CCSP Practice Exam 56 — 20 Questions

Question 1

A security analyst is configuring a SIEM solution and wants to ingest security findings from a cloud provider's security findings service into Splunk. What is the most efficient method?

Accepted Answer

Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.. A serverless function can directly invoke the findings service API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.

Answer

Enable cross-region aggregation of findings, then export to a CSV file.

Answer

Configure the findings service to publish findings to a cloud storage bucket, then use Splunk to read from the bucket.

Answer

Use a data catalog service to catalog findings data and connect to Splunk via JDBC.

Question 2

A cloud application exposes an API that allows users to view their own orders. Which TWO vulnerabilities could allow an attacker to view another user's orders?

Accepted Answer

Insecure Direct Object Reference (IDOR). Broken Object Level Authorization (BOLA) occurs when the API does not verify that the user owns the object, and IDOR (Insecure Direct Object Reference) allows access by manipulating object IDs.

Answer

Excessive Data Exposure

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 3

Match each cloud service model to its primary responsibility area according to the shared responsibility model.

Accepted Answer

SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.. The shared responsibility model delineates security obligations; SaaS offloads most to provider, on-premises retains all.

Answer

SaaS: Provider manages only physical security; customer manages all other aspects including applications and data.

Answer

IaaS: Provider manages operating system, applications, and data; customer manages physical servers.

Question 4

Match each cloud incident response phase to its primary activity.

Accepted Answer

Preparation: Develop and test incident response plan, configure tools.. Incident response in cloud requires adaptation to shared responsibility and ephemeral resources.

Answer

Detection & Analysis: Isolate affected resources to prevent spread.

Answer

Containment: Conduct lessons learned and update plans.

Question 5

Match each key management solution to its characteristic.

Accepted Answer

BYOK: Customer generates their own encryption key and imports it into the cloud provider's key management system.. Key management is critical for data protection; BYOK and KYOK offer different levels of customer control.

Answer

BYOK: Customer retains exclusive control of the encryption key, typically using a dedicated HSM.

Answer

KYOK: Customer uses an encryption key generated by the cloud provider.

Answer

Cloud KMS: Customer manages the encryption key in their own on-premises HSM.

Question 6

Match each NIST SP 800-53 control family to its focus area.

Accepted Answer

Access Control: Mechanisms for limiting access to resources based on user identity and permissions. NIST SP 800-53 provides security and privacy controls; each family addresses a specific domain.

Answer

Audit and Accountability: Controls related to physical security of facilities and environmental protections

Answer

Configuration Management: Controls for incident response procedures

Answer

Access Control: Focuses on ensuring personnel receive security awareness training

Question 7

Match each cloud security tool to its primary purpose.

Accepted Answer

CSPM: Configures and monitors cloud services for compliance with security best practices.. These tools address different aspects of cloud security; CSPM focuses on configuration, CWPP on workloads.

Answer

CSPM: Protects cloud workloads from malware and vulnerabilities.

Answer

CWPP: Controls access to cloud applications and monitors user activity.

Question 8

Match each cloud auditing term to its definition.

Accepted Answer

SOC 2: A report that evaluates a service provider's controls related to security, availability, processing integrity, confidentiality, or privacy.. Auditing in cloud requires continuous monitoring and third-party attestations like SOC 2.

Answer

SOC 2: A program that provides cloud-specific assessments and certifications based on the Cloud Security Alliance's guidance.

Answer

Continuous monitoring: A report that evaluates a service provider's controls.

Answer

CSA STAR: The ongoing observation of cloud resources.

Question 9

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

Accepted Answer

Configure a SecurityContext with runAsNonRoot: true and readOnlyRootFilesystem: true. Kubernetes SecurityContext allows fine-grained control over container permissions at the pod or container level. Setting `runAsNonRoot: true` ensures the container cannot run as UID 0, and `readOnlyRootFilesystem: true` mounts the container's root filesystem as read-only, preventing unauthorized writes at runtime. This directly satisfies the security team's requirements without relying on external policies or image-level configurations.

