CCSP Practice Test 49 — 15 Questions

Question 1

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Continue using client-side encryption and provide the analytics service with the encryption key. Client-side encryption ensures the cloud provider does not have access to the encryption keys because the keys are never stored in or managed by the provider. To allow a cloud-based analytics service to process the data, the customer can securely provide the encryption key directly to the analytics service. This approach maintains key control while enabling processing. Note: This assumes the analytics service is trusted and the key is transmitted securely.

Answer

Use client-side encryption but store the key in the cloud provider's key vault

Answer

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Answer

Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)

Question 2

A cloud security team is implementing encryption for data at rest in a cloud storage service. They require that the encryption keys be managed by the customer and that the cloud provider has access to the keys only when authorized by the customer. Which TWO key management options meet these requirements? (Select TWO.)

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys in cloud KMS, and BYOK (Bring Your Own Key) allows importing keys into cloud KMS. In both cases, the provider can access the keys when authorized.

Answer

Cloud Provider Default Encryption

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Hold Your Own Key (HYOK)

Question 3

A company is required to encrypt all data in transit between its on-premises data center and its cloud environment. They have a hybrid cloud setup and need a secure tunnel for all traffic. Which solution should they implement?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) creates an encrypted tunnel between the on-premises network and the cloud VPC, ensuring all traffic in transit is encrypted.

Answer

Client-side encryption

Answer

Pre-signed URLs

Answer

TLS 1.2+ for all API calls

Question 4

Which phase of the cloud data lifecycle involves the removal of data in a manner that ensures it cannot be reconstructed, typically using techniques like cryptographic erasure or degaussing?

Accepted Answer

Destroy. The Destroy phase is when data is securely disposed of, ensuring it cannot be recovered.

Answer

Store

Answer

Share

Answer

Archive

Question 5

A cloud security team is evaluating DLP techniques to protect sensitive data in a cloud data warehouse. They want to replace sensitive values with realistic but fictitious data for non-production environments while preserving referential integrity. Which TWO de-identification techniques are suitable?

Accepted Answer

Pseudonymization. Tokenization replaces sensitive data with a token that can be consistent across tables, preserving referential integrity. Pseudonymization replaces identifiers with consistent pseudonyms, also preserving relationships.

Answer

Bucketing

Answer

Masking

Answer

Date shifting

Question 6

A multinational corporation must store customer data in specific geographic regions to comply with data sovereignty laws. Which cloud storage feature should they configure to ensure data does not leave a designated region?

Accepted Answer

Region selection for storage buckets. Cloud providers allow selecting a specific region for storage resources, and data localization policies can be enforced via bucket location constraints and IAM policies restricting cross-region replication.

Answer

Signed URLs

Answer

Cross-region replication

Answer

Object versioning

Question 7

An organization uses a cloud storage service with versioning enabled. They discover that a ransomware attack encrypted all current versions of their files. However, they can still recover the data. Which feature protects them?

Accepted Answer

Versioning. Versioning retains previous versions of objects, so even if current versions are encrypted, previous unencrypted versions can be restored. This protects against ransomware and accidental deletion.

Answer

Pre-signed URLs

Answer

Cross-region replication

Answer

Object lock

Question 8

Which of the following is the correct order of phases in the cloud data lifecycle?

Accepted Answer

Create, Store, Use, Share, Archive, Destroy. The standard cloud data lifecycle is Create, Store, Use, Share, Archive, Destroy.

Answer

Store, Create, Use, Share, Destroy, Archive

Answer

Create, Use, Store, Share, Archive, Destroy

Answer

Create, Share, Store, Use, Archive, Destroy

Question 9

A company is using a cloud provider's key management service (KMS) with HSM-backed keys. They want to ensure that key material is automatically replaced periodically to limit the impact of a potential key compromise. Which KMS feature should they configure?

Accepted Answer

Key rotation. Key rotation automatically generates new key material at defined intervals, reducing the risk of key compromise.

Answer

Key export

Answer

Key revocation

Answer

Key policies

Question 10

Which of the following is the primary security risk associated with VM escape in a cloud environment?

Accepted Answer

Unauthorized access to other tenants' VMs and the hypervisor. VM escape is a critical risk in multi-tenant clouds because it allows an attacker to break out of a VM and access the hypervisor, potentially compromising other tenants' VMs.

Answer

Performance degradation of the VM

Answer

Loss of network connectivity

Answer

Data corruption within the VM

Question 11

Which hypervisor technology is used to provide direct device access to a VM, improving performance and isolation for I/O operations?

Accepted Answer

IOMMU. IOMMU (Input-Output Memory Management Unit) allows direct device assignment to VMs, enabling high performance and strong isolation by preventing the VM from accessing other devices' memory.

Answer

CPU pinning

Answer

Virtual switches

Answer

Memory ballooning

Question 12

A security architect is designing a multi-tenant cloud environment. Which type of hypervisor provides the strongest isolation for tenant virtual machines by running directly on the hardware without a host operating system?

Accepted Answer

Type 1 hypervisor. Type 1 (bare-metal) hypervisors run directly on hardware, reducing the attack surface and improving isolation compared to Type 2 hypervisors that run on an OS.

Answer

Type 2 hypervisor

Answer

Virtual machine monitor in user space

Answer

Container runtime

Question 13

A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?

Accepted Answer

Configure the cloud service to require all API requests to go through a proxy that enforces DLP. Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.

Answer

Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN

Answer

Implement a conditional access policy to block non-corporate devices

Answer

Use tokenization to replace sensitive data before allowing API access

Question 14

Which of the following is a primary benefit of using immutable tags for container images in a production registry?

Accepted Answer

Consistent and reproducible deployments. Immutable tags prevent accidental overwriting of image tags, ensuring that the same tag always refers to the same image, which aids in traceability and rollback.

Answer

Improved build performance

Answer

Automatic vulnerability scanning

Answer

Reduced storage cost

Question 15

During a supply chain security review, a team discovers that container images are not being verified at admission time. Which Kubernetes-native tool should be implemented to ensure only signed images are deployed?

Accepted Answer

Admission controller (e.g., Kyverno) with image signature verification. An admission controller like OPA Gatekeeper or Kyverno can enforce policies that verify image signatures before allowing pod creation.

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Answer

ResourceQuota