CCSP Practice Exam 60 — 20 Questions

Question 1

A cloud customer's legal team is reviewing a provider's contract and finds a clause requiring the customer to resolve all disputes through binding arbitration in the provider's home country. The customer operates in several jurisdictions and wants to preserve its options. Which contract provision should the customer negotiate to best address this concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A choice-of-law and choice-of-forum clause naming a neutral jurisdiction. A choice-of-law and choice-of-forum clause determines the governing law and the venue for disputes, directly countering a one-sided mandatory arbitration provision. Naming a neutral jurisdiction protects the customer's ability to pursue remedies across multiple operating regions. Audit rights, SLAs, and data residency provisions serve different purposes and do not affect where disputes are heard.

Answer

A right to audit the provider's security controls annually

Answer

A service-level agreement with credits for availability shortfalls

Answer

A data residency clause requiring storage only in the customer's home country

Question 2

A retail company is migrating its monolithic e-commerce application to containers on a managed Kubernetes service. The security architect wants to ensure that if a container is compromised, the attacker cannot use the container's credentials to access the underlying node's filesystem or other pods' volumes. Which Kubernetes feature should be configured to meet this requirement?

Accepted Answer

Runtime sandboxing with gVisor or Kata Containers. The requirement is strong runtime isolation so a compromised container cannot reach the node or other pods' data. Runtime sandboxing with gVisor or Kata Containers creates a boundary beyond standard Linux namespaces and cgroups. Pod Security Admission, NetworkPolicy, and RBAC are valuable but address configuration hardening, network traffic, and API authorization respectively, not filesystem and volume isolation from the host.

Answer

Role-Based Access Control (RBAC) to limit service account permissions

Answer

NetworkPolicy to restrict pod-to-pod traffic

Answer

Pod Security Admission with the restricted profile

Question 3

A cloud architect is documenting the essential characteristics that distinguish a cloud service from traditional hosting for an internal design review. The architect must list the characteristics defined in the widely used cloud reference architecture. Which of the following is one of those essential characteristics?

Accepted Answer

Rapid elasticity and measured service. The essential characteristics describe on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Rapid elasticity and measured service together capture how capacity flexes with demand and how consumption is metered and reported, which are definitional traits. Residency guarantees, single-tenancy mandates, and perpetual licensing are commercial or deployment choices, not defining cloud characteristics.

Answer

Guaranteed data residency in a single jurisdiction

Answer

Perpetual license ownership of the provider's software

Answer

Mandatory single-tenancy of every physical host

Question 4

A cloud security architect is designing a CI/CD pipeline for a containerized application. The requirement is that container images be cryptographically signed by the build system and that only images with valid signatures be admitted to the production Kubernetes cluster. Which combination of controls best achieves this?

Accepted Answer

Sign images with a key managed by the build system and enforce signature verification with an admission controller that rejects unsigned images.. Meeting the requirement needs two complementary controls: cryptographic signing at build time to prove provenance, and admission-time verification to reject unsigned or tampered images. Scanning, registry access controls, and caching address different concerns and cannot enforce signature validity when pods are scheduled.

Answer

Store images in a private registry and restrict registry access using IAM policies.

Answer

Scan images for vulnerabilities during the build and block the pipeline if critical findings are detected.

Answer

Enable image layer caching in the build system to speed up builds and reduce exposure to tampering.

Question 5

A financial services company stores regulated data in a cloud object storage bucket and uses a cloud key management service (KMS) with customer-managed keys. An auditor asks how the company ensures that data remains protected if a malicious insider with KMS administrator rights attempts to export key material. Which KMS capability should the security team describe?

Accepted Answer

The KMS uses hardware security modules that are validated to FIPS 140-2 or FIPS 140-3 and are configured to prevent key material from being exported in plaintext.. HSM-backed KMS with FIPS validation is the correct capability because these modules are designed to keep key material inside the hardware boundary and prevent plaintext export, even by administrators. MFA, audit logging, and rotation are useful controls but do not stop an insider from extracting usable key material through legitimate administrative interfaces.

Answer

The KMS automatically rotates customer-managed keys every 90 days, which limits the usefulness of any exported key material.

