CCSP Practice Exam 59 — 20 Questions

Question 1

A company is building a cloud-native API that uses OAuth 2.0 for delegated authorization. The security team wants to harden the authorization code flow against token interception and misuse. Which two measures should be implemented to protect the authorization code and tokens? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable PKCE so the client sends a code challenge and later proves possession of the corresponding verifier when exchanging the code.. Hardening the authorization code flow focuses on preventing intercepted codes from being redeemed by an attacker. Binding the code to the client and redirect URI, combined with a short lifetime, limits replay. PKCE adds proof of possession so a stolen code is useless without the verifier. Together they address interception and misuse without exposing tokens to the browser or weakening transport protections.

Answer

Store refresh tokens in browser local storage to allow the client to silently renew access tokens without user interaction.

Answer

Configure the resource server to accept access tokens in query string parameters so that clients can easily include them in requests.

Answer

Use the implicit grant so that tokens are returned directly from the authorization endpoint without an intermediate code.

Question 2

A cloud-native SaaS provider uses OpenID Connect (OIDC) for user authentication. The security architect wants to reduce the impact of stolen authorization codes and ensure that tokens issued to a single-page application cannot be replayed by a different client. Which OIDC mechanism should be implemented?

Accepted Answer

Use PKCE with the S256 code challenge method and validate the redirect URI against a registered value.. PKCE with S256 ties the authorization code to the initiating client via the code verifier, so a stolen code cannot be redeemed by an attacker who does not possess the verifier. Strict redirect URI validation further constrains where codes and tokens can be delivered. Together they directly mitigate code interception and cross-client replay for public clients like SPAs.

Answer

Configure the authorization server to use the implicit flow so that no authorization code is ever issued.

Answer

Require the authorization server to issue sender-constrained access tokens using Demonstrating Proof of Possession (DPoP).

Answer

Enable refresh token rotation and bind refresh tokens to the client's IP address.

Question 3

A cloud customer stores data in a SaaS application that replicates across multiple jurisdictions. The customer's legal team must respond to a subpoena for data stored in a specific region. Which concept determines the legal authority over the data?

Accepted Answer

Data sovereignty. Data sovereignty is the legal principle that data is governed by the laws of the country where it resides. When data is replicated across regions, each copy may fall under different sovereign laws. A subpoena from one jurisdiction may not be enforceable in another, and the cloud provider may be caught between conflicting legal demands. Understanding sovereignty helps legal teams navigate cross-border data requests and design compliance strategies.

Answer

Data residency

Answer

Data localization

Answer

Data portability

Question 4

A cloud security manager is implementing data discovery and classification for a multi-cloud environment. The organization needs to automatically identify and tag sensitive data such as personally identifiable information (PII) and protected health information (PHI) across cloud storage services. Which two capabilities are essential for an effective data classification solution? (Choose two.)

Accepted Answer

Pattern matching and regular expressions to detect structured data formats like credit card numbers and social security numbers.. An effective data classification solution requires automated detection using pattern matching for structured data and API-based scanning to cover multi-cloud storage without agents. These capabilities enable scalable, consistent identification and tagging of sensitive data, which is the foundation for applying appropriate protections.

Answer

Full-disk encryption of all cloud storage volumes to prevent unauthorized access to data at rest.

Answer

A data loss prevention (DLP) policy that blocks all outbound traffic from cloud workloads to external networks.

Answer

Manual sampling of files by security analysts to determine data sensitivity based on business context.

Question 5

A cloud customer is developing a data retention and deletion policy for data stored with a cloud provider. The customer must ensure compliance with legal and regulatory requirements. Which TWO factors are most important to address in the contract with the provider? (Choose two.)

Accepted Answer

Require the provider to delete data from all backups and replicas within a specified timeframe. The two most important factors are specifying retention and deletion timelines and ensuring deletion covers all backups and replicas. These directly address legal requirements for data minimization and secure disposal. The other options introduce financial incentives, provider data use, or legal hold notifications, which do not ensure compliant deletion and could create additional risks.

Answer

Require the provider to notify the customer before deleting data due to a legal hold

Answer

Allow the provider to retain data for its own analytics purposes

Answer

Ensure the provider gives the customer a discount for early deletion

Question 6

A cloud security architect is evaluating a public cloud provider for a new workload that will process regulated data. The architect must document which security responsibilities remain with the cloud customer under the shared responsibility model. Which TWO of the following are customer responsibilities in a public cloud IaaS deployment? (Choose two.)

