CCSP Practice Exam 54 — 20 Questions

Question 1

A cloud operations team runs a web tier on 40 Amazon EC2 instances behind an Application Load Balancer. Auditors require that administrators never hold long-lived SSH keys and that every login to an instance is logged with the identity of the human who initiated it. The team already uses an external SAML 2.0 identity provider for console access. Which approach BEST satisfies the auditors' requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS Systems Manager Session Manager with the instances managed by SSM Agent, and grant access through the federated IAM role.. Session Manager provides keyless, auditable interactive access that inherits the federated IAM identity, so every session is attributable to a named administrator and no standing SSH keys exist. The other designs either retain long-lived key material or produce only network-level telemetry that cannot identify the human operator, which fails the auditors' attribution and key-elimination requirements.

Answer

Deploy a bastion host with SSH certificate authority signing and rotate host certificates every 24 hours.

Answer

Store a shared PEM key pair in AWS Secrets Manager and issue it to administrators through a break-glass runbook.

Answer

Move the instances into a private subnet, restrict port 22 to the corporate CIDR range, and enable VPC Flow Logs on the subnet.

Question 2

A financial services company runs sensitive workloads on a public IaaS cloud. The security team wants to cryptographically prove to auditors that the virtual machine hosting their data booted an unmodified, approved hypervisor and firmware image. Which cloud infrastructure security capability should they require from the provider?

Accepted Answer

Measured boot with attestation using a virtual TPM. Measured boot combined with remote attestation uses a virtual TPM to hash each stage of the boot chain and expose those measurements for verification. Because the auditor needs cryptographic proof that firmware and hypervisor code were unmodified, this is the only listed control that observes the platform boot itself rather than the guest workload or network perimeter.

Answer

Full-disk encryption of the guest operating system volumes

Answer

Security groups restricting inbound management ports

Answer

Immutable infrastructure with golden VM images

Question 3

A company is migrating a legacy application to a cloud provider's infrastructure as a service (IaaS) platform. The security team must ensure that the hypervisor layer is patched and secured, and that tenants cannot access each other's memory or storage. According to the shared responsibility model, which party is responsible for securing the hypervisor and preventing cross-tenant access?

Accepted Answer

The cloud provider, because the hypervisor and underlying infrastructure are part of the provider's managed security scope.. The cloud provider is responsible for securing the hypervisor and preventing cross-tenant access because these are part of the provider's managed infrastructure. Customers cannot access or patch the hypervisor in IaaS. The shared responsibility model always assigns the hypervisor, physical hosts, and network fabric to the provider, while the customer secures the guest OS, applications, and data.

Answer

A third-party auditor, because independent verification is required to ensure tenant isolation in multi-tenant environments.

Answer

The customer, because they are responsible for all security controls in IaaS.

Answer

Both parties share equal responsibility, with the customer patching the hypervisor and the provider monitoring for cross-tenant attacks.

Question 4

A healthcare organization runs a regulated workload on a public cloud. The security team must ensure that data stored in object storage remains unreadable to the cloud provider's staff even if they have physical access to the storage media. Which approach best meets this requirement?

Accepted Answer

Encrypt data client-side before upload and retain sole custody of the keys. When the requirement is that the cloud provider itself must be unable to read the data, the customer must control encryption end to end. Encrypting client-side before upload and keeping keys outside the provider's reach guarantees that only ciphertext ever reaches provider infrastructure. Server-side options, whether provider-managed or customer-provided per request, still involve provider systems handling keys or plaintext at some point.

Answer

Enable server-side encryption with provider-managed keys

Answer

Rely on transport-layer encryption using TLS for all uploads and downloads

Answer

Enable server-side encryption with customer-provided keys that the provider does not retain

Question 5

A financial services company is migrating its cardholder data environment to a public cloud IaaS platform. The security team must determine which controls remain the customer's responsibility under the shared responsibility model. Which of the following is the customer's responsibility in this IaaS deployment?