Answer

The KMS logs all key usage to an immutable audit trail, so any export attempt by an insider would be detected after the fact.

Answer

The KMS enforces multi-factor authentication for all administrative actions, which prevents an insider from exporting key material.

Question 6

A small business wants to move its email and productivity suite to a cloud service where the provider manages the application, runtime, and underlying infrastructure, and users access the software through a browser. Which cloud service model is being described?

Accepted Answer

Software as a Service (SaaS). In SaaS, the provider manages the application, runtime, middleware, operating system, and infrastructure, while the customer consumes the software, often through a browser. Email and productivity suites delivered this way fit the SaaS model precisely, with the customer retaining only limited configuration and user management responsibilities.

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 7

A cloud operations team runs a Kubernetes cluster on Google Kubernetes Engine (GKE). A recent audit found that several pods were scheduled onto nodes that do not meet the organization's hardened baseline, and the team wants to enforce that only nodes with specific labels are eligible for certain workloads. Which Kubernetes mechanism should the team implement?

Accepted Answer

Node affinity combined with node labels. Node affinity uses node labels as hard or soft match rules in the pod specification, so requiring a specific label ensures the scheduler only places the workload on nodes that carry the hardened baseline. This is the native Kubernetes control for constraining placement without replacing the default scheduler or altering cluster autoscaling behavior.

Answer

PodDisruptionBudget

Answer

Horizontal Pod Autoscaler

Answer

NetworkPolicy

Question 8

A multinational retailer is selecting a cloud deployment model for a new inventory system. The system must be accessible to stores in several countries, must scale rapidly during seasonal promotions, and must be managed by a third-party provider. The retailer does not want to own or maintain the underlying infrastructure. Which cloud deployment model BEST fits these requirements?

Accepted Answer

Public cloud. A public cloud is provider-owned and offers on-demand scaling and global availability, which matches the retailer's need to avoid infrastructure ownership while supporting stores in multiple countries and handling seasonal demand spikes. The other models either require dedicated infrastructure, shared governance, or unnecessary private integration.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Private cloud

Question 9

A financial services firm stores transaction logs in a cloud object storage bucket. The security team wants to ensure that any modification to a log file is detectable and that the original content cannot be repudiated. Which mechanism should they implement?

Accepted Answer

Use digital signatures with a private key to sign each log file.. Digital signatures use asymmetric cryptography to bind the signer's identity to the data. When a log file is signed, any alteration invalidates the signature, and the signer cannot deny signing. This satisfies both integrity and non-repudiation requirements. Encryption alone provides confidentiality but not tamper evidence, while hashing without a signature lacks non-repudiation.

Answer

Apply a cryptographic hash (e.g., SHA-256) to each log file and store the hash separately.

Answer

Enable object versioning and configure a lifecycle policy to retain all versions.

Answer

Enable server-side encryption with customer-provided keys (SSE-C).

Question 10

A cloud customer is building its compliance monitoring program for a provider-hosted workload that processes regulated data. The customer must ensure it can demonstrate ongoing compliance to regulators between audits. Which TWO provider commitments should the customer secure in the contract to sustain continuous compliance evidence? (Choose two.)

Accepted Answer

A right to obtain current independent audit reports, bridge letters, and certification evidence at least annually and after significant changes.. Sustaining compliance between audits requires current evidence and early awareness of change. Contractual rights to timely notification of material changes and to updated audit reports, bridge letters, and certification evidence let the customer refresh its compliance file, reassess risk, and respond to regulator requests without waiting for the next scheduled audit cycle or renegotiating access each year.

Answer

A right to receive the provider's internal penetration test raw findings and unfiltered vulnerability backlog for continuous review.

Answer

A right to require the provider to adopt the customer's internal control framework verbatim across all its tenants.

Answer

A right to embed the customer's own auditors full-time inside the provider's data centers to observe live operations.

Question 11

A small business is migrating its customer database to a cloud-based database service. The security team wants to ensure that data is encrypted at rest using keys that the business controls, but they do not want to manage the underlying hardware security modules. Which cloud key management option should they choose?

