CCSP Practice Exam 61 — 20 Questions

Question 1

A cloud operations team is deploying a web application behind a load balancer in a VPC. The application servers must be reachable only from the load balancer, never directly from the internet. Which configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the application servers in a private subnet and attach a security group that allows inbound traffic only from the load balancer's security group.. Private subnets eliminate the internet route, and referencing the load balancer's security group as the allowed source ensures only that balancer can reach the application servers. Public subnets, host firewalls, and elastic IPs all leave direct internet reachability in place, so they fail the isolation requirement.

Answer

Place the application servers in a public subnet and attach a network ACL that denies inbound traffic from 0.0.0.0/0.

Answer

Keep the application servers in a public subnet but enable a host-based firewall on each instance.

Answer

Assign elastic IP addresses to the application servers and restrict access using a VPN.

Question 2

A media company uses a CI/CD pipeline to deploy a web application to a cloud platform. The security team wants to integrate security testing that can detect vulnerabilities in third-party libraries and base images before deployment, without significantly slowing the pipeline. Which practice should be implemented?

Accepted Answer

Software composition analysis (SCA) and container image scanning integrated into the pipeline.. Detecting vulnerabilities in third-party libraries and base images before deployment requires tools that inspect dependencies and image contents. SCA reads dependency manifests for known CVEs, and container image scanning checks layers for vulnerable packages. Both integrate into CI/CD with fast, automated feedback. DAST and IAST need running environments and target runtime behavior, while SAST covers only first-party code, so none of those alone meets the requirement.

Answer

Static application security testing (SAST) on the application source code only.

Answer

Dynamic application security testing (DAST) against the staging environment after each deployment.

Answer

Interactive application security testing (IAST) with agents in the staging environment.

Question 3

A cloud customer is reviewing its contract with a cloud provider. The customer wants to ensure that if the provider subcontracts any part of the service to a third party, the customer's data remains protected. Which contract provision is most critical to address this risk?

Accepted Answer

Requirement for provider to flow down data protection obligations to subcontractors. Flow-down obligations ensure that subcontractors are contractually bound to the same data protection standards as the primary provider. This maintains protection throughout the cloud supply chain and is often a regulatory requirement. Other options focus on audit rights, availability, or exit, which do not directly ensure subcontractor compliance with data protection obligations.

Answer

Right to terminate for convenience

Answer

Service level agreement (SLA) with penalties for downtime

Answer

Right to audit the provider's subcontractors

Question 4

A cloud customer requires that its data stored by a provider be irretrievably destroyed after contract termination, even if the provider uses backup tapes and replicated storage. Which contractual and technical provision best supports this requirement?

Accepted Answer

A clause requiring the provider to sanitize or crypto-shred all customer data, including backups and replicas, and to provide a certificate of destruction upon termination.. Irretrievable destruction requires more than retention limits or audit rights; it demands a contractual obligation to sanitize or crypto-shred all copies, including backups and replicas, and to certify destruction. Crypto-shredding is effective when data is encrypted and keys can be destroyed. The certificate of destruction provides verifiable evidence that the obligation was met.

Answer

A right-to-audit clause that allows the customer to inspect the provider's data centers annually.

Answer

A service level agreement that guarantees 99.99% data durability during the contract term.

Answer

A data retention schedule that specifies how long the provider may keep customer data before automatic deletion.

Question 5

A company uses Microsoft Azure and wants to implement just-in-time (JIT) virtual machine access to reduce the attack surface. They need to ensure that only authorized users can access VMs on specific management ports, and that access is granted for a limited time. Which Azure service should they use?

Accepted Answer

Azure Security Center (now Microsoft Defender for Cloud) just-in-time VM access. Microsoft Defender for Cloud's just-in-time VM access is designed to reduce the attack surface by allowing access to VMs only when needed, for a limited time, and on specific ports. It uses Azure RBAC to control who can request access and NSGs to enforce the temporary rules. This meets the requirement for time-limited, authorized access.

Answer

Azure Bastion

Answer

Network security groups (NSGs) with service tags

Answer

Azure Firewall

Question 6

A small business wants to use a cloud-based email and collaboration suite where the provider manages the application, servers, and operating system. The business only needs to configure user accounts and settings. Which cloud service model is being used?

Accepted Answer

Software as a Service (SaaS). SaaS is the model where the provider manages the entire application stack, and the customer only handles configuration and user management. The scenario explicitly states the provider manages the application, servers, and operating system, leaving only account and settings configuration to the business. IaaS, PaaS, and FaaS all require more customer responsibility for the application or runtime.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 7

A multinational corporation is using a cloud-based data warehouse to analyze customer data. The data includes personally identifiable information (PII) from various countries. The security team needs to ensure that data is anonymized before analysis to comply with privacy regulations. Which technique should they use?

Accepted Answer

Generalization and suppression. Generalization and suppression are anonymization techniques that reduce data granularity and remove identifiers, making re-identification difficult. Tokenization and masking are reversible or not fully anonymizing, and encryption does not anonymize. These techniques help comply with privacy regulations by ensuring data cannot be linked to individuals.

