CCSP Practice Exam 57 — 20 Questions

Question 1

A cloud application allows users to upload profile pictures. The application stores the files in an S3 bucket with public read access. An attacker uploads a malicious script that executes when other users view the image. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stored Cross-Site Scripting (XSS). This is a stored cross-site scripting (XSS) attack where malicious content is uploaded and later served to other users. The public bucket enables the attacker to host the script and deliver it to victims.

Answer

SQL Injection

Answer

Mass Assignment

Answer

Server-Side Request Forgery (SSRF)

Question 2

A development team builds a serverless application using AWS Lambda. The security team wants to prevent hardcoded credentials. Which TWO methods should they enforce for secure secrets management?

Accepted Answer

Assign an IAM role to the Lambda function and retrieve temporary credentials via the AWS SDK. Using cloud-native secret managers and IAM roles are secure ways to manage secrets without hardcoding. AWS Systems Manager Parameter Store is a secret manager; Lambda execution roles eliminate the need for embedded credentials.

Answer

Store secrets in environment variables in plain text

Answer

Embed secrets directly in the Lambda function code but encrypt the code

Answer

Use a third-party secrets manager with a hardcoded API key in the code

Question 3

A developer accidentally commits cloud access keys to a public GitHub repository. Which tool would be most effective in detecting this secret exposure?

Accepted Answer

GitGuardian. GitGuardian is a tool specifically designed to detect secrets (like cloud provider access keys) committed to code repositories. It monitors for hardcoded credentials and alerts.

Answer

Terraform

Answer

npm audit

Answer

tfsec

Question 4

During a security audit, a cloud security architect discovers that a cloud storage bucket is configured with a bucket policy that allows read access to objects from any principal. What is the most likely risk?

Accepted Answer

Potential for data exfiltration by unauthorized users. A storage bucket policy that allows read access from any principal effectively makes the bucket publicly readable, exposing data to anyone on the internet. This is a common misconfiguration leading to data breaches.

Answer

Denial of service from excessive requests

Answer

Insufficient logging of access

Answer

Increased cost due to excessive write operations

Question 5

A cloud application is deployed on Kubernetes and uses a cloud identity and access management (IAM) role for service accounts. Which TWO practices should be implemented to ensure least privilege?

Accepted Answer

Grant only the specific permissions required for the application. Least privilege for IAM roles means granting only the permissions necessary for the application to function and limiting the scope of those permissions to specific resources using resource identifiers. This prevents excessive access and reduces risk.

Answer

Hardcode the role's credentials in the application code

Answer

Grant the role the full IAM permissions (e.g., 'iam:*' equivalent)

Answer

Use a single role for all services in the cluster

Question 6

A cloud security analyst is troubleshooting an access denied error when an application attempts to read an object from an S3 bucket. The application uses an IAM user that is not associated with the role specified in the policy. Which of the following is the most likely cause of the error?

Accepted Answer

The IAM user is not the specified role and is explicitly denied by the Deny statement.. The bucket policy likely includes a Deny statement that explicitly denies all principals except the specified role. Since the IAM user is not that role, the Deny overrides any Allow and blocks access. Option A is incorrect because even if the user were to assume the role, it would then be the role and gain access; however, the issue is that the user is not assuming the role. Option C is incorrect because a conflicting Allow and Deny would result in an explicit Deny, not an implicit deny—the Deny always overrides. Option D is incorrect because region restriction is not mentioned as a factor in the access denied error.

Answer

The IAM user is not assuming the role before accessing the bucket.

Answer

The bucket policy has a conflicting Allow and Deny statement, causing an implicit deny.

Answer

The bucket policy is missing a condition for region restriction.

Question 7

A multinational corporation stores customer data in an AWS S3 bucket located in the US. The company's European customers' personal data must comply with GDPR. Which TWO actions should the company take to ensure compliance with GDPR data transfer requirements?

