CCSP Practice Test 49 — 15 Questions

Question 1

A development team is building a cloud-native application that stores user session data in a managed Redis service. The security architect requires that session data be encrypted at rest and that the application authenticate to Redis without embedding static credentials in code. Which approach best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest on the Redis service and use IAM authentication with short-lived tokens. The best approach combines native encryption at rest with IAM authentication using short-lived tokens. This removes static credentials from code and leverages the cloud provider's identity system. Storing passwords in environment variables, configuration files, or using long-lived shared secrets all violate the requirement to avoid static credentials, even if encryption at rest is enabled.

Answer

Rely on network isolation and Redis AUTH with a long-lived password rotated quarterly

Answer

Enable encryption at rest and store the Redis password in an environment variable

Answer

Use client-side encryption before writing to Redis and authenticate with a shared secret stored in a configuration file

Question 2

A development team is building a cloud application that stores sensitive customer data in a managed database service. The security policy requires that data be encrypted at rest with keys that the organization controls and can rotate independently of the cloud provider. Which approach meets this requirement?

Accepted Answer

Encrypt the database volume with a customer-managed key stored in the cloud provider's key management service, with key rotation and access policies defined by the organization.. The requirement is encryption at rest with organizational control over keys. Customer-managed keys in the cloud KMS allow the organization to define rotation, access policies, and revocation while integrating with the managed database. Provider-managed keys, keys in config files, and passphrase-derived keys do not provide the required control and lifecycle management.

Answer

Encrypt sensitive columns at the application layer using a key derived from a static passphrase embedded in the source code.

Answer

Enable transparent data encryption on the database and store the master key in the application's configuration file.

Answer

Use the cloud provider's default service-managed encryption keys and enable automatic key rotation in the provider console.

Question 3

A cloud security team is implementing a centralized logging solution for AWS. They need to ensure that all API activity in their production account is logged and that the logs are stored immutably for 7 years to meet compliance requirements. Which service should they use to capture the API activity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice for capturing all API calls. It integrates with Amazon S3, where logs can be stored with Object Lock to enforce immutability for compliance. The other services either focus on resource configuration, network traffic, or application logs, and cannot provide the comprehensive API auditing required.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 4

A retail company migrates its customer-facing web application to a cloud environment. The security team wants to ensure that security testing is integrated throughout the software development lifecycle (SDLC) rather than only before production deployment. Which approach best aligns with this goal?

Accepted Answer

Adopt a DevSecOps approach with automated security testing in the CI/CD pipeline.. Integrating security testing into the CI/CD pipeline through a DevSecOps approach ensures that vulnerabilities are identified and addressed continuously as code is developed and deployed. This shifts security left, reduces remediation costs, and aligns with modern cloud application security best practices. Other options either delay testing or rely solely on human training, which does not provide the continuous automated assurance required.

Answer

Implement security gates at the end of each development sprint.

Answer

Require developers to complete annual secure coding training.

Answer

Conduct a penetration test after the application is deployed to production.

Question 5

A cloud operations team at a healthcare company runs a multi-account AWS organization. Compliance requires that all Amazon S3 server access logs and AWS CloudTrail management events are retained for 7 years and cannot be altered or deleted by any account administrator, including the account that owns the bucket. The security architect must design a storage solution that enforces write-once-read-many (WORM) immutability at the storage layer. Which approach BEST satisfies these requirements?

Accepted Answer

Configure an S3 bucket with S3 Object Lock in compliance mode and a default retention period of 7 years, then centralize logs into that bucket.. The scenario demands storage-layer immutability that survives even privileged administrators and enforces a fixed 7-year retention. S3 Object Lock in compliance mode is the only mechanism here that makes object versions unalterable and undeletable for the retention period, and a default retention rule automates the 7-year window for all ingested logs. Encryption, versioning, replication, and bucket policies govern access or durability but do not deliver WORM guarantees.

Answer

Replicate logs to a second S3 bucket in a different Region using S3 Cross-Region Replication and apply a restrictive bucket policy on the replica.

