CCSP Practice Exam 57 — 20 Questions

Question 1

A cloud architect is designing a multi-cloud solution that must maintain high availability and disaster recovery across two cloud providers. Which three key considerations should be included in the architecture? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rely on each provider's native high-availability features.. Option A is correct because leveraging each provider's native high-availability features (such as AWS Multi-AZ deployments, Azure Availability Zones, or GCP regional resources) provides resilient, provider-optimized redundancy within each cloud without reinventing failover mechanisms. Option D is correct because implementing consistent identity and access management across providers (for example, federating with SAML 2.0/OIDC to a central IdP like Microsoft Entra ID or Okta) ensures uniform authentication, authorization, and least-privilege policies across both environments, which is essential for secure multi-cloud operations. Option E is correct because cloud-agnostic application code (e.g., using containers, Kubernetes, or abstraction layers instead of proprietary PaaS APIs) enables portability and failover between providers, which is fundamental to a multi-cloud DR strategy. Option B does not belong because a single networking interface creates a single point of failure and does not address cross-provider connectivity or redundancy. Option C does not belong because relying on a single DNS provider for failover introduces a single point of failure; a resilient multi-cloud design should use multiple DNS providers or health-check-based global traffic management.

Answer

Use a single networking interface to simplify connectivity.

Answer

Use a single DNS provider for failover.

Question 2

An organization is implementing a cloud SIEM solution to centralize security monitoring across multiple AWS accounts. Which service should be used to aggregate security findings and send them to a third-party SIEM like Splunk?

Accepted Answer

AWS Security Hub. AWS Security Hub is the correct service because it is designed to aggregate security findings from multiple AWS services (e.g., GuardDuty, Inspector, Macie) and AWS accounts, and then forward them to third-party SIEM solutions like Splunk via AWS EventBridge or direct integration. This centralizes security alerts into a single dashboard and stream, enabling efficient monitoring across a multi-account environment.

Answer

AWS CloudTrail

Answer

AWS GuardDuty

Answer

AWS Config

Question 3

A cloud application uses an IAM role with the policy "Action: s3:*" and "Resource: *". Which principle is violated?

Accepted Answer

Least privilege. The policy grants full access to all S3 actions on all resources, violating the principle of least privilege. Wildcard permissions like s3:* and *:* are over-permissive.

Answer

Defense in depth

Answer

Fail secure

Answer

Separation of duties

Question 4

A global enterprise is designing a cloud storage architecture with cross-region replication for disaster recovery. They must ensure that data replicated to a secondary region is encrypted with keys managed by the customer, and that those keys are stored in the secondary region's key management service (KMS). Which THREE capabilities must be enabled?

Accepted Answer

Permission for the replication service to use the secondary region's key. Option D (Cross-region replication) is required because the scenario explicitly demands that data be replicated to a secondary region for disaster recovery, which is the core mechanism that copies objects across regions. Option E (Customer-managed encryption keys in the secondary region) is correct because the requirement states the replicated data must be encrypted with customer-managed keys that reside in the secondary region's KMS, satisfying the customer-controlled key mandate. Option C (Permission for the replication service to use the secondary region's key) is correct because the replication service must be authorized to encrypt the replicated objects with that secondary-region customer-managed key; without the appropriate KMS key policy/grant, replication would fail to apply the required encryption. Option A (Default encryption with provider keys) does not belong because provider-managed keys do not meet the customer-managed key requirement. Option B (Client-side encryption before upload) does not belong because client-side encryption is performed before the data reaches the storage service and would not use the secondary region's KMS-managed customer keys as specified.

Answer

Default encryption with provider keys

Answer

Client-side encryption before upload

Question 5

A cloud security team is deploying a web application with an API Gateway. Which TWO mechanisms should be implemented to protect against API abuse and unauthorized access?

Accepted Answer

Rate limiting. Rate limiting (A) is correct because it throttles the number of requests a client can make in a given time window, directly mitigating API abuse such as brute-force attempts, credential stuffing, and denial-of-service floods that would otherwise overwhelm the gateway and backend. Authentication with JWT validation (E) is correct because it verifies the identity and integrity of the caller by validating the token's signature, issuer, audience, and expiry before granting access, thereby preventing unauthorized access to protected API routes. TLS enforcement (B) only encrypts data in transit and does not by itself stop abuse or authenticate API clients, so it does not satisfy the requirement. Resource tagging (C) is a metadata and governance mechanism for cost allocation and organization, not a runtime access control. VPC peering (D) provides private network connectivity between VPCs but does not protect an internet-facing API Gateway against abuse or unauthorized callers.

