CCSP Practice Test 47 — 15 Questions

Question 1

A company uses a cloud key management service with customer-managed keys to encrypt data in a cloud storage bucket. The security team wants to ensure that if a key is compromised, they can revoke the cloud service's ability to decrypt the data immediately. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the key in the cloud key management service or revoke the key's access permissions for the cloud service.. With customer-managed keys, the customer controls the key and can revoke the cloud service's access by disabling the key or removing the access permission that allows the service to use the key. Deleting the key would also work but is irreversible. Disabling the key is reversible and immediate.

Answer

Rotate the key to a new version.

Answer

Delete the key permanently from the cloud key management service.

Answer

Regenerate the key material by importing a new key.

Question 2

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP

Question 3

Which THREE of the following are key considerations when designing a disaster recovery plan for a cloud-based application?

Accepted Answer

Implementing cross-region replication for critical data.. Cross-region replication ensures that critical data is asynchronously or synchronously copied to a geographically separate cloud region, providing resilience against regional outages. This design directly supports disaster recovery by enabling failover to a secondary site with minimal data loss, often leveraging cloud-native services like AWS S3 Cross-Region Replication or Azure Geo-Redundant Storage.

Answer

Performing manual failover testing only once a year.

Answer

Eliminating all security controls to speed up recovery.

Question 4

An administrator applies the above bucket policy to an S3 bucket containing sensitive data. What is the EFFECT of this policy?

Accepted Answer

Denies access if the request does not use HTTPS. The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Answer

Allows public read access

Answer

Allows access only from specific IP addresses

Answer

Denies access if the request uses HTTPS

Question 5

A cloud service provider (CSP) experiences a security incident affecting customer data. The contract requires notification within 72 hours, but the CSP fails to notify. What is the most likely legal consequence for the CSP?

Accepted Answer

Breach of contract and potential regulatory fines. Failure to notify as required by contract constitutes a breach of contract. Additionally, if the incident involves personal data, it may also violate regulations like GDPR, leading to regulatory fines. Option B is incorrect because automatic termination of all customer contracts is not a standard consequence; termination typically requires specific contract clauses and may not be automatic for a single breach. Option C is incorrect because criminal liability for executives usually requires proof of negligence or intent beyond mere failure to notify, and it is less common in such scenarios. Option D is incorrect because consequences exist regardless of the incident's severity; contractual obligations must be met, and non-compliance can result in legal action or fines.

Answer

Automatic termination of all customer contracts

Answer

Criminal liability for the CSP's executives

Answer

No consequence if the incident was not serious

Question 6

An administrator applies the above S3 bucket policy to a bucket named 'data-bucket' that contains sensitive logs. The policy is intended to allow uploads only over HTTPS. After applying, the administrator finds that uploads using the AWS CLI without HTTPS still succeed. What is the most likely reason?

Accepted Answer

The Deny statement's condition is incorrectly specified, preventing it from matching non-HTTPS requests.. The bucket policy likely contains an Allow statement granting PutObject and a Deny statement intended to block non-HTTPS requests using the aws:SecureTransport condition key. However, if the Deny statement uses an incorrect condition operator (e.g., StringEquals instead of Bool), the condition never evaluates to true for non-HTTPS requests. As a result, the Deny statement does not apply, and the Allow statement permits the upload regardless of transport. This is a common syntax configuration error. In AWS IAM policy evaluation, an explicit Deny always overrides an Allow, but only if the Deny statement's conditions match the request. Therefore, a misconfigured condition effectively bypasses the Deny.

Answer

The 'aws:SecureTransport' condition key is not supported for S3 bucket policies.

Answer

The policy does not apply to requests made by the AWS root account user.

Answer

The bucket's ACLs grant PutObject permission to the authenticated user, which takes effect before the bucket policy is evaluated.

Question 7

Which TWO cloud monitoring tools are used primarily for detecting anomalous behavior that may indicate a security incident? (Choose two.)

