CCSP Practice Test 47 — 15 Questions

Question 1

An organization uses cloud object storage for backup data and requires that once written, data cannot be modified or deleted for a specified retention period. Which feature should they enable?

Accepted Answer

Object lock with write-once-read-many (WORM) protection. Object lock with WORM protection is the correct feature because it enforces a retention policy that prevents any user, including the root account, from modifying or deleting objects until the retention period expires. This is specifically designed for compliance requirements such as SEC 17a-4(f) and ensures data immutability at the object level, which bucket versioning, encryption, or lifecycle rules cannot guarantee.

Answer

Bucket versioning

Answer

Encryption at rest with customer-managed keys

Answer

Lifecycle management to expire objects old objects

Question 2

Which TWO of the following are recommended practices for securing container images in a cloud environment? (Select TWO)

Accepted Answer

Scanning images for vulnerabilities in the CI pipeline. Option B is correct because integrating image vulnerability scanning (e.g., with tools like Trivy, Clair, or Amazon ECR image scanning) directly into the CI pipeline catches known CVEs in base images and dependencies before they are pushed to a registry or deployed, shifting security left. Option E is correct because cryptographically signing images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) lets orchestrators and admission controllers verify image provenance and integrity, preventing tampered or unauthorized images from running. Option A is wrong because the 'latest' tag is mutable and non-deterministic, so it undermines reproducibility and can silently pull a vulnerable or unexpected build. Option C is wrong because running containers as root violates least privilege and increases the blast radius of a container escape. Option D is wrong because public registries expose images to unauthorized pulls and potential tampering; private, access-controlled registries are the recommended practice.

Answer

Using the latest tag for all images

Answer

Running containers as root user

Answer

Storing images in a public registry for easier access

Question 3

During a security audit, a cloud security architect discovers that a cloud storage bucket is configured with a bucket policy that allows read access to objects from any principal. What is the most likely risk?

Accepted Answer

Potential for data exfiltration by unauthorized users. A bucket policy allowing read access to objects from any principal means anyone on the internet can list and download objects, leading to potential data exfiltration. This is a classic cloud storage misconfiguration where sensitive data becomes publicly accessible without authentication. The primary risk is unauthorized disclosure of data, not performance or cost issues.

Answer

Denial of service from excessive requests

Answer

Insufficient logging of access

Answer

Increased cost due to excessive write operations

Question 4

A company is considering migrating its customer relationship management (CRM) system to a SaaS provider. Which TWO of the following security responsibilities typically remain with the customer in a SaaS deployment?

Accepted Answer

User access management. In a SaaS deployment, the customer retains responsibility for managing its own users and identities, so user access management (C) — provisioning, deprovisioning, role assignment, and enforcing least privilege through SSO/MFA — stays with the customer. Likewise, data classification and access control (E) remain customer duties because the customer owns the data and must define its sensitivity, retention, and who may access it, even though the provider secures the underlying platform. Physical security of data centers (A) is handled by the SaaS provider, which owns and operates the facilities. Operating system patching (B) is the provider's responsibility since the customer has no access to the underlying OS in a SaaS model. Application vulnerability management (D) also belongs to the provider, as it develops, hosts, and maintains the SaaS application itself.

Answer

Physical security of data centers

Answer

Operating system patching

Answer

Application vulnerability management

Question 5

Which THREE of the following are benefits of using a hybrid cloud deployment model?

Accepted Answer

Elasticity to burst to public cloud during peak demand. Option A is correct because a hybrid cloud lets workloads that exceed on-premises capacity burst into the public cloud on demand, providing elasticity during peak periods without permanently over-provisioning private infrastructure. Option C is correct because the hybrid model explicitly supports workload placement decisions, allowing sensitive or regulated data to remain on-premises while less sensitive workloads run in the public cloud. Option D is correct because hybrid cloud management tooling and unified control planes (e.g., Azure Arc, AWS Outposts, or VMware vSphere/vCloud integrations) allow consistent security policies, identity controls, and compliance configurations to be applied across both environments. Option B is not correct because SLAs typically differ between on-premises infrastructure and public cloud providers, and managing them across a hybrid estate is generally more complex, not simplified. Option E is not correct because data sovereignty concerns are not eliminated by hybrid cloud; they must still be addressed through careful workload placement, data residency controls, and jurisdictional compliance, and hybrid deployments can even complicate them.

Answer

Simplified SLA management across environments

Answer

Eliminates data sovereignty concerns

Question 6

A company is adopting a hybrid cloud strategy. Which TWO security considerations are most critical for maintaining a consistent security posture across environments? (Choose two.)

