CCSP Practice Test 46 — 15 Questions

Question 1

Which TWO responsibilities are typically shared between the cloud customer and the cloud provider in an IaaS model? (Choose two.)

Accepted Answer

Management of security group rules.. In an IaaS model, the cloud customer is responsible for managing security group rules, which act as virtual stateful firewalls controlling inbound and outbound traffic at the instance level. The cloud provider is responsible for the underlying network infrastructure, but the customer must configure these rules to enforce least-privilege access. This shared responsibility is explicitly defined in the AWS Shared Responsibility Model and similar frameworks.

Answer

Physical security of data centers.

Answer

Hypervisor security.

Answer

Patching the guest operating system.

Question 2

A financial services company uses a multi-region cloud deployment for its trading application. The application consists of a web frontend, a REST API, and a relational database. Recently, a penetration test revealed that an attacker could perform a time-based blind SQL injection through the API's search functionality. The injection allows the attacker to enumerate database contents by observing response times. The development team was already aware of the issue but had prioritized other features. The security team now demands immediate remediation. The application is critical and cannot be taken offline. Which of the following is the most effective immediate action to mitigate the risk without modifying the application code?

Accepted Answer

Deploy a Web Application Firewall (WAF) with a rule to block SQL injection patterns. A WAF can inspect incoming HTTP requests and block those matching SQL injection patterns (e.g., SQL keywords, special characters) without modifying application code. Since the vulnerability is a time-based blind SQL injection, a WAF with a dedicated SQL injection rule set can immediately stop the attack vector by filtering malicious payloads at the edge, providing a virtual patch while the code fix is developed. This is the only option that directly addresses the injection vector without requiring code changes or downtime.

Answer

Implement rate limiting on the API endpoint

Answer

Enable DDoS protection on the cloud load balancer

Answer

Enable transparent data encryption (TDE) on the database

Question 3

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Accepted Answer

Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles. AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Answer

Store credentials in the function code

Answer

Hardcode credentials in environment variables

Answer

Use database temporary tokens generated on the fly

Question 4

A company wants to encrypt data at rest in a cloud object storage service. They require that the cloud provider has no access to the encryption keys. Which key management approach should they use?

Accepted Answer

Client-side encryption. Client-side encryption (B) is the correct approach because the data is encrypted before it is sent to the cloud provider, ensuring that the cloud provider never has access to the plaintext data or the encryption keys. With server-side encryption, even if the keys are customer-managed and stored in a cloud HSM (A), the encryption and decryption operations occur on the provider's infrastructure, meaning the provider's software stack could theoretically access the keys or plaintext. Options C and D also involve server-side operations, where the cloud provider manages or processes the keys, violating the requirement that the provider has no access to the keys.

Answer

Server-side encryption with customer-managed keys stored in a cloud HSM

Answer

Server-side encryption with cloud-managed keys

Answer

Server-side encryption with envelope encryption

Question 5

An organization uses infrastructure as code (IaC) to deploy cloud resources. The security team wants to prevent misconfigurations such as open security groups from being deployed. Which two practices should be integrated into the IaC pipeline? (Select TWO)

Accepted Answer

Implement policy-as-code to enforce security rules. Policy-as-code (D) allows security rules to be defined in a machine-readable format (e.g., using Open Policy Agent or HashiCorp Sentinel) and automatically evaluated during the IaC pipeline, preventing non-compliant configurations from being deployed. Automated security scanning tools (E) analyze IaC templates (e.g., Terraform, CloudFormation) for known misconfigurations, such as overly permissive security group rules, before they reach production. Together, these practices enforce security guardrails early in the development lifecycle.

