CCSP Practice Test 46 — 15 Questions

Question 1

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It enables early detection of vulnerabilities before deployment. Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

Answer

It identifies runtime vulnerabilities such as SQL injection

Answer

It reduces false positives compared to dynamic analysis

Answer

It scans running applications to find configuration issues

Question 2

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

Accepted Answer

Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles. AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Answer

Store credentials in the function code

Answer

Hardcode credentials in environment variables

Answer

Use database temporary tokens generated on the fly

Question 3

A security architect is designing a cloud-native application using microservices. They decide to implement mutual TLS (mTLS) for service-to-service communication in a Kubernetes cluster with hundreds of services. What is the primary challenge in managing mTLS certificates in this dynamic environment?

Accepted Answer

Certificate revocation and rotation. In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Answer

High latency due to encryption overhead

Answer

Incompatibility with HTTP/2

Answer

Increased complexity in load balancer configuration

Question 4

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 5

A security engineer is investigating an incident where an attacker exploited a server-side request forgery (SSRF) vulnerability in a cloud application. The application runs in a cloud environment and uses internal metadata endpoints. Which mitigation should be prioritized to prevent future SSRF attacks?

Accepted Answer

Restrict outbound network access from the application instances using network security controls. Restricting outbound network access from application instances using security groups directly prevents the application from reaching internal metadata endpoints and other internal services. This is a fundamental network-layer control that stops SSRF attacks at the source, regardless of input validation or request inspection, by blocking the outbound traffic that the attacker would exploit.

Answer

Implement input validation to block malicious URLs

Answer

Deploy a web application firewall (WAF) to inspect outgoing requests

Answer

Require token-based authentication for metadata service access

Question 6

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

Accepted Answer

Private cloud. Private cloud (Option C) is correct because it is a single-tenant environment where the cloud infrastructure is dedicated exclusively to one organization, providing the highest level of isolation between tenants. In a private cloud, network segmentation is achieved through technologies such as VLANs (IEEE 802.1Q), VXLANs (RFC 7348), and dedicated hypervisor-level resource pools, ensuring that no other tenant's workloads share the same physical or virtual resources. This eliminates the multi-tenancy risks inherent in public and community clouds, where isolation relies on shared infrastructure and logical separation mechanisms like hypervisor-enforced memory isolation and network overlays.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 7

Which of the following is the best way to protect a web application from cross-site scripting (XSS) attacks?

Accepted Answer

Use a combination of input validation, output encoding, and Content Security Policy.. Cross-site scripting (XSS) attacks exploit multiple vectors, and no single defense is sufficient. Input validation prevents malicious payloads from being stored or processed, output encoding ensures that any residual dangerous characters are rendered inert in the HTML context, and Content Security Policy (CSP) provides a robust, browser-enforced layer that can block inline scripts and restrict script sources even if other defenses fail. This defense-in-depth approach aligns with the OWASP XSS prevention cheat sheet and is the recommended strategy for cloud-hosted web applications.

Answer

Encode all output that is rendered in HTML.

Answer

Implement a Content Security Policy (CSP) as the sole defense.

Answer

Validate all user input on the server side.

Question 8

A software company develops a mobile application that communicates with a cloud backend using REST APIs. The application uses OAuth 2.0 with the authorization code grant and PKCE for authentication. After a security audit, the team identifies that the backend API accepts both a client secret (from the authorization code grant) and a PKCE code verifier. The security team wants to remove unnecessary attack surface. Which change should be made?

Accepted Answer

Remove the client_secret parameter from the token endpoint and rely solely on PKCE. PKCE (Proof Key for Code Exchange, RFC 7636) was specifically designed to secure the authorization code grant for public clients like mobile apps, where a client secret cannot be reliably kept confidential. By removing the client_secret parameter and relying solely on PKCE, the team eliminates an unnecessary attack surface—since the secret is effectively a static credential that can be extracted from the app binary—while maintaining strong protection against authorization code interception attacks. The backend should enforce PKCE verification using the code_challenge and code_verifier, making the client_secret redundant for public clients.

