CCSP Practice Exam 58 — 20 Questions

Question 1

A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use of signed certificates from a trusted CA. Option A is correct because signed certificates from a trusted Certificate Authority authenticate the server's identity and enable the client to establish a trusted TLS session, preventing man-in-the-middle attacks on PII in transit. Option D is correct because TLS 1.2 or higher provides strong, modern cryptographic protection (e.g., AES-GCM, ECDHE key exchange) for data transmitted over untrusted networks like the internet. Together, these controls directly secure data in transit by ensuring both endpoint authenticity and encryption. Option B (penetration testing) is a validation activity, not a protective in-transit control. Option C (IPsec VPNs) can encrypt traffic but is not essential for a cloud application exposed to arbitrary internet clients, where TLS is the appropriate mechanism. Option E (AES-256 at rest) protects stored data, not data in transit.

Answer

Regular penetration testing

Answer

Implementation of IPsec VPNs

Answer

Encryption at rest using AES-256

Question 2

A cloud security team is implementing data loss prevention for a data lake that stores customer support logs. They need to redact credit card numbers from the logs before they are used for analytics. Which DLP de-identification technique should be applied?

Accepted Answer

Masking. Masking is the correct DLP de-identification technique because it replaces sensitive values like credit card numbers with obfuscated characters (e.g., ****-****-****-1234) while preserving the format and length of the original data. This allows the support logs to remain usable for analytics and pattern matching without exposing the actual PAN data. Masking is irreversible or partially reversible depending on configuration, making it ideal for redaction before analytics processing.

Answer

Date shifting

Answer

Bucketing

Answer

Tokenization

Question 3

Which cloud characteristic allows a consumer to automatically provision computing resources, such as server time and storage, as needed without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST-defined characteristic where a consumer can unilaterally provision computing capabilities, such as server time and storage, automatically without human interaction with the provider. This matches the question's wording exactly.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 4

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Accepted Answer

S3 server access logs. S3 server access logs (option A) are correct because they record detailed, bucket-level access requests to S3, including the requester, bucket name, request time, request action, response status, and error code, providing granular visibility into object-level data access. AWS CloudTrail data events for S3 (option B) are also correct because they capture object-level API activity such as GetObject, PutObject, and DeleteObject, which are not recorded by CloudTrail management events, thereby delivering comprehensive monitoring of S3 data access. AWS Config (option C) is not correct because it evaluates and records resource configuration changes and compliance, not individual S3 data access requests. VPC Flow Logs (option D) is not correct because it captures IP traffic metadata for network interfaces in a VPC, not S3 object-level API operations. Amazon GuardDuty (option E) is not correct because it is a threat detection service that analyzes logs and findings, but it does not itself enable the detailed S3 data event logging required here.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 5

A cloud-native application team is adopting a secrets management service to eliminate hardcoded credentials in source code and configuration files. Which two practices best align with secure secrets management in the cloud? (Choose two.)

Accepted Answer

Enable automatic rotation of secrets on a defined schedule and update dependent applications through the secrets manager.. Secure secrets management favours dynamic, identity-based retrieval and routine rotation over static storage. Workload identity removes static credentials, and automatic rotation limits exposure windows; environment variables, encrypted secrets in repositories, and embedded secrets all retain long-lived or broadly accessible copies.

Answer

Commit encrypted secrets to the source repository so they are version-controlled alongside application code.

Answer

Store secrets in environment variables injected at container start to keep them out of the image.

Answer

Embed secrets in the container image and rely on image scanning to detect accidental exposure.

Question 6

A company is migrating its on-premises database to a cloud-based database-as-a-service (DBaaS) offering. The security team wants to ensure that the data remains encrypted at rest and that they retain control over the encryption keys. Which cloud data security concept should they implement?

Accepted Answer

Bring Your Own Key (BYOK) integrated with the cloud provider's key management service.. BYOK enables the company to generate and control its own encryption keys while leveraging the cloud provider's KMS for key storage and operations. This meets the need for encryption at rest with customer-controlled keys, unlike provider-managed TDE or transit encryption.

Answer

SSL/TLS encryption for data in transit between the application and the database.

Answer

Database auditing and logging to monitor access to sensitive data.

Answer

Transparent Data Encryption (TDE) with keys managed by the cloud provider.