Accepted Answer

Establishing consistent network security policies (e.g., firewall rules). Option A is correct because consistent network security policies such as firewall rules, security groups, and ACLs ensure that traffic controls are enforced uniformly across on-premises and cloud environments, preventing gaps that attackers could exploit when workloads span both. Option D is correct because identity federation for single sign-on (e.g., SAML 2.0 or OIDC with a central IdP like Entra ID or Okta) provides a unified authentication and authorization model, so users and services have consistent identities and access rights regardless of environment. Option B is incorrect because relying solely on perimeter security fails in hybrid cloud, where assets sit outside a single network boundary and zero-trust, defense-in-depth controls are required. Option C is incorrect because separate security teams per environment create inconsistent policies, duplicated effort, and coordination gaps rather than a unified posture. Option E is incorrect because using different encryption keys per environment is not inherently a consistency requirement; key management should follow a unified governance model (e.g., centralized KMS/HSM with proper key rotation and separation), not simply differ by environment.

Answer

Relying solely on perimeter security

Answer

Deploying separate security teams for each environment

Answer

Using different encryption keys for each environment

Question 7

A cloud architect is designing a multi-tenant SaaS application. Which TWO design principles are critical for ensuring tenant isolation? (Select TWO.)

Accepted Answer

Network isolation between tenants. Network isolation between tenants (A) is critical because it prevents cross-tenant traffic and lateral movement by placing each tenant in separate VPCs, subnets, security groups, or namespaces, ensuring that one tenant's workloads cannot reach another's over the network. Data isolation (D), such as a schema-per-tenant model or per-tenant encryption keys, is equally essential because it guarantees that tenant data is logically or cryptographically separated, preventing unauthorized reads or writes even if application-layer bugs occur. Together, A and D address the two primary isolation dimensions—network and data—required for a secure multi-tenant SaaS design. A single shared database for all tenants (B) is not a critical isolation principle; without additional controls it actually weakens isolation by co-mingling tenant records. Using the same OS image for all tenants (C) is a standardization and patching benefit, not a tenant-isolation mechanism. Resource pooling across tenants (E) improves cost efficiency and utilization but, by itself, increases the risk of cross-tenant interference rather than ensuring isolation.

Answer

Single shared database for all tenants

Answer

Using the same OS image for all tenants

Answer

Resource pooling across tenants

Question 8

A cloud architect is designing a defense-in-depth strategy for a containerized application. Which THREE practices should be implemented to secure the container supply chain?

Accepted Answer

Sign images using Cosign. Option A is correct because signing images with Cosign (part of the Sigstore project) creates verifiable cryptographic signatures that let Kubernetes admission controllers or CI/CD pipelines confirm an image's provenance and integrity before deployment, preventing tampered or unauthorized images from entering the supply chain. Option D is correct because immutable tags such as a Git commit hash or digest guarantee that the exact audited artifact is deployed and cannot be silently overwritten, unlike mutable tags that can be repointed to different content. Option E is correct because scanning images with Trivy detects known CVEs in OS packages and language dependencies, enabling vulnerabilities to be caught and remediated early in the build pipeline. Option B is not appropriate because the 'latest' tag is mutable and non-deterministic, so builds become unreproducible and can pull in unvetted or vulnerable base images. Option C is not appropriate because running containers as root violates least privilege and dramatically increases the blast radius if a container is compromised; containers should run as a non-root user.

Answer

Always use the 'latest' tag for base images

Answer

Run containers with root privileges by default

Question 9

A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)

Accepted Answer

A process to tag resources with the appropriate classification labels. Option B is correct because an effective data classification scheme requires a repeatable process to tag resources with the appropriate classification labels, so that the assigned sensitivity level is actually recorded and travels with the data or resource for later policy enforcement. Option E is correct because classification cannot function without a defined taxonomy of labels, such as public, internal, confidential, and restricted, which establishes the categories and criteria that everything else maps to. Together, the label scheme (E) and the tagging process (B) form the foundational components of classification. Option A is not essential to the classification scheme itself; encryption at rest is a protective control that may be applied based on classification, not a component required to classify data. Option C is also a downstream control, since access policies consume classification labels rather than define the scheme. Option D is likewise an enforcement mechanism, and automated DLP scanning depends on classification being established first rather than being essential to creating it.

Answer

Encryption at rest for all classified data

Answer

Access control policies based on classification

Answer

Automated DLP scanning to enforce classification

Question 10

An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)

Accepted Answer

De-identification transforms such as masking and tokenization. Option C is correct because cloud DLP services (such as Google Cloud DLP/Sensitive Data Protection) provide de-identification transforms including masking, tokenization, and format-preserving encryption to obfuscate sensitive values while preserving usability. Option D is correct because the core function of a cloud DLP service is inspecting data at rest or in transit to detect sensitive information types (SITs) such as credit card numbers, SSNs, and API keys using built-in or custom infoType detectors. Option A is not a DLP capability; encryption key rotation is handled by a key management service (KMS) such as Cloud KMS. Option B is not a DLP capability; MFA enforcement is an identity and access management function (e.g., IAM, MFA policies). Option E is not a DLP capability; automated backups are provided by storage or backup services, not by DLP inspection tooling.

