CCSP Practice Exam 59 — 20 Questions

Question 1

Refer to the exhibit. A company uses a cloud configuration management tool to evaluate compliance with a rule that requires cloud storage buckets to enforce SSL. What should the administrator do next?

Accepted Answer

Check which bucket is non-compliant [CORRECT]. The output shows the rule is non-compliant but does not identify which specific bucket(s). The logical next step is to check which resources are non-compliant. Enabling SSL-only access is a solution but first the administrator must identify the non-compliant bucket. Disabling the rule or updating it would not resolve the issue.

Answer

Enable SSL-only access on the bucket [wrong]

Answer

Disable the compliance rule [wrong]

Answer

Update the rule to allow HTTP [wrong]

Question 2

Which THREE of the following are common risk treatment options in cloud risk management?

Accepted Answer

Transference. Avoidance (Option C), transference (Option B), and acceptance (Option E) are all standard and common risk treatment options under NIST SP 800-37 and ISO 31000. Ignorance and deletion are not recognized risk treatment options.

Answer

Ignorance

Answer

Deletion

Question 3

A cloud security architect is designing a data loss prevention (DLP) strategy for a multi-cloud environment. Which TWO actions are effective in preventing unauthorized exfiltration of sensitive data?

Accepted Answer

Implement strict Identity and Access Management (IAM) policies with least privilege. Implementing strict IAM policies with least privilege ensures that users and services have only the minimum permissions necessary to perform their functions. This directly limits the attack surface and prevents unauthorized access to sensitive data, which is a foundational control against exfiltration. Without least privilege, even with other controls in place, an over-privileged account could be exploited to move or copy data out of the environment.

Answer

Enable detailed logging and monitoring of all data access events

Answer

Encrypt all data at rest using provider-managed keys

Answer

Use a cloud access security broker (CASB) to enforce data classification

Question 4

A financial services company is migrating a critical database to the cloud. The database contains columns with PII that must be encrypted. Performance is the highest priority, and the system must support queries on encrypted data. Which technique should be used?

Accepted Answer

Application-level encryption. Application-level encryption is the correct technique because it can encrypt PII columns using deterministic encryption (e.g., AES-SIV) that allows equality queries on ciphertext without decryption, maintaining high performance with proper indexing. Tokenization is not encryption—it replaces data with tokens, and the original data is not encrypted. TDE decrypts data on access, so queries run on plaintext, not encrypted data. Hashing is one-way and not reversible.

Answer

Hashing

Answer

Transparent Data Encryption (TDE)

Answer

Tokenization

Question 5

A cloud security auditor is assessing a company's data classification policy for their cloud environment. Which finding would be considered a critical deficiency?

Accepted Answer

The data classification scheme does not include labels for public, internal, confidential, and restricted.. Without a classification scheme that includes labels such as public, internal, confidential, and restricted, the organization cannot consistently apply appropriate security controls based on data sensitivity. This is a fundamental deficiency that undermines the entire data security program. While the other options indicate gaps in review cycles, retention periods, or training, they are less critical than the absence of a classification scheme itself.

Answer

The data classification policy is reviewed annually.

Answer

The policy does not specify retention periods for each classification.

Answer

Employees receive data classification training once during onboarding.

Question 6

Which TWO of the following are recommended practices for securing cloud storage buckets? (Choose two.)

Accepted Answer

Block public read/write access. Blocking public access and enabling encryption are key practices. Versioning and logging are good but not as primary. Deleting buckets is not a security practice.

Answer

Enable bucket versioning

Answer

Delete unused buckets immediately

Answer

Enable access logging

Question 7

A cloud customer experiences a ransomware attack that encrypts data in an object storage bucket. The customer has versioning enabled on the bucket. How can the customer MOST effectively restore the data?

Accepted Answer

Restore the bucket to a previous version using the versioning feature. With versioning enabled on the object storage bucket, each object version is preserved. The correct approach is to restore the bucket to a previous, unencrypted version using the versioning feature, which effectively rolls back the data to its state before the ransomware encrypted the current versions. This avoids data loss and does not require decryption keys or bucket deletion.

