CCSP Practice Exam 60 — 20 Questions

Question 1

An organization uses cloud object storage for backup data and requires that once written, data cannot be modified or deleted for a specified retention period. Which feature should they enable?

Accepted Answer

Object lock with write-once-read-many (WORM) protection. Object lock with WORM protection is the correct feature because it enforces a retention policy that prevents any user, including the root account, from modifying or deleting objects until the retention period expires. This is specifically designed for compliance requirements such as SEC 17a-4(f) and ensures data immutability at the object level, which bucket versioning, encryption, or lifecycle rules cannot guarantee.

Answer

Bucket versioning

Answer

Encryption at rest with customer-managed keys

Answer

Lifecycle management to expire objects old objects

Question 2

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Accepted Answer

Horizontal auto-scaling for the web tier and a fixed database tier. It separates the stateless web tier, which can safely scale horizontally using auto-scaling groups triggered by CPU utilization thresholds, from the stateful database tier, which must remain fixed to avoid consistency issues such as split-brain or replication lag. Horizontal scaling adds or removes identical web server instances without affecting session state, while a fixed database tier preserves ACID properties and prevents conflicts from concurrent writes across multiple database nodes.

Answer

Manual scaling for both tiers

Answer

Vertical scaling of all tiers

Answer

Single-tier architecture with auto-scaling

Question 3

A financial services company runs a critical application on a cloud infrastructure. The application consists of a web tier, an application tier, and a database tier, all deployed in a single cloud region. The database is a managed relational database service with automated backups enabled. The company's disaster recovery plan requires a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. During a recent regional outage, the primary region became unavailable for 6 hours. The company attempted to restore the database from the latest automated backup in a different region, but the restore took 5 hours due to the large database size, exceeding the RTO. Additionally, the backup was 2 hours old at the time of the outage, exceeding the RPO. The security team has also noted that the backup data is encrypted with a cloud-managed key, which may not meet future compliance requirements for customer-managed encryption keys. Which course of action should the company take to meet both the RTO and RPO objectives while also addressing the encryption requirement?

Accepted Answer

Implement cross-region read replicas with synchronous replication and enable encryption with a customer-managed key that is replicated to the disaster recovery region.. Cross-region read replicas with synchronous replication can provide a standby database in another region with an RPO of effectively zero (synchronous replication ensures no data loss) and an RTO measured in minutes (promote the replica to primary), meeting both the 4-hour RTO and 1-hour RPO. Using a customer-managed key (CMK) replicated to the DR region satisfies the compliance requirement for customer-managed encryption keys, as the key can be controlled and audited independently of the cloud provider.

Answer

Store the backup in a different region using cross-region copy and use a cloud HSM to manage the encryption key.

Answer

Use cross-region asynchronous replication with a separate database instance and encrypt with a cloud-managed key.

Answer

Increase the frequency of automated backups to every 30 minutes and use faster storage for the database restore process.

Question 4

A security analyst reviews GCP Security Command Center findings and sees a high-severity alert for Event Threat Detection indicating that a service account key was used from an unexpected location. What is the best immediate action to contain the threat?

Accepted Answer

Disable the service account key. The correct immediate action is to disable the compromised service account key because Event Threat Detection has identified that the key is being used from an unexpected location, indicating potential unauthorized access. Disabling the key stops all further usage without deleting the service account or its other keys, preserving legitimate operations. This aligns with the principle of least privilege and incident response containment, as the key can later be rotated or deleted after investigation.

Answer

Create a new service account

Answer

Delete the service account

Answer

Rotate the key and monitor

Question 5

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

Accepted Answer

Configuration management service and serverless compute function. A configuration management service can evaluate resources against compliance rules. When a resource is non-compliant, the service can invoke a serverless compute function to perform automated remediation, such as making a public bucket private.

Answer

Audit logging service and serverless compute function

Answer

Threat detection service and workflow orchestration service

Answer

Security hub and vulnerability management service

Question 6

A software-as-a-service (SaaS) provider hosts customer data in a multi-tenant cloud environment. Each customer's data is stored in separate databases but shares a common infrastructure. A customer reports that they can see another customer's data in their application dashboard. The development team investigates and finds no application-level bugs. The security team suspects the issue is related to cloud data isolation. The provider uses a public cloud database service with separate schemas per customer. The database service uses shared compute resources. The provider's compliance team is concerned about data leakage between tenants. Which of the following is the MOST effective way to ensure data isolation in this environment?

Accepted Answer

Implement row-level security (RLS) on the database tables to restrict access based on customer ID.. Row-level security (RLS) is the most effective because it enforces data isolation directly within the shared database engine, filtering rows based on the customer ID predicate. This prevents any cross-tenant data access even if the application layer is compromised or misconfigured, as the database itself evaluates the security policy on every query. Unlike encryption or auditing, RLS provides a deterministic access control mechanism that operates at the query execution level, ensuring that each tenant sees only their own data.