Answer

Automatic encryption key rotation

Answer

Enforcing multi-factor authentication

Answer

Automated backup of sensitive data

Question 11

A company is deploying a microservices architecture on Kubernetes and wants to implement supply chain security. Which THREE of the following practices should be adopted?

Accepted Answer

Signing container images with Cosign. Option A is correct because signing container images with Cosign (part of the Sigstore project) creates a verifiable cryptographic attestation of the image's provenance and integrity, which is a foundational supply chain security control. Option C is correct because scanning images for CVEs with Trivy detects known vulnerabilities in OS packages and application dependencies before deployment, enabling remediation prior to running workloads in the cluster. Option E is correct because an admission controller such as Kyverno can enforce policy at admission time, verifying Cosign signatures and rejecting unsigned or untrusted images so that only validated artifacts run in the cluster. Option B is incorrect because allowing all images from public registries removes provenance controls and exposes the cluster to untrusted or malicious images. Option D is incorrect because using the :latest tag is mutable and non-deterministic, preventing reliable signature verification and reproducible, auditable deployments.

Answer

Allowing all images from public registries

Answer

Using the :latest tag for all images

Question 12

A cloud security team is designing network security for a multi-VPC architecture in AWS. Which TWO of the following are valid considerations for VPC peering?

Accepted Answer

VPC peering is a one-to-one relationship. Option C is correct because a VPC peering connection is strictly a one-to-one relationship between exactly two VPCs; you cannot attach a single peering connection to more than two VPCs, and each pair requires its own peering connection. Option E is correct because VPC peering routes traffic using private IPv4 or IPv6 addresses between the peered VPCs, so instances communicate over the AWS private network without traversing the public internet. Option A is incorrect because connecting on-premises networks to a VPC requires AWS Site-to-Site VPN or AWS Direct Connect, not VPC peering. Option B is incorrect because peering traffic flows over the AWS backbone and does not require an internet gateway, NAT device, or virtual private gateway. Option D is incorrect because VPC peering does not support transitive routing; to reach a third VPC you must establish a direct peering connection (or use a transit gateway).

Answer

VPC peering can be used to connect on-premises networks

Answer

VPC peering requires an internet gateway for communication

Answer

VPC peering supports transitive routing across multiple VPCs

Question 13

A cloud team is building a web application that stores user session tokens in the browser. A security review recommends that the tokens be inaccessible to JavaScript to reduce the impact of cross-site scripting attacks. Which cookie attribute should be set on the session token?

Accepted Answer

HttpOnly. HttpOnly instructs the browser to hide the cookie from client-side scripts, so a cross-site scripting vulnerability cannot directly exfiltrate the session token. Secure, SameSite, and Domain attributes address transport, cross-site request behaviour, and scope respectively, but none prevents script access.

Answer

Secure

Answer

SameSite=Strict

Answer

Domain

Question 14

A cloud operations team runs a fleet of Amazon EC2 instances behind an Application Load Balancer. After a recent penetration test, the team must ensure that only HTTP and HTTPS traffic reaches the instances from the load balancer, and that no instance can accept SSH from the internet. The instances currently have a security group named 'web-sg' that allows all inbound traffic from 0.0.0.0/0. Which action should the team take to meet these requirements with the LEAST administrative effort while following AWS best practices?

Accepted Answer

Modify the 'web-sg' security group to allow inbound HTTP and HTTPS from the load balancer's security group, and remove all other inbound rules.. Referencing the load balancer's security group in the instance security group is the most precise and least-effort method to restrict inbound traffic to only the load balancer. It leverages AWS security group referencing, which is stateful and supports least privilege without needing CIDR calculations. Removing all other inbound rules ensures no direct internet SSH access, satisfying both requirements.

Answer

Keep the existing 'web-sg' rules but configure the load balancer to use a target group that only forwards traffic on ports 80 and 443, and enable connection draining.

Answer

Replace the 'web-sg' security group with a new security group that allows inbound HTTP and HTTPS from 0.0.0.0/0, and add a rule to deny SSH from 0.0.0.0/0.

Answer

Create a new network ACL that allows inbound HTTP and HTTPS from the load balancer subnet and denies all other traffic, then associate it with the instance subnets.

Question 15

A cloud-native application uses a microservices architecture deployed on Kubernetes. The security team wants to ensure that only authorized services can communicate with each other, and that communication is encrypted. Which Kubernetes feature should be used to meet these requirements?

Accepted Answer

Network Policies with a service mesh like Istio for mutual TLS.. Network Policies provide segmentation by allowing or denying traffic between pods based on labels and namespaces. However, they do not encrypt traffic. A service mesh like Istio adds mutual TLS (mTLS) to encrypt all service-to-service communication and can enforce fine-grained authorization policies. Using both together ensures that only authorized services communicate and that the traffic is encrypted.

Answer

Role-Based Access Control (RBAC) to restrict which services can access the Kubernetes API.

Answer

Kubernetes Secrets to store service credentials and TLS certificates.

Answer

Pod Security Policies to enforce security contexts and prevent privileged containers.