Answer

Delete the bucket and recreate it

Answer

Use the cloud provider's undelete feature for the encrypted objects

Answer

Decrypt the objects using the ransomware decryption key

Question 8

A company uses a cloud-based SIEM to aggregate logs from multiple sources. Recently, the SIEM stopped receiving logs from a critical application server. The server is running and the application is functioning normally. The security team has verified that the log forwarder service is running on the server and the network path to the SIEM is open. Which additional step should the team take to diagnose the issue?

Accepted Answer

Inspect the log forwarder's configuration and recent log files for errors.. The most likely cause of logs not being received by the SIEM, when the server is running and the network path is open, is a misconfiguration or error within the log forwarder itself. Inspecting the forwarder's configuration (e.g., destination IP, port, protocol) and its local log files (e.g., syslog, Windows Event Forwarding logs) can reveal authentication failures, queue overflows, or parsing errors that prevent log transmission. This step directly addresses the log generation and forwarding pipeline, which is the remaining point of failure after verifying network connectivity and service status.

Answer

Check the server's CPU and memory utilization.

Answer

Review the firewall rules between the server and the SIEM.

Answer

Restart the SIEM collector service.

Question 9

After decommissioning a cloud database, a company is concerned about data remanence. They have overwritten all storage blocks with zeros. However, regulatory auditors require proof that the data is unrecoverable. What additional step should the company take?

Accepted Answer

Request a certificate of destruction from the cloud provider. In a cloud environment, the customer does not have physical access to the underlying storage media. Overwriting with zeros is a software-based sanitization method, but cloud providers typically do not allow customers to perform physical destruction or degaussing. The correct additional step is to request a certificate of destruction from the cloud provider, which serves as auditable proof that the provider has performed its own secure disposal process (e.g., NIST SP 800-88 compliant media sanitization) and that the data is unrecoverable.

Answer

Physically destroy the storage media

Answer

Shred the hard drives

Answer

Degauss the drives

Question 10

Refer to the exhibit. A cloud template defines a network security rule as shown. What is the security concern with this configuration?

Accepted Answer

It allows inbound traffic from all IP addresses on port 443, which is overly permissive.. The rule allows inbound traffic on port 443 (HTTPS) from 0.0.0.0/0, which means any IP address on the internet can reach the resource. This is overly permissive and violates the principle of least privilege, as it exposes the service to potential attacks from any source without restriction.

Answer

It allows SSH access on port 22.

Answer

It allows HTTP traffic on port 80, not HTTPS.

Answer

It does not allow outbound traffic.

Question 11

A company uses Azure Functions for serverless data processing. To securely access an Azure SQL database, which of the following is the most secure method for managing the database connection string?

Accepted Answer

Reference the connection string from Azure Key Vault using a managed identity. Using managed identities and Azure Key Vault removes hardcoded secrets and provides automatic rotation and access control.

Answer

Embed the connection string in the function code and encrypt the code file

Answer

Store the connection string as an environment variable in the function app settings

Answer

Use Azure Policy to enforce encryption of the connection string at rest

Question 12

A cloud application uses OAuth 2.0 for authorization. What is the primary purpose of using a refresh token in this flow?

Accepted Answer

To obtain a new access token when the current one expires without user interaction.. In OAuth 2.0, access tokens are short-lived by design to limit the window of compromise. A refresh token is a long-lived credential that allows the client to obtain a new access token from the authorization server without requiring the user to re-authenticate or re-consent. This enables seamless, ongoing access to protected resources while maintaining security through short-lived access tokens.

Answer

To grant the same access token indefinitely.

Answer

To authenticate the user without a password.

Answer

To store user credentials on the resource server for later use.

Question 13

Refer to the exhibit. A log entry shows a suspected SQL injection attack. Which security control would have prevented this attack?

Accepted Answer

Use parameterized SQL queries. SQL injection attacks exploit unsanitized user input that is concatenated into SQL queries. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders, ensuring that user input is always treated as data, not executable code. This prevents an attacker from injecting malicious SQL commands, regardless of the input content.

