CCSP Practice Exam 53 — 20 Questions

Question 1

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a separate KMS customer managed key per tenant and enforce strict IAM policies that limit each tenant's application role to only its own key.. The scenario requires cryptographic isolation so that a compromised process cannot read another tenant's data. Using a separate KMS customer managed key per tenant ensures that data is encrypted with distinct keys, and strict IAM policies limit each tenant's role to only its own key. This combination creates a strong boundary. Other options are either hygiene practices or detective controls that do not prevent cross-tenant access.

Answer

Store all tenant data in a single S3 bucket with a bucket policy that restricts access by tenant ID prefix.

Answer

Enable automatic key rotation for all KMS customer managed keys.

Answer

Enable AWS CloudTrail logging for all KMS API calls and monitor for anomalous decrypt operations.

Question 2

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a database that supports per-user encryption keys and crypto-shredding by deleting the keys upon user request.. Crypto-shredding is the most effective way to ensure permanent deletion in a multi-tenant cloud environment with backups and replicas. By encrypting each user's data with a unique key and deleting the key, the data becomes irrecoverable everywhere it exists, including backups. This satisfies the 30-day deletion requirement without needing to track and erase every copy, which is impractical in distributed systems with immutable backups. Other methods leave data remnants in backups or fail to permanently erase data.

Answer

Implement soft delete by marking records as deleted and filtering them out in the application, while retaining them in the database for audit purposes.

Answer

Configure the database to automatically purge records older than 30 days using a time-to-live (TTL) setting.

Answer

Schedule a nightly job that runs a DELETE SQL statement to remove user records from the primary database and all replicas.

Question 3

A cloud security analyst is reviewing data flows for a web application that stores session tokens in a cloud database. The tokens are considered sensitive and must be protected both at rest and in transit. The database supports encryption at rest using provider-managed keys, and the application connects over a private network link. Which additional control best protects the session tokens from being exposed in the event of a database snapshot being copied to another region?

Accepted Answer

Enable customer-managed keys for the database encryption so snapshots copied to another region remain encrypted under keys the organization controls.. Customer-managed keys are the best additional control because they keep snapshot encryption under the organization's key policy, so a snapshot copied to another region remains unreadable without those keys. Audit logging, hashing, and bucket policies either detect rather than prevent, break application functionality, or can be bypassed by privileged actions.

Answer

Restrict snapshot sharing to the same region using a bucket policy that denies cross-region replication.

Answer

Configure the application to hash session tokens before storing them so the database never contains the original token values.

Answer

Enable database audit logging to record every query that accesses the session token table and alert on unusual access patterns.

Question 4

A cloud security team is implementing data discovery and classification for a multi-cloud environment. They need to identify sensitive data such as personally identifiable information (PII) and protected health information (PHI) across structured and unstructured data stores. Which TWO approaches are MOST effective for accurate and scalable data discovery in this scenario? (Choose two.)

Accepted Answer

Use cloud-native data discovery services that integrate with the provider's storage and database services.. Cloud-native discovery services offer deep integration and scalability within each provider, while third-party multi-cloud tools provide a unified, cross-provider view and consistent classification. Together, they enable accurate and scalable discovery across structured and unstructured data in a multi-cloud environment. Manual tagging and network DLP are not sufficient for comprehensive data-at-rest discovery, and encryption does not remove the need for classification.

Answer

Use encryption to protect all data and assume that encrypted data does not need classification.

Answer

Implement network-based data loss prevention (DLP) appliances to inspect data in transit.

Answer

Rely on manual data tagging by data owners during data creation.

Question 5

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Object lifecycle management policies with expiration actions.. Object lifecycle management policies are cloud-native features that automatically transition or delete objects based on age or other criteria. They are enforced by the provider, ensuring consistent application, and typically log actions for audit. When configured to delete after a retention period, they provide automatic, verifiable, and irreversible removal of data, meeting the policy requirements.

Answer

Bucket versioning with a retention policy.

Answer

Client-side encryption with key deletion after the retention period.

Answer

Manual deletion by administrators on a scheduled basis.

Question 6

A healthcare organization stores patient data in a cloud database. Regulatory requirements mandate that data must be encrypted at rest using FIPS 140-2 validated cryptographic modules. The organization wants to use the cloud provider's managed encryption service. Which aspect should they verify to ensure compliance?