Answer

TLS enforcement

Answer

Resource tagging

Answer

VPC peering

Question 6

During a threat modeling session for a cloud application, the team identifies a risk where an attacker could trick the application into making HTTP requests to the cloud metadata endpoint (e.g., http://169.254.169.254). What is the most critical impact of this attack?

Accepted Answer

Retrieval of temporary IAM credentials for the instance. The cloud metadata endpoint (169.254.169.254) is a link-local address accessible from within the instance, and it serves temporary IAM credentials to the instance's role. If an attacker can trick the application into making HTTP requests to this endpoint (via SSRF), they can retrieve those credentials and use them to access cloud resources with the instance's permissions. This is the most critical impact because it leads to privilege escalation and potential full account compromise, far exceeding DoS, configuration modification, or source code exposure.

Answer

Denial of service to the metadata service

Answer

Modification of the cloud instance's configuration

Answer

Exposure of the application's source code

Question 7

During an audit of a containerized application, you notice that containers are running with the --privileged flag. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Container escape to the host. Privileged containers have nearly all capabilities of the host, significantly increasing the risk of container escape and host compromise.

Answer

Increased memory consumption

Answer

Inability to use secure base images

Answer

Excessive network bandwidth usage

Question 8

A cloud customer wants to ensure they can audit their cloud provider's security controls annually. Which contractual provision should be included in the cloud service agreement?

Accepted Answer

Right to audit clause. A right to audit clause contractually grants the cloud customer the ability to audit the provider's security controls, either directly or through third-party assessments, on a defined schedule. This is the specific provision that ensures annual audit capability, so D is correct.

Answer

Service level agreement (SLA) with uptime guarantees

Answer

Data deletion clause

Answer

Data portability clause

Question 9

A cloud customer is terminating its contract with a cloud provider and needs to ensure all data, including backups, is permanently deleted. Which contractual clause is most relevant?

Accepted Answer

Data deletion clause. A data deletion clause contractually obligates the provider to permanently delete customer data, including backups, upon termination, which is exactly what the customer needs. It specifies timelines, methods, and certification of deletion, giving the customer enforceable assurance. This is the most directly relevant clause for ensuring no residual copies remain.

Answer

Service Level Agreement

Answer

Data portability clause

Answer

Right to audit clause

Question 10

A company is negotiating a cloud service agreement and wants to ensure it can periodically assess the security of the cloud provider's operations. Which contractual clause is most directly relevant to this requirement?

Accepted Answer

Right to Audit clause permitting the customer to review the provider's security controls and certifications. A Right to Audit clause explicitly grants the customer the contractual right to assess the cloud provider's security controls, certifications, and compliance through audits or inspections. This directly addresses the requirement to periodically assess the provider's operations. Other clauses address different concerns such as data portability, performance, or data deletion, but not security assessment.

Answer

Data portability clause ensuring data can be exported in a usable format

Answer

Service Level Agreement (SLA) with uptime guarantees

Answer

Data deletion clause specifying how data is deleted after contract termination

Question 11

A cloud architect is designing a VPC for a three-tier application. The web servers need to be accessible from the internet, while the application servers should only be reachable from the web servers, and the database servers should be isolated from all other traffic except the application servers. Which VPC design best meets these requirements?

Accepted Answer

Web servers in a public subnet, app servers in a private subnet, databases in an isolated subnet with appropriate security groups. A three-tier design requires three distinct network zones: a public subnet for internet-facing web servers, a private subnet for application servers reachable only from the web tier, and an isolated (private, no NAT/IGW route) subnet for databases reachable only from the app tier. Security groups enforce the tier-to-tier traffic rules (web SG allows 80/443 from internet; app SG allows app port from web SG; DB SG allows DB port from app SG). This layered segmentation is the canonical defense-in-depth VPC pattern.

Answer

Web servers in a public subnet, app and database servers in a single private subnet

Answer

All servers in a private subnet with a NAT gateway

Answer

All servers in a single public subnet with security groups

Question 12

Refer to the exhibit. A security engineer attaches this bucket policy to a cloud storage bucket. What does this policy accomplish?

Accepted Answer

It denies all requests to the bucket that are not using HTTPS.. The bucket policy uses a condition that checks for HTTPS usage (secure transport) and an explicit Deny effect. This denies any request that does not use HTTPS (i.e., plain HTTP), ensuring all traffic to the bucket is encrypted in transit.

Answer

It allows only requests from a specific virtual network endpoint.

Answer

It denies requests from IP addresses outside a specific range.

Answer

It denies all requests to the bucket.

Question 13

A cloud security engineer needs to ensure that logs from multiple AWS accounts are centrally stored in a security account for analysis. Which TWO services can be used to aggregate logs across accounts? (Choose two.)

