CCSP Practice Exam 55 — 20 Questions

Question 1

An organization uses cloud storage and wants to protect against accidental deletion of objects. They also want to be able to recover previous versions of objects in case of unintended modifications. Which feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Versioning. Versioning in cloud storage preserves every version of an object, allowing recovery from accidental deletions or overwrites.

Answer

Bucket policies

Answer

Access logs

Answer

Server-side encryption

Question 2

A healthcare SaaS provider is deploying a new application that processes protected health information (PHI). The application uses a microservices architecture running on Kubernetes. Each microservice stores its data in a separate database. The compliance team requires that all data at rest be encrypted and that encryption keys be managed by the customer (CMEK). The cloud provider supports KMS with CMEK. However, the development team wants to use a single customer-managed key for all databases to simplify key management. The security architect is concerned about the blast radius if the key is compromised. Which of the following recommendations best balances security and operational efficiency?

Accepted Answer

Use a separate customer-managed key for each database, with automated key rotation. It minimizes the blast radius by ensuring that compromise of one key does not expose data in other databases, while automated key rotation reduces the window of vulnerability and operational overhead. This aligns with the principle of least privilege and the compliance requirement for customer-managed encryption keys (CMEK). Using separate keys per database is a standard security best practice for microservices architectures, especially when handling PHI.

Answer

Use the cloud provider's default encryption keys for all databases

Answer

Disable encryption to improve performance and use network segmentation instead

Answer

Use one customer-managed key for all databases, but enable automatic key rotation

Question 3

A developer accidentally uploaded a file containing API credentials to a public cloud storage bucket. The cloud provider states they cannot guarantee deletion of the object. Which practice could have prevented this incident?

Accepted Answer

Data loss prevention for cloud storage. Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Answer

Bucket versioning

Answer

Access control lists

Answer

Server-side encryption

Question 4

The exhibit shows a key policy for a customer master key (CMK) in a cloud KMS. An administrator wants to prevent the AppRole from using the key to decrypt data. Which change to the policy would accomplish this?

Accepted Answer

Remove "kms:Decrypt" from the action list in the AppRole statement.. The AppRole's current policy statement explicitly includes 'kms:Decrypt' in the action list, granting it permission to decrypt data. By removing 'kms:Decrypt' from that action list, the AppRole retains its other allowed actions (such as kms:Encrypt) but can no longer perform decryption operations. This is the most precise and least disruptive change, as it only removes the specific permission needed to prevent decryption without affecting other allowed actions.

Answer

Add a deny statement for AppRole with effect "Deny" for kms:Decrypt.

Answer

Remove the entire "Allow use of the key" statement.

Answer

Change the AppRole action list to include only kms:Encrypt.

Question 5

A company is moving its data to the cloud and must ensure that all data at rest is encrypted using keys that are generated and managed on-premises, with the cloud provider having no access to the keys. Which encryption method should be used?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-supplied encryption keys (CSEK) allow the customer to generate and manage keys outside the cloud, giving the maximum control and ensuring the cloud provider cannot access the keys.

Answer

Bring Your Own Key (BYOK)

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

AES-256 Server-Side Encryption

Question 6

Refer to the exhibit. A cloud security analyst is reviewing an S3 bucket policy. The bucket contains sensitive data and must only be accessible over HTTPS from the internal network (10.0.0.0/24). Which of the following correctly describes the behavior of this policy?

Accepted Answer

Requests from 10.0.0.0/24 over HTTPS are allowed; all other requests are denied.. The policy uses an explicit Deny for any request that is not using HTTPS (i.e., aws:SecureTransport is false) or does not originate from the 10.0.0.0/24 IP range. This Deny overrides the Allow statement, ensuring that only requests meeting both conditions (source IP 10.0.0.0/24 AND HTTPS) are permitted. Requests from 10.0.0.0/24 over HTTPS satisfy the Allow and are not caught by the Deny, so they are allowed; all other requests are denied.

Answer

Requests from 10.0.0.0/24 over HTTP are allowed because the Allow statement matches.

Answer

The policy is invalid because it combines Allow and Deny statements.

Answer

All requests from 10.0.0.0/24 are denied because the Deny statement applies to all actions.

Question 7

What is the primary purpose of a Software Bill of Materials (SBOM) in cloud application security?