Answer

Use a RuntimeClass that disables root capabilities

Answer

Set the container's user to a non-root user in the Dockerfile

Answer

Apply a PodSecurityPolicy that blocks privileged containers

Question 10

A cloud security engineer reviews the Terraform configuration above. Which of the following is a security best practice that has been violated?

Accepted Answer

The security group allows unrestricted inbound traffic on port 80. The security group allows unrestricted inbound traffic on port 80 from any source (0.0.0.0/0), violating the principle of least privilege. This is a common security misconfiguration that exposes the instance to unnecessary risk. Option A is incorrect because while plain text user_data is not ideal, it is not a best practice violation in the same sense; secrets should not be in user_data, but the main issue here is the overly permissive security group. Option B is incorrect because the security group does not allow SSH access, which is actually a good security practice if SSH is not needed. Option D is incorrect because using a public AMI is not inherently a violation; the security risk depends on the AMI's trustworthiness.

Answer

The user_data script should not be in plain text

Answer

The security group does not allow SSH access

Answer

The instance uses a public AMI

Question 11

A cloud customer is decommissioning a storage service that contains sensitive data. The cloud provider offers several data destruction options. Which method provides the HIGHEST assurance that data is irrecoverable?

Accepted Answer

Physical shredding of the storage drives. (Physical shredding of the storage drives) is correct because physical destruction renders the storage media completely unusable and data irrecoverable by any means. Option A (Degaussing) is only effective on magnetic media and not on SSDs, and some residual data may remain. Option C (Multiple overwrite passes) can leave residual data due to physical characteristics of the media and is not guaranteed to be irrecoverable. Option D (Cryptographic erasure) is effective only if the encryption keys are securely destroyed, but if the keys are compromised or not fully erased, data may still be recoverable. Therefore, physical shredding provides the highest assurance.

Answer

Degaussing the storage media

Answer

Multiple overwrite passes with zeros and ones

Answer

Cryptographic erasure of encryption keys

Question 12

A healthcare company, MedSecure, is migrating its critical patient record application to a public cloud IaaS environment. The application processes Protected Health Information (PHI) subject to HIPAA in the US and also includes some patient data from EU residents subject to GDPR. MedSecure has signed Business Associate Agreements (BAAs) with the cloud provider covering US HIPAA compliance. However, the compliance officer is concerned about GDPR requirements for EU patient data. The architecture uses AWS EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS (MySQL) using encryption at rest and TLS for transmission. The company uses AWS CloudTrail for logging but only retains logs for 90 days. The compliance officer has identified that the current logging retention does not meet the GDPR requirement for logs to be retained for a minimum of 12 months for audit purposes. Additionally, the data stored in RDS is in a single AWS region in the US (us-east-1). The company plans to expand to EU customers. The GDPR requires that personal data of EU residents be stored in the EU or have adequate safeguards for transfer. Currently, the company has not implemented any data residency controls. What course of action should MedSecure take to address the most critical compliance gaps?

Accepted Answer

Enable S3 Object Lock for CloudTrail logs to ensure they cannot be deleted before 12 months, and use AWS DMS with CDC to replicate data to a eu-west-1 region. Also, sign a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage.. It directly addresses the two most critical compliance gaps: GDPR log retention (12 months) and data residency for EU patient data. Enabling S3 Object Lock on CloudTrail logs ensures they cannot be deleted or altered before 12 months, meeting GDPR audit requirements. Using AWS DMS with Change Data Capture (CDC) to replicate the RDS database to eu-west-1 provides a continuous, low-latency copy of PHI within the EU, satisfying GDPR data residency. Signing a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage is essential because the existing BAA only covers HIPAA, and GDPR requires a separate DPA to establish the cloud provider as a data processor under EU law.

