at rest using the cloud provider's default encryption. The security team is concerned about the risk of a rogue database administrator (DBA) exfiltrating data by creating unencrypted backups or snapshots and moving them to a different account. Which of the following controls would BEST mitigate this risk while maintaining operational efficiency?

Accepted Answer

Use a customer-managed key (CMK) in KMS and configure the database to use that key for encryption, and restrict the DBA's IAM permissions to prevent using the key on snapshots.. Using a customer-managed key (CMK) in AWS KMS allows the organization to attach a key policy that explicitly denies the DBA's IAM role the kms:Decrypt permission on the CMK when used with snapshot operations. This prevents the DBA from creating an unencrypted snapshot or from copying an encrypted snapshot to another account, as the snapshot would remain encrypted with the CMK and the DBA cannot decrypt it. This maintains operational efficiency because the DBA can still perform routine database management tasks (e.g., creating backups) but cannot exfiltrate data via snapshots.

Answer

Disable the ability for any user to create database snapshots.

Answer

Implement database activity monitoring (DAM) to alert on snapshot creation.

Answer

Enable automatic snapshot encryption and ensure that only the database service role can access snapshots.

Question 3

A fintech startup deploys a customer-facing web application on Azure App Service. The application uses OAuth 2.0 with Azure AD for authentication. Recently, users report being logged out unexpectedly during active sessions. Security logs show multiple token refresh attempts failing with 'invalid_grant' errors. The application uses a standard library for token management. What is the most likely cause and recommended action?

Accepted Answer

The access token and refresh token lifetimes are misconfigured; align token lifetimes. The 'invalid_grant' error during token refresh typically indicates that the refresh token has expired or been revoked. In Azure AD, refresh token lifetimes are configurable and, if set too short or misaligned with the access token lifetime, users will be logged out unexpectedly when the refresh token expires before a new access token is requested. The standard library correctly handles the OAuth 2.0 flow, but the token lifetime configuration in the Azure AD app registration is the root cause.

Answer

The Azure AD API is throttling requests; implement exponential backoff

Answer

The authorization code was reused; implement PKCE to prevent reuse

Answer

The user consent was revoked; advise users to re-consent

Question 4

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

Accepted Answer

Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.. The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Answer

Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.

Answer

Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.

Answer

Implement a data classification policy to label all data assets according to sensitivity.

Question 5

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Accepted Answer

Delete the Lambda function. Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Answer

Disable CloudTrail logging in the affected region

Answer

Place the function in a quarantine VPC

Question 6

A company is migrating healthcare data to the cloud and must comply with HIPAA. They need to sign a Business Associate Agreement (BAA) with the CSP. What key element must be included in the BAA?

Accepted Answer

Permitted uses and disclosures of protected health information (PHI). A Business Associate Agreement (BAA) must specify the permitted uses and disclosures of protected health information (PHI) by the business associate, which is a fundamental requirement under HIPAA. Option A is wrong because while encryption requirements are often included in a BAA, they are not the key element; permitted uses are more essential. Option B is wrong because audit log retention period is an operational detail, not a core element. Option C is wrong because breach notification timeframe is important but secondary to defining permitted uses and disclosures.

Answer

Data encryption requirements for data at rest and in transit

Answer

Audit log retention period for access to PHI

Answer

Breach notification timeframe to the covered entity

Question 7

A security team is investigating a potential credential compromise in a cloud environment. They have cloud audit logs showing a user's access key was used to provision compute instances in a geographic region where the user has never operated. What is the BEST course of action to confirm and contain the incident?

Accepted Answer

Check cloud audit logs for the access key events, then rotate the access key.. The first step in confirming a potential credential compromise is to verify that the anomalous activity (instance launches in an unfamiliar region) is indeed associated with the specific access key in the audit logs. Once confirmed, rotating the key (i.e., deactivating the old key and issuing a new one) immediately invalidates the compromised credential, stopping any further unauthorized use while preserving the user's ability to operate with a new key. This aligns with cloud security incident response best practices for credential compromise.

Answer

Create a new access policy to deny all actions for that user.

Answer

Immediately delete all compute instances launched by that user.

Answer

Disable the user's console access and delete the access key.

Question 8

A security team wants to detect when the root user account is used in a cloud environment. Which service can generate an alert for this activity?

Accepted Answer

Threat detection service. A threat detection service is designed to continuously monitor for malicious or unauthorized behavior, including the use of the root user account. It uses machine learning and integrated threat intelligence to generate findings for such activities, which can then trigger alerts via event notification services. This makes it the correct choice for detecting root user usage.

Answer

Activity logging service

Answer

Configuration monitoring service

Answer

Security posture management service

Question 9

A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?