Accepted Answer

Customer-managed keys stored in a cloud KMS.. Customer-managed keys in a cloud KMS provide the business with control over key lifecycle and access policies while the cloud provider handles the HSM infrastructure. This balances control with operational simplicity, making it ideal for organizations that want key control without managing hardware.

Answer

Client-side encryption with keys stored on-premises.

Answer

Provider-managed keys with automatic rotation.

Answer

Bring your own key (BYOK) using a third-party key management service.

Question 12

A cloud customer is subject to a regulatory audit and must provide evidence of the cloud provider's security controls. The provider refuses to allow direct audits of its data centers. Which artifact should the customer rely on to satisfy the auditors?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is specifically designed to provide independent assurance over a period, covering the Trust Services Criteria. It is widely accepted by auditors as evidence of a cloud provider's security controls when direct audits are not feasible. Other artifacts like ISO 27001 certificates or self-assessments do not offer the same level of detailed, independent validation of control operation.

Answer

Provider's self-assessment questionnaire

Answer

Penetration test summary

Answer

ISO/IEC 27001 certificate

Question 13

A development team is building a cloud application and needs to store API keys and database passwords securely. The team wants to minimize management overhead and ensure automatic rotation of secrets. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing and managing secrets, offering automatic rotation for many AWS services and custom rotation via Lambda. This minimizes management overhead and ensures secrets are regularly rotated, reducing the risk of compromise. The team can focus on application development while Secrets Manager handles the lifecycle of secrets securely.

Answer

AWS IAM roles

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with server-side encryption

Question 14

A cloud operations team is deploying a three-tier application across two AWS Availability Zones. The database tier must not be reachable from the internet, and the web tier must accept HTTPS from the public. The security architect wants defense in depth at both the subnet and instance levels. Which combination of controls BEST aligns with a layered network security design?

Accepted Answer

Place the web tier in a public subnet with a security group allowing 443 from 0.0.0.0/0 and a network ACL allowing 443 inbound; place the database tier in a private subnet with a security group allowing 3306 only from the web tier security group and a network ACL denying all internet CIDR ranges.. A layered VPC design uses network ACLs at the subnet boundary and security groups at the instance level, giving two independent enforcement points. Referencing the web tier's security group as the database source restricts access to authorized instances rather than broad CIDRs. Keeping the database in a private subnet and denying internet CIDRs at the network ACL completes the defense-in-depth model.

Answer

Place both tiers in public subnets and use network ACLs to restrict the database tier to the web tier's CIDR block, with security groups allowing all traffic within the VPC.

Answer

Use AWS WAF in front of the web tier and AWS Shield Advanced for the database tier, with security groups allowing 3306 from the VPC CIDR.

Answer

Place both tiers in private subnets, use a NAT gateway for web tier egress, and rely on security groups alone to control inbound traffic.

Question 15

A cloud service provider is expanding into a new jurisdiction and must demonstrate compliance with local data protection laws. The provider's legal team is reviewing the shared responsibilities between the provider and its customers. Which TWO activities are the provider's responsibility under a typical cloud shared responsibility model? (Choose two.)

Accepted Answer

Securing the physical facilities, hardware, and network infrastructure that host the cloud services.. In a cloud shared responsibility model, the provider secures the infrastructure that delivers the service, including physical facilities, hardware, and the virtualization layer that isolates tenants. The customer remains responsible for its data, identity management, and customer-side encryption key custody. Understanding this division is essential for meeting regulatory obligations in any jurisdiction.

Answer

Configuring encryption for the customer's data at rest using customer-managed keys stored in the customer's environment.

Answer

Classifying the customer's data and determining which regulatory requirements apply to that data.

Answer

Managing the customer's identity and access policies for the customer's own users and applications.

Question 16

A cloud security engineer is reviewing the security posture of a web application deployed on AWS. The application uses an Application Load Balancer (ALB) and EC2 instances. The engineer wants to ensure that all incoming traffic is encrypted in transit. Which action should the engineer take?

