CCSP Practice Exam 51 — 20 Questions

Question 1

A cloud customer is subject to a regulatory audit and must provide evidence that the cloud provider's security controls are effective. The customer has no right to audit the provider directly but can rely on third-party attestations. Which report should the customer request to obtain an independent assessment of the provider's controls relevant to security, availability, and confidentiality?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SOC 2 Type II report. SOC 2 Type II is specifically designed to report on the effectiveness of controls related to security, availability, and confidentiality over a period. It is produced by an independent CPA firm and is widely accepted in regulatory audits. Other options either focus on financial controls, lack detailed period-based evidence, or are self-assessed, making SOC 2 Type II the correct choice.

Answer

Cloud Security Alliance STAR Level 1 self-assessment

Answer

SOC 1 Type II report

Answer

ISO/IEC 27001 certificate

Question 2

A company is migrating to a public cloud and must ensure compliance with PCI DSS. Which responsibility does the cloud customer retain under the shared responsibility model?

Accepted Answer

Configuring security groups and access controls for its workloads. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes configuring security groups, identity and access management, and application-level controls. The provider is responsible for security 'of' the cloud, such as physical security, hypervisor patching, and network infrastructure. For PCI DSS, the customer must ensure its configurations meet the standard's requirements.

Answer

Patching the hypervisor and underlying host operating systems

Answer

Managing physical security of the data center

Answer

Ensuring the cloud provider's network is segmented from other tenants

Question 3

A financial services firm stores transaction logs in a cloud object storage bucket. The security team wants to ensure that if an attacker gains access to the bucket, the data cannot be read. They also want to prevent the cloud provider from accessing the plaintext. Which approach best meets these requirements?

Accepted Answer

Use client-side encryption with customer-managed keys stored on-premises.. Client-side encryption with customer-managed keys ensures data is encrypted before reaching the cloud and keys never leave the customer's control. This prevents the cloud provider from accessing plaintext and protects data even if the storage bucket is compromised. Server-side options leave key management or plaintext handling with the provider, failing the requirement.

Answer

Use bucket policies to restrict access to only authorized IAM roles.

Answer

Enable server-side encryption with provider-managed keys (SSE-S3).

Answer

Enable server-side encryption with customer-provided keys (SSE-C).

Question 4

A cloud provider discovers a security incident affecting a customer's personal data stored in its platform. The customer acts as the data controller under the General Data Protection Regulation (GDPR). Which obligation does the provider have regarding notification of this breach?

Accepted Answer

Notify the customer without undue delay after becoming aware of the personal data breach.. GDPR splits breach notification duties: processors must notify controllers without undue delay after becoming aware of a personal data breach, while controllers assess risk and handle authority and data subject notifications. The cloud provider, acting as processor, therefore owes prompt notice to its customer, enabling the customer to meet the 72-hour authority deadline if required.

Answer

Notify affected data subjects directly, because the provider holds the data and knows which records were exposed.

Answer

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.

Answer

Publish a public incident report within 24 hours and wait for the customer to respond.

Question 5

A multinational retailer uses a SaaS e-commerce platform hosted in the EU and serves customers in the EU, the UK, and the US. The legal team must determine which cross-border data transfer mechanism can be used to lawfully move customer personal data from the EU entity to the US parent company for analytics. Which mechanism should the legal team select?

Accepted Answer

EU-U.S. Data Privacy Framework (DPF) certification of the US parent company. For an EU-to-US transfer of personal data, the most current and straightforward mechanism is the EU-U.S. Data Privacy Framework, provided the US recipient is certified for the relevant data. BCRs must be approved by EU supervisory authorities, internal attestations have no legal force, and APEC CBPR is not a GDPR transfer mechanism. The DPF certification directly addresses the scenario.

Answer

Binding Corporate Rules (BCRs) approved only by the US Federal Trade Commission

Answer

The APEC Cross-Border Privacy Rules (CBPR) system certification of the US parent

Answer

A self-attestation of GDPR compliance signed by the US parent's Chief Privacy Officer

Question 6

A cloud customer is reviewing its incident response plan and wants to ensure it can meet regulatory breach notification timelines. The customer's data is hosted by a cloud provider that does not automatically notify customers of security incidents. Which action should the customer take FIRST to address this gap?

