CCSP Practice Test 5 — 10 Questions

Question 1

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 2

A company is implementing a serverless application using AWS Lambda. The function processes S3 events and writes to a DynamoDB table. Which of the following is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create a custom IAM role with only the required actions on specific resources. AWS Lambda functions require an IAM role (execution role) to access other AWS services. By creating a custom IAM role with only the required actions (e.g., s3:GetObject for the specific S3 bucket and dynamodb:PutItem for the specific DynamoDB table), you adhere to the principle of least privilege, minimizing the attack surface and ensuring secure, auditable access.

Answer

Use resource-based policies on the Lambda function

Answer

Attach a managed policy that grants full access to S3 and DynamoDB

Answer

Use the root user credentials of the AWS account

Question 3

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

Accepted Answer

Up to $500K, the total fees paid in the past 12 months. The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Answer

The amount of direct damages only

Answer

Full $2M because negligence overrides liability caps

Answer

Zero because the customer accepted the terms

Question 4

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Accepted Answer

Validate and sanitize all user inputs. Option A is correct because validating and sanitizing all user inputs defends against injection attacks (SQLi, XSS, command injection) and malformed payloads that could compromise the API or its backend data stores. Option D is correct because rate limiting (e.g., token-bucket or fixed-window throttling at the API gateway) mitigates brute-force, credential-stuffing, and denial-of-service abuse by capping request volume per client, key, or IP. Option E is correct because applying least privilege to API keys and roles ensures each key or IAM role only grants the minimum scopes and permissions needed, limiting blast radius if credentials are leaked. Option B is wrong because automatically exposing every endpoint increases attack surface and can reveal undocumented or internal APIs; endpoints should be explicitly published and protected. Option C is wrong because mass assignment lets clients bind arbitrary fields to backend objects, enabling privilege escalation or data tampering; allowlists of assignable fields should be enforced instead.

Answer

Expose all API endpoints automatically for transparency

Answer

Allow mass assignment for ease of development

Question 5

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. A multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 6

A multinational corporation is implementing a multi-cloud strategy to avoid concentration risk. The risk management team is evaluating the inherent risks of using multiple cloud providers. Which THREE risks are specifically associated with a multi-cloud strategy? (Choose three.)

Accepted Answer

Expanded attack surface due to more entry points and APIs. Option B is correct because a multi-cloud strategy adds more entry points and APIs, since each provider exposes its own management consoles, IAM endpoints, and service APIs, expanding the attack surface that must be monitored and secured. Option C is correct because consistent security policies must be enforced across heterogeneous providers with different native controls, identity models, and configuration semantics, making uniform governance and compliance far more complex. Option E is correct because each cloud platform has its own tooling, services, and operational model, so the organization needs specialized skills and expertise for each provider rather than a single unified skill set. Option A is not correct because multi-cloud generally reduces vendor lock-in rather than increasing it, since workloads can be distributed and portability is improved. Option D is not correct because data sovereignty challenges stem from where data is stored and processed across jurisdictions, which is not inherently a risk specific to using multiple cloud providers.

Answer

Higher likelihood of vendor lock-in due to proprietary services

Answer

Greater difficulty in meeting data sovereignty requirements across jurisdictions

Question 7

A cloud security architect is designing a key management strategy for a multi-cloud environment. Which of the following is a BEST practice for key management?

Accepted Answer

Use a centralized key management system that integrates with all clouds. A centralized key management system (KMS) that integrates with all cloud providers enables consistent key lifecycle management, reduces the risk of key sprawl, and ensures uniform access control policies across a multi-cloud environment. This approach aligns with the principle of separation of duties and allows for centralized auditing and rotation without vendor lock-in.

Answer

Use the same key for all data to simplify rotation

Answer

Store keys in each cloud provider's native KMS separately

Answer

Embed keys in application code for simplicity

Question 8

A cloud customer is migrating a legacy application to a cloud platform. The application currently runs on physical servers and uses local storage. The migration plan involves rehosting the application on virtual machines (VMs) in the cloud. The security team wants to ensure that the VMs are properly hardened before deployment. During the migration testing, the team discovers that the base image used for the VMs contains several unnecessary services and default credentials. The team is concerned that these vulnerabilities could be exploited. The cloud provider offers a shared responsibility model where the customer is responsible for securing the OS. Which of the following is the BEST course of action to address this issue?

Accepted Answer

Create a custom golden image with necessary hardening and approved software only. Creating a custom golden image allows the customer to enforce a hardened baseline that removes unnecessary services, disables default credentials, and includes only approved software before any VM is deployed. This aligns with the shared responsibility model, where the customer controls OS-level security, and prevents vulnerabilities from ever reaching production. Pre-hardening the image is more secure and efficient than fixing issues post-deployment, as it eliminates the window of exposure during initial boot and configuration.

Answer

Deploy the VMs and run vulnerability scans to identify and fix issues after deployment

Answer

Ask the cloud provider to provide a hardened OS image

Answer

Deploy the VMs and manually apply security patches and remove services after deployment

Question 9

A company has a disaster recovery (DR) plan that includes failing over to a secondary cloud region. The plan was tested six months ago and worked, but since then significant infrastructure changes have been made. Which of the following should the company do to ensure the DR plan remains effective?

Accepted Answer

Conduct a tabletop exercise now, followed by a partial failover test of critical applications.. After significant infrastructure changes, the DR plan may no longer be valid. A tabletop exercise quickly identifies gaps in the plan and updates documentation, while a partial failover test of critical applications validates that the changes work in practice without the risk of a full-scale failover. This combined approach ensures the plan remains effective and current.

Answer

Wait until the next annual DR test to verify the changes.

Answer

Automate the entire failover process to eliminate human error.

Answer

Update the DR documentation to reflect the changes and assume the plan still works.

Question 10

A cloud customer is decommissioning a storage service that contains sensitive data. The cloud provider offers several data destruction options. Which method provides the HIGHEST assurance that data is irrecoverable?

Accepted Answer

Physical shredding of the storage drives. Physical shredding of the storage drives provides the highest assurance that data is irrecoverable because it physically destroys the media, making it impossible to reconstruct any data. Unlike degaussing, which may leave residual magnetization, or overwriting, which can leave data in bad sectors, shredding reduces the drives to small particles that cannot be reassembled. Cryptographic erasure is effective only if the encryption keys are securely destroyed and the encryption was properly implemented, but it still relies on the encryption being unbreakable.

Answer

Degaussing the storage media

Answer

Multiple overwrite passes with zeros and ones

Answer

Cryptographic erasure of encryption keys