CCSP Practice Test 6 — 10 Questions

Question 1

A company is migrating on-premises workloads to IaaS. They need to ensure that virtual machine images are secure and free of malware. Which approach is best practice?

Accepted Answer

Create a hardened baseline image and store it in a secure repository.. Creating a hardened baseline image ensures that the virtual machine is built from a known, secure configuration with all necessary security patches, minimal services, and no malware. Storing this image in a secure repository (e.g., encrypted and access-controlled) prevents tampering and allows consistent deployment of secure instances. This approach follows the principle of immutable infrastructure and is a foundational practice for secure IaaS migrations.

Answer

Use a golden image from the cloud provider's marketplace.

Answer

Rely on host-based firewalls to protect instances.

Answer

Perform vulnerability scanning on running instances only.

Question 2

A cloud service provider (CSP) offers a shared responsibility model. According to this model, who is responsible for patching the hypervisor?

Accepted Answer

The cloud service provider.. In a cloud shared responsibility model, the hypervisor is part of the underlying infrastructure that the cloud service provider (CSP) manages. The CSP is responsible for patching the hypervisor because it controls the virtualization layer that separates tenant workloads. Customers are responsible only for securing their guest operating systems and applications, not the hypervisor itself.

Answer

The customer.

Answer

The regulatory authority.

Answer

A third-party auditor.

Question 3

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

Accepted Answer

Cloud External Key Manager (EKM). Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Answer

Cloud KMS with software keys

Answer

Cloud KMS with hardware keys

Answer

Cloud HSM

Question 4

A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?

Accepted Answer

Configure the cloud service to require all API requests to go through a proxy that enforces DLP. Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.

Answer

Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN

Answer

Implement a conditional access policy to block non-corporate devices

Answer

Use tokenization to replace sensitive data before allowing API access

Question 5

A cloud security team needs to ensure that an Amazon EC2 instance hosting a regulated workload cannot communicate with the public internet, but the instance must still be able to download OS patches from an internal repository and retrieve secrets from AWS Secrets Manager. The workload runs in a private subnet with no NAT gateway or internet gateway route. Which combination of configurations will meet these requirements with the LEAST operational overhead?

Accepted Answer

Create VPC interface endpoints (AWS PrivateLink) for Secrets Manager and an S3 gateway endpoint for the patch repository, and associate the endpoints with the private subnet's route table and security group.. VPC interface endpoints (AWS PrivateLink) and S3 gateway endpoints let resources in private subnets reach AWS services entirely over the AWS private network, with no internet gateway, NAT, or public IP required. This satisfies the no-internet constraint, supports both patch retrieval and secret access, and requires minimal ongoing operational effort compared to firewall or NAT-based designs.

Answer

Attach an internet gateway to the VPC and use a security group that allows only outbound HTTPS to the patch server and Secrets Manager endpoints.

Answer

Place the instance in a public subnet and use an AWS Network Firewall policy to block all outbound traffic except the patch server and Secrets Manager IP ranges.

Answer

Deploy a NAT gateway in a public subnet and update the private subnet route table to direct 0.0.0.0/0 through the NAT gateway, then restrict outbound traffic using network ACLs.

Question 6

A cloud customer is subject to the EU GDPR and stores personal data with a provider that replicates it across data centers in several countries. The customer's legal team must confirm that appropriate safeguards exist for each international transfer. Which TWO elements are required for a valid transfer under GDPR Chapter V? (Choose two.)

Accepted Answer

A transfer impact assessment documenting the destination country's laws and any supplementary measures. A valid Chapter V transfer needs a legal mechanism, such as an adequacy decision or Standard Contractual Clauses, plus a documented transfer impact assessment that evaluates destination-country laws and any supplementary measures. Certifications and registrations may support due diligence but are not transfer mechanisms. When data is replicated across several countries, both elements must cover every jurisdiction where personal data resides or is accessible.

Answer

A SOC 2 Type II report covering the provider's security controls in each region

Answer

Registration of the cloud provider as a data controller with the customer's supervisory authority

Answer

An ISO/IEC 27701 certification held by the cloud provider

Question 7

A cloud security engineer is concerned about VM escape attacks in a multi-tenant environment. Which of the following is the most effective mitigation strategy?

Accepted Answer

Regularly patching and updating the hypervisor. VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

Answer

Using host-based intrusion detection on each VM

Answer

Implementing network segmentation between VMs

Answer

Enforcing strong passwords on guest OS accounts

Question 8

A multinational corporation is migrating its customer data to a cloud provider that operates data centers in multiple jurisdictions. To comply with the General Data Protection Regulation (GDPR), the company must ensure that customer data remains within the European Economic Area (EEA) unless adequate safeguards are in place. The cloud provider offers data residency options but does not guarantee that data will never be accessed from outside the EEA. What is the BEST course of action for the company?

Accepted Answer

Enter into a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) with the provider.. A Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the correct mechanism under GDPR to lawfully transfer personal data outside the EEA when the cloud provider cannot guarantee that data will never be accessed from outside the EEA. SCCs are a set of contractual terms approved by the European Commission that impose obligations on both the data exporter and importer to ensure adequate data protection, even if the provider's data residency feature is not absolute. This approach directly addresses the GDPR requirement for adequate safeguards when data may be accessed from third countries.

Answer

Accept the provider's data residency feature as sufficient compliance.

Answer

Pseudonymize all customer data before uploading to the cloud.

Answer

Encrypt all data and store the keys on-premises.

Question 9

A cloud security engineer reviews this Terraform configuration for a security group. Which change is necessary to improve security?

Accepted Answer

Restrict egress to specific ports.. The default egress rule in Terraform's AWS security group allows all outbound traffic (0.0.0.0/0, all ports, all protocols). This violates the principle of least privilege. Restricting egress to only specific ports and protocols (e.g., TCP/443 for HTTPS) reduces the attack surface and prevents data exfiltration or unintended outbound connections.

Answer

Use a broader CIDR for ingress.

Answer

Change protocol to UDP.

Answer

Remove the ingress rule.

Question 10

Which TWO statements about data masking are correct?

Accepted Answer

Data masking replaces sensitive data with realistic fictional data.. Data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Answer

Data masking is a form of encryption.

Answer

Data masking is primarily used for production environments.

Answer

Data masking is reversible.