Accepted Answer

Managing guest operating system patches and updates. In public cloud IaaS, the provider secures facilities, hardware, and the virtualization platform, while the customer secures the guest operating system and its own identity and access management configurations. Guest OS patching and IAM policy management are therefore customer responsibilities, whereas physical facilities, hypervisor maintenance, and physical network redundancy remain with the provider.

Answer

Maintaining the provider's hypervisor and virtualization platform

Answer

Ensuring the physical network backbone between data centers is redundant

Answer

Securing the physical facilities that house the servers

Question 7

A cloud customer is evaluating a provider's compliance with the Payment Card Industry Data Security Standard (PCI DSS). The customer plans to store cardholder data in the provider's IaaS environment. Which responsibility does the customer retain under PCI DSS?

Accepted Answer

The customer is responsible for configuring and managing the guest operating system, applications, and cardholder data environment, including access controls and encryption.. Under PCI DSS in IaaS, the customer is responsible for the guest operating system, applications, and cardholder data environment, including access controls and encryption. The provider secures the physical and hypervisor layers. Each party must validate its own controls, and the customer cannot rely solely on the provider's attestation for its own compliance obligations.

Answer

The customer is responsible only for physical security of the data center because the provider handles all logical controls.

Answer

The customer is responsible for nothing because the provider's PCI DSS attestation covers all systems storing cardholder data.

Answer

The customer is responsible for all PCI DSS requirements because PCI DSS does not recognize shared responsibility models.

Question 8

A U.S. financial services firm uses a cloud provider with data centers in the EU. The firm must comply with both SEC regulations requiring books and records preservation and the GDPR. A data subject requests erasure of personal data that is also subject to a legal hold. What should the firm do?

Accepted Answer

Assess the scope of the legal hold, retain only the data subject to the hold under restricted processing, and erase or anonymize other personal data as required by the GDPR request.. When GDPR erasure requests conflict with legal holds, the firm must apply GDPR Article 17(3)(b), which permits retention when necessary to comply with a legal obligation. The correct approach is to scope the hold, retain only the data subject to it under restricted processing, and erase or anonymize the rest. This satisfies both the legal hold and the data subject's rights to the extent possible.

Answer

Immediately erase all personal data to comply with the GDPR erasure request, because data subject rights override legal retention obligations.

Answer

Transfer all personal data to a third country outside the EU to avoid GDPR jurisdiction, then erase it there.

Answer

Deny the erasure request entirely and retain all data indefinitely, because legal holds always supersede data subject rights.

Question 9

A cloud security manager is implementing a data retention policy for a SaaS CRM that stores customer contact records. Regulations require that records be irreversibly destroyed after seven years, but the SaaS provider's recycle bin retains deleted records for 30 days and backups persist for 90 days. Which cloud data disposal approach best satisfies the regulatory requirement?

Accepted Answer

Use crypto-shredding by deleting the per-tenant data encryption key and allowing key material to be destroyed after the retention period.. Crypto-shredding is the most reliable cloud disposal method when data may persist in backups, replicas, or provider recycle bins. By destroying the per-tenant encryption key after the seven-year retention period, the records become cryptographically unrecoverable regardless of residual copies. Logical deletion, provider attestations, and field overwrites do not guarantee irreversible destruction in a shared-responsibility SaaS environment.

Answer

Overwrite the CRM database fields containing contact records with null values using the provider's bulk update API.

Answer

Configure the SaaS recycle bin to empty automatically every 30 days and rely on the provider's backup expiration after 90 days.

Answer

Issue a formal written request to the SaaS provider asking them to delete all customer records and confirm completion in a service report.

Question 10

A cloud application team is designing a multi-tenant SaaS platform on a public cloud. Tenant data is stored in a shared database, and the application uses a single service account to connect. During a threat modeling session, the security architect raises concerns that a coding error could allow one tenant to read another tenant's records. Which control should be implemented to provide defense in depth against this cross-tenant data access risk?

Accepted Answer

Enforce row-level security policies in the database that filter queries based on a tenant identifier derived from the authenticated session context.. Row-level security enforces tenant boundaries inside the database engine, independent of application query construction. By deriving the tenant identifier from the authenticated session, the policy cannot be bypassed by a forgotten WHERE clause or a manipulated parameter. This creates a reliable second layer of defense that complements application-level checks and encryption, directly mitigating the cross-tenant read risk identified during threat modeling.

Answer

Create a separate database schema for each tenant and grant the application service account access only to the schema corresponding to the current request.

