CCSP Practice Questions 1 — 50 Questions

Question 1

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Accepted Answer

The policy allows GetObject requests only from the specified IP range. The S3 bucket policy includes a Condition block using the IpAddress condition key to restrict the aws:SourceIp to a specific IP range. The Effect is Allow, and the Action is s3:GetObject, so only GET requests from that IP range are permitted. This makes option B correct because the policy explicitly allows GetObject requests from the specified IP range while implicitly denying all other access.

Answer

The policy grants full administrative access to the bucket

Answer

The policy denies all access from the specified IP range

Answer

The bucket is publicly accessible to any IP address

Question 2

Which TWO of the following are required for GDPR compliance when processing personal data in the cloud?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk. Options A and B are correct. DPIA is required for high-risk processing, and records of processing activities are mandatory. Option C is wrong because data can be stored outside EU with adequate safeguards. Option D is wrong because DPO is only required in certain cases. Option E is wrong because CSP certification is not a legal requirement.

Answer

Appoint a Data Protection Officer (DPO) for all organizations

Answer

Store data only within the European Union

Answer

Use only ISO 27001 certified cloud service providers

Question 3

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

Accepted Answer

GDPR. The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Answer

SOX

Answer

HIPAA

Answer

PCI DSS

Question 4

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Accepted Answer

2. The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Answer

12

Answer

4

Answer

3

Question 5

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for early detection of vulnerabilities during the coding phase of the SSDLC. By integrating SAST into the CI/CD pipeline, developers receive immediate feedback on security flaws such as SQL injection or buffer overflows, enabling remediation before the code is built or deployed. This aligns with the 'shift left' principle, catching issues when they are cheapest and easiest to fix.

Answer

Penetration testing in production

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 6

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Accepted Answer

Certificate of destruction. Option A is correct (Certificate of destruction) provides evidence of secure deletion. Option B (Annual penetration testing) is for security testing, not deletion. Option C (Right to audit) is broad. Option D (Service level credits) are for availability.

Answer

Service level credits

Answer

Annual penetration testing

Answer

Right to audit

Question 7

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. Option C is correct because the S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 8

A cloud service provider stores customer data in a multi-tenant environment. A customer from the European Union requests that all personal data be encrypted at rest to comply with GDPR. What is the primary reason for this requirement?

Accepted Answer

To prevent unauthorized access by other tenants. Option A is correct because encryption at rest protects against unauthorized access in multi-tenant environments. Option B is about portability, not encryption. Option C is about minimizing data collected, not encryption. Option D is about deletion, not encryption.

Answer

To ensure data portability

Answer

To meet data minimization principles

Answer

To satisfy the right to be forgotten

Question 9

Refer to the exhibit. A security engineer discovers that the S3 bucket policy allows public read access from the entire corporate network (10.0.0.0/16). However, the company wants to restrict access only to the security team's subnet (10.0.1.0/24). What modification should be made to the policy?

Accepted Answer

Change the Condition value to "aws:SourceIp": "10.0.1.0/24".. Option D is correct because modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

Answer

Add a Deny statement for the 10.0.0.0/16 range.

Answer

Add a Deny statement for IP addresses outside 10.0.1.0/24.

Answer

Remove the Condition element to allow access from any IP.

Question 10

Which TWO of the following are common risk treatment options in cloud risk management?

Accepted Answer

Transference. Options A and C are correct. Avoidance and transference (transfer) are standard risk treatment options. Acceptance is also a treatment, but in this question we require exactly two correct, so we chose avoidance and transference. Mitigation is another common option, but it is not listed as correct here.

Answer

Ignorance

Answer

Deletion

Answer

Acceptance

Question 11

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. Option A is correct because a communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 12

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 13

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

Accepted Answer

Implement a process to request immediate deletion from the provider and verify completion within 30 days.. Option C is correct because the bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Answer

Store all customer data on-premises and only use the cloud for non-sensitive data.

