CCSP Practice Test 50 — 15 Questions

Question 1

A cloud security team needs to ensure that all AWS API activity across a multi-account organization is captured in a tamper-evident, immutable log that can be queried later for forensic analysis. The organization uses AWS Organizations with a dedicated security account. Which approach BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail as an organization trail that delivers logs to a centralized S3 bucket with S3 Object Lock in compliance mode and validate log file integrity.. Centralized, tamper-evident API logging in AWS Organizations is achieved with an organization trail that aggregates events into a single S3 bucket. S3 Object Lock in compliance mode prevents anyone, including the root user, from deleting or overwriting objects for the retention period, while CloudTrail log file integrity validation uses digest files to prove logs were not altered, which is essential for forensic admissibility.

Answer

Configure each member account to send AWS CloudTrail events to a local CloudWatch Logs group and rely on the default 90-day retention.

Answer

Use AWS Config to record configuration changes across accounts and store the configuration history in the security account for later retrieval.

Answer

Enable Amazon GuardDuty in the security account and export its findings to an S3 bucket with versioning enabled for long-term storage.

Question 2

A security analyst is investigating a potential security incident in a Microsoft Azure environment. The analyst needs to review the history of role assignments and changes to Azure resources over the past 90 days. Which Azure service should the analyst use?

Accepted Answer

Azure Activity Log. The Azure Activity Log is the correct service because it records subscription-level events, including role assignments and resource modifications, and retains them for 90 days. This directly matches the analyst's need to review the history of changes over that period. Other services either focus on different scopes (like Microsoft Entra ID) or require additional configuration for log retention.

Answer

Azure Monitor Logs

Answer

Azure Security Center

Answer

Azure AD Audit Logs

Question 3

A cloud operations team is deploying a new web application on Google Cloud Platform (GCP). They need to ensure that all incoming traffic to their Compute Engine instances is inspected for common web attacks such as SQL injection and cross-site scripting. They also want to minimize latency and management overhead. Which GCP service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the GCP service designed to protect web applications from application-layer attacks. It provides WAF rules that can block SQL injection and XSS, and it integrates with load balancing to inspect traffic at the edge. This minimizes latency and is fully managed, meeting the requirements for security and low overhead.

Answer

VPC Service Controls

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud IDS

Question 4

A security operations team at a healthcare company running workloads on AWS needs to ensure that all API activity in their production account is recorded and retained for 12 months, with the ability to search for specific events during a forensic investigation. The compliance officer mandates that logs must be protected from deletion by any user, including administrators. Which AWS service and configuration should the team implement to meet these requirements?

Accepted Answer

Enable AWS CloudTrail with a multi-region trail, deliver logs to an S3 bucket with versioning and MFA delete enabled, and apply a bucket policy that denies deletion.. CloudTrail is the AWS service that records API activity. To meet retention and immutability, logs should be stored in S3 with versioning and MFA delete, and a bucket policy that denies deletion for all principals. This ensures logs cannot be tampered with, even by administrators, and can be queried for forensic purposes. Other services like AWS Config or VPC Flow Logs capture different data types and lack the required protection mechanisms.

Answer

Enable AWS CloudTrail with a multi-region trail, deliver logs to a CloudWatch Logs log group with a 12-month retention policy, and set up a subscription filter to S3.

Answer

Enable AWS Config to record configuration changes and deliver snapshots to an S3 bucket with a lifecycle policy to retain for 12 months.

Answer

Enable VPC Flow Logs to capture all traffic, store them in CloudWatch Logs with a 12-month retention policy, and restrict access using IAM policies.

Question 5

A financial services company uses Azure and must ensure that all administrative actions in their Azure subscription are logged and that logs are stored in an immutable storage account for 7 years. They also need to be able to alert on specific critical operations, such as deletion of a resource group. Which combination of Azure services should they implement?

Accepted Answer

Azure Monitor activity log, Azure Storage with immutable blob storage, and Azure Monitor alerts.. The Azure Monitor activity log is the source for subscription-level administrative events. To achieve immutability, logs must be exported to a storage account configured with immutable blob storage policies. Azure Monitor alerts can be set up to trigger on specific operations like resource group deletion. This trio meets logging, retention, and alerting requirements.

Answer

Azure Monitor activity log, Azure Event Hubs, and Azure Stream Analytics.

Answer

Azure Security Center (now Microsoft Defender for Cloud), Azure SQL Database auditing, and Azure Logic Apps.