Answer

Switch to the implicit grant (response_type=token) to avoid client secrets

Answer

Keep both mechanisms but use short-lived tokens to reduce risk

Answer

Require a stronger client secret (e.g., 256-bit) and store it in the app's encrypted storage

Question 9

A cloud application uses OAuth 2.0 for authorization. What is the primary purpose of using a refresh token in this flow?

Accepted Answer

To obtain a new access token when the current one expires without user interaction.. In OAuth 2.0, access tokens are short-lived by design to limit the window of compromise. A refresh token is a long-lived credential that allows the client to obtain a new access token from the authorization server without requiring the user to re-authenticate or re-consent. This enables seamless, ongoing access to protected resources while maintaining security through short-lived access tokens.

Answer

To grant the same access token indefinitely.

Answer

To authenticate the user without a password.

Answer

To store user credentials on the resource server for later use.

Question 10

An organization is designing a cloud application that must remain available even if an entire AWS availability zone fails. Which architecture pattern should they implement?

Accepted Answer

Single region with multiple AZs active-active. The correct architecture is a single region with multiple Availability Zones (AZs) in an active-active configuration. This ensures that if one AZ fails, the application continues to serve traffic from the remaining AZs without any manual intervention, as all AZs are actively handling requests. AWS Availability Zones are physically separate data centers within a region, and an active-active pattern distributes the workload across them to achieve high availability and fault tolerance.

Answer

Single region with multiple AZs active-standby

Answer

Active-passive in a single region

Answer

Multi-region active-active

Question 11

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

Accepted Answer

Configure a SecurityContext with runAsNonRoot: true and readOnlyRootFilesystem: true. Kubernetes SecurityContext allows fine-grained control over container permissions at the pod or container level. Setting `runAsNonRoot: true` ensures the container cannot run as UID 0, and `readOnlyRootFilesystem: true` mounts the container's root filesystem as read-only, preventing unauthorized writes at runtime. This directly satisfies the security team's requirements without relying on external policies or image-level configurations.

Answer

Use a RuntimeClass that disables root capabilities

Answer

Set the container's user to a non-root user in the Dockerfile

Answer

Apply a PodSecurityPolicy that blocks privileged containers

Question 12

A company develops a microservices application and wants to ensure secrets such as API keys and database credentials are not exposed in container images. Which approach best meets this requirement?

Accepted Answer

Use a secrets management service such as HashiCorp Vault to inject secrets at runtime.. A secrets management service like HashiCorp Vault allows secrets to be dynamically injected into containers at runtime, ensuring they never reside in the image. This approach decouples secrets from the application artifact, adhering to the principle of least privilege and immutable infrastructure. Vault can inject secrets via sidecar containers, init containers, or API calls, preventing exposure in image layers or configuration files.

Answer

Hardcode secrets in the application code and obfuscate with encryption.

Answer

Pass secrets as environment variables during container deployment.

Answer

Store secrets in a separate configuration file within the image.

Question 13

A security team wants to detect container image vulnerabilities before they are pushed to a registry. Which stage of the CI pipeline should container image scanning occur?

Accepted Answer

After build and before push to registry. Scanning container images after build but before push ensures vulnerabilities are caught early and not deployed.

Answer

During runtime in production

Answer

After deployment to production

Answer

After push to registry and before deployment

Question 14

A company has a contractual requirement that the CSP must delete all customer data within 30 days of contract termination. Which document should specify this requirement?

Accepted Answer

Data Processing Agreement (DPA). The Data Processing Agreement (DPA) outlines data handling obligations, including deletion requirements. SLAs cover performance, BAAs are for HIPAA, and MOUs are high-level.

Answer

Business Associate Agreement (BAA)

Answer

Memorandum of Understanding (MOU)

Answer

Service Level Agreement (SLA)

Question 15

An organization uses a private artifact registry for approved packages. What attack does this practice primarily defend against?

Accepted Answer

Dependency confusion attacks. A private artifact registry restricts package resolution to a curated, organization-controlled source, so an attacker cannot trick the build system into pulling a malicious package with the same name from a public repository. Dependency confusion exploits the fact that public registries are often checked before or alongside private ones, allowing a higher-versioned public package to override the internal one. By using only a private registry, the organization removes that public lookup path entirely.

Answer

Denial of service attacks

Answer

Man-in-the-middle attacks

Answer

Injection attacks