Accepted Answer

Sign Standard Contractual Clauses (SCCs) with the cloud provider.. Standard Contractual Clauses (SCCs) are a lawful mechanism under GDPR for transferring personal data from the EU to a third country (the US) without an adequacy decision. By signing SCCs with AWS, the company contractually binds the cloud provider to ensure adequate data protection for the European customers' data stored in the US S3 bucket. This directly addresses the GDPR requirement for a valid transfer tool.

Answer

Implement encryption at rest using AWS KMS with a key stored in the US.

Answer

Ensure that the data is only accessed by employees in the EU.

Answer

Use AWS Direct Connect to route traffic exclusively through EU-based links.

Question 8

A cloud-native application is deployed on AWS. During a security review, the team discovers that if an attacker can send a crafted request to the application, the application will make an HTTP request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Which vulnerability is being exploited?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) targeting the cloud metadata endpoint can expose IAM credentials. The IP 169.254.169.254 is the link-local address for cloud metadata services.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Insecure deserialization

Question 9

A security analyst is conducting a forensic investigation of a compromised virtual machine in a public cloud. The VM is running in a production environment and cannot be stopped. Which of the following techniques is MOST appropriate to acquire volatile memory evidence?

Accepted Answer

Run `dd if=/dev/mem of=/tmp/mem.dump` from within the VM.. The most appropriate technique to acquire volatile memory evidence from a running VM without stopping it. While `dd if=/dev/mem` requires root privileges and may not be available on all VM configurations, it is the only option among the choices that directly captures RAM contents. Cloud providers do not offer native APIs to take a memory snapshot without halting the instance; disk snapshots (option A) capture storage only, and network packet captures (option B) do not include memory data. Therefore, in this scenario, running `dd` from within the VM is the feasible method, despite its limitations.

Answer

Create a snapshot of the VM's disk and then analyze it.

Answer

Perform a network packet capture to capture memory data.

Answer

Use the cloud provider's API to take a memory snapshot of the VM.

Question 10

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

Accepted Answer

Modify the bucket policy to deny access from all IP addresses except trusted ranges.. The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Answer

Enable bucket logging to track access attempts.

Answer

Notify the security team and wait for a formal change request.

Answer

Enable server-side encryption on the bucket.

Question 11

A cloud architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms are essential to prevent tenant data leakage? (Choose two.)

Accepted Answer

Network isolation (e.g., VLANs, VPCs). Logical data isolation and network isolation are key to prevent data leakage.

Answer

Geographic isolation

Answer

Shared storage volume encryption

Answer

Hypervisor isolation

Question 12

Based on the audit log, why did the Decrypt call fail?

Accepted Answer

The key policy denied access.. The Decrypt call failed because the key policy attached to the cloud key management service (KMS) key explicitly denied the cloud identity making the request. Audit logs show the error code 'AccessDenied' or 'UnauthorizedOperation', which indicates that the key policy did not grant the necessary decrypt permission to the principal. Even if the key is enabled and the ciphertext is valid, a restrictive key policy will block the operation.

Answer

The encryption algorithm mismatch.

Answer

The ciphertext was tampered.

Answer

The key was disabled.

Question 13

During a cloud security incident, the response team needs to collect evidence from a compromised AWS EC2 instance. Which method is most appropriate for capturing volatile data while preserving forensic integrity?

Accepted Answer

Create a memory dump by SSH and save to S3. The most appropriate method for capturing volatile data (memory) from a compromised EC2 instance. Using SSH to perform a memory dump (e.g., via LiME or fmem) and saving the output to S3 captures RAM contents, which is volatile and critical for incident response. While SSH access alters system state, it is the standard approach for remote memory acquisition when direct physical access is unavailable. Option C (EBS snapshot) captures persistent storage, not volatile memory, so it is incorrect for the stated requirement.

Answer

Terminate the instance and launch a replacement

Answer

Take an EBS snapshot of the instance's volumes

Answer

Reboot the instance and collect logs

Question 14

A company uses a cloud storage service to store sensitive customer data. They need to ensure that data is encrypted at rest using keys managed by the cloud provider. Which encryption model should they use?