Answer

Encrypt each tenant's data with a separate customer-managed key and store the key identifier in the application configuration.

Answer

Implement a Web Application Firewall rule that inspects request parameters for tenant identifiers and blocks requests where the identifier does not match the authenticated user.

Question 11

A logistics firm runs a customer portal on a public cloud provider. The board wants assurance that a provider outage will not halt order intake. The architect proposes an active-passive deployment in a second region of the same provider. Which design element is MOST critical to validate the recovery time objective?

Accepted Answer

Regularly scheduled failover tests that measure actual recovery time and data loss. Recovery objectives are validated by measurement, not by documentation or provider guarantees. Scheduled failover exercises reveal the real elapsed time to restore service and the true data loss window, accounting for DNS time-to-live, database promotion, and application reconnection. Replication and agreements enable recovery, but only testing produces the evidence that the stated recovery time objective is achievable.

Answer

A documented failover runbook that has never been executed

Answer

A service level agreement from the provider guaranteeing 99.99 percent regional availability

Answer

Cross-region replication of the database with asynchronous commit enabled

Question 12

A cloud security team must harden the management plane for a Kubernetes cluster running on Google Kubernetes Engine. They want to limit who can reach the control plane endpoint and ensure that any administrative action taken against the cluster is attributable to a named identity. (Choose two.)

Accepted Answer

Enable Cloud Audit Logs for the GKE cluster's Admin Activity and Data Access logs. Restricting control plane reachability is accomplished with authorized networks, which constrain the source CIDRs permitted to contact the API server. Attribution of administrative actions requires Cloud Audit Logs, specifically Admin Activity and Data Access logs, which record the identity and method for each call. Together they harden the management plane and provide accountability.

Answer

Enable network policy enforcement on the cluster's node pools

Answer

Use Binary Authorization to require attestations before workloads deploy

Answer

Apply PodSecurity admission with the restricted profile to all namespaces

Question 13

A cloud security team is evaluating controls for protecting data in a PaaS database service. The database must support tenant isolation, and the team wants to prevent one tenant's queries from accessing another tenant's rows. Which TWO controls BEST achieve row-level tenant isolation? (Choose two.)

Accepted Answer

Use separate database schemas per tenant with distinct database roles and grant only schema-scoped privileges.. Row-level security policies and schema-per-tenant with role-scoped grants both enforce isolation inside the database engine, so cross-tenant access is blocked regardless of application behavior. TDE, application-side filtering, and auditing do not prevent a query from reaching another tenant's rows, making them insufficient as primary isolation controls.

Answer

Enable database auditing and alert on queries that return more than a threshold number of rows.

Answer

Enable transparent data encryption on the database so that rows are encrypted at rest with a service-managed key.

Answer

Configure the application to append a tenant_id filter to every generated SQL statement.

Question 14

A healthcare organization stores PHI in an Amazon S3 bucket. An auditor finds that objects are encrypted with SSE-S3, and the organization wants to demonstrate that it controls the encryption keys and can audit their use independently of AWS-managed keys. Which change best satisfies this requirement while minimizing application changes?

Accepted Answer

Switch the bucket to SSE-KMS using a customer managed key in AWS KMS, and grant the application role kms:Decrypt and kms:GenerateDataKey permissions.. SSE-KMS with a customer managed key allows the organization to define the key policy, control rotation, and audit every cryptographic operation through CloudTrail. Applications continue to use the standard S3 API with only additional IAM permissions on the KMS key, so code changes are minimal. This is the cleanest way to demonstrate independent key control and usage auditing.

Answer

Configure SSE-C with a customer-provided key sent on every request via the x-amz-server-side-encryption-customer-key header.

Answer

Keep SSE-S3 but enable S3 Object Lock in compliance mode and versioning to prevent unauthorized key access.

Answer

Enable client-side encryption in the application using a locally stored AES-256 key and upload the encrypted objects to S3.

Question 15

A cloud data governance team is defining controls for data remanence in a multi-tenant public cloud environment. They must address both logical and physical media reuse concerns. Which TWO practices are MOST appropriate for managing data remanence risk? (Choose two.)

Accepted Answer

Implement cryptographic erasure by destroying tenant-controlled keys when data must be made unrecoverable.. Managing data remanence in a public cloud requires addressing both layers: physical media sanitization, which tenants cannot perform and must verify through provider audit evidence, and logical destruction, which tenants achieve through cryptographic erasure using keys they control. Tenant-side overwriting is infeasible, isolation is not a sanitization control, and provider-managed key rotation does not destroy data.

