CCSP Practice Exam 51 — 20 Questions

Question 1

An organization is implementing a DevSecOps pipeline for cloud-native applications. Which security testing method should be integrated early in the CI/CD pipeline to analyze source code for vulnerabilities without executing the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) scans source code early in the SDLC, aligning with shift-left security.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 2

A cloud application uses an IAM role with a policy that allows 's3:*' on all buckets. This is an example of which cloud security issue?

Accepted Answer

Over-permissive IAM. Over-permissive IAM roles with wildcard permissions grant excessive privileges, violating least privilege.

Answer

Exposed S3 bucket

Answer

Insecure API endpoint

Answer

Hardcoded credentials

Question 3

A security team is implementing a DevSecOps pipeline for a cloud-native application. Which three practices should be included to enhance application security? (Choose THREE.)

Accepted Answer

Static application security testing (SAST) in CI/CD. Shift-left security involves integrating security early. IaC scanning detects misconfigurations before deployment. SAST scans source code for vulnerabilities. These three are key DevSecOps practices.

Answer

Manual penetration testing only at final stage

Answer

Runtime application self-protection (RASP) deployment

Question 4

Which OWASP Top 10 vulnerability is most directly related to cloud API security when an attacker can modify parameters to access another user's data?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA) occurs when an API does not properly enforce user permissions on object access.

Answer

Security Misconfiguration

Answer

Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 5

An organization is implementing a cloud SIEM solution to centralize security monitoring across multiple AWS accounts. Which service should be used to aggregate security findings and send them to a third-party SIEM like Splunk?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it is designed to aggregate security findings from multiple AWS services (e.g., GuardDuty, Inspector, Macie) and AWS accounts, and then forward them to third-party SIEM solutions like Splunk via AWS EventBridge or direct integration. This centralizes security alerts into a single dashboard and stream, enabling efficient monitoring across a multi-account environment.

Answer

AWS CloudTrail

Answer

AWS GuardDuty

Answer

AWS Config

Question 6

During a cloud security incident, a security team needs to isolate a compromised virtual machine instance that is performing outbound port scanning. Which containment action should be taken first?

Accepted Answer

Modify the security group to deny outbound traffic. Modifying the virtual machine's security group rules to deny all outbound traffic is a quick and reversible containment action that stops the scanning.

Answer

Terminate the virtual machine instance immediately

Answer

Create a snapshot or image of the virtual machine for analysis

Answer

Detach the virtual machine from the virtual network

Question 7

A cloud security architect is evaluating vulnerability management solutions for a hybrid cloud environment. The team needs to scan both on-premises servers and cloud workloads without installing agents on every system. Which approach is most suitable for cloud workloads?

Accepted Answer

Agentless scanning via cloud APIs (CSPM). Agentless scanning uses cloud APIs to assess vulnerabilities without requiring an agent on each instance. This is ideal for cloud workloads where agents may not be desired.

Answer

Agent-based scanning using a cloud-native service

Answer

Network vulnerability scanning from a remote scanner

Answer

Container image scanning only

Question 8

Which AWS service uses machine learning to detect threats such as crypto mining activity on EC2 instances and compromised IAM credentials?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Inspector

Question 9

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 10

A company is deploying a containerized application on Kubernetes. The security team requires that containers run with the least privilege, and that any attempt to escalate privileges within a container is blocked. Which Kubernetes security context setting should be applied to the pod specification?

Accepted Answer

allowPrivilegeEscalation: false. Setting `allowPrivilegeEscalation: false` in the pod's security context directly blocks any attempt by a container process to gain more privileges than its parent process, such as through setuid binaries or syscalls like `setuid()`. This satisfies the requirement to prevent privilege escalation within the container, aligning with the least privilege principle.

Answer

runAsNonRoot: true

Answer

capabilities: drop: ['ALL']

Answer

readOnlyRootFilesystem: true

Question 11

A company uses Azure Defender for Cloud to protect its hybrid environment. Which of the following is a feature of Azure Defender that provides vulnerability assessment for virtual machines?

Accepted Answer

Defender for Servers. Azure Defender includes integrated vulnerability assessment via Qualys or Microsoft built-in scanner, available for Defender for Servers.

Answer

Azure Secure Score

Answer

Azure Policy

Answer

Azure Sentinel

Question 12

An organization wants to implement a cloud security automation solution that can automatically remediate non-compliant resources in Azure. Which Azure service should be used to create remediation tasks?

Accepted Answer

Azure Policy. Azure Policy includes 'remediation tasks' that can automatically fix non-compliant resources, often using managed identities.

