CCSP Practice Test 6 — 10 Questions

Question 1

A company wants to enforce that all EC2 instances launched in a specific AWS account are tagged with the key "Environment" and "Owner". What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that requires tags on resource creation.. AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.

Answer

Use AWS Resource Groups to create a group that filters tagged instances.

Answer

Enable CloudTrail to monitor instance launches and alert on missing tags.

Answer

Configure AWS Config rules to automatically tag untagged instances.

Question 2

An administrator configured the above key policy for a KMS key used to encrypt S3 backup data. The backup role 'BackupRole' is in the same account. However, when the backup service attempts to use the key to decrypt objects, the operation fails. What is the most likely cause?

Accepted Answer

The 'kms:ViaService' condition restricts calls to those originating from S3, but the backup service uses direct KMS API. The 'kms:ViaService' condition key restricts KMS API calls to those that originate from a specific AWS service, in this case S3. However, the backup service is likely making direct KMS API calls (e.g., Decrypt) rather than having S3 proxy the request, so the condition fails. The key policy explicitly denies access unless the call comes via S3, which is why decryption fails.

Answer

The principal ARN is incorrect because the role name contains uppercase letters

Answer

The key policy requires a grant token that is not being provided

Answer

The action list does not include 'kms:Decrypt' for S3

Question 3

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Accepted Answer

2. The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Answer

12

Answer

4

Answer

3

Question 4

An organization wants to ensure that if they decide to migrate away from their current cloud provider, they can retrieve all data in a usable format and delete it from the provider's systems. Which principle does this best describe?

Accepted Answer

Reversibility. Reversibility is the ability to cleanly exit a cloud service, including data portability and secure deletion of data from the provider's environment.

Answer

Interoperability

Answer

Portability

Answer

Elasticity

Question 5

A company uses a cloud provider's key management service. They want to rotate keys automatically every 90 days. What is the correct way to achieve this?

Accepted Answer

Enable automatic key rotation in the KMS settings.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) offer a built-in automatic key rotation feature that can be configured to rotate the key material every 90 days without any manual intervention. Enabling this setting ensures that new cryptographic material is generated for the key, while the old key material remains available for decrypting data encrypted with it, maintaining seamless security compliance.

Answer

Manually update the key alias each quarter.

Answer

Create a new key and update all applications to use it.

Answer

Use a third-party HSM.

Question 6

A DevOps team is deploying containers in a Kubernetes cluster. They need to ensure that container images are scanned for vulnerabilities before deployment. Which is the most effective approach?

Accepted Answer

Use a container registry with integrated vulnerability scanning and enforce admission controls.. Integrating vulnerability scanning into the container registry (e.g., using tools like Trivy, Clair, or Amazon ECR scanning) combined with admission controllers (e.g., OPA/Gatekeeper or Kyverno) allows automated scanning of images at rest and blocks deployments of non-compliant images before they enter the cluster. This shift-left approach ensures that only images passing security policies are admitted, preventing vulnerable images from reaching production.

Answer

Scan images manually after deployment.

Answer

Rely on the developer's assurance that images are secure.

Answer

Use a runtime security tool.

Question 7

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 8

A security analyst reviews the bucket policy above. What is the primary security concern?

Accepted Answer

The bucket policy allows public read access to all objects. The bucket policy grants public read access to all objects via a Principal set to '*' and an Effect of 'Allow' on the s3:GetObject action. This means any unauthenticated user on the internet can list and download objects in the bucket, leading to potential data exposure. The primary security concern is unauthorized data disclosure, which violates the principle of least privilege.

Answer

The bucket policy uses an outdated version

Answer

The bucket policy is missing a Condition element

Answer

The bucket policy allows public write access to all objects

Question 9

A cloud application uses an API that allows users to view other users' profile details by changing the user ID in the request. Which vulnerability is this?

Accepted Answer

Broken object level authorization (BOLA). Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), occurs when an application does not properly verify that the user has permission to access a specific object, such as another user's profile.

Answer

Mass assignment

Answer

Broken authentication

Answer

Excessive data exposure

Question 10

Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?

Accepted Answer

Platform as a Service (PaaS). This is the definition of Platform as a Service (PaaS) per NIST SP 800-145. The consumer manages applications and data, while the provider manages everything else.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)