Accepted Answer

That the encryption service's cryptographic module has a current FIPS 140-2 validation certificate.. FIPS 140-2 validation is a requirement for cryptographic modules used by federal agencies and often mandated by regulations like HIPAA. To comply, the organization must confirm that the specific cryptographic module used by the cloud service has a valid FIPS 140-2 certificate. This ensures the module meets stringent security standards for design and implementation.

Answer

That the database uses AES-256 encryption.

Answer

That the cloud provider's encryption service uses FIPS 140-2 validated hardware security modules (HSMs) for key storage.

Answer

That the cloud provider is certified under ISO/IEC 27001.

Question 7

A cloud administrator is configuring a new object storage bucket that will hold internal project files. The organization's policy states that data must be encrypted at rest, but the team wants the cloud provider to handle all key management with no additional operational overhead. Which configuration meets this policy with the least administrative effort?

Accepted Answer

Enable the bucket's default server-side encryption using provider-managed keys.. Server-side encryption with provider-managed keys encrypts objects at rest automatically and delegates key lifecycle to the cloud provider. It requires no customer key handling, no application changes, and no extra infrastructure, so it satisfies the encryption-at-rest policy with the least administrative effort. Client-side encryption and third-party gateways add operational burden, while access policies alone do not encrypt data.

Answer

Use a third-party encryption gateway that proxies all uploads and encrypts objects before they reach the bucket.

Answer

Store the files in a bucket without encryption but restrict access using bucket policies.

Answer

Encrypt each file on the client side before uploading it to the bucket.

Question 8

A financial services company runs a critical workload on AWS. The security team must ensure that all data at rest in Amazon S3 is encrypted with keys that the company controls and that the keys are stored in a hardware security module (HSM) separate from the cloud provider's default HSM. The company also requires the ability to immediately revoke access to the keys. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS custom key store backed by AWS CloudHSM (SSE-KMS with custom key store).. The requirement is for customer-controlled keys stored in a dedicated HSM separate from the cloud provider's default HSM, with immediate revocation. AWS KMS custom key store backed by AWS CloudHSM provides exactly this: you control the HSM cluster, and you can revoke access by disassociating the key or deleting it. Other options either use provider-managed HSMs or lack HSM separation.

Answer

Use S3 server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS).

Answer

Use S3 client-side encryption with a customer-provided key stored in AWS Secrets Manager.

Question 9

A multinational corporation uses a cloud-based data lake to store aggregated analytics data. The security team needs to ensure that data subjects can exercise their right to erasure under GDPR, even when data is replicated across multiple cloud regions and stored in immutable backups. Which strategy best addresses this requirement?

Accepted Answer

Use crypto-shredding by encrypting each data subject's records with a unique key and destroying that key upon erasure request.. Crypto-shredding is the most effective way to satisfy erasure requests when data is replicated and backed up immutably. By destroying the unique key for a data subject, the ciphertext becomes useless, achieving erasure without needing to locate and delete every copy. This approach is scalable and works across regions.

Answer

Store all personal data in a single cloud region to simplify deletion and avoid cross-region replication issues.

Answer

Anonymize the data by removing direct identifiers, then consider the erasure request fulfilled.

Answer

Implement a centralized deletion workflow that removes the data from all primary storage and waits for backup retention periods to expire.

Question 10

A cloud security team is implementing a data loss prevention (DLP) solution for a cloud storage environment. They need to detect and prevent the exfiltration of sensitive data, including personally identifiable information (PII) and intellectual property, in real time. The solution must also provide granular reporting on policy violations. Which approach is most effective?

Accepted Answer

Use a cloud-native DLP service that integrates with the cloud storage API and inspects data at rest and in transit.. A cloud-native DLP service integrated with the storage API can inspect data in real time, enforce policies to block exfiltration, and provide granular reporting. It is designed for cloud environments and can monitor both data at rest and in transit within the cloud, making it the most effective solution for detecting and preventing sensitive data loss.

Answer

Rely on the cloud provider's built-in encryption and access controls to prevent data exfiltration.

Answer

Deploy endpoint DLP agents on all user devices to monitor data transfers.

Answer

Implement a network-based DLP appliance at the perimeter to inspect all traffic leaving the cloud.

Question 11

A healthcare organization runs a critical workload on Azure virtual machines. The security team wants to ensure that the VMs are protected against rootkit and kernel-level malware that could persist across reboots. They need a solution that can detect and alert on suspicious kernel driver loads and provide file integrity monitoring. Which Azure service should they implement?

