CCSP Practice Test 48 — 15 Questions

Question 1

A cloud operations team is building a CI/CD pipeline that deploys container images to a managed Kubernetes cluster. Security policy requires that only images whose vulnerabilities have been scanned and approved can run. The team wants the cluster itself to refuse any pod that references an unapproved image, even if the pipeline is bypassed. Which mechanism should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Kubernetes admission controller with a policy engine, such as Open Policy Agent Gatekeeper, to reject pods referencing images that lack the approved scan attestation.. The requirement is preventive enforcement at the cluster level, independent of the deployment channel. A Kubernetes admission controller backed by a policy engine intercepts pod creation and rejects any manifest that does not carry the approved scan attestation. Registry scanning, pipeline gates, and audit alerts each leave a path for an unapproved pod to run, so they cannot satisfy the policy as written.

Answer

Enable image vulnerability scanning in the container registry and configure the registry to block pulls of images that exceed the severity threshold.

Answer

Enable Kubernetes audit logging and forward events to a SIEM so that alerts fire when pods with unapproved images are created.

Answer

Add a policy check stage to the CI/CD pipeline that fails the build when the scanned image contains vulnerabilities above the threshold.

Question 2

A healthcare organization runs a multi-tenant SaaS application on a public cloud. Each tenant's data is stored in a shared database with a tenant identifier column. A penetration test shows that a crafted API request can return records belonging to another tenant. The application already authenticates users and validates their tenant membership at login. Which control most directly addresses the root cause of this finding?

Accepted Answer

Enforce tenant scoping in the data access layer by deriving the tenant identifier from the authenticated session and applying it to every query, ignoring any tenant value supplied by the client.. The penetration test demonstrates broken object-level authorization, where the API accepts a client-controlled tenant identifier and uses it to scope queries. The durable fix is to derive the tenant from the authenticated session and enforce that scope in the data access layer so client input can never widen it. WAF rules, schema separation, and mutual TLS each add defense in depth but do not correct the authorization flaw that allows cross-tenant reads.

Answer

Move each tenant's data into a separate database schema and grant the application role access only to the schema matching the authenticated tenant.

Answer

Require tenants to authenticate with mutual TLS and bind each client certificate to a tenant identifier that the API validates on every request.

Answer

Add a web application firewall rule that inspects API request bodies for tenant identifier values that differ from the authenticated user's tenant.

Question 3

A cloud architect is designing a data classification strategy for a multi-cloud environment. The strategy must automatically tag resources with classification labels and enforce access controls based on those labels. Which THREE components are essential for this automated classification and enforcement?

Accepted Answer

IAM policies that reference classification tags. Option B is essential because the strategy requires resources to actually carry classification labels (e.g., via cloud-native tagging such as AWS tags, Azure tags, or GCP labels), which serve as the metadata foundation that any automated enforcement mechanism must reference. Option D is essential because automated DLP scanning (e.g., Amazon Macie, Azure Information Protection, or Google Cloud DLP) is what discovers and identifies sensitive data so that classification labels can be applied automatically rather than manually, directly enabling the 'automatically tag' requirement. Option A is essential because IAM policies that reference classification tags (e.g., AWS IAM policy conditions using aws:ResourceTag or azureResourceTags) are the mechanism that translates labels into actual access-control decisions, satisfying the 'enforce access controls based on those labels' requirement. Option C is not correct because pre-signed URLs only grant temporary access to a specific object and do not perform classification or tag-based policy enforcement. Option E is not correct because HSM-backed key generation addresses cryptographic key protection and management, not data classification or label-based access control.

Answer

Pre-signed URLs for temporary access

Answer

HSM-backed key generation

Question 4

A cloud team is designing a new microservices application deployed on a managed Kubernetes service. The security architect requires that all service-to-service traffic be encrypted with mutual TLS (mTLS) without modifying application code. Which cloud-native component should be implemented to meet this requirement?

Accepted Answer

A service mesh such as Istio or Linkerd. A service mesh is the correct cloud-native solution because it provides transparent mTLS between services through sidecar proxies, requiring no application code changes. It also enables fine-grained authorization and observability. Other options address perimeter security or network segmentation but do not deliver encrypted, mutually authenticated service-to-service communication inside the cluster.

Answer

An API gateway with TLS termination at the ingress

Answer

Kubernetes NetworkPolicy objects with default deny rules

Answer

A web application firewall (WAF) in front of each service

Question 5

A healthcare analytics company processes electronic protected health information (ePHI) for multiple covered entities using a public cloud provider. The company signs a Business Associate Agreement (BAA) with each covered entity and also signs a BAA with the cloud provider. A security analyst discovers that the cloud provider stores backups of the ePHI in a region outside the United States and refuses to sign a separate BAA for that region. Which of the following is the MOST appropriate action for the company to take to maintain compliance with HIPAA?

