CCSP Practice Exam 58 — 20 Questions

Question 1

A cloud security architect is designing a multi-tier application that processes sensitive customer data. To protect data in transit between the web tier and the application tier, which of the following is the MOST appropriate approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use mutual TLS (mTLS) between the tiers. Mutual TLS (mTLS) is the most appropriate approach because it provides bidirectional authentication and encryption between the web tier and application tier. In a multi-tier application processing sensitive customer data, mTLS ensures that both the client (web tier) and server (application tier) present valid certificates, preventing man-in-the-middle attacks and unauthorized inter-tier communication. This is critical for protecting data in transit in zero-trust or internal network segments where simple server-side TLS would not verify the identity of the calling service.

Answer

Use standard TLS with server-side certificates only

Answer

Establish SSH tunnels for all inter-tier communication

Answer

Implement IPsec VPN between the tiers

Question 2

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

Accepted Answer

The cloud service provider.. In a cloud shared responsibility model, the hypervisor is part of the underlying infrastructure that the cloud service provider (CSP) manages. The CSP is responsible for patching the hypervisor because it controls the virtualization layer that separates tenant workloads. Customers are responsible only for securing their guest operating systems and applications, not the hypervisor itself.

Answer

The customer.

Answer

The regulatory authority.

Answer

A third-party auditor.

Question 3

Which TWO of the following are primary responsibilities of a cloud service customer under the shared responsibility model regarding compliance with regulations such as GDPR?

Accepted Answer

Implementing data encryption for sensitive data at rest. The customer is responsible for data encryption and access controls (C and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

Answer

Conducting annual penetration tests on the provider's infrastructure

Answer

Ensuring the cloud provider's physical security controls are adequate

Answer

Verifying the provider's compliance certifications are current

Question 4

During a cloud audit, the auditor finds that the CSP's data deletion process does not meet contractual requirements. The customer's data may still be recoverable after termination. What is the best next step for the customer?

Accepted Answer

Initiate a remediation plan with defined timelines. When a cloud audit reveals that the CSP's data deletion process does not meet contractual requirements, the customer should initiate a remediation plan with defined timelines to address the issue. This ensures the CSP corrects the deficiency and data is properly deleted. Option B (immediately terminating the contract) may be too drastic and could disrupt operations without solving the immediate data recovery risk. Option C (reporting to regulatory authority) might be appropriate if no remediation occurs, but it is not the first step. Option D (ignoring) is unacceptable as it leaves data at risk.

Answer

Immediately terminate the contract with the CSP

Answer

Report the CSP to the regulatory authority

Answer

Ignore the finding because it is a minor issue

Question 5

A company is deploying a new application that processes sensitive personal data. The cloud provider operates in a specific region that adheres to the EU General Data Protection Regulation (GDPR). The company requires that data never leave the region. Which combination of cloud architecture controls should be implemented?

Accepted Answer

Use data sovereignty policies, restrict geographic deployment to the region, and disable cross-region replication.. Data sovereignty policies explicitly enforce that data remains within a specific jurisdiction, restricting geographic deployment to the region ensures all cloud resources are provisioned only in that region, and disabling cross-region replication prevents any automated or manual data transfer to other regions. This combination directly addresses the GDPR requirement that data never leave the designated region, as it controls both resource placement and data movement at the infrastructure level.

Answer

Use a virtual private cloud (VPC) with a route table that only allows egress to the internet through a NAT gateway.

Answer

Use encryption at rest and in transit with keys stored in a cloud HSM.

Answer

Use a cloud provider's CDN service to cache content within the region.

Question 6

Which legal concept allows customers to retain ownership of data stored in the cloud regardless of where it is physically stored?

Accepted Answer

Data sovereignty. Data sovereignty is the legal concept that data is subject to the laws and governance structures of the nation where it is collected or owned, regardless of physical storage location. This allows customers to retain ownership rights and control over their data even when stored in the cloud across different jurisdictions. Option A (Data localization) is incorrect because it mandates that data be physically stored within specific geographic boundaries, which actually restricts where data can be stored. Option B (Data portability) is incorrect because it refers to the ability to transfer data between service providers, not ownership retention. Option D (Data minimization) is incorrect because it is a privacy principle limiting data collection to what is necessary, unrelated to ownership or location.

Answer

Data localization

Answer

Data portability

Answer

Data minimization

Question 7

A company stores PII in the cloud and needs to ensure compliance with GDPR. What is the first step they should take?

Accepted Answer

Perform data classification and mapping. The first step is to perform data classification and mapping to identify what PII is held, where it resides, and how it flows. This foundational activity informs all subsequent GDPR compliance actions. Option A is incorrect because deleting data may be part of data minimization but not the first step. Option B is incorrect because encryption is a security control, not the initial step. Option C is incorrect because a Data Processing Agreement is signed after identifying and understanding data processing activities.

Answer

Delete all data older than the required retention period

Answer

Implement encryption for all stored data

Answer

Sign a Data Processing Agreement with the CSP

Question 8

An organization is developing a mobile app that communicates with a cloud API. To ensure secure authentication, which of the following should be used?