Answer

Use application-level encryption with different keys per customer.

Answer

Enable database auditing and monitor for anomalies.

Answer

Move each customer to a separate database instance.

Question 7

A company uses Azure Sentinel as its SIEM. To ingest Azure Activity Logs and correlate with other data sources, which connector should be configured?

Accepted Answer

Azure Activity connector. The Azure Activity connector is specifically designed to ingest Azure Activity Logs, which contain subscription-level events such as resource creation, modification, and deletion. This connector enables Sentinel to correlate these operational logs with other data sources for comprehensive threat detection and incident response.

Answer

Office 365 connector

Answer

Azure Defender connector

Answer

Windows Security Events connector

Question 8

Which TWO of the following are valid methods to protect data at rest in a cloud environment?

Accepted Answer

Client-side encryption. Client-side encryption (A) is a valid method to protect data at rest because the data is encrypted by the client before being transmitted to the cloud provider. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, which remain under the customer's control. It is a strong approach for maintaining data confidentiality and compliance with regulatory requirements.

Answer

Data loss prevention (DLP) policies

Answer

Tokenization

Answer

Transport Layer Security (TLS)

Question 9

A cloud security team is designing an incident response playbook for a suspected data exfiltration via an AWS S3 bucket. Which TWO actions should be included for containment and evidence collection? (Choose two.)

Accepted Answer

Revoke IAM credentials associated with the compromised access.. For containment, revoking the IAM credentials used by the attacker stops further access. For evidence, enabling VPC Flow Logs (if not already enabled) captures network traffic for analysis.

Answer

Immediately notify all users to change passwords.

Answer

Take a snapshot of the S3 bucket using AWS Backup.

Answer

Delete the S3 bucket to prevent further access.

Question 10

An organization is migrating a legacy application to the cloud and plans to use a cloud access security broker (CASB). Which of the following is the PRIMARY function of a CASB in securing cloud applications?

Accepted Answer

Enforcing security policies across cloud applications and controlling access. The primary function of a CASB is to enforce security policies and control access across cloud applications, acting as an intermediary between users and cloud providers. It provides visibility into cloud usage, applies data loss prevention (DLP) rules, and enforces authentication and authorization policies, which directly addresses the need to secure a legacy application migrated to the cloud.

Answer

Performing vulnerability scans on cloud infrastructure

Answer

Encrypting data at rest in cloud storage

Answer

Protecting against distributed denial-of-service (DDoS) attacks

Question 11

Which THREE of the following are key components of an incident response plan specific to cloud environments? (Choose three.)

Accepted Answer

Establishing a process for preserving system snapshots and logs as evidence. Options A, C, and E are correct. A: Preserving system snapshots and logs is crucial for evidence collection and analysis in cloud incidents. C: Defining procedures for contacting the cloud provider’s support and security teams ensures timely assistance and coordination. E: Clarifying the shared responsibility model for incident handling clarifies which party is responsible for each aspect of incident response. Option B is incorrect because not every incident requires legal department involvement; legal is typically consulted for specific scenarios such as data breaches or regulatory issues. Option D is incorrect because a detailed forensic analysis procedure for all incident types is impractical; procedures should be scalable and tailored to incident severity and type.

Answer

Requiring involvement of the legal department for every incident

Answer

Including a detailed data forensic analysis procedure for all incident types

Question 12

Which TWO measures are effective for securing container images in a cloud environment?

Accepted Answer

Sign images to ensure integrity. Signing container images (e.g., using Docker Content Trust or Notary) ensures integrity and authenticity by cryptographically verifying that the image has not been tampered with since it was signed. This prevents man-in-the-middle attacks and the deployment of malicious images, which is a critical security measure in cloud environments where images are pulled from remote registries.

Answer

Store images in a public registry without scanning

Answer

Use latest tags without version pinning

Answer

Run containers with root privileges

Question 13

A financial institution uses a multi-cloud strategy with AWS and Azure. They must comply with PCI DSS. The security team found that a developer accidentally stored a file with credit card numbers in an S3 bucket that is publicly readable. Which immediate action should be taken to contain the breach?

Accepted Answer

Remove the public read permission on the bucket.. Removing the public read permission on the S3 bucket immediately stops unauthorized access to the file containing credit card numbers, containing the breach in accordance with PCI DSS incident response requirements. This action does not destroy evidence (unlike deletion) and directly addresses the root cause—the bucket's misconfigured access control list (ACL) or bucket policy that allowed public read access. It is the fastest way to prevent further data exfiltration while preserving the file for forensic analysis.

Answer

Delete the file immediately.

Answer

Enable default encryption on the bucket.

Answer

Revoke the developer's IAM credentials.

Question 14

An organization is migrating a legacy application to the cloud and must comply with PCI DSS. The application currently logs credit card numbers in plaintext. Which data security control should be implemented FIRST?

