CCSP Practice Exam 56 — 20 Questions

Question 1

A cloud architect is designing a multi-tier application that will be deployed in a public cloud. The application must meet strict security and compliance requirements, including data isolation, network segmentation, and encryption of data at rest and in transit. The architect is considering using a virtual private cloud (VPC) and must ensure that the design aligns with the cloud shared responsibility model. Which TWO of the following are the cloud customer's responsibilities under the shared responsibility model? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypting application data at rest using customer-managed keys.. Under the shared responsibility model for IaaS, the customer is responsible for security in the cloud, which includes configuring network controls (security groups, network ACLs) and encrypting data at rest with customer-managed keys. The provider is responsible for security of the cloud, including physical security, hypervisor patching, and physical network redundancy. Therefore, the customer's responsibilities are configuring security groups and network ACLs, and encrypting application data at rest.

Answer

Ensuring the physical network infrastructure is redundant and fault-tolerant.

Answer

Managing the physical security of the data center where the application is hosted.

Answer

Patching the hypervisor and underlying host operating system.

Question 2

A government agency is comparing cloud providers and must prove to auditors that its workloads will remain available and recoverable during a regional provider outage. The agency wants an objective, contractual commitment about the percentage of time a service will be operational, plus a documented financial remedy if the provider misses that target. Which provider artifact should the agency rely on FIRST?

Accepted Answer

The provider's service level agreement. The agency needs a measurable availability commitment plus a defined remedy, and that is precisely what a service level agreement provides. It sets the uptime percentage, the measurement window, exclusions, and the service credits owed when targets are missed. Audit reports, disaster recovery test summaries, and architecture whitepapers are useful evidence about controls and design, but none of them creates an enforceable service commitment with compensation terms.

Answer

The provider's architecture whitepaper

Answer

The provider's independent audit report

Answer

The provider's disaster recovery test summary

Question 3

An organization is evaluating a cloud service where the provider manages the operating system, runtime, middleware, and application, and subscribers access the software through a thin client such as a web browser. The organization's security team wants to know which layer remains squarely under the subscriber's control in this model. Which responsibility belongs to the cloud consumer in a SaaS arrangement?

Accepted Answer

Managing user identities, access rights, and data classification. In SaaS the provider secures everything from the physical facility up through the application, while the consumer retains control over its own identities, access entitlements, and the data it chooses to place in the service. Physical security, hypervisor maintenance, and guest operating system patching all sit beneath the application and never move to the subscriber.

Answer

Applying hypervisor patches to the multi-tenant virtualization layer

Answer

Patching the guest operating system on the provider's hosts

Answer

Maintaining the physical security of the provider's data centers

Question 4

An enterprise is evaluating whether to move a legacy customer relationship management system to a cloud provider. The security architect must assess the provider's ability to meet the enterprise's control requirements before signing. Which TWO artifacts or activities BEST provide direct evidence of the provider's security control environment? (Choose two.)

Accepted Answer

A current independent third-party audit report covering the relevant trust services criteria. Direct evidence comes from independent testing and from a structured, documented assessment conducted by the enterprise itself. An independent third-party audit report covers defined criteria over a stated period and discloses exceptions, while a framework-mapped questionnaire reviewed with the provider turns vague assurances into specific, verifiable answers. Marketing brochures, terms of service, and reference calls may inform the decision, but they do not establish that the provider's controls are designed and operating effectively.

Answer

The provider's public marketing brochure describing its security posture

Answer

A customer reference call with another organization of similar size in the same industry

Answer

The provider's standard terms of service and acceptable use policy

Question 5

An organization uses GCP and wants to monitor for threats in real-time, including detecting malicious activity from compromised service accounts. Which GCP service should be used?

Accepted Answer

Event Threat Detection. Event Threat Detection is part of GCP Security Command Center and provides real-time threat detection for IAM anomalies, including compromised service accounts.

Answer

Cloud Audit Logs

Answer

Cloud Security Scanner

Answer

Container Threat Detection

Question 6

A cloud security team is implementing a Web Application Firewall (WAF) for a public-facing web application. The application uses a REST API with JSON payloads. Which of the following is the WAF's primary benefit?

Accepted Answer

Inspecting HTTP traffic for malicious payloads. A WAF operates at Layer 7 (application layer) and is specifically designed to inspect HTTP/HTTPS traffic for malicious payloads such as SQL injection, cross-site scripting (XSS), and JSON-based attacks. For a REST API using JSON, the WAF can parse and validate the JSON structure, blocking malformed or malicious payloads before they reach the application server. This is the primary benefit because it directly protects the application logic from web-based exploits.