Accepted Answer

OAuth 2.0 with OpenID Connect. OAuth 2.0 with OpenID Connect (OIDC) is the correct choice because it provides a delegated authorization framework (OAuth 2.0) combined with an identity layer (OIDC) that enables secure authentication and single sign-on (SSO) for mobile apps communicating with cloud APIs. This combination issues short-lived access tokens and ID tokens (typically JWTs) rather than exposing long-lived credentials, and supports token refresh, scoped permissions, and PKCE (Proof Key for Code Exchange) to prevent authorization code interception on mobile devices.

Answer

Session cookies for state management

Answer

Basic authentication with username and password

Answer

API keys sent in HTTP headers

Question 9

A cloud security auditor is reviewing container runtime configurations. Which TWO practices help prevent a container from compromising the host operating system?

Accepted Answer

Using a read-only root filesystem. Running containers without the --privileged flag and with a read-only root filesystem reduces the risk of host compromise.

Answer

Disabling SELinux inside the container

Answer

Running containers in privileged mode

Answer

Mapping the host's Docker socket into the container

Question 10

A security engineer is reviewing logs and finds repeated failed login attempts to a cloud database instance. The database is accessible only from a specific security group. What is the BEST immediate action to reduce the attack surface?

Accepted Answer

Review the security group inbound rules and restrict the source IP to only the required application servers.. The immediate priority is to restrict network-level access to the database. Since the database is only accessible from a specific security group, reviewing and tightening the inbound rules to allow traffic only from the required application servers' IP addresses directly reduces the attack surface by eliminating unnecessary exposure. This is a fundamental network segmentation principle in cloud security, as it prevents any unauthorized host within the security group from attempting authentication.

Answer

Enable multi-factor authentication for the database user accounts.

Answer

Change the database port to a non-standard port.

Answer

Delete the database instance and restore from backup.

Question 11

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers a complete application managed entirely by the cloud provider, so the customer only needs to use the software without managing underlying infrastructure, platforms, or runtime. For a small business with limited IT expertise, this model minimizes operational overhead because the provider handles maintenance, patching, and availability.

Answer

IaaS

Answer

PaaS

Answer

FaaS

Question 12

A company needs to ensure that data stored in the cloud is securely deleted when no longer needed. Which TWO of the following are secure deletion methods? (Choose two.)

Accepted Answer

Cryptographic erasure (destroying encryption keys). Cryptographic erasure renders data unrecoverable by securely destroying the encryption keys used to encrypt the data at rest. Without the keys, the ciphertext becomes effectively indecipherable, even if the underlying storage blocks remain intact. This method is recognized by NIST SP 800-88 as a valid sanitization technique for cloud environments where physical access to storage is limited.

Answer

Deleting the file metadata

Answer

Wiping the swap space

Answer

Degaussing the storage medium

Question 13

A security auditor is reviewing a cloud application's API endpoints. Which THREE OWASP API Security risks are particularly relevant to cloud applications due to their reliance on APIs for resource access?

Accepted Answer

Broken Object Level Authorization (BOLA/IDOR). Broken Object Level Authorization (BOLA/IDOR) is a top OWASP API Security risk because cloud APIs expose object identifiers (e.g., user IDs, document keys) in URLs or request bodies. If the API fails to verify that the authenticated user owns or is permitted to access the requested resource, an attacker can manipulate these identifiers to access or modify another tenant's data, directly violating cloud multi-tenancy isolation. Broken Authentication is also a critical risk, as weak authentication mechanisms can allow attackers to compromise user accounts or obtain tokens, leading to unauthorized access. Excessive Data Exposure occurs when APIs return more data than necessary, which is particularly dangerous in cloud environments where APIs often include sensitive fields that are not filtered based on user roles. Lack of Rate Limiting and Mass Assignment are not part of the OWASP API Security Top 10 list; Lack of Rate Limiting is a security control concern, and Mass Assignment is a vulnerability from insufficient input validation, but both are not categorized as standalone risks in that specific list (2019 or 2023). Therefore, the correct selection is A, D, E.

Answer

Lack of Rate Limiting

Answer

Mass Assignment

Question 14

A company uses Terraform to manage cloud infrastructure. Which infrastructure-as-code (IaC) security scanner can detect misconfigurations such as overly permissive security group rules before deployment?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically designed to scan Infrastructure as Code (IaC) templates, including Terraform, for security misconfigurations such as overly permissive security group rules (e.g., 0.0.0.0/0 ingress on port 22). It uses a policy-as-code framework with hundreds of built-in checks (e.g., CKV_AWS_24 for unrestricted SSH) and can be integrated into CI/CD pipelines to catch issues before deployment, making it the correct choice for pre-deployment IaC scanning.