Accepted Answer

Patching the guest operating system and its installed applications. Under the shared responsibility model for IaaS, the provider owns security of the cloud, including facilities, hardware, and the hypervisor, while the customer owns security in the cloud. That includes the guest operating system, runtime, applications, and data. Because the question concerns a cardholder data environment, the customer must demonstrate patch management for the guest OS and applications as part of PCI DSS compliance obligations.

Answer

Maintaining the physical security controls of the data center housing the hosts

Answer

Managing the redundancy of the physical network switches that interconnect racks

Answer

Applying firmware and microcode updates to the underlying hypervisor hosts

Question 6

A cloud security engineer is designing network isolation for a multi-tier application in a single VPC. The database tier must accept connections only from the application tier, and the application tier must accept traffic only from the web tier. Which mechanism should the engineer use to enforce this at the instance level?

Accepted Answer

Security groups that reference other security groups as allowed sources. Security groups are stateful and evaluated at the instance's elastic network interface, and they uniquely support referencing another security group as an allowed source. That lets the engineer define the database tier as reachable only from members of the application tier's group, and the application tier as reachable only from the web tier's group. This logical, identity-based rule set preserves isolation as instances scale and change IP addresses.

Answer

Network ACLs applied to the subnets hosting each tier

Answer

VPC flow logs analyzed by a security information and event management system

Answer

A route table that directs inter-tier traffic through a virtual appliance

Question 7

A media production company wants to use a public cloud for rendering video but must retain full control over the guest OS, patching, and runtime configuration. The company does not want to manage physical hardware or hypervisors. Which cloud service model BEST meets these requirements?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS is the only model that gives the customer control over the guest operating system and runtime while the provider manages the physical infrastructure and hypervisor. PaaS, SaaS, and FaaS abstract away the OS layer, removing the control the media company needs. The scenario explicitly requires retaining patching and runtime configuration, which maps directly to IaaS responsibilities.

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 8

A startup runs a three-tier web application on cloud virtual machines. The database tier must accept connections only from the application tier and never from the internet. Which cloud network security control should the team implement to enforce this requirement with the least operational overhead?

Accepted Answer

A security group on the database instances allowing only the application tier's security group as source. Referencing the application tier's security group as the source of the database rule creates a dynamic, identity-based allow that follows instances as they scale. Because membership is managed automatically, the team avoids editing CIDR ranges or host firewalls whenever the application tier changes, meeting the segmentation goal with the least ongoing effort.

Answer

A network ACL on the database subnet denying all inbound traffic

Answer

A host-based firewall rule on each database VM allowing the application tier's public IP address

Answer

A web application firewall inspecting SQL traffic bound for the database

Question 9

An organization uses Azure Functions and needs to ensure that the function can securely access a database in a private VNet. What is the recommended approach?

Accepted Answer

Enable VNet integration for the function app and configure the function to use the private IP of the database. VNet integration allows Azure Functions to access resources in a virtual network without exposing them to the internet, using a private IP.

Answer

Place the function in the same VNet as the database without any additional configuration

Answer

Use a VPN connection from the function to the database VNet

Answer

Store database credentials in environment variables and use a public endpoint with IP whitelisting

Question 10

A cloud security team is designing the management plane for a regulated workload on a public IaaS platform. They must ensure that administrative access to the cloud console and APIs is strongly controlled. Which TWO measures best satisfy this requirement? (Choose two.)

Accepted Answer

Restrict administrative API calls to approved source networks using provider policy conditions. Protecting the management plane requires both strong authentication and contextual authorization. Phishing-resistant multifactor authentication stops credential theft, while policy conditions that restrict administrative API calls to approved source networks ensure that even a stolen credential cannot be replayed from an untrusted location. Together they address identity and context, which are the two levers tenants control over the provider's management plane.

Answer

Issue long-lived access keys to automation accounts to simplify pipeline authentication

Answer

Deploy a content delivery network in front of the provider's management console endpoints

Answer

Enable verbose object storage access logging for all buckets in the account

Question 11

A company stores sensitive backups in cloud object storage. The security policy requires that backups be recoverable even if the primary cloud region suffers a catastrophic outage, and that the backup data remain encrypted with keys the company controls throughout replication. Which configuration best satisfies both requirements?

Accepted Answer

Cross-region replication with customer-managed keys replicated to the destination region. The scenario imposes two independent requirements: survive a regional outage and keep encryption keys under company control throughout replication. Cross-region replication satisfies the first, and customer-managed keys replicated to the destination region satisfy the second. Client-side encryption with keys confined to the source region fails because a regional outage would strand the keys, leaving replicated ciphertext unrecoverable.

Answer

Single-region storage with versioning and object lock enabled

Answer

Cross-region replication with client-side encryption using keys held only in the source region

Answer

Cross-region replication with provider-managed encryption keys in both regions

Question 12

A multinational bank is deploying a hybrid cloud with sensitive workloads on private infrastructure and analytics on a public cloud. The security team must ensure that data classified as confidential never leaves the private environment, while allowing the public cloud to process anonymized datasets. Which cloud deployment model characteristic is MOST relevant to enforcing this boundary?

Accepted Answer

The hybrid model enables workload placement based on data classification and policy.. Hybrid cloud's primary security value in this scenario is the ability to place workloads and data according to classification and policy. The bank can enforce that confidential data stays private while anonymized datasets are processed publicly. Other options either misstate security properties or contradict the requirement, so workload placement based on data classification is the relevant characteristic.

Answer

The hybrid model automatically replicates all data to both environments for redundancy.

Answer

The private cloud eliminates the need for encryption at rest.

Answer

The public cloud provides stronger physical security than private data centers.

Question 13

A media production company needs to process high-resolution video renders that require tightly coupled, low-latency inter-node communication. The company is evaluating cloud deployment models and wants to retain full control over the hardware, hypervisor, and network fabric while still using cloud burst capacity. Which cloud deployment model BEST meets these requirements?

Accepted Answer

Hybrid cloud. The scenario requires both exclusive control over the underlying infrastructure and the ability to extend into elastic public capacity on demand. A hybrid cloud is the only model that pairs a controlled private environment with public cloud bursting, satisfying the latency-sensitive rendering requirements while avoiding permanent over-provisioning of owned hardware.

Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Question 14

A cloud operations team is hardening the management plane of a production VPC. The security architect wants to reduce the risk of credential compromise and lateral movement through management interfaces. Which TWO measures best address this goal? (Choose two.)

Accepted Answer

Enforce least privilege on management roles and require multi-factor authentication for privileged sessions. Reducing management plane risk centers on making credentials short-lived and limiting what they can do. Federated identity with temporary credentials removes static keys that can be stolen and reused, while least privilege plus multi-factor authentication constrains the impact of any single compromised session. Together these directly attack credential compromise and lateral movement, whereas logging is detective and password length and bastion placement are secondary hardening steps.

Answer

Enable verbose API logging and forward all management events to a central log repository

Answer

Place management interfaces behind a bastion host reachable only from a corporate IP range

Answer

Increase the password complexity policy for all administrative accounts to twenty characters

Question 15

A startup is designing its first cloud landing zone and wants a guardrail that prevents any principal in the organization from disabling AWS CloudTrail logging in any account, including the management account, while still allowing normal administrative work. Which control achieves this with the LEAST operational overhead?

Accepted Answer

An organization-level service control policy attached to the root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail.. An organization root service control policy denies the trail-modification API calls for all principals in every account, making the guardrail preventive rather than detective and requiring no per-account upkeep. Detection rules, permissions boundaries, and remediation automation either act after the fact or leave uncovered principals.

Answer

A CloudWatch Logs metric filter on the CloudTrail log group that triggers an AWS Lambda function to restart the trail.

Answer

An IAM permissions boundary on every administrator role that denies the CloudTrail modification actions.

Answer

An AWS Config rule that detects when a trail is stopped and sends an Amazon SNS notification to the security team.