Accepted Answer

Require the cloud provider to sign a BAA that covers all regions where ePHI is stored, including the offshore region, or disable backup replication to that region.. HIPAA requires a Business Associate Agreement (BAA) with any entity that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or another business associate. A cloud provider storing ePHI backups in an offshore region acts as a subcontractor, so a BAA must cover that region. If the provider refuses, the company must either negotiate an expanded BAA or disable replication to that region to maintain compliance.

Answer

Encrypt the ePHI backups in the offshore region and continue operations without a BAA for that region.

Answer

Terminate the BAA with the cloud provider and migrate all ePHI to an on-premises data center.

Answer

Report the cloud provider to the HHS Office for Civil Rights (OCR) and continue using the service while awaiting guidance.

Question 6

A healthcare company runs a containerized patient portal on a managed Kubernetes service. Security policy requires that every container image be cryptographically verified as coming from the company's internal build pipeline before any pod is admitted to the cluster. The images are stored in a private OCI registry, and each build produces a signature using a private key held in a cloud key management service. Which mechanism should be implemented to enforce this policy at admission time?

Accepted Answer

Configure an admission controller that validates image signatures against a trusted public key and rejects pods whose images are unsigned or signed by an untrusted key.. Enforcing image provenance requires cryptographic verification at admission time, not merely scanning or network controls. An admission controller that checks signatures against a trusted public key ensures that only images signed by the internal pipeline's private key are admitted. This directly ties the cluster's admission decision to the build pipeline's signing authority, satisfying the policy while leveraging the existing KMS key infrastructure.

Answer

Enable image vulnerability scanning in the registry and configure the cluster to pull only images with a CVSS score below a defined threshold.

Answer

Use a mutating admission webhook to inject an init container that runs a checksum comparison of the image layers against a manifest stored in the registry.

Answer

Apply a network policy that restricts pod egress to only the private registry, preventing images from being pulled from any other source.

Question 7

A cloud-native payroll application stores employee bank details in a managed database. The security team wants to ensure that even if the database storage is compromised, the data cannot be read without explicit decryption. They also need to minimize changes to the application code. Which approach best meets these requirements?

Accepted Answer

Implement client-side field-level encryption using a customer-managed key (CMK) in a cloud KMS.. The team needs encryption where keys are controlled by the organization and decryption is explicit, not automatic. Client-side field-level encryption with a customer-managed key in a cloud KMS achieves this: ciphertext is stored in the database, and only holders of the CMK can decrypt. TDE, provider-managed keys, and database-native encryption with locally stored keys all leave decryption capability with the database or provider, failing the threat model.

Answer

Use database-native column encryption with keys stored in the database configuration.

Answer

Enable transparent data encryption (TDE) at the database storage layer using provider-managed keys.

Answer

Rely on the cloud provider's default encryption at rest with provider-managed keys.

Question 8

An attacker publishes a malicious package to a public registry using the same name as an internal package used by a cloud application. This is known as:

Accepted Answer

Dependency confusion attack. Dependency confusion attacks exploit package managers that prioritize public registries over private ones, allowing malicious packages to be installed.

Answer

Cross-site scripting (XSS)

Answer

Man-in-the-middle attack

Answer

Supply chain poisoning

Question 9

A cloud operations team is deploying a web application that stores configuration files and application logs in an object storage bucket. The security policy requires that data be encrypted at rest, and the team wants the cloud provider to manage the encryption keys with minimal operational overhead. The bucket must remain accessible to the application without code changes. Which approach should the team use?

Accepted Answer

Enable server-side encryption with provider-managed keys on the bucket, which automatically encrypts objects at rest.. Provider-managed server-side encryption is the lowest-overhead way to meet an encryption-at-rest requirement because the cloud service handles key storage, rotation, and cryptographic operations automatically. The application's read and write operations remain unchanged, so no code modifications are needed. This satisfies both the security policy and the operational constraints described by the team.

Answer

Use server-side encryption with customer-provided keys, supplying the key in each request so the provider does not store it.

Answer

Rely on transport layer security for data in transit and document that encryption at rest is not required for configuration files.

Answer

Implement client-side encryption in the application so that objects are encrypted before upload, using keys stored in the application configuration.

Question 10

A cloud security engineer is reviewing the software development lifecycle for a team building a containerized application on a public cloud. The team wants to shift security left and reduce vulnerabilities in production images. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Integrate static application security testing (SAST) into the CI pipeline. Shifting security left means embedding security checks early in the development lifecycle. SAST finds code-level flaws at commit time, and container image scanning finds vulnerable packages at build time. Both prevent vulnerable artifacts from reaching production. Runtime detection, annual penetration tests, and private registries are valuable but operate after deployment or only control access, not vulnerability reduction.

