CCSP Practice Exam 55 — 20 Questions

Question 1

Which TWO measures are effective for securing container images in a cloud environment?

Accepted Answer

Sign images to ensure integrity. Option B is correct because cryptographically signing container images (e.g., with Docker Content Trust/Notary or Sigstore Cosign) lets the orchestrator verify image integrity and provenance, ensuring only trusted, untampered images are deployed. Option E is correct because scanning images for known CVEs in OS packages and application dependencies before deployment (using tools like Trivy, Clair, or Grype) catches vulnerabilities early and prevents shipping flawed images into production. Option A is wrong because a public registry without scanning exposes images to tampering and untracked vulnerabilities, undermining supply-chain security. Option C is wrong because relying on mutable 'latest' tags without version pinning prevents reproducibility and integrity verification, making it easy to deploy unexpected or compromised images. Option D is wrong because running containers as root violates least privilege and dramatically increases the impact of a container escape or compromise.

Answer

Store images in a public registry without scanning

Answer

Use latest tags without version pinning

Answer

Run containers with root privileges

Question 2

A cloud administrator is designing a backup strategy for a critical database. Which of the following is the BEST approach to ensure data recoverability in case of a regional outage?

Accepted Answer

Regularly copy backups to a different geographic region.. Replicating backups to a different geographic region ensures data recoverability even if the entire primary region experiences a catastrophic outage. This approach leverages cross-region replication, which provides independent fault domains and meets the recovery point objective (RPO) and recovery time objective (RTO) requirements for regional disaster scenarios. Cloud providers like AWS, Azure, and GCP offer services such as S3 Cross-Region Replication (CRR) or Azure Geo-Redundant Storage (GRS) to automate this process.

Answer

Use tape backups stored in a physical safe in the same building.

Answer

Perform only daily backups without replication.

Answer

Store backups in a different availability zone within the same region.

Question 3

A cloud architect is designing a system for a media streaming company that experiences unpredictable spikes in viewer demand during live events. The company wants to minimize infrastructure costs during periods of low demand while maintaining the ability to handle sudden increases in traffic. The architect proposes using a cloud deployment model that provides rapid elasticity and measured service. Which cloud deployment model BEST meets these requirements?

Accepted Answer

Public cloud. The public cloud model is designed to provide on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These characteristics allow the media streaming company to automatically scale resources during live events and reduce costs when demand is low. Private, community, and hybrid models do not offer the same combination of rapid elasticity and cost efficiency for unpredictable workloads.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 4

A cloud architect is evaluating a public cloud provider for a regulated workload. The provider offers a shared responsibility model. Which TWO of the following are typically the cloud customer's responsibilities under that model? (Choose two.)

Accepted Answer

Configuring identity and access management policies. Under the shared responsibility model, the customer is responsible for security in the cloud, which includes configuring identity and access management policies and classifying and protecting data. Physical access, hypervisor patching, and physical network fabric are provider responsibilities. Regulated workloads require the customer to focus on data protection and access control while relying on the provider for infrastructure security.

Answer

Maintaining the physical network fabric between availability zones

Answer

Patching the hypervisor

Answer

Managing physical access to the data center

Question 5

A cloud security architect is designing the network segmentation for a three-tier web application hosted in a single Amazon VPC. The database tier must accept connections only from the application tier, and the application tier must accept connections only from the web tier. The architect wants the enforcement to be stateful, evaluated per elastic network interface, and independent of subnet CIDR ranges so that instances can be replaced without rewriting rules. Which control should the architect use to enforce this segmentation?

Accepted Answer

Security groups attached to each tier's instances, referencing other security groups as sources. Security groups provide stateful, interface-level filtering and allow other security groups to be referenced as sources, which decouples the rules from subnet addressing. That combination satisfies the stateful, per-interface, CIDR-independent requirement and survives instance replacement. Subnet-level ACLs, route tables, and PrivateLink endpoints do not deliver group-based, stateful enforcement within a single VPC.