Accepted Answer

Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections. The root cause is that the application is accessible via HTTP due to a misconfiguration, allowing session tokens to be intercepted in transit despite HTTPS being available. Implementing HTTP Strict Transport Security (HSTS) forces the browser to always use HTTPS, preventing any HTTP connections and thus eliminating the interception vector. This directly addresses the misconfiguration before other controls, which would only mitigate but not prevent the theft.

Answer

Use IP address binding for session tokens

Answer

Switch from OAuth to SAML for authentication

Answer

Shorten the session token expiration time

Question 10

A healthcare organization is planning to use a cloud provider to host protected health information (PHI) subject to HIPAA. Which THREE requirements must be addressed before the organization can lawfully use the cloud for PHI? (Choose three.)

Accepted Answer

Configure access controls to limit PHI access to authorized personnel. Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with the cloud provider, ensure encryption of PHI at rest and in transit, and implement access controls. Penetration testing is not a HIPAA requirement but a good practice, and data portability is not a HIPAA requirement.

Answer

Implement data portability features to export PHI

Answer

Conduct quarterly penetration testing on the cloud infrastructure

Question 11

A financial services company is migrating its customer account management system to a public cloud provider. The company is subject to SOX compliance requirements for internal controls over financial reporting. Which TWO controls are essential for the cloud environment to meet SOX IT general control requirements? (Choose two.)

Accepted Answer

Establishing a formal change management process. SOX requires IT general controls (ITGC) for systems that support financial reporting. Change management ensures that changes to the system are authorized and tested, and audit logs provide evidence of user activities and system events. While encryption and backup are important security measures, they are not specifically ITGC requirements under SOX.

Answer

Enforcing role-based access control with least privilege

Answer

Implementing encryption for data at rest and in transit

Answer

Configuring automated backups with daily snapshots

Question 12

Which TWO data lifecycle stages are most critical for applying encryption controls in a cloud object storage service? (Choose two.)

Accepted Answer

Data in transit. Encryption for data in transit (e.g., TLS 1.3) protects data as it moves between the client and the cloud object storage service, preventing interception or man-in-the-middle attacks. Data at rest encryption (e.g., server-side encryption with AES-256) protects stored objects from unauthorized access, whether from compromised infrastructure or misconfigured access controls. These two stages cover the primary threat vectors for cloud object storage: network interception and storage compromise.

Answer

Data in use

Answer

Data deletion

Answer

Data creation

Question 13

During litigation, a company receives a legal hold notice for electronically stored information (ESI) in a cloud environment. The cloud provider's standard service agreement includes a clause that automatically deletes data 30 days after termination of service. What should the company do to ensure compliance?

Accepted Answer

Notify the provider to preserve the data. A legal hold notice imposes a duty to preserve relevant ESI. The company must notify the cloud provider to suspend any automatic deletion policies, such as the 30-day post-termination deletion clause, to ensure data is preserved in accordance with eDiscovery obligations under FRCP Rule 37(e) or similar regulations.

Answer

Ignore the legal hold notice

Answer

Download all data immediately

Answer

Terminate the account to stop further processing

Question 14

A company runs its production workloads on a cloud infrastructure-as-a-service (IaaS) platform. The security operations team uses a SIEM to monitor security events. Over the past week, they have observed an increasing number of alerts indicating failed login attempts to a critical database server. The source IP addresses are varied and originate from different geographic regions. The team has also noticed that the database server's CPU usage has spiked during non-business hours. The database is not exposed to the internet; it is in a private subnet. The security team suspects that the database credentials have been compromised. Which of the following actions should the security team take FIRST to mitigate the risk?

Accepted Answer

Rotate the database credentials immediately. Rotating the database credentials immediately is the first priority because it stops any ongoing unauthorized access. The failed login attempts indicate the credentials are compromised, so changing them directly mitigates the risk. Option A is incorrect because conducting a forensic investigation should come after containment; the immediate focus is stopping the attack. Option B is incorrect because blocking IPs is ineffective since the source IPs are varied and dynamic. Option C is incorrect because enabling multi-factor authentication is a good security improvement but does not stop an attacker who already has valid credentials; credential rotation is the immediate step.

Answer

Conduct a forensic investigation to determine how the credentials were compromised

Answer

Block the source IP ranges identified in the SIEM alerts at the network firewall

Answer

Enable multi-factor authentication on the database server

Question 15

A cloud architect is designing key management for a multi-tenant SaaS application. The architect must ensure that each customer's encryption keys are isolated and that the cloud provider cannot access the keys. Which TWO key management strategies meet these requirements? (Select TWO.)

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it reaches the cloud, so the cloud provider never sees plaintext or keys. Hold Your Own Key (HYOK) keeps the key on-premises in an HSM, never exposing it to the cloud. Both give the customer exclusive control.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption