CCSP Practice Test 5 — 10 Questions

Question 1

In a DevSecOps pipeline for a cloud application, which practice best ensures that only approved open-source components are used?

Accepted Answer

Using a private artifact registry with allow-lists. A private artifact registry with allow-lists enforces a whitelist of approved open-source components, preventing developers from pulling unvetted dependencies directly from public repositories. This ensures that only components that have passed security and compliance reviews are used in the pipeline, directly addressing the requirement for 'approved' open-source components.

Answer

Signing container images

Answer

Implementing dependency scanning with Snyk

Answer

Running SAST scans on all source code

Question 2

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 3

A financial institution is migrating sensitive transaction data to the cloud. They must comply with a regulation that requires data to be retained for 7 years, but also support immediate legal holds. The cloud storage service offers object lock with governance mode. What is the best practice to ensure compliance?

Accepted Answer

Use object lock in governance mode with a 7-year retention period and grant legal hold permissions to authorized users. Governance mode allows authorized users to override retention settings for legal holds while still enforcing a 7-year minimum retention period. This balances compliance with the need for immediate legal holds, as users with appropriate permissions can place a legal hold on objects without extending the retention period for all data.

Answer

Use object lock in compliance mode with a 7-year retention period

Answer

Apply a lifecycle policy to delete objects after 7 years and rely on backups

Answer

Encrypt all objects with a client-managed key and store deletion timestamps in a database

Question 4

A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?

Accepted Answer

API keys in URLs are often logged in plaintext in server logs and browser history.. The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.

Answer

API keys in query strings are not encrypted, even with HTTPS.

Answer

API keys provide weak authentication because they are not tied to a user session.

Answer

API keys are not valid for use in query strings; they require a certificate.

Question 5

During a cloud migration, a company discovers that some sensitive data was inadvertently stored in an object storage bucket with public read access. The security team needs to determine the scope of exposure and remediate. What is the FIRST step they should take?

Accepted Answer

Review the bucket's access logs to identify any unauthorized access.. The first step is to review the bucket's access logs (e.g., AWS CloudTrail or S3 server access logs) to identify any unauthorized access. This determines the scope of exposure—who accessed the data, when, and from where—before taking any remediation action. Without this forensic step, the company cannot assess breach notification obligations or legal liability.

Answer

Notify the data protection authority.

Answer

Change the bucket's permission to private.

Answer

Immediately delete all objects in the bucket.

Question 6

A DevOps team wants to prevent insecure code from being deployed to production. Which gate should be implemented in the CI/CD pipeline?

Accepted Answer

Automated security scanning with failure conditions. Automated security scanning with failure conditions (option A) is the correct gate because it enforces security checks directly within the CI/CD pipeline, preventing any code that fails static application security testing (SAST) or software composition analysis (SCA) from progressing to production. This shift-left approach ensures that vulnerabilities are caught before deployment, aligning with DevSecOps principles and reducing risk.

Answer

Run penetration testing after release

Answer

Dependency scanning only on weekly basis

Answer

Manual code review after deployment

Question 7

A company uses Azure and wants to ensure that all activity log events are retained for seven years to meet compliance requirements. What is the most efficient way to implement this?

Accepted Answer

Export activity logs to an Azure Storage account and apply a lifecycle management policy to delete logs after 7 years.. Azure Monitor Activity Logs can be streamed to a storage account, and a lifecycle management policy can be applied to automatically delete logs after the required retention period.

Answer

Enable Azure Monitor and configure the activity log to be stored in a Log Analytics workspace with a retention of 7 years.

Answer

Use Azure Backup to back up activity logs and retain them for 7 years.

Answer

Configure activity logs to be sent to an Event Hub and then to a third-party archival service.

Question 8

Which of the following is a primary purpose of a SOAR (Security Orchestration, Automation and Response) platform in cloud security operations?

Accepted Answer

To automate response to security incidents by executing predefined playbooks.. SOAR platforms automate incident response processes, orchestrating actions across multiple tools and reducing manual effort.

Answer

To provide a centralized dashboard for cloud cost management.

Answer

To scan container images for vulnerabilities.

Answer

To enforce identity and access management policies.

Question 9

A company is implementing a cloud key management system (KMS) to control encryption keys for sensitive data. Which practice is essential to ensure the security of the keys?

Accepted Answer

Periodically rotate the encryption keys.. Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Answer

Use a single key for all encryption operations to simplify management.

Answer

Export keys to the cloud provider's hardware security module (HSM).

Answer

Store encryption keys in the same region as the encrypted data.

Question 10

A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?

Accepted Answer

Post-build image scanning in registry. Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Answer

Runtime security monitoring

Answer

Pre-commit hook in source control

Answer

Admission controller in Kubernetes