Answer

A VPC peering connection between the three tier subnets with route table entries restricting traffic

Answer

AWS PrivateLink endpoints published by each tier and consumed by the tier above it

Answer

Network ACLs on each subnet, with rules that allow only the CIDR range of the adjacent tier's subnet

Question 6

A cloud security administrator is responsible for managing access to a cloud management console. The organization wants to enforce multi-factor authentication (MFA) for all human users and ensure that programmatic access uses short-lived credentials instead of long-term access keys. Which approach BEST aligns with these requirements?

Accepted Answer

Use an identity provider with SAML 2.0 federation for console access with MFA enforced, and use IAM roles with temporary credentials for programmatic access via AWS STS.. Enforcing MFA for human users is best achieved through federation with an identity provider that applies MFA, such as SAML 2.0, which issues temporary console sessions. For programmatic access, assuming IAM roles via AWS STS provides temporary credentials that rotate automatically, eliminating long-term access keys. Together these practices enforce MFA and short-lived credentials, aligning with cloud security best practices.

Answer

Create a single shared IAM user for all administrators with MFA enabled and distribute the access keys securely to the team.

Answer

Create IAM users with long-term access keys and attach an IAM policy that requires MFA for console access only.

Answer

Store IAM user access keys in AWS Secrets Manager and rotate them every 90 days, while enabling MFA for the root account only.

Question 7

A cloud provider offers a virtual private cloud (VPC) with a subnet that hosts a database. A security architect must ensure that only instances in a specific application security group can connect to the database on port 3306, and that no other traffic from the internet or other subnets can reach it. The architect is configuring security groups and network ACLs. Which combination of rules BEST achieves this?

Accepted Answer

Configure the database security group to allow inbound TCP 3306 from the application security group ID, and leave the network ACL at its default allow-all state.. Security groups are stateful and can reference other security groups as sources, which is the most precise way to allow only instances with a specific application security group to reach the database. Network ACLs are stateless and subnet-level; they cannot reference security group IDs and should generally be left at default allow unless additional subnet-level controls are needed. Allowing the application security group ID on the database security group meets the requirement exactly.

Answer

Configure the database security group to allow inbound TCP 3306 from 0.0.0.0/0, and configure the network ACL to deny all traffic except from the application subnet CIDR.

Answer

Configure the database security group to allow inbound TCP 3306 from the application subnet CIDR, and configure the network ACL to allow inbound TCP 3306 from the application security group ID.

Answer

Configure the database security group to allow inbound TCP 3306 from the application security group ID, and configure the subnet's network ACL to allow inbound TCP 3306 from the application subnet CIDR only.

Question 8

An enterprise is evaluating a cloud service provider for a workload that handles regulated data. The security architect must assess whether the provider's cloud architecture supports the organization's data residency and audit obligations. Which TWO of the following are the MOST relevant architectural artifacts to request from the provider? (Choose two.)

Accepted Answer

Independent third-party audit reports and certifications such as SOC 2 and ISO/IEC 27001. Assessing data residency and audit obligations requires verifiable evidence about where data lives and how controls are validated. A data flow diagram identifies storage, processing, and replication locations, while independent audit reports and certifications demonstrate that controls have been examined against recognized standards. Together they give the architect the factual basis needed for compliance due diligence.

Answer

The provider's current stock price and quarterly earnings report

Answer

A copy of the provider's internal employee acceptable use policy

Answer

The provider's marketing brochure describing its global footprint and uptime record

Question 9

A media company runs a video transcoding workflow on a public cloud. Jobs arrive unpredictably and must be processed within minutes, but the company wants to minimize cost by using spare capacity that can be reclaimed when demand for full-price capacity rises. The jobs are checkpointed every 30 seconds and can resume on a different host. Which cloud service model and purchasing approach BEST fits this requirement?

Accepted Answer

Infrastructure as a Service with spot instances. The workload is interruption-tolerant because it checkpoints frequently and can resume elsewhere, which is exactly the profile that reclaimable spare-capacity pricing is built for. Using infrastructure as a service preserves control over the transcoding runtime while allowing the team to bid on spare capacity and cut cost. Committed discounts, per-seat subscriptions, and dedicated hosts all price or isolate capacity in ways that do not match unpredictable, bursty batch processing.