Answer

Tokenization

Answer

Data masking

Answer

Encryption with customer-managed keys

Question 8

A cloud architect is designing a data retention solution for a SaaS application hosted with a cloud provider. The organization must ensure that customer data is irretrievably destroyed at the end of its retention period, even though the data is stored in a multi-tenant object storage service with underlying solid-state drives. Which approach best satisfies this requirement?

Accepted Answer

Use crypto-shredding: encrypt each customer's data with a unique data encryption key and destroy the key when retention expires.. Crypto-shredding is the most reliable method for irretrievable destruction in multi-tenant cloud storage because it makes data unreadable by destroying the key. Physical destruction or overwriting is impractical when the provider controls the media and may keep replicas. Destroying a unique key per customer ensures that even residual ciphertext cannot be decrypted.

Answer

Issue a delete command to the object storage API and rely on the provider's background garbage collection to erase the data blocks.

Answer

Overwrite the objects with random data before deleting them, then request a certificate of media destruction from the provider.

Answer

Move the data to an infrequent access storage tier and configure a lifecycle policy to expire it after the retention period.

Question 9

A security operations team is using AWS Security Hub to aggregate findings from multiple AWS accounts. They want to automatically create a ticket in their IT service management (ITSM) system for any new critical finding. The ITSM system exposes a REST API. Which AWS service should they use to invoke the ITSM API when a critical finding is generated?

Accepted Answer

Amazon EventBridge. Security Hub integrates with EventBridge by sending findings as events. EventBridge rules can filter for critical findings and route them to targets like Lambda or API destinations. API destinations allow EventBridge to invoke external REST APIs directly, enabling automatic ticket creation in the ITSM system without custom code.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Simple Notification Service (SNS)

Question 10

A startup is deploying a new cloud application that stores user profile pictures in an object storage bucket. The security team wants to ensure that data at rest is encrypted and that the encryption keys are managed by the cloud provider with minimal operational overhead. Which encryption option should they choose?

Accepted Answer

Server-side encryption with provider-managed keys (SSE-S3 or equivalent).. Server-side encryption with provider-managed keys automatically encrypts data at rest and the cloud provider handles all aspects of key management, including generation, rotation, and storage. This requires no effort from the startup, perfectly aligning with the goal of minimal operational overhead while ensuring data at rest is encrypted.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Answer

Client-side encryption with keys stored in an on-premises hardware security module (HSM).

Answer

Server-side encryption with customer-managed keys in the cloud KMS (SSE-KMS).

Question 11

A startup wants to deploy a new web application without purchasing servers or managing operating systems, and it prefers to focus only on writing code while the provider handles runtime, scaling, and patching. Which cloud service model aligns BEST with this goal?

Accepted Answer

Platform as a Service (PaaS). PaaS is designed to abstract away servers, operating systems, and runtime management while still allowing custom application deployment. The startup wants to write code and let the provider handle patching and scaling, which is exactly the division of labor PaaS provides, unlike IaaS where infrastructure remains the customer's concern or SaaS where no custom code is deployed.

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Desktop as a Service (DaaS)

Question 12

A security operations center (SOC) uses AWS GuardDuty and wants to automatically isolate an Amazon EC2 instance that generates a high-severity finding. The isolation must block all network traffic except for forensic analysis traffic from a specific security subnet. Which combination of actions should be taken?

Accepted Answer

Modify the instance's security group to allow only traffic from the forensic subnet and remove all other rules.. The most effective and least disruptive method to isolate an EC2 instance is to modify its security group to allow only traffic from a specific forensic subnet and remove all other rules. This blocks all other network traffic while enabling forensic analysis, and it can be automated via Lambda triggered by GuardDuty findings.

Answer

Detach the instance's Elastic Network Interface (ENI) and attach a new ENI with a restrictive security group.

Answer

Move the instance to a new subnet with a network ACL that denies all traffic except from the forensic subnet.

Answer

Apply a new IAM role to the instance that denies all network access.

Question 13

A cloud customer is preparing for an audit of its cloud environment. The provider offers a SOC 2 Type II report covering security and availability. What does this report provide to the customer's auditors?

Accepted Answer

An opinion on the design and operating effectiveness of the provider's controls over a period of time.. A SOC 2 Type II report is an attestation covering a period, with the service auditor opining on the design and operating effectiveness of controls against selected trust services criteria. For the customer's auditors, it supplies independent evidence of sustained control operation, though they must still consider scope, period, and complementary user entity controls.

Answer

A certification issued by the AICPA that the provider fully complies with all applicable laws and regulations.

Answer

A guarantee that the provider's controls will remain effective for the next twelve months.

Answer

A point-in-time description of controls without any testing of operating effectiveness.

Question 14

A cloud security team is reviewing a provider's architecture documentation to assess multi-tenancy risks before migrating regulated workloads. The team wants to verify that logical isolation between tenants is enforced at multiple layers. Which TWO provider controls are MOST directly relevant to preventing one tenant from accessing another tenant's data or processes? (Choose two.)