Answer

Extend CloudTrail log retention to 12 months by configuring a new trail in a separate account and storing logs in an S3 bucket with a lifecycle policy to delete after 12 months. For data residency, use AWS DMS to replicate the RDS database to a second RDS instance in the eu-west-1 region and enable cross-region replication for continuous sync.

Answer

Implement AWS Config rules to monitor compliance with both HIPAA and GDPR, and enable AWS CloudTrail Insights to detect unusual activity. For data residency, sign a Standard Contractual Clauses (SCCs) with the cloud provider for the existing US-based data.

Answer

Use AWS Lambda to copy CloudTrail logs from the existing trail to a separate S3 bucket with a retention policy of 12 months. For data residency, configure the RDS instance to have a read replica in eu-west-1 and implement a DPA with AWS for GDPR.

Question 13

A security architect is designing a cloud-native application using microservices. They decide to implement mutual TLS (mTLS) for service-to-service communication in a Kubernetes cluster with hundreds of services. What is the primary challenge in managing mTLS certificates in this dynamic environment?

Accepted Answer

Certificate revocation and rotation. In a dynamic Kubernetes environment with hundreds of microservices, mTLS certificates must be frequently rotated and revoked to maintain security, especially as services scale up/down and pods are replaced. Manual certificate management is impractical, so automated solutions like SPIFFE/SPIRE or Istio’s Citadel are required to handle the lifecycle at scale. The primary challenge is not the encryption overhead but the operational complexity of ensuring every service has a valid, non-expired certificate and that compromised certificates can be promptly revoked across the mesh.

Answer

High latency due to encryption overhead

Answer

Incompatibility with HTTP/2

Answer

Increased complexity in load balancer configuration

Question 14

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

Accepted Answer

Use of signed certificates from a trusted CA. Signed certificates from a trusted Certificate Authority (CA) are essential for authenticating the server's identity and establishing a chain of trust. Without them, a client cannot verify that it is communicating with the legitimate server, making the connection vulnerable to man-in-the-middle (MITM) attacks. This is a foundational requirement for any secure communication channel over the internet.

Answer

Regular penetration testing

Answer

Implementation of IPsec VPNs

Answer

Encryption at rest using AES-256

Question 15

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 16

Which security testing technique is most effective at identifying vulnerabilities early in the development lifecycle by analyzing source code without executing it?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code at rest, allowing early detection of vulnerabilities before compilation or execution. This aligns with shift-left security principles.

Answer

Runtime Application Self-Protection (RASP)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 17

An API allows users to access their own profile data by providing a user ID. However, an attacker can change the user ID parameter to access another user's data. Which OWASP API Security vulnerability is this?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), occurs when an API fails to verify that the user is authorized to access the object identified by the parameter.

Answer

Excessive Data Exposure

Answer

Mass Assignment

Answer

Broken User Authentication

Question 18

Which practice is essential for securing cloud application secrets such as database passwords and API tokens?

Accepted Answer

Use a secrets management service like Vault or cloud secret manager. Using a dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault prevents hardcoding secrets in code.

Answer

Store secrets in environment variables in the source code

Answer

Encrypt secrets with a hardcoded key

Answer

Share secrets via encrypted email

Question 19

An organization uses a private artifact registry for approved packages. What attack does this practice primarily defend against?

Accepted Answer

Dependency confusion attacks. Dependency confusion attacks occur when an attacker publishes a malicious package with the same name as an internal package to a public registry, tricking the build system into using the malicious one. A private registry ensures only approved packages are used.

Answer

Denial of service attacks

Answer

Man-in-the-middle attacks

Answer

Injection attacks

Question 20

A security engineer is integrating security into a cloud application's CI/CD pipeline. Which practice is an example of 'shift-left' security?

Accepted Answer

Running SAST scans during pull request review. Shift-left security means performing security activities early in the development lifecycle. Running SAST during the coding phase, before code is merged, is a classic shift-left practice. The other options are either reactive or occur later.

Answer

Performing a penetration test after deployment

Answer

Analyzing logs after an incident

Answer

Scanning container images in production