CCSP Practice Test 50 — 15 Questions

Question 1

A cloud provider's data center is located in Country A, but the customer's data is subject to litigation in Country B. The court in Country B orders the cloud provider to produce data. The cloud provider refuses, citing Country A's laws that prohibit disclosure. This situation best illustrates which challenge in eDiscovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Jurisdiction issues. Jurisdictional issues arise when data is stored in multiple legal jurisdictions, and courts in one country may not have authority over data in another, leading to conflicts of law.

Answer

Data portability

Answer

Data preservation

Answer

Forensic soundness

Question 2

Which hypervisor type is most commonly deployed in production cloud data centers to host multiple tenant virtual machines?

Accepted Answer

Type 1 bare-metal hypervisor like VMware ESXi. Type 1 (bare-metal) hypervisors run directly on hardware and are used in cloud environments for better performance and isolation.

Answer

Container runtime like Docker

Answer

Para-virtualization interface

Answer

Type 2 hosted hypervisor like VirtualBox

Question 3

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. AWS WAF protects the application from web exploits, and security groups act as instance-level firewalls to control traffic between tiers. NACLs are subnet-level and less granular.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 4

A serverless function needs to access a private RDS database inside a VPC. What configuration is required to enable this without using public IP addresses?

Accepted Answer

Place the Lambda function inside the VPC using VPC configuration. Serverless functions can be configured with VPC integration to access resources inside a VPC via private IP.

Answer

Store database credentials in the function code

Answer

Use a NAT Gateway to allow inbound traffic

Answer

Attach an Internet Gateway to the VPC

Question 5

Which container image security practice is most effective at reducing the attack surface by removing unnecessary components and lowering the number of CVEs?

Accepted Answer

Using distroless base images. Distroless images contain only the application and its runtime dependencies, minimizing the attack surface.

Answer

Using the :latest tag for base images

Answer

Adding security agents inside the image

Answer

Scanning images only at build time

Question 6

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 7

A serverless function needs to access a private database service without traversing the public internet. Which configuration should be used?

Accepted Answer

Configure the serverless function with virtual private cloud integration. Virtual private cloud (VPC) integration allows the serverless function to be deployed inside a VPC, enabling private access to resources like a database service. Internet access is not required.

Answer

Assign a public IP to the serverless function

Answer

Enable public access on the database service

Answer

Use a network address translation gateway to route traffic

Question 8

A security team implements Kubernetes RBAC. They want to ensure that a service account can only create pods in the 'dev' namespace. Which RBAC resource should they use?

Accepted Answer

Role and RoleBinding in the 'dev' namespace. RBAC uses Role and RoleBinding for namespace-scoped permissions. ClusterRole and ClusterRoleBinding are cluster-scoped. A Role with permissions to create pods in the 'dev' namespace, bound via RoleBinding, achieves the goal.

Answer

ClusterRole and ClusterRoleBinding

Answer

PodSecurityPolicy (deprecated)

Answer

NetworkPolicy

Question 9

A company has multiple VPCs in different cloud accounts that need to communicate with each other. They also need to enforce centralized security policies and simplify network management. Which cloud networking service should they use to create a hub-and-spoke topology?

Accepted Answer

Cloud transit gateway. A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

Answer

Virtual network peering

Answer

Private link service

Answer

Virtual network endpoint

Question 10

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Accepted Answer

Running containers as a non-root user. Running as non-root user, dropping unnecessary Linux capabilities, and using AppArmor/SELinux profiles are key container security best practices. Running as root defeats isolation; privileged containers grant excessive host access.

Answer

Enabling privileged mode for containers that need host access

Answer

Running containers as root

Question 11

In a Kubernetes cluster, which resource should be used to restrict network traffic between pods based on source and destination labels?

Accepted Answer

Network Policies. Network policies in Kubernetes act as a firewall for pods, allowing or denying traffic based on selectors.

Answer

Pod Security Admission

Answer

Secrets management with Vault

Answer

Role-Based Access Control (RBAC)

Question 12

A cloud security engineer is reviewing an AWS IAM policy that includes the following statement: 'Effect: Allow, Action: iam:*, Resource: *'. Which two security concerns does this configuration create? (Choose TWO.)

Accepted Answer

Over-permissive IAM role. The policy allows all IAM actions (iam:*) on all resources (*), which is over-permissive. It can lead to privilege escalation and unauthorized actions.

Answer

Exposed S3 bucket

Answer

Hardcoded credentials

Answer

SSRF vulnerability

Question 13

A security analyst is investigating a potential compromise of an AWS EC2 instance. Which step should be taken FIRST to contain the incident and prevent further damage?

Accepted Answer

Isolate the EC2 instance by updating the security group to deny all traffic.. The first priority in incident response is containment. Updating the security group to deny all traffic immediately isolates the EC2 instance from network communication, preventing lateral movement or data exfiltration while preserving the instance for further investigation. This aligns with the NIST SP 800-61 incident response framework, which emphasizes containment before eradication or recovery.

Answer

Terminate the EC2 instance immediately.

Answer

Take a snapshot of the instance for forensic analysis.

Answer

Disable the IAM role attached to the instance.

Question 14

A security engineer discovers that a cloud application can access the metadata service endpoint at 169.254.169.254. Which vulnerability is most likely being exploited?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) can be used to target the cloud metadata endpoint (169.254.169.254) to retrieve IAM credentials or other sensitive information. This is a cloud-specific vulnerability.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Insecure Deserialization

Question 15

A developer configures an AWS S3 bucket to allow public access by setting a bucket policy that grants 's3:GetObject' to 'Principal: *'. Which vulnerability does this introduce?

Accepted Answer

Exposed S3 bucket. Exposing an S3 bucket to anonymous access allows anyone to read objects, leading to data exposure. This is a common cloud misconfiguration.

Answer

Mass assignment

Answer

SSRF vulnerability

Answer

Over-permissive IAM