Question 7

A cloud security administrator is configuring access to a cloud object storage bucket that contains regulated data. The requirement is that only identities with an explicit business need can read objects, and that access decisions are evaluated centrally with fine-grained conditions such as department and time of day. Which capability BEST addresses this requirement?

Accepted Answer

A centralized policy engine that evaluates identity attributes and contextual conditions before granting object reads.. A centralized policy engine evaluates identity attributes and contextual conditions, enabling fine-grained, least-privilege authorization for bucket reads. It provides consistent enforcement and auditing across the environment, which ACLs, pre-signed URLs, and network ACLs cannot deliver. Only the policy engine meets the requirement for condition-based, business-need-driven access decisions.

Answer

Bucket access control lists that grant read permission to specific user accounts.

Answer

Network ACLs that restrict access to the bucket from approved corporate IP ranges.

Answer

Pre-signed URLs generated by an administrator and distributed to approved users.

Question 8

A cloud security team is implementing a data classification scheme for objects stored in a cloud environment. They need to ensure that classification labels persist with the data, travel with it when copied or moved between services, and can be used to enforce access and DLP policies automatically. Which approach BEST achieves these outcomes?

Accepted Answer

Embed classification metadata as tags or object metadata that are preserved through supported copy and move operations and referenced by policy engines.. Embedding classification as tags or object metadata keeps labels attached to the data and allows them to be carried through supported copy and move operations. Policy engines and DLP services can then enforce access and handling rules automatically based on those labels. Spreadsheets, bucket-level classification, and naming conventions lack persistence, portability, and reliable automated enforcement.

Answer

Store classification labels in a separate spreadsheet maintained by the data governance team and update it after each data movement.

Answer

Use file naming conventions that include the classification level in the object name and enforce policies based on name patterns.

Answer

Apply classification only at the storage bucket level and rely on bucket policies to enforce access.

Question 9

A company is migrating a legacy web application to the cloud. The application uses a relational database. The security team wants to ensure that database credentials are never hardcoded in the application and are automatically rotated. Which cloud-native approach should be used?

Accepted Answer

Use a managed secrets management service that integrates with the database to rotate credentials.. A managed secrets management service provides secure storage and automatic rotation of database credentials. The application retrieves credentials dynamically, so they are never hardcoded. This is the cloud-native best practice for secret management and meets both requirements.

Answer

Store credentials in environment variables on the application server.

Answer

Encrypt the database connection string in a configuration file.

Answer

Use a database user with a long, complex password that is changed manually every 90 days.

Question 10

A retail company is designing a new cloud architecture for its e-commerce platform. The security team has been asked to define the cloud security architecture. According to the Cloud Security Alliance (CSA) Enterprise Architecture, which of the following is the PRIMARY purpose of the security architecture domain?

Accepted Answer

To provide a framework for managing security risks and controls across the cloud ecosystem. The security architecture domain in the CSA Enterprise Architecture is designed to provide a holistic framework for managing security risks across cloud environments. It integrates security controls and practices into the overall cloud architecture, ensuring that security is aligned with business goals and compliance obligations.

Answer

To ensure that the cloud provider meets all regulatory compliance requirements

Answer

To define the physical security controls for data centers hosting cloud services

Answer

To specify the encryption algorithms required for data at rest and in transit

Question 11

A cloud customer's provider announces that a sub-processor in a new jurisdiction will begin handling EU personal data next month. The customer's DPA gives it a right to object but states that continued use of the service constitutes acceptance. Which action best preserves the customer's legal position under GDPR Article 28(2)?

Accepted Answer

Exercise the objection right in writing before the change takes effect and document the outcome, escalating to termination if the provider cannot accommodate it.. Article 28(2) gives the controller the right to object to new sub-processors, and Article 28(4) holds the processor liable for sub-processor performance. Exercising the objection in writing before the change takes effect preserves the remedy and creates an auditable record. Remaining silent while continuing to use the service typically constitutes acceptance and extinguishes the objection right.

Answer

Accept the change and rely on the provider's downstream SCCs with the new sub-processor as sufficient protection for the customer.

Answer

Perform a new data protection impact assessment covering the sub-processor and treat a favorable outcome as consent to the change.

Answer

Notify the supervisory authority of the sub-processor change and request a formal opinion before responding to the provider.

Question 12

A security engineer is reviewing a cloud application that uses OAuth 2.0 to delegate access to a third-party API. The application is a single-page application (SPA) running in the browser. The engineer wants to prevent authorization code interception and ensure that the client cannot impersonate another client. Which OAuth 2.0 enhancement should be implemented?