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription filters. Option A is correct because CloudWatch Logs supports cross-account subscription filters, which allow a destination account (the security account) to receive real-time log events from source accounts via a destination Logs resource policy and a subscription filter, enabling centralized log aggregation. Option D is correct because Amazon S3 with cross-account bucket policies lets multiple accounts write their logs (e.g., via PutObject permissions in the bucket policy) into a single central bucket owned by the security account, which is a common pattern for centralized log storage and analysis. Option B (AWS Config) is a configuration compliance and resource inventory service, not a cross-account log aggregation mechanism. Option C (AWS Security Hub) aggregates security findings and compliance checks across accounts, not raw logs. Option E (Amazon GuardDuty) is a threat detection service that generates findings, not a general log aggregation service.

Answer

AWS Config

Answer

AWS Security Hub

Answer

Amazon GuardDuty

Question 14

Which of the following is a key practice for secure management of cloud credentials in application code?

Accepted Answer

Use IAM roles or managed identities. Using IAM roles or managed identities eliminates the need to embed long-term credentials in application code. This approach relies on temporary, automatically rotated credentials obtained via the cloud provider's metadata service (e.g., AWS IMDSv2, Azure Instance Metadata Service), which significantly reduces the risk of credential leakage and simplifies credential management.

Answer

Hardcode credentials in environment variables

Answer

Store credentials in source code comments

Answer

Encrypt credentials with a static key in the codebase

Question 15

Which of the following is a primary purpose of a SOAR (Security Orchestration, Automation and Response) platform in cloud security operations?

Accepted Answer

To automate response to security incidents by executing predefined playbooks.. SOAR platforms are designed to orchestrate security tools, automate repetitive response tasks, and execute predefined playbooks that coordinate actions across multiple systems during an incident. This reduces mean time to respond (MTTR) and enables consistent, repeatable incident handling. The primary purpose is automation of incident response workflows, not cost management, vulnerability scanning, or IAM enforcement.

Answer

To provide a centralized dashboard for cloud cost management.

Answer

To scan container images for vulnerabilities.

Answer

To enforce identity and access management policies.

Question 16

A cloud application uses an API that allows users to view other users' profile details by changing the user ID in the request. Which vulnerability is this?

Accepted Answer

Broken object level authorization (BOLA). Broken Object Level Authorization (BOLA) occurs when an API fails to verify that the requesting user is authorized to access the specific object (e.g., user profile) referenced in the request. In this case, changing the user ID in the request allows viewing other users' profiles because the API does not check if the authenticated user has permission to access that particular user's data. This is a classic example of BOLA, listed as API1:2019 in the OWASP API Security Top 10.

Answer

Mass assignment

Answer

Broken authentication

Answer

Excessive data exposure

Question 17

Which OWASP Top 10 vulnerability is most directly related to cloud API security when an attacker can modify parameters to access another user's data?

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (BOLA) occurs when an API does not properly enforce user permissions on object access.

Answer

Security Misconfiguration

Answer

Injection

Answer

Cross-Site Request Forgery (CSRF)

Question 18

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for early detection of vulnerabilities during the coding phase of the SSDLC. By integrating SAST into the CI/CD pipeline, developers receive immediate feedback on security flaws such as SQL injection or buffer overflows, enabling remediation before the code is built or deployed. This aligns with the 'shift left' principle, catching issues when they are cheapest and easiest to fix.

Answer

Penetration testing in production

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 19

A cloud security engineer needs to protect a storage bucket from accidental deletion and ransomware attacks. Which two features should be enabled together for maximum protection?

Accepted Answer

Bucket versioning and object lock. Versioning keeps multiple variants of an object, allowing recovery from accidental deletion or overwrite. Object lock (immutability) prevents objects from being deleted or overwritten for a specified retention period, protecting against ransomware. Combining both provides defense in depth.

Answer

IAM policies and MFA delete

Answer

Cross-region replication and lifecycle policies

Answer

Server access logging and bucket policies

Question 20

A company's cloud infrastructure is subject to GDPR. The DPO requires that all customer personal data be encrypted at rest and in transit. The cloud provider offers SSE-S3 for object storage and enforces TLS 1.2 for API calls. Which additional control should the company implement to meet GDPR accountability requirements?

Accepted Answer

Enable detailed logging of all access to encrypted data.. While SSE-S3 and TLS 1.2 address encryption at rest and in transit, GDPR accountability requires the company to demonstrate compliance through audit trails. Enabling detailed logging of all access to encrypted data (Option B) provides the necessary records to prove who accessed personal data, when, and from where, fulfilling the 'demonstrate compliance' principle under Article 5(2) and Article 30 of the GDPR.

Answer

Implement client-side encryption with a key management service.

Answer

Automatically delete backups older than 30 days.

Answer

Apply data masking to all personal data fields before storage.