Answer

Limit access to the cloud management console

Answer

Perform manual code reviews for every change

Answer

Segment the network using security groups

Question 6

Which TWO of the following are effective methods for preventing hardcoded credentials from being committed to a cloud application's source code repository? (Select TWO)

Accepted Answer

Implementing pre-commit hooks with secret scanning. Pre-commit hooks with secret scanning (Option A) automatically scan code for patterns matching credentials (e.g., AWS access keys, passwords) before a commit is finalized. Tools like GitLeaks or TruffleHog integrate into the local Git workflow, blocking commits that contain secrets and preventing them from ever reaching the remote repository.

Answer

Disabling SSH keys for developers

Answer

Enforcing code reviews by senior developers

Answer

Encrypting the entire repository

Question 7

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

Accepted Answer

Configure a web application firewall (WAF) with rate limiting and IP blacklisting. A Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.

Answer

Rotate API keys more frequently

Answer

Implement cross-origin resource sharing (CORS) policies

Answer

Require encryption of session tokens

Question 8

A media streaming company uses a multi-cloud strategy with AWS and GCP. Their application uses a message queue (Amazon SQS and Google Pub/Sub) for asynchronous processing. The security team discovers that messages contain sensitive user data (e.g., email addresses) that are not encrypted at the broker level. The compliance team mandates encryption of data at rest and in transit for all sensitive data. However, the application already uses TLS for message delivery. What is the most secure and operationally efficient way to meet compliance?

Accepted Answer

Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service. Client-side encryption ensures that sensitive data is encrypted before it ever leaves the application, meeting the compliance mandate for encryption at rest and in transit regardless of the broker's native encryption capabilities. Since TLS already protects data in transit, adding client-side encryption with a centralized key management service (e.g., AWS KMS or GCP Cloud KMS) provides end-to-end confidentiality: the message payload is encrypted by the producer, remains encrypted in the queue, and is decrypted only by the authorized consumer. This approach is operationally efficient because it avoids vendor lock-in and works uniformly across AWS SQS and GCP Pub/Sub without relying on broker-specific SSE features that may not cover all states (e.g., broker logs or backups).

Answer

Enable server-side encryption with SQS (SSE-SQS) and Pub/Sub (CSEK) and rely on TLS for in transit

Answer

Separate sensitive and non-sensitive messages into different queues with different retention policies

Answer

Use a third-party encryption gateway that wraps messages before they reach the queues

Question 9

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Answer

AWS Config configuration history

Answer

AWS CloudTrail management events

Answer

Amazon S3 access logs

Question 10

Which THREE statements about tokenization compared to encryption are correct?

Accepted Answer

Tokenization is typically used for payment card data.. Tokenization is commonly used for payment card data (e.g., PCI DSS compliance) because it replaces sensitive PANs with non-sensitive tokens that have no exploitable value outside the tokenization system. This allows organizations to reduce their compliance scope by not storing actual card numbers, while encryption still leaves ciphertext that could be decrypted if keys are compromised.

Answer

Encryption is always more secure than tokenization.

Answer

Tokenization preserves data format and length.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. Which action is the user allowed to perform?

Accepted Answer

Read an existing object from the bucket.. The IAM policy grants the `s3:GetObject` action, which allows the user to read (download) an existing object from the specified S3 bucket. The policy explicitly allows this action for the bucket `my-bucket` and its objects, so the user can perform read operations on objects within that bucket.

Answer

Change the bucket's policy.

Answer

Upload a new object to the bucket.

Answer

Delete an object from the bucket.

Question 12

A large enterprise is migrating its data center workloads to a public cloud. The security policy requires that all sensitive data stored in cloud storage services be encrypted with keys managed by the enterprise's on-premises HSM. The cloud storage service offers server-side encryption with customer-provided keys. However, compliance regulations prohibit the transmission of encryption keys over the public internet. The enterprise also has a dedicated network connection to the cloud provider. The security team is considering several options. Which solution meets all requirements: (1) data encrypted at rest on the cloud service, (2) keys controlled by the enterprise, (3) keys never transmitted over the internet?

