CCSP Practice Test 48 — 15 Questions

Question 1

In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?

Accepted Answer

Rapid elasticity. Rapid elasticity is the defined characteristic. Measured service is about metering, resource pooling is about sharing, broad network access is about network availability.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 2

Which design principle is MOST directly concerned with the ability to move workloads between cloud providers or back on-premises without significant re-architecture?

Accepted Answer

Portability. Portability focuses on minimizing vendor lock-in and enabling migration.

Answer

Reversibility

Answer

Isolation

Answer

Elasticity

Question 3

Which cloud design principle ensures that resources can be dynamically adjusted to meet changing demand, often using auto-scaling groups?

Accepted Answer

Elasticity. Rapid elasticity is the ability to scale resources up or down quickly and automatically in response to demand.

Answer

Resource pooling

Answer

Resiliency

Answer

Measured service

Question 4

In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?

Accepted Answer

Patch management of the guest operating system. In IaaS, the customer is responsible for managing the operating system, applications, and data. The provider manages the physical infrastructure.

Answer

Network firewall configuration at the hypervisor level

Answer

Physical security of data centers

Answer

Storage device maintenance

Question 5

An organization is moving a legacy application to the cloud and wants to minimize changes to the application code. They require full control over the operating system and middleware. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides virtual machines where the customer can install and configure the OS and middleware without modifying the application code.

Answer

PaaS

Answer

SaaS

Answer

FaaS

Question 6

A cloud architect is designing a secure data sharing mechanism for a third-party partner. The partner needs temporary access to download a specific object from a private cloud storage bucket, but should not have broader access to the bucket. Which approach should be used?

Accepted Answer

Use a time-limited access URL for the specific object. A time-limited access URL grants temporary access to a specific object without requiring the partner to have cloud credentials or bucket-level permissions.

Answer

Make the object publicly readable

Answer

Use cross-region replication to the partner's account

Answer

Grant the partner a role with read access to the bucket

Question 7

When data is in transit between an on-premises data center and a cloud service, which of the following is the minimum encryption standard recommended by security best practices?

Accepted Answer

TLS 1.2. TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Answer

IPsec with 3DES

Answer

TLS 1.0

Answer

SSL 3.0

Question 8

A company wants to use a cloud KMS to encrypt data but requires that the encryption key never leaves their on-premises hardware security module (HSM) due to compliance. Which key management model should they adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) allows the customer to retain the key in their on-premises HSM, and the cloud service must call back to the on-premises HSM for each encryption/decryption operation. This provides maximum control but introduces latency.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Customer-Supplied Encryption Key (CSEK)

Answer

Bring Your Own Key (BYOK)

Question 9

A cloud security architect is designing access controls for a cloud storage bucket that contains sensitive customer data. The architect needs to implement a solution that provides granular, time-limited access to specific objects for external auditors. Which TWO methods should the architect consider? (Select TWO.)

Accepted Answer

Signed URLs. Pre-signed URLs and signed URLs are both used to grant time-limited access to specific objects without requiring the user to have cloud credentials. IAM roles provide broader access. Bucket policies provide blanket access. Access keys are long-lived.

Answer

Bucket policies

Answer

IAM roles

Answer

Access keys

Question 10

An organization wants to protect its cloud storage data from ransomware attacks that might encrypt or delete objects. The security team decides to enable a feature that maintains previous versions of objects when changes are made. Which feature is being described?

Accepted Answer

Object versioning. Object versioning keeps multiple variants of an object, allowing restoration to a previous state if data is encrypted or deleted. Cross-region replication is for disaster recovery. Bucket locking prevents deletion but does not maintain versions. Access controls prevent unauthorized access but do not protect against authorized actions.

Answer

Access control lists

Answer

Cross-region replication

Answer

Bucket locking

Question 11

A DevOps team is deploying an application that will store encryption keys in a cloud KMS. The security policy requires that keys be stored in a hardware security module (HSM) and that key material never leaves the HSM boundary. Which key management option should they choose?

Accepted Answer

Cloud KMS with HSM-backed key storage. Cloud KMS with HSM-backed key storage ensures keys are generated and stored in an HSM. CMEK and BYOK typically use software-backed keys unless HSM is specified. HYOK keeps keys on-premises, not in cloud HSM.

Answer

Customer-managed encryption keys (CMEK) with software-backed storage

Answer

Hold your own key (HYOK) with on-premises HSM

Answer

Bring your own key (BYOK) with key import to cloud KMS

Question 12

A financial institution must ensure that sensitive data processed in the cloud cannot be decrypted by the cloud provider under any circumstances. They also need low latency for data operations. Which encryption model best meets these requirements?

Accepted Answer

Client-side encryption. Client-side encryption ensures that only the customer holds the decryption keys; the cloud provider never has access to plaintext or keys. This provides maximum control and meets the requirement, though it may introduce some latency if not optimized. The other options involve the provider managing or using keys in a way that potentially allows access to plaintext.

Answer

HYOK

Answer

Server-side encryption with customer-managed keys

Answer

Server-side encryption with customer-supplied keys

Question 13

A cloud security engineer needs to protect a storage bucket from accidental deletion and ransomware attacks. Which two features should be enabled together for maximum protection?

Accepted Answer

Bucket versioning and object lock. Versioning keeps multiple variants of an object, allowing recovery from accidental deletion or overwrite. Object lock (immutability) prevents objects from being deleted or overwritten for a specified retention period, protecting against ransomware. Combining both provides defense in depth.

Answer

IAM policies and MFA delete

Answer

Cross-region replication and lifecycle policies

Answer

Server access logging and bucket policies

Question 14

A company is implementing a data classification policy for cloud storage. They want to label objects with tags indicating the sensitivity level (e.g., 'Confidential'). Which benefit does tagging resources with classification labels provide?

Accepted Answer

It allows enforcement of data handling policies based on sensitivity. Tags enable automated enforcement of access controls, encryption requirements, and retention policies. For example, a policy can prevent objects tagged 'Confidential' from being made public. Tags also facilitate auditing and reporting.

Answer

It provides client-side encryption keys

Answer

It automatically encrypts data at rest

Answer

It reduces storage costs by moving data to cheaper tiers

Question 15

Which phase of the cloud data lifecycle involves making data available for processing by applications and users?

Accepted Answer

Use. The cloud data lifecycle consists of Create, Store, Use, Share, Archive, Destroy. The 'Use' phase is when data is accessed and processed.

Answer