Accepted Answer

Proof Key for Code Exchange (PKCE). PKCE is specifically designed to secure the authorization code flow for public clients like SPAs that cannot hold a client secret. It prevents code interception by binding the code to a dynamically generated verifier. The implicit flow, client credentials, and resource owner password credentials either expose tokens or require secrets that SPAs cannot protect, and none address code interception.

Answer

OpenID Connect (OIDC) with the implicit flow

Answer

Client credentials grant with a client secret

Answer

Resource owner password credentials grant

Question 13

A healthcare company stores medical images in a cloud object storage bucket. The images are accessed by radiologists via a web application. The security team wants to ensure that data is encrypted in transit and that the encryption keys are not accessible to the cloud provider. Which solution should they implement?

Accepted Answer

Implement client-side encryption with keys stored in an on-premises HSM and enforce HTTPS for all access.. Client-side encryption with keys held in an on-premises HSM ensures the cloud provider never possesses the key material, so the provider cannot access the plaintext. Enforcing HTTPS encrypts data in transit, meeting both the transit encryption and key control requirements. This combination provides the necessary security for sensitive medical images.

Answer

Enable server-side encryption with customer-provided keys (SSE-C) and enforce HTTPS for all access.

Answer

Configure the bucket to use HTTPS with TLS 1.2 and enable server-side encryption with provider-managed keys.

Answer

Use client-side encryption with keys stored in the cloud provider's KMS and enforce HTTPS for all access.

Question 14

A cloud architect is designing a federated identity solution so that employees of a partner company can access a shared SaaS application without creating separate local accounts. The architect must select mechanisms that enable secure cross-domain authentication and attribute exchange. (Choose two.)

Accepted Answer

OpenID Connect (OIDC). Federated identity requires protocols that carry authentication assertions and user attributes across security domains. SAML 2.0 and OpenID Connect both do this, allowing partner employees to authenticate with their home identity provider and access the shared SaaS application without local accounts. IPsec, DLP endpoint agents, and DHCP snooping operate at network or data layers and cannot federate identities.

Answer

Data Loss Prevention (DLP) endpoint agent

Answer

Internet Protocol Security (IPsec) transport mode

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Question 15

A cloud customer's legal team must decide which party bears responsibility for generating audit evidence that demonstrates regulatory compliance. The customer uses IaaS from a provider. According to the CSA Cloud Controls Matrix and shared responsibility principles, how should audit evidence obligations be divided?

Accepted Answer

The customer must obtain evidence for controls it operates, while the provider supplies evidence for controls it operates, with each party relying on the other's attestations where appropriate.. In a shared responsibility model, audit evidence must map to who operates each control. For IaaS, the provider evidences the physical, network, and hypervisor layers, while the customer evidences the guest OS, applications, and data. Contractual audit rights and provider attestations like SOC 2 reports bridge the gap, allowing each party to rely on the other's evidence for controls outside its own scope.

Answer

The cloud provider is solely responsible for producing all audit evidence because it operates the physical infrastructure and hypervisor.

Answer

A third-party auditor engaged by the customer must independently verify every control across both the provider and customer environments, regardless of who operates them.

Answer

The provider is responsible only for evidence related to its own internal corporate compliance, not for any controls that support customer workloads.

Question 16

A cloud security engineer is responsible for securing a serverless application built on AWS Lambda. The application processes sensitive customer data and writes results to an Amazon S3 bucket. The engineer must ensure that the Lambda function has only the permissions it needs to write to that specific bucket, and that the credentials are not hardcoded. Which approach should the engineer take?

Accepted Answer

Create an IAM role with a policy granting s3:PutObject to the specific bucket and attach it to the Lambda function.. The best practice for granting permissions to AWS Lambda is to use an IAM role with a narrowly scoped policy. The role provides temporary credentials that are automatically rotated, and the policy grants only the required s3:PutObject permission to the specific bucket. This adheres to least privilege and eliminates the need for hardcoded or stored long-term credentials. Other options involve long-term credentials or insecure storage, which are not recommended.

Answer

Use an IAM user with an inline policy for S3 access and configure the Lambda function to use those credentials via the AWS SDK.

Answer

Embed the access keys in the Lambda function's environment variables.