Accepted Answer

Include a contractual clause requiring the provider to notify the customer of security incidents within a specified timeframe.. The customer cannot meet regulatory breach notification deadlines if it learns about a provider-side incident too late. A contractual notification clause with a defined timeframe creates an enforceable obligation and ensures the customer receives timely information to begin its own incident assessment and notification process. This is the foundational step before technical monitoring or insurance can be effective.

Answer

Purchase cyber insurance to cover the costs of a breach notification and any regulatory fines.

Answer

Deploy a third-party vulnerability scanner to continuously monitor the provider's infrastructure for signs of compromise.

Answer

Rely on the provider's public status dashboard and security blog to learn about incidents affecting the customer's data.

Question 7

A multinational company is evaluating a cloud provider for a workload that processes personal data of employees in several countries. The company wants to ensure that cross-border data transfers comply with legal requirements. Which consideration is MOST important when assessing the provider's data transfer mechanisms?

Accepted Answer

Whether the provider can contractually commit to a recognized transfer mechanism, such as standard contractual clauses or an approved certification, for each transfer.. Cross-border data transfers require a recognized legal mechanism, such as standard contractual clauses, an adequacy decision, or an approved certification. The provider must be able to contractually commit to the applicable mechanism for every country where personal data is processed or stored. Technical factors like latency or staff location do not satisfy the legal requirement, and security certifications alone do not authorize a transfer.

Answer

Whether the provider's employees who may access the data are located in the same country as the data subjects.

Answer

Whether the provider offers the lowest latency by storing data in the region closest to each employee.

Answer

Whether the provider's data centers are certified to ISO/IEC 27001 in every region where data is stored.

Question 8

A cloud customer is assessing a provider's compliance with the Cloud Security Alliance (CSA) STAR program. Which TWO artifacts are part of the STAR program? (Choose two.)

Accepted Answer

Cloud Controls Matrix (CCM). The CSA STAR program includes the Cloud Controls Matrix (CCM) as the control framework and the Consensus Assessments Initiative Questionnaire (CAIQ) as the assessment tool. These artifacts enable cloud providers to document their security controls and customers to evaluate them. Other reports like SOC 2 or ISO certifications are separate and not unique to STAR, though they may be used in conjunction.

Answer

ISO/IEC 27017 certificate

Answer

GDPR compliance statement

Answer

SOC 2 Type II report

Question 9

A US-based retail company stores customer personal data in a cloud provider's data center located in Germany. The company is subject to GDPR because it offers goods to EU residents. Which legal mechanism most directly establishes that the controller and the cloud provider may lawfully transfer personal data from the EU to the provider's US-based support team?

Accepted Answer

Standard Contractual Clauses (SCCs) executed between the controller and the cloud provider. When EU personal data is accessible from a third country such as the United States, the controller needs a valid Chapter V transfer mechanism. Standard Contractual Clauses are pre-approved by the European Commission and are the most direct, widely used tool for controller-to-processor cloud transfers. A DPA governs processing but does not authorize the transfer, and security certifications or corporate-group rules do not fill that gap.

Answer

A data processing agreement (DPA) alone, without any additional transfer safeguard

Answer

A Binding Corporate Rules (BCR) approval granted to the cloud provider by its lead supervisory authority

Answer

The provider's ISO/IEC 27001 certification covering its German data center

Question 10

A cloud customer's security team learns that a provider's subprocessor experienced a breach affecting the customer's data. The customer's contract requires the provider to notify the customer of subprocessor breaches. Under the GDPR, within what timeframe must the cloud provider, acting as a processor, notify the controller of a personal data breach?

Accepted Answer

Without undue delay after becoming aware of the breach. GDPR Article 33(2) requires a processor to inform the controller without undue delay after becoming aware of a personal data breach. The 72-hour clock applies to the controller's notification to the supervisory authority, not to the processor's notice to the controller. This sequencing lets the controller assess the breach and meet its own regulatory and contractual duties.

Answer

Within 30 calendar days of completing its internal forensic investigation

Answer

Within 72 hours of becoming aware of the breach

Answer

Within 24 hours of confirming that the breach involves personal data

Question 11

A cloud customer operates a SaaS-based HR platform in the EU and receives a data subject access request (DSAR) from an employee. The provider's standard contract states it will only assist with DSARs on a 'reasonable efforts' basis and bills hourly for that assistance. Under GDPR Article 28, which contractual element must the customer ensure is in place before relying on this SaaS platform?