Accepted Answer

Azure Defender for Servers. Azure Defender for Servers, a component of Microsoft Defender for Cloud, provides endpoint detection and response, file integrity monitoring, and kernel-level threat detection. It can identify suspicious kernel driver loads and rootkit behavior, alerting security teams. Other services like Network Watcher focus on network diagnostics, Sentinel is a SIEM, and the outdated Security Center standard tier is superseded by Defender for Servers.

Answer

Azure Network Watcher

Answer

Azure Sentinel

Answer

Azure Security Center (standard tier)

Question 12

A cloud security team is reviewing data retention for a software-as-a-service application hosted in a public cloud. Legal counsel requires that customer data be deleted permanently when a subscription ends, and that deletion be demonstrable to auditors. The cloud provider's storage system uses log-structured storage and maintains replicas across multiple availability zones. Which action best supports demonstrable, permanent deletion?

Accepted Answer

Use cryptographic erasure by destroying the customer-specific encryption key, and retain the key-destruction audit record.. Cryptographic erasure destroys the key that protects a customer's data, making the ciphertext permanently unrecoverable even if remnants persist on replicated or log-structured media. The key-destruction event can be logged and attested, giving auditors the evidence legal counsel requires. API deletion, overwriting, and tenant-level media sanitization cannot guarantee or demonstrate that every copy is gone in shared cloud storage.

Answer

Delete the objects through the provider's API and rely on the provider's standard garbage collection.

Answer

Ask the cloud provider to issue a media-sanitization certificate for the underlying disks.

Answer

Overwrite the objects with random data before deleting them from the bucket.

Question 13

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A cloud provider's managed Hardware Security Module (HSM) service offering dedicated, tamper-resistant HSM appliances.. The requirement is for a FIPS 140-2 Level 3 validated HSM with minimal operational overhead and keys that never leave the HSM. A managed HSM service provides dedicated, validated hardware while the provider handles maintenance and availability, satisfying both security and operational needs. Alternatives either lack hardware validation, export keys outside the boundary, or add unnecessary management burden.

Answer

A software-based key management service that uses a shared, multi-tenant key store with encryption at rest.

Answer

A cloud provider's virtual private cloud (VPC) with a customer-managed encryption key stored in the provider's object storage.

Answer

An on-premises HSM connected to the cloud via a VPN tunnel, with keys replicated to the cloud provider's key vault.

Question 14

A cloud security team is using AWS Lambda functions to process sensitive data. The functions are triggered by Amazon S3 events and write to an Amazon DynamoDB table. The team wants to ensure that the Lambda functions have only the permissions they need and that any compromised function cannot access other AWS resources. Which of the following is the MOST effective approach?

Accepted Answer

Create a separate IAM role for each Lambda function with permissions scoped to only the specific S3 bucket and DynamoDB table it needs.. The most effective approach is to create a separate IAM role for each Lambda function with permissions scoped to only the resources that function needs. This enforces least privilege and ensures that a compromised function cannot access other AWS resources. Other options either grant excessive permissions, use insecure credential storage, or are overly permissive.

Answer

Attach a resource-based policy to the DynamoDB table that allows all Lambda functions in the account to write to it.

Answer

Use AWS Lambda environment variables to store IAM credentials and rotate them regularly.

Answer

Create a single IAM role with broad permissions to all necessary services and assign it to all Lambda functions.

Question 15

A financial services company runs a regulated workload on a public cloud. The security team must ensure that all data at rest in the cloud provider's block storage service is encrypted with keys that the company controls and can revoke immediately. The company also needs to prove to auditors that the cloud provider cannot access the plaintext data. Which approach BEST meets these requirements?

Accepted Answer

Implement client-side encryption before writing data to block storage, using a customer-managed key stored in an external key management system.. Client-side encryption with an externally managed key ensures the cloud provider never receives plaintext and cannot access the key. The company retains full control and can revoke the key instantly, and auditors can verify that the provider has no path to the plaintext. Other options either leave key control with the provider or do not provide provable inaccessibility, failing the regulatory requirements.

Answer

Use provider-managed encryption keys with automatic rotation enabled, and rely on the provider's attestation reports for audit evidence.

Answer

Use a cloud provider's key management service to generate a customer-managed key (CMK) and enable automatic rotation, while the provider manages the underlying HSM.

Answer

Enable server-side encryption with customer-provided keys (SSE-C), where the company supplies the key with each API request but the provider stores the encrypted data.