Question 16

A healthcare company is migrating a legacy three-tier application to AWS. The security team must ensure that the database tier is reachable only from the application tier, that the rule follows the application instances automatically as they scale, and that no rule permits a broader source. Which mechanism should the team use?

Accepted Answer

A security group on the database instances whose inbound rule references the security group ID of the application tier.. A security group rule that names the application tier's security group as its source gives an identity-based, stateful permission that tracks instances through scaling events and excludes every other resource in the VPC. CIDR-based subnet filters and VPC-wide rules are broader than needed, and PrivateLink does not address intra-VPC tier isolation.

Answer

A network ACL on the database subnet that allows inbound traffic only from the application subnet CIDR range.

Answer

A security group on the database instances that allows inbound traffic from the VPC CIDR range on the database port.

Answer

AWS PrivateLink endpoint policies that restrict which application-tier principals may open connections to the database.

Question 17

A media production company stores and edits large video files on-premises. During peak project periods, editors need to temporarily consume extra compute and storage, but the company wants to keep its existing private cloud and avoid rebuilding workflows. The company wants a solution that lets the private cloud seamlessly use public cloud resources for these bursts without changing how editors access the files. Which cloud deployment model BEST meets this requirement?

Accepted Answer

Hybrid cloud. A hybrid cloud is designed to integrate a private cloud with public cloud services so workloads can move or burst between them. Because the company wants to retain its private editing workflows while temporarily using public resources during peaks, the hybrid model provides the required elasticity without forcing a full migration or redesign.

Answer

Private cloud

Answer

Public cloud

Answer

Community cloud

Question 18

A cloud security architect is hardening the metadata service on a fleet of EC2 instances that host a customer-facing web application. The team wants to reduce the risk of server-side request forgery leading to credential theft, while keeping the application's legitimate ability to retrieve instance role credentials. Which TWO measures should the architect implement? (Choose two.)

Accepted Answer

Set the instance metadata service hop limit to 1 so responses cannot traverse additional network hops.. Requiring IMDSv2 forces token-based requests that SSRF payloads generally cannot produce, and a hop limit of 1 stops metadata responses from being relayed through proxies or container layers. Together they harden the endpoint while preserving legitimate role credential retrieval. The remaining choices either fail to block the retrieval path or break required functionality.

Answer

Enable AWS CloudTrail data events on the S3 bucket that stores application logs.

Answer

Attach an IAM role with a permissions boundary that denies all actions except those the application needs.

Answer

Disable the instance metadata service entirely on all web application instances.

Question 19

A cloud architect is designing a system that must survive the failure of an entire cloud provider region. The application uses a relational database and object storage. Which design approach BEST achieves regional fault tolerance while minimizing data loss and operational complexity?

Accepted Answer

Deploy the application in two regions with asynchronous database replication and cross-region replication for object storage, then use DNS failover to redirect traffic.. Surviving a full region failure requires resources and data in at least two independent regions. Asynchronous database replication avoids the latency and availability penalties of synchronous cross-region writes, cross-region object storage replication protects unstructured data, and DNS failover provides a practical traffic redirection mechanism with acceptable recovery time objectives.

Answer

Deploy the application in a single region with a multi-master database cluster spanning three availability zones and global load balancing.

Answer

Deploy the application in two availability zones within a single region and rely on the provider's managed backup service for the database.

Answer

Deploy the application in two regions using synchronous database replication and a single object storage bucket with cross-region access.

Question 20

A startup is building a SaaS product on a public cloud. The security team wants to ensure that virtual machines belonging to different customers cannot access each other's memory or network traffic, even though they may share the same physical host. Which cloud architectural concept MOST directly addresses this requirement?

Accepted Answer

Hypervisor-based virtualization and network segmentation. Multi-tenant isolation on shared hardware is achieved through the hypervisor, which partitions memory and CPU, and through network segmentation, which restricts traffic flows between tenants. These architectural controls directly satisfy the requirement that different customers' virtual machines cannot access each other's memory or network traffic even when co-located.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service