Answer

Azure Security Center

Answer

Azure Automation

Answer

Azure Logic Apps

Question 13

During a security incident in GCP, a forensic analyst needs to determine the exact timeline of events leading to a credential compromise. Which log source provides the most detailed information about IAM policy changes and authentication events?

Accepted Answer

Cloud Audit Logs. GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

Answer

VPC Flow Logs

Answer

Cloud DNS logs

Answer

Cloud Monitoring metrics

Question 14

A company wants to ensure that its cloud infrastructure can automatically add capacity during traffic spikes and remove capacity during low demand. Which cloud characteristic is primarily needed?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that enables automatic scaling of resources up or down in response to demand, often leveraging orchestration tools like AWS Auto Scaling or Azure VM Scale Sets. This ensures that capacity matches workload spikes and troughs without manual intervention, directly addressing the requirement for dynamic capacity adjustment.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 15

Under SOX, which of the following is an IT general control that must be implemented for financial data systems in a cloud environment?

Accepted Answer

Access controls over financial systems. SOX requires IT general controls (ITGCs) such as access controls to ensure the integrity of financial data. Audit logs support monitoring but are not the only control.

Answer

Data encryption at rest

Answer

Multi-factor authentication

Answer

Annual penetration testing

Question 16

A multinational corporation uses multiple cloud service providers for its critical applications. The board is concerned about concentration risk. Which strategy would best address this risk?

Accepted Answer

Adopting a multi-cloud strategy that distributes applications across multiple cloud providers. Concentration risk refers to over-reliance on a single provider. A multi-cloud strategy reduces this risk by distributing workloads across multiple providers, avoiding a single point of failure.

Answer

Negotiating a longer contract with the primary cloud provider to ensure stability

Answer

Implementing a hybrid cloud model with on-premises infrastructure only

Answer

Requiring each business unit to use the same cloud provider for consistency

Question 17

A large e-commerce company uses a multi-cloud environment with workloads in AWS and Azure. They store customer payment data in an AWS S3 bucket and use Azure SQL Database for transactional data. The company requires that all data at rest be encrypted using keys managed by their on-premises HSM. They have implemented AWS KMS with custom key store (CloudHSM) for S3, and Azure SQL TDE with Azure Key Vault (using BYOK) for the database. Recently, the security team noticed that some S3 objects are not encrypted with the expected key, and there are intermittent access failures to the Azure SQL database. Investigation reveals that the AWS KMS key ID changed after a recent security incident, and the Azure Key Vault key has been disabled due to a misconfigured access policy. What is the most effective course of action to restore encryption compliance and service availability?

Accepted Answer

Re-establish synchronization between on-premises HSM and cloud key stores: update AWS KMS custom key store with correct key and fix Azure Key Vault access policies.. The root cause is a loss of synchronization between the on-premises HSM and the cloud key stores. Updating the AWS KMS custom key store (CloudHSM) with the correct key restores S3 encryption compliance, while fixing the Azure Key Vault access policy re-enables the BYOK key for SQL TDE, restoring service availability. This directly addresses the specific failures: the changed KMS key ID and the disabled Key Vault key.

Answer

Implement client-side encryption for all data, bypassing cloud KMS.

Answer

Switch S3 to use SSE-S3 and Azure SQL to use service-managed keys.

Answer

Roll back all encryption to use cloud-provided managed keys to simplify operations.

Question 18

Under GDPR, what is the maximum time allowed for a data controller to notify the supervisory authority of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 19

A covered entity under HIPAA is planning to migrate electronic protected health information (ePHI) to a public cloud environment. Which of the following is a mandatory requirement before using the cloud service?

Accepted Answer

Obtain a signed Business Associate Agreement from the cloud provider. HIPAA requires covered entities to obtain satisfactory assurances that PHI will be protected, typically through a Business Associate Agreement (BAA) with the cloud provider.

Answer

Encrypt all ePHI with keys managed solely by the covered entity

Answer

Conduct a physical on-site audit of the cloud provider's data centers

Answer

Ensure the cloud provider is certified under the Privacy Shield framework

Question 20

A multinational company operating in the EU uses a cloud service provider based in the US to process personal data of EU data subjects. The company is considered a data controller under the GDPR. Which of the following must the company ensure is in place to lawfully transfer personal data from the EU to the US?

Accepted Answer

Standard Contractual Clauses adopted by the European Commission. Under GDPR, transfers of personal data to third countries require an adequate level of protection. Standard Contractual Clauses (SCCs) are a valid transfer mechanism approved by the European Commission.

Answer

A binding corporate rule approved by the US Department of Commerce

Answer

An adequacy decision by the US Federal Trade Commission

Answer

A data processing agreement solely between the cloud provider and the data subjects