Accepted Answer

A data processing agreement (DPA) that obligates the processor to assist the controller in responding to data subject requests.. GDPR Article 28(3) requires the controller and processor to be bound by a contract or other legal act that sets out the processor's obligations, including assisting the controller with data subject requests. Without a DPA containing that assistance obligation, the customer has no enforceable basis to compel the provider's help, regardless of the provider's internal practices or certification status.

Answer

A Standard Contractual Clause (SCC) module three signed with the SaaS provider to legitimize onward transfers.

Answer

A binding corporate rules (BCR) approval from the lead supervisory authority covering the provider's intra-group transfers.

Answer

A certification under an approved Article 42 code of conduct demonstrating the provider's accountability framework.

Question 12

A healthcare organization stores electronic protected health information (ePHI) in a cloud environment. They need to implement data discovery and classification to meet HIPAA requirements. Which two techniques are most appropriate for identifying ePHI in unstructured data stored in cloud object storage? (Choose two.)

Accepted Answer

Regular expression pattern matching for known ePHI formats.. Regular expression pattern matching and NLP are both content inspection techniques that can identify ePHI in unstructured data. Pattern matching catches formatted identifiers, while NLP detects medical context. Together they provide a robust discovery strategy. Encryption, manual review, and metadata tagging do not effectively identify ePHI content at scale.

Answer

Full-disk encryption of the storage volumes.

Answer

Metadata tagging based on file extensions and folder names.

Answer

Manual review of every file by a compliance officer.

Question 13

A financial services firm stores sensitive customer records in a cloud object storage bucket. The security team wants to ensure that even if the cloud provider's internal staff or a compromised administrative account attempts to access the data, they cannot read it. The firm already uses provider-managed encryption at rest. Which additional control BEST achieves this requirement?

Accepted Answer

Implement client-side encryption where keys are managed by the firm and never shared with the provider.. The requirement is to prevent the cloud provider from reading the data. Provider-managed encryption does not meet this because the provider holds the keys. Client-side encryption with firm-controlled keys ensures the provider only sees ciphertext. Other options address access control, integrity, or key management within the provider, but none remove the provider's ability to decrypt.

Answer

Configure a bucket policy that denies access to all principals except a specific IAM role.

Answer

Enable bucket versioning and object lock to prevent unauthorized deletion.

Answer

Enable default encryption with a customer-provided key stored in the cloud provider's KMS.

Question 14

A cloud provider operates a public IaaS environment. A customer's legal team is reviewing the provider's audit rights clause and wants to ensure the provider will cooperate with a regulatory examination by a financial services regulator. The provider's standard contract currently states that customers may review SOC 2 reports annually but does not grant any right to audit. Which action should the customer's legal team take to best satisfy the regulator's expectations while maintaining a workable relationship with the provider?

Accepted Answer

Request that the provider undergo a third-party audit against a recognized framework and share the resulting report under NDA, supplemented by a right to receive audit summaries and to conduct audits only when required by the regulator. A practical audit rights clause in cloud contracts usually combines independent third-party attestations with a limited right for the customer to audit or receive audit results when required by a regulator. This satisfies oversight without demanding unlimited access. The other options either overreach, rely on insufficient evidence, or misunderstand the regulator's role.

Answer

Rely solely on the provider's published marketing materials and self-assessment questionnaires

Answer

Demand an unlimited right to audit the provider's data centers at any time without notice

Answer

Insist that the regulator conduct the audit directly against the provider without any customer involvement

Question 15

A cloud service provider wants to demonstrate compliance with ISO/IEC 27017 for cloud services. Which TWO controls are specific additions that this standard introduces beyond ISO/IEC 27002? (Choose two.)

Accepted Answer

Guidance on shared roles and responsibilities between cloud service customers and cloud service providers.. ISO/IEC 27017 extends ISO/IEC 27002 with cloud-specific implementation guidance, notably clarifying shared roles and responsibilities between customers and providers, and addressing the return or removal of customer assets at service termination. These additions target the unique risks of cloud arrangements rather than imposing technology mandates or certification requirements.

Answer

A mandate that all cloud personnel hold a Certified Cloud Security Professional (CCSP) certification.

Answer

A requirement to publish real-time security incident dashboards to all customers.

Answer

Mandatory encryption of all data at rest using AES-256 or an equivalent algorithm.

Question 16

A cloud customer stores regulated data with a provider that uses sub-processors in multiple countries. The customer's legal team wants to ensure that international transfers of personal data remain lawful under the General Data Protection Regulation (GDPR). Which mechanism is the most appropriate to implement with the provider?