Answer

Encrypt data with provider-managed keys and assume key rotation eliminates residual data.

Answer

Overwrite storage blocks with random data using a tenant-installed utility on the provider's physical hosts.

Answer

Rely on the provider's multi-tenancy to isolate data so remanence is not a concern.

Question 16

A company is migrating its on-premises database to a cloud-based managed database service. The security policy requires that data at rest be encrypted and that the company retain control over key rotation. Which cloud service should they use to meet these requirements?

Accepted Answer

Cloud HSM or Key Management Service (KMS) with customer-managed keys.. A cloud HSM or KMS with customer-managed keys gives the company control over key lifecycle, including rotation, while still encrypting data at rest. Provider-managed keys, client-side encryption with local key storage, and TDE with in-database keys either cede rotation control or introduce operational risks that fail the policy requirement.

Answer

Transparent Data Encryption (TDE) with keys stored in the database.

Answer

Cloud provider's default encryption with provider-managed keys.

Answer

Client-side encryption with keys stored in a local file server.

Question 17

A development team is building a web application that stores user passwords. The security architect recommends using a password hashing algorithm with a tunable work factor and a per-user random salt. Which approach best meets this recommendation?

Accepted Answer

Use a memory-hard password hashing function such as Argon2id with a calibrated cost parameter and a unique salt per user.. Storing passwords securely requires a one-way function designed for the purpose, with a per-user salt and an adjustable cost that can be raised as hardware improves. Argon2id provides memory hardness and a calibrated cost parameter, satisfying both parts of the architect's recommendation. Fast hashes, reversible encryption, and keyed hashes with a shared secret each fail to make large-scale offline guessing economically impractical.

Answer

Hash each password with SHA-256 and store the resulting digest alongside a random salt generated per user.

Answer

Encrypt each password with AES-256 using a key stored in a hardware security module and store the ciphertext.

Answer

Apply HMAC-SHA-256 to each password using a global application secret as the key and store the resulting tag.

Question 18

A cloud architect is designing a solution that must ensure data isolation between tenants in a multi-tenant environment. The architect decides to use a virtual private cloud (VPC) per tenant. Which of the following is the PRIMARY security benefit of this approach?

Accepted Answer

It ensures that each tenant's network traffic is isolated from other tenants.. Using a VPC per tenant provides network-level isolation, which is critical in multi-tenant environments to prevent cross-tenant traffic and unauthorized access. Each VPC acts as a virtual network boundary, with its own IP range, subnets, route tables, and security groups. This logical separation helps enforce security policies and reduces the attack surface, making it the primary security benefit.

Answer

It provides dedicated physical hardware for each tenant.

Answer

It automatically encrypts all data at rest for each tenant.

Answer

It guarantees compliance with data residency requirements.

Question 19

A financial services firm stores transaction logs in a cloud object storage bucket. The security team wants to ensure that data is protected at rest but does not want to manage encryption keys themselves. They also need to prove to auditors that encryption is enabled. Which cloud provider feature should they use?

Accepted Answer

Server-side encryption with provider-managed keys (SSE-S3 or equivalent). Server-side encryption with provider-managed keys is correct because it automatically encrypts data at rest without requiring the customer to manage keys, and it can be audited through provider configurations. Client-side and SSE-C both involve customer key management, which the firm wants to avoid. TLS is irrelevant for data at rest.

Answer

Transport Layer Security (TLS) for data in transit

Answer

Client-side encryption with customer-provided keys

Answer

Server-side encryption with customer-provided keys (SSE-C)

Question 20

A healthcare SaaS provider exposes REST APIs to partner clinics. The security team must ensure that the API cannot be abused by replaying captured requests. The API already uses TLS 1.3 and OAuth 2.0 bearer tokens with short lifetimes. Which additional control best mitigates replay attacks against the API?

Accepted Answer

Require a unique nonce and timestamp in each request, validated server-side against a replay cache.. Replay attacks occur when a valid request is captured and resent. Defenses must make each request unique and single-use. A server-validated nonce plus timestamp achieves this by rejecting duplicates and expired requests. Transport security such as TLS or mTLS does not stop replay of already-authenticated application requests, and longer token lifetimes worsen exposure. HSTS is browser-focused and irrelevant to server-to-server API replay.

Answer

Enable HTTP Strict Transport Security (HSTS) with a long max-age on the API domain.

Answer

Increase the OAuth 2.0 token lifetime to reduce the frequency of token refresh calls.

Answer

Enforce mutual TLS between partner clinics and the API gateway.