Answer

Platform as a Service with a committed use discount

Answer

Infrastructure as a Service with dedicated hosts

Answer

Software as a Service with a per-seat subscription

Question 10

A government agency is evaluating a cloud deployment model where several agencies with similar missions and compliance obligations will jointly use a cloud environment governed by a shared policy framework. Each agency will retain independent control over its own data and security configurations. Which cloud deployment model does this describe?

Accepted Answer

Community cloud. The community cloud model is defined by exclusive use among a group of organizations sharing common mission, security, policy, and compliance interests. Because several agencies jointly consume the environment under a shared governance framework while each controls its own data, this matches the community cloud definition precisely rather than single-tenant private, open public, or cross-model hybrid arrangements.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 11

A financial services firm runs regulated workloads on Microsoft Azure. Auditors require that disk encryption keys for IaaS virtual machines remain under the firm's exclusive control, that the keys never leave a hardware security module, and that the firm can revoke access to the keys at any time, rendering the disks unreadable. The firm does not want Microsoft to be able to decrypt the disks without an explicit grant. Which Azure disk encryption configuration meets these requirements?

Accepted Answer

Azure Disk Encryption with BitLocker keys wrapped by a customer key held in Azure Key Vault Managed HSM. The auditors require customer-exclusive key custody in a hardware security module plus the ability to revoke access and render disks unreadable. Azure Key Vault Managed HSM supplies single-tenant, hardware-backed key storage, and Azure Disk Encryption wraps the volume keys with a customer key from that HSM. Disabling or revoking the key-encryption key effectively crypto-shreds the disks, which platform-managed or software-protected keys cannot achieve.

Answer

Server-side encryption with customer-managed keys stored in Azure Key Vault, using software-protected keys

Answer

Azure Storage Service Encryption with infrastructure encryption enabled on the managed disks

Answer

Azure Disk Encryption with BitLocker keys stored in an Azure Key Vault that uses platform-managed keys

Question 12

A cloud security manager is evaluating the security responsibilities of the cloud provider and the cloud consumer under the shared responsibility model for a PaaS deployment. Which TWO of the following are typically the responsibility of the cloud consumer? (Choose two.)

Accepted Answer

Managing user identities and access within the application. In a PaaS model, the cloud provider manages the underlying infrastructure, including servers, operating systems, and runtime environments, while the consumer is responsible for the security of their applications and data. This includes configuring application-level security controls and managing user identities and access within the application. These two areas fall under the consumer's control and are critical for protecting the application from threats.

Answer

Managing the physical security of data centers

Answer

Securing the hypervisor and virtualization layer

Answer

Patching the underlying operating system and runtime

Question 13

A startup is developing a new mobile application and wants to minimize infrastructure management while focusing on code development. The team has limited operational resources and prefers a serverless approach. Which cloud service model should they adopt?

Accepted Answer

Function as a Service (FaaS). FaaS is the most serverless option, allowing developers to run code in response to events without provisioning or managing servers. It aligns with the startup's goal of minimizing infrastructure management and focusing on code development. The provider handles all scaling, patching, and capacity planning, making it ideal for teams with limited operational resources.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 14

A cloud architect is mapping security responsibilities for a SaaS customer relationship management deployment. The provider manages the application, runtime, middleware, operating system, and physical infrastructure. Which security task remains the responsibility of the customer organization?

Accepted Answer

Managing user identities, access entitlements, and authentication configuration. In every cloud service model, the customer retains responsibility for its own data governance and access management. With SaaS, the provider covers the stack from physical facilities through the application, but identity lifecycle, entitlement decisions, and authentication configuration require knowledge of the customer's personnel and business roles, so those tasks cannot be delegated to the provider.

Answer

Maintaining the physical security of the data center hosting the application

Answer

Patching the operating system and runtime hosting the application

Answer

Applying firmware updates to the hypervisor and host servers

Question 15

A media company runs a video-transcoding workload on a public cloud IaaS platform. The workload is stateless, tolerant of interruption, and must complete within a 6-hour window at the lowest possible compute cost. The company's architects propose using a cloud service that provisions spare capacity at a significant discount but can reclaim it with a two-minute notice. Which cloud deployment and service model does this describe?