Accepted Answer

Intrusion detection system (IDS).. An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and system activities for signs of malicious activity or policy violations, making it a primary tool for detecting anomalous behavior indicative of a security incident. A Security Information and Event Management (SIEM) system aggregates and correlates logs from multiple sources, using rules and analytics to identify patterns of suspicious activity that may signal a security breach.

Answer

Infrastructure monitoring tool.

Answer

Cloud cost management tool.

Answer

Application performance monitoring (APM).

Question 8

An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?

Accepted Answer

Data encrypted before rotation can still be decrypted using the previous key as long as it is available. Cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.

Answer

Key rotation is not supported in cloud KMS

Answer

The KMS automatically re-encrypts all data with the new key

Answer

Existing data encrypted with the previous key must be re-encrypted with the new key

Question 9

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. The bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 10

An organization is designing a cloud storage solution for highly sensitive customer data. The data must be encrypted at rest and the encryption keys must be managed by the customer, not the cloud provider. Additionally, the solution must allow granular access control based on data classification. Which combination of services should the architect recommend?

Accepted Answer

Cloud HSM for key management and a cloud storage service with object-level ACLs.. Cloud HSM provides customer-managed keys for encryption at rest, ensuring the customer retains sole control over the keys. Combined with a cloud storage service that supports object-level ACLs, this allows granular access control based on data classification, meeting both requirements.

Answer

Server-side encryption with customer-managed keys and a storage bucket with bucket-level policies.

Answer

Server-side encryption with cloud-managed keys and a storage bucket with bucket-level policies.

Answer

Client-side encryption with a cloud KMS and a storage bucket with bucket-level policies.

Question 11

A cloud security team is auditing a cloud environment and needs to ensure compliance with logging requirements. Which TWO actions are essential? (Choose two.)

Accepted Answer

Encrypt logs at rest.. Encrypting logs at rest (Option C) is essential to protect sensitive audit data from unauthorized access if the storage medium is compromised. Cloud providers like AWS offer server-side encryption (SSE-S3 or SSE-KMS) for log buckets, ensuring compliance with standards such as SOC 2, PCI DSS, and ISO 27001. Without encryption, logs could be read by anyone with physical or administrative access to the storage infrastructure.

Answer

Store logs in a publicly accessible bucket.

Answer

Allow users to modify logs.

Answer

Delete logs after 30 days.

Question 12

When evaluating a cloud service provider's SLA, which TWO metrics are MOST relevant for assessing availability and reliability?

Accepted Answer

Uptime percentage (e.g., 99.99%). Uptime percentage (e.g., 99.9%) and RTO/RPO are key availability and disaster recovery metrics. Latency and throughput are performance, not availability; support response time is operational.

Answer

Support ticket response time

Answer

Maximum throughput per instance

Answer

Average latency for API calls

Question 13

A cloud security architect is evaluating a CSP for a financial services client. Which of the following audit reports would provide the most comprehensive assurance regarding the CSP's controls over security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports on controls over security, availability, processing integrity, confidentiality, and privacy over a period.

Answer

PCI DSS Attestation of Compliance

Answer

SOC 1 Type II

Answer

ISO 27001 certification

Question 14

Which of the following is a key benefit of using a hybrid cloud deployment model?

Accepted Answer

Ability to keep sensitive data on-premises while leveraging public cloud for less sensitive workloads. Hybrid cloud allows workloads to move between environments, providing flexibility and optimization.

Answer

Complete isolation from public networks

Answer

Single vendor management

Answer

Elimination of shared responsibility

Question 15

A community cloud is best suited for which scenario?

Accepted Answer

Several government agencies with similar security and compliance requirements. Community clouds are used by organizations with shared concerns like compliance, mission, or security requirements. A single organization would use private cloud, general public use is public cloud, hybrid is for combining models.

Answer

A startup wanting to minimize costs by sharing resources with the general public

Answer

A single organization needing dedicated infrastructure

Answer

A company that needs to burst workloads to the public cloud during peak times