Accepted Answer

Standard Contractual Clauses approved by the European Commission, supported by a transfer impact assessment.. Transfers of personal data outside the European Economic Area require a Chapter V mechanism. Standard Contractual Clauses are a widely used appropriate safeguard, and after Schrems II they must be supported by a transfer impact assessment and, where needed, supplementary measures. This pairing best satisfies the customer's need for lawful, defensible international transfers.

Answer

A binding corporate rules framework filed only by the cloud provider with its own supervisory authority.

Answer

A verbal assurance from the provider that data will remain within the European Economic Area.

Answer

A data processing agreement alone, because it binds the provider to GDPR terms regardless of where processing occurs.

Question 17

A financial services company is migrating a customer analytics platform to a public cloud IaaS environment. The security team must ensure that sensitive data at rest in the cloud provider's block storage volumes is encrypted and that the company retains sole control over the encryption keys, even from the cloud provider. Which approach BEST meets these requirements?

Accepted Answer

Implement client-side encryption before writing data to the block storage volumes, managing keys in an on-premises HSM.. Client-side encryption with keys stored in an on-premises HSM ensures that data is encrypted before it leaves the company's control and that the cloud provider never has access to the encryption keys. This provides the strongest level of key control and meets both the encryption at rest and sole key control requirements. Provider-managed or customer-managed keys in the cloud still involve the provider in key management.

Answer

Enable cloud provider volume encryption with customer-managed keys stored in the provider's KMS.

Answer

Use the cloud provider's native volume encryption with provider-managed keys.

Answer

Use transport-layer encryption (TLS) for all data written to the block storage volumes.

Question 18

A cloud customer is preparing for an audit of its provider and wants to rely on the provider's existing independent attestation rather than conduct its own on-site review. Which document should the customer request to evaluate the provider's controls over security, availability, and confidentiality?

Accepted Answer

A SOC 2 Type II report covering the trust services criteria relevant to the customer's use of the service.. A SOC 2 Type II report is the standard independent attestation for security, availability, and confidentiality controls over a period of time, allowing a customer to evaluate a provider without an on-site review. The customer should confirm the report's scope covers the in-use service, the audit period is recent, and any listed complementary user entity controls are implemented on its side.

Answer

An ISO/IEC 27001 certificate listing the provider's statement of applicability for its corporate IT systems.

Answer

A completed CSA CAIQ self-assessment submitted by the provider's security team.

Answer

A SOC 1 Type II report covering controls relevant to the customer's internal control over financial reporting.

Question 19

A cloud customer stores personal data of EU residents in a SaaS application. The customer's contract with the SaaS provider includes a data processing addendum. The customer's legal team wants to understand the allocation of GDPR responsibilities. Which of the following best describes the roles of the customer and the SaaS provider under GDPR?

Accepted Answer

The customer is the controller and the SaaS provider is the processor, unless the provider processes data for its own purposes, in which case it may also be a controller for those specific activities. In a typical SaaS arrangement, the customer is the controller and the provider is the processor. The provider may become a controller for specific processing done for its own purposes, such as service analytics or marketing. This dual role is recognized in GDPR and should be addressed in the data processing addendum.

Answer

The customer is the processor and the SaaS provider is the controller because the provider hosts the data

Answer

The SaaS provider is the sole controller because it owns the infrastructure and determines the security measures

Answer

Both the customer and the SaaS provider are joint controllers for all processing activities

Question 20

A US-based cloud customer stores EU personal data in a provider's Singapore region and uses the provider's support team located in India. The customer relies on the EU-US Data Privacy Framework (DPF) for its own US transfers. Which action is required to legitimize the support team's access to that EU data?

Accepted Answer

Verify the provider's DPF certification covers the Indian support entity and the Singapore processing, or put an Article 46 transfer tool in place for the India access.. A transfer occurs whenever personal data is made accessible to an entity in a third country, including remote support access. DPF certification only covers the certified entity and the data categories it lists, so the customer must confirm the Indian support team is covered or execute a valid Article 46 mechanism such as SCCs. Storage location alone does not resolve the transfer question.

Answer

Obtain a derogation under Article 49 for occasional support access, since break-fix support is by definition non-repetitive.

Answer

Rely on the provider's Singapore data residency commitment because data stored in-region never leaves the jurisdiction.

Answer

Adopt binding corporate rules covering the customer's own corporate group, which automatically extends to provider personnel.