Accepted Answer

Use client-side encryption on-premises before uploading data, using keys from the HSM.. Client-side encryption encrypts data on-premises using keys from the enterprise's HSM before the data is ever transmitted to the cloud. This ensures the data is encrypted at rest in the cloud, the enterprise retains full control of the keys, and the keys never traverse any network—public or private—to the cloud provider. The dedicated network connection is irrelevant for key transmission since the keys never leave the on-premises HSM.

Answer

Use a cloud-based HSM and keep the key material in the cloud HSM.

Answer

Use server-side encryption with customer-provided keys with the enterprise's HSM, sending keys over the dedicated network connection as it is private.

Answer

Use server-side encryption with a key management service using an imported key material protected by the enterprise's HSM, accessed via the key management service API over the dedicated network connection.

Question 13

A software company develops a mobile application that communicates with a cloud backend using REST APIs. The application uses OAuth 2.0 with the authorization code grant and PKCE for authentication. After a security audit, the team identifies that the backend API accepts both a client secret (from the authorization code grant) and a PKCE code verifier. The security team wants to remove unnecessary attack surface. Which change should be made?

Accepted Answer

Remove the client_secret parameter from the token endpoint and rely solely on PKCE. PKCE (Proof Key for Code Exchange, RFC 7636) was specifically designed to secure the authorization code grant for public clients like mobile apps, where a client secret cannot be reliably kept confidential. By removing the client_secret parameter and relying solely on PKCE, the team eliminates an unnecessary attack surface—since the secret is effectively a static credential that can be extracted from the app binary—while maintaining strong protection against authorization code interception attacks. The backend should enforce PKCE verification using the code_challenge and code_verifier, making the client_secret redundant for public clients.

Answer

Switch to the implicit grant (response_type=token) to avoid client secrets

Answer

Keep both mechanisms but use short-lived tokens to reduce risk

Answer

Require a stronger client secret (e.g., 256-bit) and store it in the app's encrypted storage

Question 14

An organization uses a cloud database service and needs to protect data at rest. They enable Transparent Data Encryption (TDE) with a customer-managed key stored in the cloud provider's key management service. Which additional control should they implement to ensure the key cannot be used by unauthorized personnel?

Accepted Answer

Implement key rotation with a short rotation interval. Implementing key rotation with a short interval ensures that even if a customer-managed key is compromised or accessed by unauthorized personnel, the window of exposure is minimized. TDE with a customer-managed key in a cloud KMS relies on the key's secrecy; frequent rotation invalidates older key material, reducing the risk of long-term unauthorized decryption of data at rest.

Answer

Enable SSL/TLS for all database connections

Answer

Enable audit logging on key management operations

Answer

Disable automatic key rotation and rely on manual rotation

Question 15

A defense contractor uses a cloud provider that is FedRAMP authorized at the Moderate impact level. The contractor's contract requires compliance with DFARS 252.204-7012, which mandates safeguarding covered defense information (CDI) and reporting cyber incidents. The contractor's security team wants to ensure the cloud provider's security controls are adequate. The provider offers a FedRAMP package that includes a System Security Plan (SSP) and a Security Assessment Report (SAR). The contractor's legal department has determined that if the provider is FedRAMP authorized, the audit requirements are satisfied. What is the most efficient way to verify compliance?

Accepted Answer

Use the FedRAMP authorization letter as evidence without further audit.. The FedRAMP authorization letter is the most efficient verification because FedRAMP Moderate authorization is explicitly recognized by the DoD as meeting the security control baseline for DFARS 252.204-7012. The legal department has already determined that FedRAMP authorization satisfies audit requirements, so no additional analysis of the SSP/SAR or third-party testing is needed. Using the authorization letter alone avoids redundant effort while still providing auditable evidence of compliance.

Answer

Request the provider's SSP and SAR and compare against DFARS requirements.

Answer

Engage a third-party auditing firm to assess the provider.

Answer

Perform an independent penetration test on the provider's infrastructure.