Accepted Answer

Configure the ALB to use an HTTPS listener with an ACM certificate and redirect HTTP to HTTPS.. To encrypt incoming traffic, the Application Load Balancer must terminate TLS using an HTTPS listener with a valid certificate from AWS Certificate Manager. Redirecting HTTP to HTTPS ensures all clients use encryption. This secures data in transit from clients to the ALB, meeting the requirement.

Answer

Use AWS Shield Advanced to protect the application from DDoS attacks.

Answer

Enable encryption at rest on the EC2 instance volumes using AWS KMS.

Answer

Configure a security group on the EC2 instances to allow only HTTPS traffic from the ALB.

Question 17

A cloud engineer is configuring a storage bucket that will hold publicly accessible marketing images. The security policy requires that data at rest be encrypted, but the images are not sensitive and the team wants to minimize operational overhead. Which cloud storage encryption option is most appropriate?

Accepted Answer

Provider-managed encryption keys with automatic rotation, using the cloud provider's default encryption at rest.. Provider-managed encryption keys are the best fit because they satisfy the encryption-at-rest policy while imposing no key management burden on the team. The images are public and non-sensitive, so stronger controls such as customer-managed keys or client-side encryption add cost and complexity without proportional benefit. The policy requirement is met with minimal operational effort.

Answer

Customer-managed keys stored in a hardware security module that the team rotates manually each quarter.

Answer

No encryption at rest, because the images are publicly accessible and therefore not confidential.

Answer

Client-side encryption where the application encrypts each image before uploading and manages its own key store.

Question 18

A cloud application team is adopting a DevSecOps pipeline for a containerized workload. They want to integrate security testing that can detect vulnerable dependencies and misconfigured infrastructure-as-code templates before deployment. Which two practices should be implemented to meet these goals? (Choose two.)

Accepted Answer

Scan infrastructure-as-code templates with a policy-as-code tool that evaluates them against organizational security baselines and blocks noncompliant changes.. Detecting vulnerable dependencies requires software composition analysis of dependency manifests during the build. Detecting misconfigured IaC requires policy-as-code scanning of templates before deployment. Both are preventive and shift security left. Runtime controls such as RASP and WAF, and dynamic testing of a running app, do not analyze dependencies or templates, so they do not meet the stated goals.

Answer

Perform dynamic application security testing against the staging environment after each deployment to find runtime vulnerabilities.

Answer

Enable runtime application self-protection in production to block exploitation attempts against the running application.

Answer

Deploy a web application firewall in front of the application and tune it using production traffic logs.

Question 19

A cloud security architect is designing a multi-tenant IaaS deployment where tenants run untrusted workloads on shared physical hosts. The architect wants to reduce the risk of cross-tenant data remanence in the storage layer. Which control is MOST effective?

Accepted Answer

Enable encryption at rest with per-tenant customer-managed keys and cryptographic erasure on deprovisioning.. Cryptographic erasure with per-tenant customer-managed keys is the strongest control against storage remanence in multi-tenant environments because destroying the key renders residual ciphertext unrecoverable. Provider-managed shared keys, memory scrubbing, and QoS controls do not address persistent-block reuse by other tenants, leaving confidentiality risk unresolved.

Answer

Enable server-side encryption with a single provider-managed key for the whole storage service.

Answer

Implement storage QoS and IOPS throttling to isolate tenant workloads on shared volumes.

Answer

Rely on the hypervisor's memory scrubbing between VM lifecycles to prevent data leakage.

Question 20

A cloud security engineer is responsible for securing a Kubernetes cluster running on Google Kubernetes Engine (GKE). They need to detect and respond to runtime threats such as cryptomining and reverse shell attempts. They want a solution that integrates natively with GKE and provides detailed container-level visibility. Which GCP service should they use?

Accepted Answer

Google Cloud's Container Threat Detection. Container Threat Detection is a GKE-native service that monitors runtime activity within containers. It detects threats such as cryptomining and reverse shells by analyzing system calls and process behavior. It provides container-level visibility and integrates with Security Command Center for centralized findings. This makes it the correct choice for runtime threat detection in GKE.

Answer

Google Cloud's Cloud IDS

Answer

Google Cloud's Anthos Service Mesh

Answer

Google Cloud Security Command Center (SCC)