Answer

Store container images in a private registry with access controls

Answer

Perform a penetration test of the production environment annually

Answer

Enable runtime threat detection in the production Kubernetes cluster

Question 11

A cloud security team is designing a secure software development lifecycle (SDLC) for a new microservices application deployed to a public cloud. They want to ensure that security is embedded throughout development and operations. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Conduct threat modeling during the design phase for each microservice.. Embedding security throughout the SDLC requires proactive design-time analysis and automated enforcement in delivery. Threat modeling during design surfaces risks before code exists, while automated CI/CD security gates ensure every build meets policy and blocks critical findings. Together they shift security left and maintain it through deployment. Production-only testing, centralized ownership, and reduced logging all weaken or delay security rather than integrating it continuously.

Answer

Assign all security responsibilities exclusively to a centralized security team.

Answer

Disable detailed logging in production to reduce storage costs and improve performance.

Answer

Perform a full penetration test only after the application is deployed to production.

Question 12

A cloud security team is reviewing a CI/CD pipeline that builds and deploys a containerized application to a production cluster. The pipeline runs in a cloud build service and uses a long-lived service account key stored as a secret in the pipeline configuration to push images and update deployments. A recent audit flagged this as a risk. Which change best reduces the risk of credential compromise while maintaining automated deployments?

Accepted Answer

Replace the long-lived key with short-lived credentials obtained through workload identity federation between the build service and the cloud provider.. Storing long-lived service account keys in a pipeline creates a persistent credential that attackers can steal and reuse. Workload identity federation replaces that key with short-lived tokens bound to the build service's identity, so credentials expire automatically and are scoped to the workload. This maintains automation while removing the stored secret, which is the most effective way to reduce credential compromise risk.

Answer

Grant the service account broader permissions so that fewer distinct credentials are needed across pipeline stages.

Answer

Rotate the service account key on a weekly schedule and store the new key in the same pipeline secret store.

Answer

Encrypt the service account key with a customer-managed key and restrict access to the pipeline configuration to a small group of administrators.

Question 13

A cloud application uses a managed API gateway to expose REST APIs. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. The backend services run on private subnets and are fronted by an internal load balancer. Which control should be implemented to enforce this requirement?

Accepted Answer

Configure the backend services to accept traffic only from the API gateway's security group or service account. The only way to prevent clients from bypassing the API gateway is to restrict backend ingress to the gateway's identity. This can be enforced through security groups, network policies, or IAM roles. mTLS, WAFs, and gateway-only API key validation add security but do not block direct network access, so they cannot guarantee that all traffic flows through the gateway.

Answer

Enable TLS mutual authentication between the API gateway and backend services

Answer

Use API keys validated at the API gateway only

Answer

Deploy a web application firewall (WAF) on the backend services

Question 14

A cloud security architect is designing a secure CI/CD pipeline for a containerized application deployed on a Kubernetes cluster. The pipeline must ensure that only approved images are deployed. Which TWO of the following controls should be implemented? (Choose two.)

Accepted Answer

Configure the Kubernetes admission controller to reject pods that use unsigned images.. Option B is correct because a Kubernetes admission controller (e.g., via an admission webhook or policy engine like OPA Gatekeeper or Kyverno) can enforce at admission time that any Pod referencing an image without a valid signature is rejected, directly ensuring only approved images run on the cluster. Option E is correct because signing container images with a private key (e.g., using cosign/Notation with a key pair) and verifying those signatures before deployment establishes cryptographic provenance, so only images signed by the trusted key are treated as approved. Together, B and E implement the verify-at-admission and sign-at-build halves of a supply-chain control that guarantees only approved images are deployed. Option A is not correct because RBAC on the registry controls who may push images, but it does not verify that deployed images are approved or untampered. Option C is not correct because network policies only restrict pod-to-pod traffic and have no bearing on image approval. Option D is not correct because vulnerability scanning identifies known CVEs but does not enforce that only approved (signed/trusted) images are deployed.

Answer

Implement role-based access control (RBAC) to restrict who can push images to the registry.

Answer

Use network policies to restrict pod-to-pod communication.

Answer

Scan all container images for vulnerabilities in the CI pipeline.

Question 15

Which TWO of the following are primary objectives of a cloud application security program?

Accepted Answer

Maintaining application availability. Option A (Maintaining application availability) is correct because a cloud application security program must protect against denial-of-service, misconfiguration, and resilience failures so that applications remain accessible to authorized users, aligning with the availability pillar of the CIA triad. Option D (Ensuring data confidentiality and integrity) is correct because the core purpose of application security is to prevent unauthorized disclosure and unauthorized modification of data, typically enforced through encryption, access controls, and integrity checks. Options B (continuous deployment), C (microservices architecture), and E (Agile development practices) are incorrect because they are software delivery and architectural methodologies, not security objectives; they may support security when implemented well but are not primary goals of a cloud application security program.

Answer

Performing continuous deployment

Answer

Implementing a microservices architecture

Answer

Adopting Agile development practices