Accepted Answer

To inventory all dependencies and facilitate vulnerability management. An SBOM lists all components (libraries, dependencies) used in a software application, helping to track vulnerabilities and ensure supply chain security.

Answer

To scan infrastructure as code

Answer

To automate deployment of containers

Answer

To document software licensing

Question 8

During an eDiscovery process, a company needs to preserve data stored in AWS S3 that may be relevant to a lawsuit. Which AWS feature should be used to implement a legal hold?

Accepted Answer

S3 Object Lock. S3 Object Lock prevents object deletion or modification for a specified period, meeting legal hold requirements.

Answer

AWS CloudTrail

Answer

S3 Versioning

Answer

AWS Config

Question 9

A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?

Accepted Answer

Use dedicated (single-tenant) hosts for sensitive workloads.. Using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.

Answer

Encrypt all data at rest using AES-256.

Answer

Implement network segmentation using VLANs.

Answer

Enable multi-factor authentication for all cloud administrative accounts.

Question 10

Which TWO of the following are required for GDPR compliance when processing personal data in the cloud?

Accepted Answer

Conduct a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk. Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing is likely to result in high risk to individuals' rights and freedoms (Article 35). Additionally, controllers and processors must maintain a record of processing activities (Article 30). Option A is incorrect because a DPO is required only for certain organizations, not all. Option B is incorrect because data can be transferred outside the EU with adequate safeguards (e.g., Standard Contractual Clauses). Option C is incorrect because ISO 27001 certification is not a legal requirement under GDPR, though it can demonstrate compliance.

Answer

Appoint a Data Protection Officer (DPO) for all organizations

Answer

Store data only within the European Union

Answer

Use only ISO 27001 certified cloud service providers

Question 11

Which TWO of the following are best practices for securing a cloud-based container orchestration platform?

Accepted Answer

Use minimal base images to reduce the attack surface.. Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Answer

Store secrets in environment variables for ease of use.

Answer

Run containers with root privileges by default.

Answer

Disable TLS certificate validation for internal communications.

Question 12

Which TWO of the following are primary objectives of a cloud application security program?

Accepted Answer

Maintaining application availability. Maintaining application availability is a primary objective of a cloud application security program because it directly supports the security triad of confidentiality, integrity, and availability (CIA). In a cloud environment, availability ensures that authorized users can access applications and data when needed, which is critical for business continuity and is often enforced through SLAs, redundancy, and DDoS protection mechanisms. Without availability, security controls become irrelevant as the service is effectively denied.

Answer

Performing continuous deployment

Answer

Implementing a microservices architecture

Answer

Adopting Agile development practices

Question 13

A cloud security engineer is configuring a Data Loss Prevention (DLP) API to scan a cloud storage bucket for personally identifiable information (PII). Which of the following is a de-identification technique that replaces sensitive values with a token that can be mapped back to the original data using a secure lookup table?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

Answer

Pseudonymization

Answer

Bucketing

Answer

Masking

Question 14

A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters. Amazon CloudWatch Logs supports cross-account subscription filters, which allow you to stream log data from log groups in multiple source accounts to a single destination (e.g., a Kinesis stream or Lambda function) in a central security account. This enables real-time aggregation of logs across accounts. Amazon S3 with cross-account bucket policies allows you to write logs from multiple accounts to a central S3 bucket by granting write permissions to source accounts via bucket policies. Both services can aggregate logs across accounts, while AWS Config, Security Hub, and GuardDuty aggregate configuration items and security findings, not raw logs.

Answer

AWS Config

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Question 15

A healthcare SaaS company runs containerized microservices on Google Kubernetes Engine (GKE). The security team scans containers with a vulnerability scanner and finds that base images have several critical vulnerabilities. The container build process uses a Dockerfile that pulls the latest Ubuntu image from Docker Hub. The team wants to reduce the attack surface without delaying feature releases. What is the best approach?

Accepted Answer

Adopt minimal hardened base images and integrate vulnerability scanning into CI/CD. Adopting minimal hardened base images (such as distroless or Alpine-based images) reduces the attack surface by including only necessary packages, and integrating vulnerability scanning into the CI/CD pipeline ensures that vulnerabilities are detected and addressed before deployment. Option A (restricting outbound traffic) does not address the vulnerabilities within the images. Option B (scheduled weekly rebuilds) still relies on the same vulnerable base images and leaves a window of exposure. Option D (refactoring all applications to use scratch) is generally impractical because scratch images lack essential libraries and binaries, making them unsuitable for most applications.