Answer

Scanning for data loss prevention (DLP) violations

Answer

Preventing network-layer DDoS attacks

Answer

Encrypting data in transit between client and server

Question 7

A DevSecOps team runs workloads on a managed Kubernetes service. The security policy states that no pod may run as the root user, that containers must not mount the host filesystem, and that privilege escalation must be blocked. The team wants a control that evaluates pod specifications at admission time and rejects non-compliant pods before they are scheduled, without modifying application code. Which mechanism should the team implement?

Accepted Answer

A validating admission webhook or a Pod Security Admission configuration with the restricted profile enforced. The requirement is admission-time rejection of pods that run as root, mount the host filesystem, or allow privilege escalation. Pod Security Admission with the restricted profile, or a validating admission webhook, evaluates pod specifications before scheduling and rejects non-compliant pods without code changes. Network policies and runtime agents address different layers and cannot prevent the pods from being admitted.

Answer

A runtime security agent that scans running containers and sends alerts when it detects root processes

Answer

A PodSecurityPolicy object bound to the service account used by the workloads

Answer

A network policy that denies ingress to the pods from all namespaces except the application namespace

Question 8

A cloud security architect is drafting design requirements for storing regulated data in a public cloud IaaS environment. The requirements must address the risks introduced by resource pooling and multi-tenancy. Which TWO of the following design controls directly mitigate multi-tenancy risks in this environment? (Choose two.)

Accepted Answer

Require strong workload isolation using virtual networks, security groups, and separate tenant identities. Resource pooling means physical infrastructure is shared, so mitigations must either make the data unreadable to anyone outside the tenant or make the logical boundaries between tenants enforceable and auditable. Externally held encryption keys protect confidentiality even if a boundary fails, and virtual network segmentation with distinct identities constrains reachability. Contractual guarantees, disabled logging, and default provider-managed encryption do not change the underlying sharing risk.

Answer

Rely on the provider's published service-level agreement to guarantee that tenants never share a physical host

Answer

Disable all provider-side logging so that telemetry from one tenant cannot be aggregated with another tenant's records

Answer

Move the regulated data into the provider's object storage with default provider-managed encryption only

Question 9

A development team is migrating a legacy application to the cloud. Which security testing approach should be adopted early in the CI/CD pipeline to catch vulnerabilities as code is written?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binary code without executing the application, making it ideal for integration early in the CI/CD pipeline to catch vulnerabilities like SQL injection, buffer overflows, and XSS as code is written. This 'white-box' approach provides immediate feedback to developers, aligning with the shift-left security principle for cloud-native development.

Answer

Dynamic application security testing (DAST)

Answer

Penetration testing

Answer

Runtime application self-protection (RASP)

Question 10

A company is implementing a hybrid cloud architecture. Which two components are essential for establishing a secure connection between on-premises and cloud environments? (Choose two.)

Accepted Answer

Direct connect or dedicated interconnect. Option A (Direct connect or dedicated interconnect) is correct because a dedicated private circuit such as AWS Direct Connect or Azure ExpressRoute bypasses the public internet, providing a consistent, low-latency, and secure private link between the on-premises data center and the cloud provider's network. Option E (VPN gateway) is correct because it establishes an encrypted IPsec/IKE tunnel over the public internet between the on-premises VPN device and the cloud VPN gateway, which is the standard mechanism for secure hybrid connectivity. Together these are the two essential transport components for a secure on-premises-to-cloud connection. Option B (IAM) is not a connectivity component; it governs authentication and authorization of identities and does not establish the network link. Option C (CASB) is a policy enforcement and visibility layer for cloud service usage, not a site-to-site transport mechanism. Option D (WAF) protects web applications from HTTP-layer attacks and does not provide the hybrid network connection.

Answer

Identity and access management (IAM)

Answer

Cloud access security broker (CASB)

Answer

Web application firewall (WAF)

Question 11

An Azure application uses a key vault key for client-side encryption of data. The application also communicates with a cloud service over HTTPS. After deploying, the handshake failure occurs. Which of the following is the most likely cause?

