CCSP Practice Exam 53 — 20 Questions

Question 1

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 2

A company is designing a data retention policy for cloud storage. Regulatory requirements mandate that certain records be kept for 7 years and then securely destroyed. Which combination of controls should be used?

Accepted Answer

Lifecycle policy and secure deletion. A lifecycle policy automates the transition and expiration of objects, allowing you to set a rule to delete objects after 7 years. Secure deletion (e.g., overwriting or cryptographic erasure) ensures the data is irrecoverable, meeting the regulatory requirement for secure destruction. Together, they provide a fully automated, auditable process for retention and destruction.

Answer

Data masking and encryption

Answer

Versioning and MFA delete

Answer

Lifecycle policy and object lock

Question 3

A healthcare organization is migrating sensitive patient data to a public cloud. The compliance team requires that data be encrypted at rest and in transit, and that the cloud provider cannot access the encryption keys. Which cloud service model should the organization use to maintain sole control over encryption keys?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS provides the customer with full control over the underlying infrastructure, including virtual machines, storage, and networking. This allows the organization to implement their own encryption mechanisms and manage their own keys using a Hardware Security Module (HSM) or a key management service (KMS) that the cloud provider cannot access. In contrast, SaaS and PaaS typically abstract away the infrastructure, limiting customer control over encryption key management.

Answer

Software as a Service (SaaS)

Answer

Hybrid Cloud

Answer

Platform as a Service (PaaS)

Question 4

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

Accepted Answer

To provide centralized protection against common web exploits before traffic reaches the microservices.. Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Answer

To reduce latency by caching responses at the API gateway.

Answer

To offload authentication from the microservices to the API gateway.

Answer

To monitor API usage and detect anomalies in traffic patterns.

Question 5

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Accepted Answer

Validate and sanitize all user inputs. Rate limiting, input validation, and least privilege are key API security practices. Mass assignment is a vulnerability to avoid, not a practice, and exposing all endpoints is contrary to security.

Answer

Expose all API endpoints automatically for transparency

Answer

Allow mass assignment for ease of development

Question 6

A company is implementing a cloud risk management program. Which THREE of the following are essential components of a risk assessment according to NIST SP 800-30?

Accepted Answer

Risk determination. NIST SP 800-30 risk assessment includes threat identification, impact analysis, and risk determination. Vulnerability scanning is a method used to identify vulnerabilities, not a component of the assessment itself. Control implementation is part of risk mitigation.

Answer

Control implementation

Answer

Vulnerability scanning

Question 7

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

Accepted Answer

A distroless image. Distroless images contain only the application and its runtime dependencies, removing package managers, shells, and other utilities that could be exploited. This reduces the attack surface significantly.

Answer

A full distribution image like Ubuntu

Answer

An Alpine-based image

Answer

The 'latest' tag of any official image

Question 8

Which TWO of the following are valid data states that must be protected in cloud computing?

Accepted Answer

Data at rest. In cloud computing, data exists in three primary states: at rest (stored on disk or in memory), in transit (moving across networks), and in use (being processed). The CCSP exam specifically identifies 'data at rest' and 'data in transit' as the two fundamental data states that require protection through encryption, access controls, and integrity mechanisms. Option B is correct because data at rest refers to inactive data stored physically on any digital device, such as databases, backups, or archives, and must be safeguarded against unauthorized access or theft.

Answer

Data encryption

Answer

Data integrity

Answer

Data in database

Question 9

A multinational corporation operates across multiple cloud providers (AWS, Azure, GCP) and uses a variety of data storage services. They have a requirement to enforce a consistent encryption policy across all providers: all data at rest must be encrypted using a centrally managed key that is rotated every 90 days. The cloud security team is evaluating different key management solutions. They want to minimize operational overhead and avoid vendor lock-in. The team has experience with configuring cloud-native key management services (KMS) but is concerned about managing keys across different regions and providers. Which solution best meets the requirements?