Answer

Enable S3 Versioning and a bucket policy that denies s3:DeleteObject for all principals except the organization's root user.

Answer

Store logs in an S3 bucket encrypted with AWS KMS customer managed keys and rotate the keys every 90 days.

Question 6

A cloud provider's API is used by an application to retrieve secrets from a managed secrets store. The security team wants to ensure that if a secret is compromised, its use is limited to a short window and that all access is attributable to a specific workload identity. Which combination best meets these requirements?

Accepted Answer

Use the secrets store's dynamic secrets feature to issue short-lived credentials tied to the workload's authenticated identity, with audit logging of each issuance.. Dynamic secrets issued to an authenticated workload identity provide short-lived credentials and per-issuance audit trails. If a credential leaks, its TTL limits the damage, and logs attribute each issuance to a specific workload. Static secrets in environment variables, encrypted secrets with dual approval, and secrets embedded in images do not provide both short-lived use and workload-level attribution.

Answer

Store the secret in an environment variable on the compute instance and rotate it every 90 days using a scheduled job.

Answer

Encrypt the secret with a customer-managed key and require two administrators to approve each retrieval.

Answer

Embed the secret in the container image and rely on image signing to ensure only trusted images run.

Question 7

A security architect is designing a multi-tenant SaaS application hosted on AWS. The application uses a shared Amazon RDS database with a tenant_id column to isolate data. The architect must ensure that tenants cannot access each other's data even if there is a vulnerability in the application layer. Which additional control should be implemented to enforce data isolation at the database level?

Accepted Answer

Implement row-level security (RLS) policies in the database based on tenant_id.. Row-level security (RLS) enforces data isolation at the database level by filtering rows based on the tenant context. Even if an attacker exploits the application, the database will only return rows for the current tenant, preventing cross-tenant data leakage. This defense-in-depth measure is critical for multi-tenant SaaS applications using a shared database, as it adds a layer of protection beyond application logic.

Answer

Use separate database schemas for each tenant.

Answer

Enable RDS encryption at rest using AWS KMS.

Answer

Configure security groups to restrict access to the RDS instance.

Question 8

A cloud security engineer needs to review who created or modified IAM policies in an Azure subscription over the past 90 days, and must retain that evidence for compliance. Which Azure-native capability should be used to collect and store these records?

Accepted Answer

Azure Activity Log with a diagnostic setting to a Log Analytics workspace. The Azure Activity Log is the subscription's control-plane audit record and captures write operations such as role assignment and policy edits along with the calling identity. Exporting it via a diagnostic setting to a Log Analytics workspace provides queryable, retainable evidence, which is exactly what is needed to review IAM changes over 90 days.

Answer

Microsoft Defender for Cloud secure score

Answer

Azure Policy compliance reports

Answer

Azure Monitor metrics

Question 9

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers a complete application managed entirely by the cloud provider, so the customer only needs to use the software without managing underlying infrastructure, platforms, or runtime. For a small business with limited IT expertise, this model minimizes operational overhead because the provider handles maintenance, patching, and availability.

Answer

IaaS

Answer

PaaS

Answer

FaaS

Question 10

A cloud application uses a microservices architecture deployed on Kubernetes. The security team wants to enforce that only signed container images from a trusted registry can be deployed to the cluster. Which Kubernetes feature should be used to achieve this?

Accepted Answer

Admission controllers with image signature verification. To enforce that only signed container images from a trusted registry are deployed, an admission controller with image signature verification is required. This controller validates the signature of the image before allowing the pod to be created. Tools like OPA Gatekeeper or Sigstore's policy controller can be configured to check signatures against trusted public keys. This ensures supply chain security and prevents unauthorized or tampered images from running in the cluster.

Answer

Pod security policies

Answer

Role-based access control (RBAC)

Answer

Network policies

Question 11

A healthcare company stores regulated data in Amazon S3. An auditor requires proof that objects are protected against accidental deletion or overwrite for a fixed period, and that the protection cannot be removed even by the root account. Which S3 feature should the security team implement?