Answer

Snyk

Answer

Dependabot

Answer

GitGuardian

Question 15

Which THREE of the following are key components of a secure cloud SDLC that support shift-left security? (Select THREE)

Accepted Answer

Infrastructure as Code (IaC) security scanning. Infrastructure as Code (IaC) security scanning is a key component of shift-left security because it allows teams to detect misconfigurations and compliance violations in cloud templates (e.g., Terraform, CloudFormation) before any resources are provisioned. By integrating scanners like Checkov or tfsec into the development pipeline, security issues are identified and remediated during coding, not after deployment, which reduces risk and cost.

Answer

Post-deployment penetration testing

Answer

Annual security awareness training

Question 16

A cloud operations team is setting up a new virtual network in the cloud. They need to segment traffic between different tiers of an application (web, application, database). Which security control should they implement?

Accepted Answer

Network access control lists and security groups. Network access control lists (NACLs) and security groups are the correct controls for segmenting traffic between application tiers. NACLs act as stateless firewalls at the subnet level, while security groups provide stateful filtering at the instance level. Together they allow or deny traffic based on rules, effectively isolating web, application, and database tiers. Intrusion detection systems (IDS) monitor for malicious activity but do not control traffic flow. Data loss prevention (DLP) focuses on preventing data exfiltration. Web application firewalls (WAF) protect against web-specific attacks at layer 7 and are not designed for general network segmentation.

Answer

Intrusion detection system

Answer

Data loss prevention

Answer

Web application firewall

Question 17

Refer to the exhibit. An AWS CloudTrail log entry is shown. Which of the following can be determined from this log entry?

Accepted Answer

The instance launch was performed by user john.doe via the console. The CloudTrail log entry shows an event with eventName 'RunInstances', indicating an EC2 instance launch. The userIdentity section identifies the IAM user as 'john.doe', and the sourceIPAddress and userAgent (likely AWS Management Console) indicate the action was performed via the console. Therefore, option A is correct. Option B is incorrect because there is no evidence of a termination event. Option C is incorrect because the region shown in the log is 'us-east-1', not 'eu-west-2'. Option D is incorrect because the event is 'RunInstances', not an S3 bucket policy modification.

Answer

The instance was terminated immediately after launch

Answer

The instance was launched in eu-west-2

Answer

An S3 bucket policy was modified

Question 18

A cloud security engineer is responsible for a SaaS application hosted on a public cloud provider. The application uses a relational database to store customer data. The security team recently conducted a vulnerability assessment and discovered that the database can be accessed over the internet without any network restrictions. Additionally, the database admin user has the same password as the root account, and the password has not been changed in 18 months. The company is subject to GDPR and PCI DSS compliance requirements. The engineer needs to remediate these issues immediately. Which of the following actions should be taken FIRST?

Accepted Answer

Configure the database security group to allow traffic only from the application server's IP address range.. Restricting network access to authorized sources only is the most immediate way to reduce the attack surface and prevent unauthorized access over the internet. Option A is wrong because changing the password is important but should follow the network restriction to ensure the database is not exposed during the change. Option B is wrong because upgrading the database might not be immediately available and does not address the access issue. Option D is wrong because enabling encryption does not prevent an attacker from connecting directly to the database.

Answer

Change the database admin password to a complex new password immediately.

Answer

Upgrade the database to the latest version with all security patches applied.

Answer

Enable encryption at rest for the database to protect the data if it is stolen.

Question 19

A multinational corporation uses a hybrid cloud model with on-premises data centers and the AWS cloud. They have implemented a Cloud Access Security Broker (CASB) to enforce security policies. Recently, the security team noticed that users are accessing cloud applications from unusual geographic locations and downloading large volumes of data. The CASB logs show that the users authenticated using single sign-on (SSO) with valid credentials. The company has not enabled multi-factor authentication (MFA) for all users due to a previous pushback from the user community. The security team suspects a credential theft incident. What is the BEST course of action to mitigate the risk and respond to the potential incident?

Accepted Answer

Revoke the suspicious sessions and require all users to re-authenticate with MFA before granting access to cloud applications.. Immediately revoking the suspicious sessions stops the potential attack, and requiring MFA re-authentication adds an essential layer of security to prevent further unauthorized access. Option B is insufficient because password changes alone do not address the lack of MFA, leaving accounts vulnerable to future credential theft. Option C is too disruptive and assumes all users are compromised, which is not indicated by the evidence. Option D would severely disrupt business operations and does not enforce stronger authentication; it only bypasses SSO without addressing the root cause.

Answer

Ask the affected users to change their passwords and monitor their accounts for further suspicious activity.

Answer

Lock all user accounts and require the IT team to manually verify each user's identity before unlocking.

Answer

Disable SSO immediately and require users to authenticate directly with the cloud applications.

Question 20

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Accepted Answer

Certificate of destruction. (Certificate of destruction) is the correct answer because it provides verifiable evidence that data has been securely deleted, which directly addresses the company's requirement. Option A (Service level credits) is for compensation when service levels are not met, not for deletion verification. Option C (Annual penetration testing) is a security testing measure, not related to data deletion. Option D (Right to audit) allows the company to audit the provider, but does not guarantee verifiable deletion evidence.

Answer

Service level credits

Answer

Annual penetration testing

Answer

Right to audit