Answer

Encrypt the database connection

Answer

Implement rate limiting on the login endpoint

Answer

Enforce strong password policies

Question 14

A cloud security architect is designing a log aggregation strategy for a multi-account AWS environment. The security team needs to ensure logs from all accounts are stored centrally and cannot be altered. Which combination of services meets these requirements?

Accepted Answer

CloudTrail with cross-account log delivery to a central S3 bucket and enable log file validation. AWS CloudTrail supports cross-account log delivery to a central S3 bucket, and enabling log file validation uses a digest file signed with the CloudTrail private key to cryptographically verify that log files have not been modified, deleted, or tampered with since delivery. This combination ensures centralized storage and immutability, meeting the security team's requirements.

Answer

CloudWatch Logs to a centralized log group with IAM policies

Answer

S3 server access logs delivered to each account's own bucket

Answer

VPC Flow Logs to CloudWatch Logs in each account

Question 15

A financial services company is required to maintain audit trails of all user activities in its cloud environment for regulatory compliance. The company uses multiple cloud services and wants a centralized logging solution. The current architecture sends logs to a central storage bucket, but some logs are being lost due to high volume and insufficient throughput. Additionally, the logs must be immutable to prevent tampering. The company needs to ensure that all logs are captured and stored in a tamper-proof manner. Which of the following solutions BEST meets the requirements?

Accepted Answer

Configure the cloud provider's logging service to send logs to a dedicated bucket with versioning and object lock enabled, and set a high throughput.. Enabling Object Lock with retention modes (Governance or Compliance) on the cloud storage bucket ensures immutability, preventing log tampering. Versioning provides an additional safeguard by preserving all object versions, and configuring a high throughput setting (e.g., increasing the bucket's request rate limits or using a dedicated endpoint) addresses the log loss due to insufficient throughput.

Answer

Cache logs locally on each server and have a background job upload them to a bucket.

Answer

Use multiple log streams with different destinations and aggregate them using a third-party SIEM.

Answer

Use a message queue to decouple log generation from storage, and store logs in a bucket with immutability settings.

Question 16

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

Accepted Answer

Set readOnlyRootFilesystem to true. Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer

Set allowPrivilegeEscalation to true

Answer

Use a more restrictive runAsUser value like 2000

Answer

Use a trusted image from a private registry

Question 17

Which of the following best describes the purpose of the Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) program?

Accepted Answer

To allow cloud providers to publicly document their security controls and achieve different levels of assurance. CSA STAR provides a framework for cloud providers to demonstrate their security posture through self-assessment or third-party assessments. It increases transparency and helps customers assess risk.

Answer

To offer a certification program for cloud security professionals

Answer

To define mandatory security requirements for all cloud services

Answer

To provide a legal framework for cloud contracts

Question 18

An organization wants to detect potential crypto mining activity on their AWS EC2 instances. Which AWS service uses machine learning to identify such threats?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor for malicious activity, including cryptocurrency mining (e.g., connections to known mining pools or unusual compute resource spikes). It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to identify behavioral patterns indicative of crypto mining, such as sustained outbound traffic to mining pool IPs or unusual EC2 instance launches.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 19

Which TWO data states must be encrypted to meet common compliance requirements for data in the cloud? (Choose two.)

Accepted Answer

Data at rest. Data at rest (C) must be encrypted because compliance frameworks like PCI DSS, HIPAA, and GDPR require protection of stored data against unauthorized access. Encryption at rest typically uses AES-256 or similar algorithms to secure data on disks, databases, or object storage, ensuring that even if physical media is compromised, the data remains unreadable.

Answer

Data in audit logs

Answer

Data in backup

Answer

Data in use

Question 20

A company is using AWS Lambda functions that need to access a private RDS database. Which configuration allows the Lambda function to connect securely without traversing the internet?

Accepted Answer

Configure the Lambda function to use a VPC with private subnets and a VPC endpoint for RDS. Attaching the Lambda function to a VPC and placing it in private subnets with a VPC endpoint for RDS or a NAT gateway allows private connectivity.

Answer

Assign an Elastic IP to the Lambda function

Answer

Use a Lambda environment variable to store the database endpoint and credentials

Answer

Place the Lambda function in a public subnet with an internet gateway