Accepted Answer

S3 Object Lock in compliance mode with a retention period matching the required fixed duration.. S3 Object Lock in compliance mode creates a write-once-read-many (WORM) protection that no principal, including the root account, can bypass or shorten during the retention period. Governance mode and bucket policies are administratively changeable, and versioning alone does not prevent deletion. Compliance mode directly satisfies the immutability and fixed-duration requirements.

Answer

S3 Object Lock in governance mode with a retention period matching the required fixed duration.

Answer

A bucket policy that denies s3:DeleteObject and s3:PutObject to all principals except a dedicated backup role.

Answer

S3 Versioning with a lifecycle rule that transitions noncurrent versions to S3 Glacier Deep Archive.

Question 12

A cloud security team is building an incident response runbook for workloads on AWS. They need to ensure that when a compromised EC2 instance is detected, responders can preserve volatile evidence and prevent further malicious activity without destroying forensic artifacts. (Choose two.)

Accepted Answer

Capture an EBS snapshot of the instance's volumes before making changes.. Effective cloud incident response follows the order of containment and preservation before remediation. Isolating the instance with a restrictive security group stops command-and-control and lateral movement while keeping the system alive, and capturing EBS snapshots first preserves disk artifacts. Together these steps contain the threat without destroying the evidence responders need.

Answer

Reboot the instance to clear any malicious processes from memory.

Answer

Terminate the instance immediately to stop the attacker.

Answer

Detach the root volume and attach it to an analysis instance without snapshotting first.

Question 13

A cloud operations team runs a mission-critical application on Amazon EC2 instances behind an Application Load Balancer. The security policy requires that the instances be patched monthly, but the team wants to minimize downtime and avoid manual patching. They decide to use AWS Systems Manager Patch Manager. Which configuration should they implement to meet the patching requirement while maintaining availability?

Accepted Answer

Create a patch baseline, a maintenance window that targets the instances, and a patch group that associates the instances with the baseline.. Patch Manager simplifies patching by using patch baselines, patch groups, and maintenance windows. The baseline defines which patches are approved, the patch group associates instances with the baseline, and the maintenance window schedules the patching. This integrated approach automates patching, provides compliance visibility, and allows controlled rollout to maintain availability.

Answer

Use AWS Config rules to automatically apply patches when a new CVE is published, and configure an SNS topic to notify the team.

Answer

Enable automatic OS updates on the EC2 instances by configuring the operating system's update service to run daily.

Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to run yum update on each instance via AWS Systems Manager Run Command on a schedule.

Question 14

A cloud operations team manages 200 Amazon EC2 instances spread across three AWS accounts. They must continuously assess the instances for missing OS patches and misconfigured software, and they want findings aggregated in a single console with severity ratings and remediation runbooks. Which AWS service should the team deploy to meet these requirements?

Accepted Answer

Amazon Inspector. Continuous detection of missing OS patches and software misconfigurations inside EC2 instances requires a vulnerability management service with host-level visibility. Amazon Inspector uses the SSM agent to inventory packages and network reachability, assigns severity, and supports multi-account aggregation through a delegated administrator, so findings from all three accounts appear in one console with remediation runbooks.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A cloud application development team is using a public API gateway to expose microservices. The security team wants to protect the APIs from common web vulnerabilities such as SQL injection and cross-site scripting (XSS). Which control should be implemented at the API gateway?

Accepted Answer

Web application firewall (WAF). A web application firewall (WAF) deployed at the API gateway is the appropriate control to protect against SQL injection and XSS. It inspects HTTP requests and can block or sanitize malicious inputs before they reach the microservices. While other controls like rate limiting, mTLS, and OAuth 2.0 are important for availability, authentication, and authorization, they do not analyze request content for injection attacks. A WAF provides the necessary application-layer protection.

Answer

API rate limiting

Answer

Mutual TLS (mTLS) authentication

Answer

OAuth 2.0 token validation