Answer

Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

Answer

Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

Question 14

A financial services company uses a cloud-based logging service for audit trails. A regulatory investigation is initiated, and the company is required to preserve all logs from the past 18 months. The cloud provider's default retention policy is 12 months, and logs older than that are automatically deleted. The company did not configure custom retention. What is the most appropriate action to ensure compliance?

Accepted Answer

Request that the provider place a legal hold on all logs and verify implementation.. Option C is correct because a legal hold (or litigation hold) is a cloud provider feature that overrides the default retention policy to preserve data indefinitely or for a specified period, preventing automated deletion. This ensures compliance with regulatory requirements without relying on manual exports or backups, and the company must verify implementation through provider tools or APIs to confirm the hold is active.

Answer

Accept the data loss and explain to regulators that the provider has a limited retention policy.

Answer

Export all available logs and store them locally immediately.

Answer

Rely on the provider's backup policy, which may retain data for up to 24 months.

Question 15

A cloud security architect is designing a data loss prevention (DLP) strategy for a multi-cloud environment. Which TWO actions are effective in preventing unauthorized exfiltration of sensitive data?

Accepted Answer

Implement strict Identity and Access Management (IAM) policies with least privilege. Option D is correct because implementing strict IAM policies with least privilege ensures that users and services have only the minimum permissions necessary to perform their functions. This directly limits the attack surface and prevents unauthorized access to sensitive data, which is a foundational control against exfiltration. Without least privilege, even with other controls in place, an over-privileged account could be exploited to move or copy data out of the environment.

Answer

Enable detailed logging and monitoring of all data access events

Answer

Encrypt all data at rest using provider-managed keys

Answer

Use a cloud access security broker (CASB) to enforce data classification

Question 16

A cloud security engineer reviews the S3 bucket policy shown in the exhibit. What is the net effect of this policy when a request originates from IP address 203.0.113.10 over HTTPS?

Accepted Answer

Deny access because the request is from the specified IP range. The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Answer

Deny access because the request does not meet the SecureTransport condition

Answer

Allow access because the condition for Deny does not include SecureTransport

Answer

Allow access because the request uses HTTPS

Question 17

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. Option B is correct because a SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 18

Which TWO of the following are primary responsibilities of a cloud service customer under the shared responsibility model regarding compliance with regulations such as GDPR?

Accepted Answer

Implementing data encryption for sensitive data at rest. The customer is responsible for data encryption and access controls (B and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

Answer

Conducting annual penetration tests on the provider's infrastructure

Answer

Ensuring the cloud provider's physical security controls are adequate

Answer

Verifying the provider's compliance certifications are current

Question 19

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Accepted Answer

The second Allow statement does not include the IP restriction, allowing any IP to read objects. Option C is correct because the second Allow statement in the IAM policy grants s3:GetObject access to all principals without any condition, effectively overriding the IP restriction in the first statement. AWS IAM policy evaluation is explicit deny by default, but when multiple statements apply, an Allow without conditions will permit the action even if another statement restricts it. Since the second statement has no aws:SourceIp condition, any IP address, including those outside 10.0.0.0/8, can download objects.

Answer

The condition key 'aws:SourceIp' does not apply to S3 operations

Answer

The first statement's condition explicitly denies access to IPs outside 10.0.0.0/8

Answer

The policy document has a syntax error that causes the first statement to be ignored

Question 20

Which TWO of the following are primary objectives of a cloud application security program?

Accepted Answer

Maintaining application availability. Maintaining application availability is a primary objective of a cloud application security program because it directly supports the security triad of confidentiality, integrity, and availability (CIA). In a cloud environment, availability ensures that authorized users can access applications and data when needed, which is critical for business continuity and is often enforced through SLAs, redundancy, and DDoS protection mechanisms. Without availability, security controls become irrelevant as the service is effectively denied.

Answer

Performing continuous deployment

Answer

Implementing a microservices architecture

Answer

Adopting Agile development practices

CCSP Practice Questions 1 — 50 Questions

Exhibit

CCSP Practice Questions 1 — 50 Questions

Exhibit