Accepted Answer

Deploy a third-party cloud-agnostic key management solution that supports BYOK and integrates with all providers' KMS. A third-party cloud-agnostic key management solution (e.g., HashiCorp Vault, Thales CipherTrust) that supports Bring Your Own Key (BYOK) allows the organization to centrally manage and rotate a single root key every 90 days, while integrating with each provider's native KMS via external key stores (e.g., AWS KMS custom key store, Azure Key Vault managed HSM, GCP Cloud HSM). This minimizes operational overhead by avoiding manual per-provider policy replication and prevents vendor lock-in by decoupling key management from any single cloud provider's proprietary KMS.

Answer

Use each cloud provider's native KMS and create identical key policies manually

Answer

Store the key in an internal secrets manager and configure each provider's KMS to use that key as a root key

Answer

Implement client-side encryption using a single master key stored in the application configuration

Question 10

A cloud security engineer needs to de-identify a dataset containing credit card numbers before sharing it with a third-party analytics team. The engineer wants to replace each credit card number with a unique token that can be used for correlation but cannot be reversed to obtain the original number. Which de-identification technique should be used?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a non-reversible token, preserving the ability to correlate records without exposing the original values.

Answer

Pseudonymisation

Answer

Masking

Answer

Bucketing

Question 11

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

Accepted Answer

Encrypt data client-side before uploading to the cloud.. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Answer

Enable detailed audit logging of all data access.

Answer

Implement strict IAM policies for CSP employees.

Answer

Enable server-side encryption with customer-provided keys.

Question 12

A security team is implementing container image scanning in a CI pipeline. Which TWO of the following actions should be performed? (Select TWO)

Accepted Answer

Scan the image before pushing to the registry. Scanning the image before pushing to a registry prevents vulnerable images from being stored. Signing images ensures integrity and authenticity, preventing tampered images from being deployed.

Answer

Disable scanning to speed up the pipeline

Answer

Scan the image after deployment to production

Answer

Scan the image only if it is based on a public base image

Question 13

A company uses a cloud database that stores customer financial information. To ensure compliance with PCI DSS, which control is required?

Accepted Answer

Encryption of cardholder data stored in the database. PCI DSS Requirement 3.4 specifically mandates that stored cardholder data must be rendered unreadable anywhere it is stored, including in cloud databases. Encryption at rest (e.g., AES-256) is the primary control to achieve this, as it directly protects the confidentiality of Primary Account Numbers (PANs) if the storage layer is compromised. Without encryption, the data remains in clear text, violating PCI DSS compliance.

Answer

Network segmentation between the database and other systems

Answer

Annual external vulnerability scans of the database

Answer

Multi-factor authentication for database administrators

Question 14

A company stores sensitive data in cloud object storage and wants to protect against ransomware attacks that could encrypt or delete objects. Which TWO measures should they implement? (Choose two.)

Accepted Answer

Implement immutable storage (e.g., Object Lock). Immutable storage (Object Lock) prevents objects from being deleted or overwritten during a specified retention period, directly thwarting ransomware that attempts to encrypt or delete data. This is a foundational defense because even if an attacker gains write access, they cannot modify or remove locked objects, preserving clean backups. Object versioning provides an additional layer of protection by maintaining multiple versions of an object. If ransomware encrypts or deletes the current version, prior unaltered versions can be restored, enabling recovery without relying solely on immutable storage.

Answer

Use cross-region replication

Answer

Configure signed URLs for access

Answer

Set short object lifetimes using lifecycle policies

Question 15

A cloud security team wants to integrate security testing early in the development lifecycle to reduce vulnerabilities. Which approach best describes this concept?

Accepted Answer

Shift-left security. Shift-left security is the practice of integrating security testing and controls early in the software development lifecycle (SDLC), such as during design and coding phases, rather than waiting until deployment. This proactive approach reduces vulnerabilities by catching flaws when they are cheaper and easier to fix, aligning with DevSecOps principles.