Question 16

A cloud security engineer is configuring network security for a web application hosted on AWS. The application runs on EC2 instances behind an Application Load Balancer (ALB). The engineer needs to allow HTTP and HTTPS traffic from the internet to the ALB and restrict direct access to the EC2 instances. Which AWS service should be used to control inbound traffic to the ALB?

Accepted Answer

Security groups. Security groups are stateful virtual firewalls that control inbound and outbound traffic for AWS resources such as ALBs and EC2 instances. They are the correct tool to allow HTTP/HTTPS to an ALB and to restrict EC2 instances to only accept traffic from the ALB. Network ACLs operate at the subnet level and are stateless, AWS WAF is for layer 7 protection, and AWS Shield is for DDoS mitigation, so none of these fulfill the basic network access control requirement.

Answer

AWS Shield

Answer

Network ACLs

Answer

AWS WAF

Question 17

A financial services firm runs a multi-tenant SaaS platform on AWS. A penetration test reveals that a compromised container on one tenant's node was able to read environment variables belonging to another tenant's pods scheduled on the same node. The platform uses Kubernetes with default settings, and pods are not configured with any security context. Which control most directly addresses this isolation failure?

Accepted Answer

Deploy each tenant's workloads using a dedicated container runtime sandbox such as gVisor or Kata Containers, or enforce pod-level isolation with user namespaces and separate runtime classes.. When containers share a node without strong isolation, one workload can sometimes observe another's process environment or runtime metadata. Enforcing dedicated sandboxes such as gVisor or Kata Containers, or isolating with user namespaces and distinct runtime classes, creates a hard boundary between tenants. This is the control that directly addresses the cross-tenant environment variable exposure described.

Answer

Configure pod security contexts to run containers as non-root with readOnlyRootFilesystem and drop all Linux capabilities.

Answer

Encrypt all Kubernetes Secrets at rest using a KMS provider and rotate the encryption keys quarterly.

Answer

Enable Kubernetes Network Policies that deny all ingress and egress by default between namespaces.

Question 18

A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?

Accepted Answer

New key material is generated, and the old key material is retained for decryption.. Option C is correct because KMS rotation generates new cryptographic key material under the same logical key, while the previous key versions are retained so that data encrypted with them can still be decrypted. Option D is correct because applications reference the stable key identifier (key ID/ARN) rather than the underlying key material, so encryption and decryption continue to work transparently without code changes. Option A is wrong because the key ID remains the same; only the backing key material (key version) changes. Option B is wrong because old key material is retained, not immediately destroyed, to preserve the ability to decrypt existing ciphertext. Option E is wrong because re-encryption is not required; old data remains decryptable via the retained old key versions.

Answer

The key ID changes after each rotation.

Answer

The old key is immediately destroyed after rotation.

Answer

All data encrypted with the old key must be re-encrypted.

Question 19

A cloud security architect is designing a multi-tenant SaaS platform on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application process cannot read another tenant's data. The architect plans to use AWS Key Management Service (KMS) with tenant-specific keys. Which of the following is the MOST critical security control to implement to achieve this isolation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations. AWS Organizations is designed to centrally manage multiple AWS accounts, apply service control policies (SCPs) to enforce security boundaries, and simplify billing. It enables logical isolation by placing each tenant in a separate account while allowing centralized security governance. The other services provide access management, governance automation, or resource sharing but do not fulfill the core requirement of central account management and policy enforcement.

Answer

AWS IAM Identity Center

Answer

AWS Resource Access Manager (RAM)

Answer

AWS Control Tower

Question 20

A cloud operations team is configuring a virtual private cloud (VPC) and needs to control both inbound and outbound traffic at the subnet level. The team wants to ensure that any traffic leaving the subnet is explicitly allowed, and that responses to inbound requests are automatically permitted. Which VPC component should the team configure?

Accepted Answer

Network ACLs, because they are stateless and can enforce explicit allow/deny rules for both inbound and outbound traffic at the subnet boundary.. Network ACLs are stateless and operate at the subnet level, requiring explicit rules for both inbound and outbound traffic. This makes them the correct choice for controlling traffic at the subnet boundary with explicit outbound allowances. Security groups are stateful and instance-level, route tables direct traffic without filtering, and flow logs only record metadata without enforcement.

Answer

Security groups, because they are stateful and evaluate all traffic at the instance level.

Answer

VPC flow logs, because they capture metadata about traffic and can be used to enforce outbound restrictions.

Answer

Route tables, because they determine which subnet traffic is directed to and can block unauthorized destinations.