Accepted Answer

Server-Side Encryption with Provider-Managed Keys (SSE-PMK). The requirement specifies that the cloud provider manages the encryption keys. Server-Side Encryption with Provider-Managed Keys (SSE-PMK) uses keys that are entirely managed by the cloud provider for encrypting data at rest, with each object encrypted by a unique key that is itself encrypted by a regularly rotated master key. This aligns perfectly with the scenario where the customer does not want to manage keys.

Answer

Server-Side Encryption with Customer-Managed Keys (SSE-CMK)

Answer

Client-Side Encryption (CSE)

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-CPK)

Question 15

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 16

A developer is implementing a cloud application that stores sensitive user data. To minimize the risk of data exposure during transit, which security control should be enforced as a baseline requirement?

Accepted Answer

Enforce TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, providing confidentiality, integrity, and authentication. Enforcing TLS for all communications ensures that sensitive user data is protected from eavesdropping and tampering during transmission, making it a baseline requirement for cloud application security.

Answer

Implement IPsec tunnels between components

Answer

Use HTTPS without additional controls

Answer

Require SSH for all connections

Question 17

A company uses a cloud-based intrusion detection system (IDS) that generates logs containing IP addresses. The company is headquartered in a country with data localization laws. What is the primary compliance risk?

Accepted Answer

Log data containing personal data may be processed in a different jurisdiction. Logs contain IP addresses (personal data under many laws) and may be transferred abroad if the IDS vendor processes logs in another jurisdiction, violating localization requirements. Encryption does not solve localization.

Answer

The logs may be tampered with in transit

Answer

The IDS logs consume too much storage

Answer

The IDS may miss certain attack patterns

Question 18

A healthcare organization has deployed a cloud-based application that handles protected health information (PHI). The application runs on virtual machines in a virtual private cloud (VPC). The security team has implemented security groups to control traffic to the VMs. Recently, an external penetration test revealed that a web server VM is accessible from the internet on port 22 (SSH) from any IP address (0.0.0.0/0). The security team also discovered that the SSH key pair used for the web server was created with a weak algorithm (1024-bit RSA). The team needs to remediate these issues without causing downtime for the application. Additionally, the application logs must be sent to a centralized logging solution that is encrypted in transit and at rest. Which combination of actions should the security team take?

Accepted Answer

Restrict inbound SSH access to only a bastion host's IP address, generate a new 2048-bit RSA key pair, configure the application to send logs via TLS to a centralized logging service, and enable server-side encryption for the logging bucket.. It addresses both critical vulnerabilities without downtime: restricting SSH to a bastion host's IP eliminates internet-wide exposure, and generating a new 2048-bit RSA key pair replaces the weak 1024-bit key. For logging, TLS ensures encryption in transit, and server-side encryption for the logging bucket ensures encryption at rest, meeting compliance requirements for PHI.

Answer

Implement a VPN connection for all administrative access, keep the existing key pair, and use a third-party logging tool with TLS.

Answer

Change the SSH port to a non-standard port, keep the existing key pair, and enable logging to a cloud storage bucket without encryption.

Answer

Disable SSH access entirely and use a serial console for administration, keep the existing key pair, and send logs via plaintext syslog to a logging server.

Question 19

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

Accepted Answer

SAML assertion. A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.

Answer

JWT

Answer

Kerberos ticket

Answer

OAuth access token

Question 20

A cloud architect is tasked with designing a disaster recovery plan for a critical application. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. The application runs on IaaS with data stored in a relational database. Which replication strategy is MOST cost-effective while meeting the objectives?

Accepted Answer

Asynchronous storage-level replication with 15-minute snapshots. Asynchronous storage-level replication with 15-minute snapshots meets the RPO of 15 minutes and the RTO of 1 hour, while being more cost-effective than synchronous replication. Asynchronous replication avoids the latency and bandwidth costs of synchronous mirroring across regions, and the 15-minute snapshot schedule ensures data loss is limited to the RPO window. This strategy is suitable for IaaS relational databases where near-real-time consistency is acceptable.

Answer

Daily full backups to another region

Answer

Synchronous database mirroring across regions

Answer

Multi-region active-active deployment with load balancing