Accepted Answer

The client and server do not have a common TLS version or cipher suite. The handshake failure occurs at the transport layer (TLS/SSL), which is independent of client-side encryption using a key vault key. The most likely cause is a mismatch in TLS versions or cipher suites between the client and server, as HTTPS relies on a successful TLS handshake. Options A, B, and D relate to the key vault key's availability or configuration, which would not cause a TLS handshake failure.

Answer

The application is using the wrong key version

Answer

The key vault key is not accessible due to network restrictions

Answer

The key vault key is not enabled for encryption

Question 12

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) in the cloud? (Choose three.)

Accepted Answer

Static application security testing (SAST) in CI/CD. SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Answer

Manual code reviews without automation

Answer

Annual penetration testing only

Question 13

A large enterprise is migrating a legacy .NET application to Azure App Service. The application currently stores session state in-memory on the web server. During the migration, the team plans to horizontally scale the application across multiple instances. The security team requires that session data remain confidential and be available even if an instance fails. Which solution should the team implement?

Accepted Answer

Use Azure Redis Cache to store session state with encryption enabled. Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.

Answer

Store session data in Azure SQL Database with column-level encryption

Answer

Encrypt session data and store it as a client-side cookie

Answer

Configure Application Gateway with cookie-based affinity (sticky sessions)

Question 14

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 15

An enterprise uses a Cloud Access Security Broker (CASB) to monitor cloud application usage. The CASB generates alerts about potential data loss prevention events. What is the primary purpose of the CASB's DLP capabilities?

Accepted Answer

To detect and prevent unauthorized sharing of sensitive data based on policies. The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Answer

To block all uploads of sensitive data to cloud apps

Answer

To classify data automatically using machine learning

Answer

To encrypt data before it is sent to cloud apps

Question 16

An organization is evaluating techniques to protect data while it is being processed in memory. The goal is to prevent unauthorized access even if the operating system or hypervisor is compromised. Which TWO techniques are suitable for protecting data in use?

Accepted Answer

Secure enclaves (e.g., Intel SGX). Secure enclaves, such as Intel SGX, provide hardware-enforced isolation by creating trusted execution environments (TEEs) that encrypt memory pages in use, protecting data even if the OS or hypervisor is compromised. This makes them suitable for protecting data in use because the CPU itself enforces access controls, preventing any privileged software from reading the enclave's memory.

Answer

Hashing

Answer

Data masking

Answer

Tokenization

Question 17

An organization wants to ensure that its CSP does not access customer data for any purpose other than providing the service. Which clause should be included?

Accepted Answer

Data use restriction. A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

Answer

Right to audit

Answer

Security incident response

Answer

Non-disclosure agreement

Question 18

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Option A is correct because Cosign (part of the Sigstore project) cryptographically signs container images using keyless or key-based signatures, producing a verifiable signature stored in the OCI registry that establishes provenance and integrity from build time. Option C is correct because an admission controller such as Kyverno (or OPA Gatekeeper) enforces policy at deploy time by verifying Cosign signatures before allowing a pod to be admitted, ensuring only trusted, signed images run in the cluster. Option E is correct because Trivy scans image layers against vulnerability databases (e.g., CVE feeds) and can fail CI/CD pipelines on critical findings, catching known flaws before an image is promoted. Option B is not appropriate because a private registry alone provides no integrity verification, and skipping scanning removes a key detection control. Option D is wrong because the mutable :latest tag offers no immutability or traceability, undermining supply-chain trust and reproducibility.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag

Question 19

A security analyst notices that an IAM user from a cloud account has logged in from two different countries within a span of 10 minutes. Which type of detection mechanism is most likely to flag this activity as suspicious?

Accepted Answer

A correlation rule in a SIEM. A correlation rule in a SIEM is designed to aggregate and analyze log data from multiple sources, such as cloud IAM logs, to detect anomalous patterns. The specific scenario of a user logging in from two geographically distant countries within 10 minutes is a classic example of an impossible travel time anomaly, which SIEM correlation rules are built to flag by comparing login timestamps and IP geolocation data.

Answer

A cloud configuration management database (CMDB)

Answer

A vulnerability scanner

Answer

An agent-based intrusion detection system (IDS)

Question 20

A cloud-native application stores sensitive user files in an Amazon S3 bucket. Which misconfiguration poses the greatest risk of data exposure?

Accepted Answer

Bucket ACL set to public read. Setting the S3 bucket ACL to public read allows anyone on the internet to access files, leading to data exposure.

Answer

Bucket versioning enabled

Answer

Default encryption enabled

Answer

Bucket policy with a condition for source IP