Answer

Runtime application self-protection (RASP)

Answer

Software bill of materials (SBOM)

Answer

Web application firewall (WAF)

Question 16

A security architect applies the above bucket policy to an Amazon S3 bucket containing sensitive data. What is the net effect of this policy?

Accepted Answer

It denies all PutObject requests that do not specify an encryption header, enforcing encryption at rest.. The bucket policy uses a condition key `s3:x-amz-server-side-encryption` with a `StringNotEquals` condition to deny `PutObject` requests that do not include the `x-amz-server-side-encryption` header set to `AES256`. This effectively denies any upload that does not specify server-side encryption with S3-Managed Keys (SSE-S3), enforcing encryption at rest for all objects written to the bucket.

Answer

It denies all PutObject requests, regardless of encryption.

Answer

It allows only PutObject requests using SSE-KMS (AWS KMS managed keys).

Answer

It allows PutObject requests only from principals that use an IAM role with encryption permissions.

Question 17

A security analyst reviews the above cloud storage bucket policy. The bucket stores sensitive application data. What is the primary security issue with this policy?

Accepted Answer

The Deny statement will block all access, including from authorized IPs. The Deny statement with a condition that denies all requests not matching the specified IP range will block access from any IP address that is not in the listed range, including authorized IPs that the policy intended to allow. This creates a complete denial of service for legitimate users, making it the primary security issue.

Answer

The resource identifier should not include a wildcard

Answer

The policy should use a condition with source VPC instead of IP

Answer

The IP address range is too broad

Question 18

An organization is designing a data residency strategy for compliance with data sovereignty laws. They must ensure that customer data remains within specific geographic boundaries. Which three measures should they implement? (Choose three.)

Accepted Answer

Use IAM policies to restrict API calls to specific regions. To enforce data residency, organizations should choose cloud regions in the required geography, configure bucket policies to restrict storage location, and use IAM policies to limit access from other regions. Cross-region replication would violate data residency.

Answer

Use pre-signed URLs for all access

Answer

Enable cross-region replication for disaster recovery

Question 19

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

Accepted Answer

Implement rate limiting on the authentication endpoint. Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.

Answer

Require API keys for all requests

Answer

Use TLS to encrypt the communication channel

Answer

Add input validation for all parameters

Question 20

A healthcare organization recently migrated a patient records management application from on-premises infrastructure to a cloud environment using Infrastructure as a Service (IaaS). The application was originally designed as a monolithic workload running on bare-metal servers. After migration, the application is deployed on a fleet of virtual machines (VMs) of the same instance type. The organization is using a combination of Reserved Instances for baseline capacity and On-Demand instances to handle spikes. However, two months after the migration, the cloud bill is 40% higher than the estimated on-premises total cost of ownership. Additionally, performance reports indicate that the application experiences inconsistent latency and occasional timeouts during peak hours. The operations team has confirmed that the application code has not changed, and the cloud provider's infrastructure is healthy. There is no issue with network bandwidth or storage I/O. The team is considering several options to address both cost and performance issues. What should the team do first?

Accepted Answer

Perform a rightsizing analysis of the current VM usage and adjust instance types accordingly.. The symptoms (high cost and inconsistent performance) strongly suggest that the instances are not appropriately sized for the workload. Rightsizing based on actual metrics (CPU, memory, I/O) is the most direct and effective first step to reduce waste and improve performance. Option A is too drastic; moving to serverless would require significant architectural changes and is not a quick fix. Option C (Spot Instances) is unsuitable for baseline capacity because they can be terminated with little notice, which would disrupt a monolithic application. Option D (consolidation into fewer, larger instances) might reduce licensing costs but assumes that the current instances are underutilized; it could exacerbate performance issues if the application is not designed to scale horizontally.

Answer

Migrate the application to serverless compute to eliminate the need to manage VMs.

Answer

Consolidate the workload into fewer, larger instances to reduce overhead and licensing costs.

Answer

Replace On-Demand instances with Spot Instances to reduce costs during spikes.