Answer

Store IAM user access keys in AWS Secrets Manager and retrieve them in the Lambda function code.

Question 17

A cloud security architect is designing a multi-tenant SaaS platform hosted on AWS. The platform must ensure that each tenant's data is cryptographically isolated so that even a compromised application instance in one tenant's environment cannot decrypt another tenant's data. The architect wants to use AWS Key Management Service (KMS) to manage encryption keys. Which approach BEST meets this requirement?

Accepted Answer

Create a separate AWS KMS customer managed key per tenant, with a key policy that grants decrypt permission only to that tenant's application role, and store the tenant's data encrypted under its own key.. Cryptographic isolation in a multi-tenant cloud environment requires that each tenant's data be protected by a distinct key whose usage is governed by least-privilege policies. Per-tenant AWS KMS customer managed keys with narrowly scoped key policies ensure that a compromised application instance can only decrypt its own tenant's data. Shared keys, even with rotation or application-level checks, do not prevent cross-tenant decryption if credentials are compromised.

Answer

Use AWS KMS with a single customer managed key, but enable automatic key rotation every 90 days and require all tenants to use the same key alias for encryption and decryption.

Answer

Use a single AWS KMS customer managed key with a key policy that grants decrypt permissions to all tenant application roles, and rely on application-level tenant ID checks before decryption.

Answer

Store all tenant data in a single Amazon S3 bucket encrypted with SSE-S3, and use S3 bucket policies to restrict each tenant's application role to its own prefix.

Question 18

A cloud operations team runs a production Kubernetes cluster on Amazon EKS. During a security review, they discover that the cluster's control plane audit logs are not being captured, preventing investigation of suspicious API server activity. The team must enable audit logging with the least operational overhead while retaining logs for 90 days. Which action should they take?

Accepted Answer

Modify the EKS cluster configuration to enable control plane logging for the 'audit' log type, and configure a CloudWatch Logs retention policy of 90 days on the resulting log group.. The native way to capture Kubernetes API server audit events on EKS is to enable the 'audit' control plane log type on the cluster, which streams events to CloudWatch Logs. Setting a retention policy of 90 days satisfies the retention requirement without deploying agents or managing additional infrastructure. Node-based collection and CloudTrail do not capture control plane audit data.

Answer

Install the Amazon CloudWatch agent on each worker node and configure it to tail the kubelet and container runtime logs, then set a 90-day retention policy on the log group.

Answer

Enable AWS CloudTrail data events for the EKS cluster and set a 90-day retention period in the S3 bucket that receives the trails.

Answer

Deploy a DaemonSet that runs a Fluent Bit container on every node to collect /var/log/kube-apiserver/audit.log and forward it to CloudWatch Logs.

Question 19

A cloud security manager is designing an exit strategy for a critical SaaS application. The provider's contract permits data export only through a proprietary API that returns records in a non-standard binary format. The manager must reduce the risk of being unable to move data to another provider. Which action BEST addresses this risk?

Accepted Answer

Negotiate a contractual right to receive data in a documented, non-proprietary format at any time. The core risk is that data can only be extracted in a proprietary binary format, which prevents migration to another provider. The strongest mitigation is a contractual right to receive the data in a documented, non-proprietary format on demand. Authentication hardening, backups through the same API, and API documentation do not remove the format dependency, so they cannot resolve the portability problem.

Answer

Enable multi-factor authentication for all administrative accounts on the SaaS platform

Answer

Require the provider to publish its API documentation to the customer's security team

Answer

Replicate the SaaS data nightly to an on-premises backup appliance using the same API

Question 20

A startup is using a cloud-based SaaS CRM to store customer contact information. The security policy requires that data be encrypted both in transit and at rest. The SaaS provider states that it encrypts data in transit using TLS and at rest using AES-256. What should the startup do to verify these claims?

Accepted Answer

Request the provider's SOC 2 Type II report and review the encryption controls.. Independent audit reports such as SOC 2 Type II are designed to provide assurance about a service provider's controls, including encryption. They cover both in-transit and at-rest encryption and are based on evidence gathered by auditors. This is the standard method for verifying a SaaS provider's security claims without requiring direct access to their systems.

Answer

Use a network sniffer to capture traffic between the startup and the SaaS provider.

Answer

Perform a penetration test against the SaaS provider's application.

Answer

Ask the provider to send the encryption keys so the startup can decrypt data.