Answer

Azure Log Analytics workspace, Azure Monitor alerts, and Azure Automation runbooks.

Question 6

A security operations centre uses AWS CloudTrail and wants to detect when an IAM access key belonging to a privileged role is used from an unrecognized IP address outside business hours. The team already has CloudTrail management events delivered to Amazon CloudWatch Logs. Which approach best detects this behaviour with the LEAST operational overhead?

Accepted Answer

Enable Amazon GuardDuty and rely on its IAM finding types for anomalous access key usage. Detecting anomalous use of privileged access keys from unfamiliar IPs outside normal hours is a behavioural threat-detection problem. Amazon GuardDuty ingests CloudTrail management events continuously and applies anomaly detection and threat intelligence to surface findings like anomalous access key usage, requiring no custom filters or scheduled queries, which minimizes operational overhead for the SOC.

Answer

Write a CloudWatch Logs Insights query and schedule it hourly to email matching events to the security team

Answer

Create a CloudWatch Logs metric filter that matches the access key event and an alarm that triggers when the source IP is outside an allowlist

Answer

Configure an AWS Config custom rule that evaluates IAM access key metadata against approved CIDR ranges

Question 7

A European retail company is migrating its customer analytics platform to a public cloud provider. The dataset contains personal data of EU residents, and the company wants to minimize the risk of regulatory enforcement action if the cloud provider suffers a breach. Which action BEST addresses the shared responsibility for compliance in this scenario?

Accepted Answer

Execute a data processing agreement with the provider and independently verify the technical and organizational measures applied to the personal data.. The customer remains the data controller and therefore accountable under GDPR, even when using a public cloud. A data processing agreement establishes the required contractual framework, and independent verification confirms that the provider's technical and organizational measures are effective. Together these actions address the shared responsibility model and reduce the risk of regulatory enforcement after a breach.

Answer

Encrypt the data at rest with provider-managed keys and consider the compliance obligation fully transferred to the cloud provider.

Answer

Rely on the cloud provider's ISO/IEC 27001 certification as full evidence of GDPR compliance for the workload.

Answer

Transfer all personal data to the provider's infrastructure and let the provider determine the lawful basis for processing.

Question 8

A cloud security engineer is deploying a web application on Google Cloud Platform (GCP) and needs to protect it from common web exploits like SQL injection and cross-site scripting. The engineer wants a managed service that can be configured with security policies. Which GCP service should be used?

Accepted Answer

Google Cloud Armor. Google Cloud Armor is the correct service because it is a managed WAF that can be configured with security policies to protect against web exploits. It integrates with load balancing to filter malicious traffic. The other services provide identity control, network connectivity, or load distribution, but none offer WAF functionality.

Answer

Google Cloud Load Balancing

Answer

Google Cloud VPN

Answer

Google Cloud Identity-Aware Proxy (IAP)

Question 9

A security team is using AWS and wants to monitor for changes to security groups that could expose resources to the internet. They need to receive an alert when a security group rule is modified to allow inbound traffic from 0.0.0.0/0 on port 22. Which AWS service should they use to detect this change?

Accepted Answer

AWS Config. AWS Config is designed to monitor resource configurations and evaluate them against desired settings. It can detect when a security group rule is changed to allow inbound SSH from 0.0.0.0/0 and trigger an alert. The other services either log API calls without evaluation, focus on threat detection, or provide periodic checks, making them less suitable for this specific requirement.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 10

A cloud operations team is deploying a containerized workload on a managed Kubernetes service. They need to ensure that if a container image is discovered to contain a critical vulnerability, the running pods using that image are automatically replaced with a non-vulnerable version. Which mechanism BEST achieves this?

Accepted Answer

Configure an admission controller that rejects the vulnerable image tag and use a deployment strategy that replaces pods when the image tag is updated to a patched version.. Blocking the vulnerable image through an admission controller stops new pods from using it, and updating the deployment to a patched image tag triggers a rolling update that replaces existing pods. Together these enforce image policy and automatically converge the workload on the safe version, meeting the automatic replacement requirement without relying on manual intervention.

Answer

Use a network policy that isolates pods running the vulnerable image until the image is patched.

Answer

Configure a pod disruption budget that prevents pods with vulnerabilities from being evicted during maintenance windows.

Answer

Enable a runtime security agent that detects the vulnerability at runtime and sends an alert to the security team for manual remediation.