Accepted Answer

Perform data discovery and classification. Before any remediation can be applied, the organization must first perform data discovery and classification to locate where all credit card numbers (PANs) are stored, including logs, databases, and backups. PCI DSS Requirement 3.1 mandates that cardholder data be identified and classified before implementing controls like tokenization or encryption. Without discovery, subsequent controls may miss critical data stores, leaving plaintext PANs exposed.

Answer

Implement tokenization for credit card numbers

Answer

Deploy a data loss prevention (DLP) solution

Answer

Encrypt the database at rest

Question 15

A cloud security analyst is investigating a potential credential compromise in AWS. Which TWO CloudTrail events would be most relevant to establishing a timeline of the compromise?

Accepted Answer

CreateAccessKey. (CreateAccessKey) is correct because the creation of a new access key pair is a strong indicator of an attacker establishing persistent programmatic access to an AWS account. This event, logged by CloudTrail as 'CreateAccessKey' in the IAM service, provides a precise timestamp for when the attacker may have generated credentials to maintain access outside of the console.

Answer

DeleteBucket

Answer

UpdateLoginProfile

Answer

DescribeInstances

Question 16

A DevSecOps team is implementing security scanning in the CI/CD pipeline for a cloud application. Which THREE tools or practices should be included to shift security left?

Accepted Answer

Infrastructure-as-Code (IaC) security scanning. Shift-left security involves integrating security early. SAST scans source code, IaC scanning detects misconfigurations before deployment, and dependency scanning identifies vulnerable libraries.

Answer

Web Application Firewall (WAF) deployment

Answer

Runtime Application Self-Protection (RASP)

Question 17

A financial institution subject to SOX is migrating its general ledger system to a SaaS provider. Which of the following IT general controls is most critical to ensure the integrity of financial data in the cloud?

Accepted Answer

Change management procedures for the SaaS application. SOX requires controls over financial reporting. Change management ensures that modifications to the system are authorized, tested, and documented, which is critical for data integrity.

Answer

Annual penetration testing of the SaaS provider's infrastructure

Answer

Daily backups of the financial database

Answer

Implementation of multi-factor authentication for all users

Question 18

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

Accepted Answer

Private cloud. Private cloud (Option C) is correct because it is a single-tenant environment where the cloud infrastructure is dedicated exclusively to one organization, providing the highest level of isolation between tenants. In a private cloud, network segmentation is achieved through technologies such as VLANs (IEEE 802.1Q), VXLANs (RFC 7348), and dedicated hypervisor-level resource pools, ensuring that no other tenant's workloads share the same physical or virtual resources. This eliminates the multi-tenancy risks inherent in public and community clouds, where isolation relies on shared infrastructure and logical separation mechanisms like hypervisor-enforced memory isolation and network overlays.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 19

A healthcare organization is using a cloud-based electronic health record (EHR) system hosted on a PaaS platform. The platform provides a web interface and an API for integration with internal systems. The organization's security policy requires encryption of all data at rest and in transit. They have implemented SSL/TLS for data in transit and enabled server-side encryption for the database. However, during a recent audit, it was discovered that the API returns diagnostic data in clear text when accessed from internal networks. The internal network is considered trusted. The auditor recommends implementing end-to-end encryption. Which of the following is the BEST approach to meet this requirement?

Accepted Answer

Configure the API to require mutual TLS (mTLS) authentication and use TLS 1.2 or higher for all connections from internal systems.. The best approach because mutual TLS (mTLS) provides both authentication of internal clients and encryption of data in transit, achieving end-to-end encryption without adding unnecessary complexity. mTLS ensures that only authorized systems can call the API and that all data is encrypted from client to server. Option B (client-side encryption) does not protect data in transit between the client and the API unless combined with TLS, and it introduces key management overhead. Option C (VPN) adds latency and complexity, and while it encrypts traffic, it does not provide per-connection authentication for each API call. Option D (proxy service) introduces an additional component that could become a bottleneck or point of failure, and still requires TLS between the proxy and the API to maintain end-to-end encryption.

Answer

Implement client-side encryption on the internal systems before sending data to the API.

Answer

Set up a VPN connection between the internal network and the cloud PaaS environment to encrypt all traffic.

Answer

Create a proxy service in the cloud that encrypts the data before forwarding it to the API.

Question 20

A company identifies a high-risk vulnerability in a cloud application. The cost to remediate is significantly higher than the potential loss from exploitation. Which risk treatment strategy is most appropriate?

Accepted Answer

Acceptance. When the cost to remediate a vulnerability exceeds the potential loss from exploitation, the most appropriate risk treatment strategy is acceptance. This means the organization formally acknowledges the risk and chooses to tolerate it without implementing additional controls, often documented in a risk register. In cloud environments, this is common for low-impact, high-cost vulnerabilities where the business decides the residual risk is within its risk appetite.

Answer

Avoidance

Answer

Transfer

Answer

Mitigation