Answer

Place a network security policy to restrict outbound traffic from pods

Answer

Schedule weekly automated rebuilds with the latest base image

Answer

Refactor all applications to use scratch as base image

Question 16

A security analyst notices that a cloud storage bucket contains objects with public read access. The organization's policy prohibits public access. What is the most efficient way to remediate this issue across all objects in the bucket?

Accepted Answer

Apply a bucket policy that denies public access and update the bucket ACL to block public access. Applying a bucket policy that denies public access and updating the bucket ACL to block public access will override any object-level public ACLs, providing the most efficient remediation across all objects. Option A is unnecessarily disruptive and inefficient. Option B may work but is not the most efficient. Option D is inefficient as it requires manual updates to each object.

Answer

Delete the bucket and recreate it

Answer

Use a third-party tool to scan and fix

Answer

Manually update each object's ACL

Question 17

An organization has implemented a change management process for its cloud infrastructure. During a routine change, a network security group rule is modified incorrectly, causing a critical application to become inaccessible. What is the most effective way to prevent this issue in future changes?

Accepted Answer

Integrate automated configuration validation tests into the change pipeline.. Automated configuration validation tests catch misconfigurations before deployment, preventing issues like the incorrect network security group rule. Option A is wrong because requiring manager approval does not prevent technical errors. Option C is wrong because rollback plans are reactive, not preventive. Option D is wrong because while peer review helps, it is manual and can miss errors, whereas automated tests are more reliable.

Answer

Require all changes to be approved by two managers.

Answer

Ensure every change has a rollback plan.

Answer

Implement a peer review process for all change requests.

Question 18

A company has a disaster recovery (DR) plan that includes failing over to a secondary cloud region. The plan was tested six months ago and worked, but since then significant infrastructure changes have been made. Which of the following should the company do to ensure the DR plan remains effective?

Accepted Answer

Conduct a tabletop exercise now, followed by a partial failover test of critical applications.. Conducting a tabletop exercise followed by a partial failover test of critical applications allows the company to validate the DR plan against recent infrastructure changes without full disruption. This approach provides immediate feedback and reduces risk. Option A is wrong because waiting for the next annual test leaves the organization exposed to potential failures for an extended period. Option B is wrong while automation can reduce human error, it does not replace the need to validate the plan's effectiveness after changes. Option C is wrong because updating documentation without testing assumes the plan still works, which is unreliable after significant changes.

Answer

Wait until the next annual DR test to verify the changes.

Answer

Automate the entire failover process to eliminate human error.

Answer

Update the DR documentation to reflect the changes and assume the plan still works.

Question 19

A security analyst is using a cloud security posture management (CSPM) tool that reports a finding of "storage bucket publicly accessible." However, upon manual inspection, the bucket's ACL and bucket policy both restrict access to authorized users only. What is the most likely cause of the false positive?

Accepted Answer

The bucket contains objects with public ACLs. CSPM tools can scan individual object ACLs within a bucket. If objects have public ACLs (e.g., read access to AllUsers), the tool may flag the bucket as publicly accessible even if the bucket-level policy restricts access. Option A (different region) is irrelevant as CSPM tools evaluate access controls regardless of region. Option B (policy syntax error) would likely cause an error, not a false positive of public access. Option D (CSPM misconfiguration) is possible but less likely since the specific object-level ACL is a common cause of such false positives.

Answer

The bucket is in a different region

Answer

The bucket policy has a syntax error

Answer

The CSPM tool is misconfigured

Question 20

A security analyst is investigating a data breach in a cloud environment. The analyst needs to preserve evidence for legal proceedings. Which of the following actions is most critical to ensure the chain of custody is maintained?

Accepted Answer

Begin a detailed log documenting all actions, timestamps, and personnel involved.. Chain of custody requires meticulous documentation of every action taken with evidence. Option C is most critical because maintaining a detailed log of actions, timestamps, and personnel involved directly supports the chain of custody. Option A is important for integrity but does not document the chain of custody. Option B may preserve data but does not document handling. Option D is necessary but procedural; documenting the investigation is more critical for custody.

Answer

Calculate cryptographic hashes of all relevant files.

Answer

Isolate all affected systems from the network to prevent further data loss.

Answer

Immediately notify senior management and legal counsel.