Accepted Answer

Spot instances within a public cloud. The workload is stateless, tolerant of interruption, and cost-sensitive, which maps precisely to spare-capacity compute sold at a discount with short-notice reclamation. Committed-term reservations, physically isolated hosts, and full-price on-demand capacity all fail at least one stated constraint, either cost, availability guarantees, or the eviction behavior the architects are designing around.

Answer

Reserved instances within a community cloud

Answer

Dedicated hosts within a private cloud

Answer

On-demand instances within a hybrid cloud

Question 16

A bank is designing a new payment API that must run in a public cloud. The security team wants the application to run in an isolated, logically separated section of the provider's network where the bank controls inbound and outbound traffic, defines its own IP addressing, and can connect privately to the provider's object storage without traversing the internet. Which cloud architecture construct should the bank use?

Accepted Answer

A virtual private cloud with private subnets and a service endpoint. The requirement combines network isolation, customer-defined addressing and traffic control, and private access to a provider service. A virtual private cloud supplies the isolated network and its subnets, route tables, and gateways; security groups and network ACLs provide the traffic control; and a service endpoint keeps storage traffic on the provider backbone. Content delivery, web application firewalls, and hardware security modules address latency, application attacks, and key protection, not network isolation.

Answer

A web application firewall in front of the API gateway

Answer

A content delivery network with origin shielding

Answer

A dedicated hardware security module cluster

Question 17

A financial services company is migrating its legacy on-premises application to a public cloud IaaS environment. The application currently uses a shared file system that requires strong consistency and low-latency access for transaction processing. The cloud architect must choose a storage solution that meets these performance requirements. Which cloud storage type is MOST appropriate?

Accepted Answer

File storage. The application requires a shared file system with strong consistency and low latency. Cloud file storage services, such as Amazon EFS or Azure Files, provide shared NFS or SMB access with configurable performance and strong consistency. Block storage is not inherently shared, object storage is not low-latency or strongly consistent, and archive storage is for cold data. Therefore, file storage is the most appropriate choice.

Answer

Object storage

Answer

Block storage

Answer

Archive storage

Question 18

A software vendor wants to offer its analytics product to several hospitals. Each hospital demands that its data reside on infrastructure dedicated to that hospital, that the hospital retain control over patching windows, and that the vendor's other customers never share the same physical hosts. The hospitals also want to share the cost of the common management tooling the vendor provides. Which cloud deployment model BEST matches these requirements?

Accepted Answer

Community cloud. The hospitals share a common set of concerns, including data residency, tenancy isolation, and patching control, and they want to pool the cost of the vendor's management tooling. That combination of exclusive use by a defined group plus shared economics is the defining characteristic of a community cloud. A public cloud conflicts with dedicated tenancy, a hybrid cloud addresses portability between models, and a private cloud serves one organization rather than a group sharing common requirements.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 19

A retail enterprise is defining its cloud governance program before migrating workloads to a public cloud provider. The CISO wants controls that address the loss of direct physical control inherent in the cloud. Which TWO governance elements are MOST important to establish first? (Choose two.)

Accepted Answer

An identity and access management framework with least privilege and centralized federation. Governance replaces lost physical control with policy and identity. A data classification and handling policy translates business risk into rules about which services, regions, and protections each data category requires, while a federated identity framework with least privilege governs who and what can reach those resources. Default configurations, dedicated-host mandates, and blanket key prohibitions are either too permissive or too rigid to serve as foundational governance.

Answer

A mandate that all production data remain on dedicated physical hosts owned by the enterprise

Answer

A policy prohibiting any use of provider-managed encryption keys for data at rest

Answer

A requirement that all cloud workloads use the provider's default security configuration

Question 20

A startup wants to deploy a new web application without purchasing servers, and it accepts that its workloads will share physical hardware with other tenants. The founders want the lowest possible upfront cost and the ability to release resources when the product is discontinued. Which cloud deployment model matches these requirements?

Accepted Answer

Public cloud. The public cloud model is defined by provider ownership, multi-tenant shared infrastructure, self-service provisioning, and consumption-based billing. Those traits deliver the lowest barrier to entry and allow the startup to stop paying when the product ends. Private and community clouds require dedicated or consortium arrangements, while hybrid assumes a pre-existing private footprint to integrate.

Answer

Private cloud

Answer

Community cloud

Answer

Hybrid cloud