Question 11

A company runs a regulated workload in Microsoft Azure and must retain all administrative activity logs for seven years to satisfy an auditor. The logs must be immutable and retrievable even if the original resource is deleted. Which Azure capability should the team implement?

Accepted Answer

Azure Storage immutable blob storage with a time-based retention policy. The requirement combines long retention, immutability, and availability after resource deletion. Azure Storage immutable blob storage with a locked time-based retention policy holds blobs unalterable for the configured interval, and diagnostic settings can route activity logs there. That pairing meets the seven-year immutability mandate in a way plain log retention or streaming pipelines cannot.

Answer

Azure Event Hubs streaming activity logs to a third-party SIEM

Answer

A Log Analytics workspace with a 30-day interactive retention and archive tier

Answer

Azure Monitor activity log with the default 90-day retention setting

Question 12

A cloud security team is designing a detective control strategy for a multi-account AWS organization. The team wants to continuously evaluate resource configurations against CIS AWS Foundations Benchmark controls across all accounts and receive alerts when a resource drifts from the desired state. The team also wants to automatically remediate noncompliant resources where possible. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AWS Config with conformance packs. Continuous configuration evaluation against CIS controls across an organization is delivered by AWS Config conformance packs, which package standards-mapped rules and support multi-account deployment through a delegated administrator. Automatic remediation of noncompliant resources is delivered by AWS Config remediation actions that invoke AWS Systems Manager Automation runbooks. Security Hub and Trusted Advisor provide visibility or advice but do not perform the configuration recording and automated remediation this design requires.

Answer

AWS Trusted Advisor

Answer

AWS Security Hub with CIS AWS Foundations Benchmark standard

Answer

Amazon GuardDuty

Question 13

A European retailer stores customer personal data in a cloud-hosted e-commerce platform. The cloud provider processes data only on documented instructions from the retailer, which determines the purposes and means of processing. Under the General Data Protection Regulation (GDPR), which role does the cloud provider hold?

Accepted Answer

Data processor, because it processes personal data on behalf of, and only on documented instructions from, the retailer.. The GDPR distinguishes controllers, who determine the purposes and means of processing, from processors, who act on the controller's behalf. The retailer decides why and how personal data is processed, while the cloud provider follows documented instructions, making it a processor. This triggers Article 28 obligations, including a mandatory data processing agreement and appropriate technical and organizational measures.

Answer

Independent controller, because it makes technical decisions about storage locations and backup schedules.

Answer

Data controller, because it operates the physical infrastructure where the personal data resides.

Answer

Joint controller, because both organizations participate in the processing activity.

Question 14

A cloud security team is building an incident response runbook for compromised compute instances in a public cloud. They need to preserve volatile evidence and maintain chain of custody while minimizing service disruption. Which TWO actions should be included in the runbook? (Choose two.)

Accepted Answer

Capture a memory dump of the running instance before shutting it down, storing the dump in a write-once location with a documented hash.. Preserving volatile memory before any shutdown and snapshotting persistent volumes into an isolated forensic account together capture the full evidence set while maintaining integrity. Both actions record identifiers and hashes for chain of custody, and they allow the original instance to be contained or rebuilt without losing forensic artifacts, which is the core of a defensible cloud incident response runbook.

Answer

Disable all logging on the instance to prevent the attacker from tampering with logs, then re-enable after remediation.

Answer

Immediately terminate the instance to prevent further malicious activity and rely on the cloud provider's internal logs for evidence.

Answer

Reboot the instance into safe mode to clear malicious processes, then continue using it for production traffic.

Question 15

A cloud customer is subject to an eDiscovery request and stores business records in a cloud object storage service. The legal team needs to preserve potentially relevant data and prevent it from being altered or deleted while the matter is active. Which cloud capability should the customer configure to meet this obligation?

Accepted Answer

Apply an object lock with a retention mode and legal hold to prevent deletion or overwrite for the required period.. A legal hold requires that potentially relevant data be preserved and protected from alteration or deletion. Object lock, especially in compliance mode, enforces immutability for a defined retention period, and a legal hold flag prevents deletion regardless of retention expiry. These controls give the customer a defensible preservation mechanism that survives administrative actions and supports eDiscovery obligations.

Answer

Enable versioning on the bucket so previous object versions remain available after overwrite or deletion.

Answer

Enable cross-region replication so a secondary copy exists in another region if the primary copy is deleted.

Answer

Configure a lifecycle policy that transitions objects to cold storage after 30 days to reduce cost.