Accepted Answer

Tenant-scoped encryption keys with strict key separation and access controls. Preventing cross-tenant access requires controls that enforce boundaries at the compute, network, and data layers. Hypervisor isolation with per-tenant network segmentation separates running workloads and their traffic, while tenant-scoped encryption keys protect data even on shared storage. Governance documents such as SLAs, privacy policies, and disaster recovery plans do not create technical isolation boundaries.

Answer

A disaster recovery plan with a documented recovery time objective

Answer

A provider-published privacy policy describing data handling practices

Answer

A published service level agreement guaranteeing 99.99 percent availability

Question 15

A cloud security engineer is configuring an Amazon S3 bucket that must store sensitive financial data. The requirement is that all data must be encrypted at rest with keys that the organization controls and can rotate, and that access to the keys must be auditable and separable from the data access permissions. Which S3 encryption option BEST meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS, with a key policy that grants decrypt permissions only to specific roles and enables automatic key rotation.. The requirement calls for customer-controlled keys, rotation, and auditable, separable key access. SSE-KMS with a customer managed key in AWS KMS satisfies all three: the organization creates and controls the key, can enable automatic rotation, and uses key policies and IAM to separate key access from S3 data access. CloudTrail logs every KMS operation, providing the needed audit trail. Other options either use AWS-managed keys or shift key management outside AWS, failing at least one requirement.

Answer

SSE-C where the customer provides the encryption key with each request, and the key is stored in AWS Secrets Manager for automatic retrieval.

Answer

SSE-S3 with default bucket encryption enabled and S3 Block Public Access turned on.

Answer

Client-side encryption using the AWS Encryption SDK with a master key stored in an on-premises HSM, and uploading the encrypted objects to S3.

Question 16

A financial services firm stores transaction logs in a cloud object storage bucket. Regulations require that deleted records be irrecoverable within 24 hours, even from provider-managed replicas and backups. The security team must select a deletion method that meets this requirement without relying on provider assurances. Which approach BEST satisfies the requirement?

Accepted Answer

Use cryptographic erasure by destroying the customer-managed key that encrypts the objects, rendering all copies undecipherable.. Cryptographic erasure is the only listed method that makes all copies—including provider-managed replicas and backups—unreadable by destroying the customer-controlled key. It avoids dependence on provider deletion timelines and assurances, so it can satisfy a strict 24-hour irrecoverability mandate. Versioning, delete requests, and storage-class changes leave recoverable copies or rely on provider processes.

Answer

Enable bucket versioning and delete the current object versions, relying on the provider's lifecycle policy to purge noncurrent versions after 30 days.

Answer

Issue a delete request for each object and then open a support ticket asking the provider to confirm removal from all replicas and backups.

Answer

Move the objects to a colder storage class with a short retention period, then allow the provider to expire them automatically.

Question 17

A multinational corporation uses a cloud-based data warehouse. The security team must enforce a policy that prevents any user from exporting query results containing more than 100 personally identifiable information (PII) records to an external IP address. Which cloud data security control is MOST appropriate?

Accepted Answer

Implement a cloud access security broker (CASB) with data loss prevention (DLP) policies that inspect outbound traffic for PII and block transfers exceeding the threshold.. A CASB with DLP is designed to inspect data in motion, recognize sensitive information like PII, and enforce policies based on content and volume. It can block or alert on transfers that exceed the defined threshold to external IP addresses, providing the inline enforcement needed to prevent data exfiltration. Other controls either lack content inspection or cannot block the transfer in real time.

Answer

Apply row-level security in the data warehouse to limit the number of PII records each user can query.

Answer

Enable database activity monitoring (DAM) on the data warehouse to log all queries and alert on large result sets.

Answer

Configure cloud storage bucket policies to deny access from external IP ranges.

Question 18

A multinational corporation uses a cloud-based data warehouse to analyze customer data across regions. The company must comply with GDPR, which restricts cross-border data transfers. The security architect needs to ensure that data subjects' personal data remains within the EU region and is not replicated to other regions. Which cloud data security control should be implemented?

Accepted Answer

Data residency policies enforced through cloud provider's region lock feature. GDPR requires that personal data of EU subjects not be transferred to countries without adequate protection unless specific safeguards are in place. To ensure data remains within the EU, the organization should use the cloud provider's region lock or data residency feature, which restricts data storage and processing to a chosen region. This preventive control directly addresses the requirement.

Answer

Use of a cloud access security broker (CASB) to monitor data flows

Answer

Tokenization of all personal data before storing in the cloud data warehouse

Answer

Encryption of data at rest with customer-managed keys stored in the EU

Question 19

A cloud application uses an API gateway to expose backend microservices. The security team wants to ensure that clients cannot bypass the gateway and call backend services directly. Which control should be implemented to enforce this?

Accepted Answer

Place the backend services in a private subnet and restrict inbound traffic to only the API gateway's security group or identity.. Enforcing that backend services accept traffic only from the API gateway requires network-level restriction, such as private subnets combined with security group or identity-based rules. Authentication, rate limiting, and logging at the gateway improve security but do not prevent a client from reaching a backend endpoint that remains exposed.

Answer

Configure rate limiting on the API gateway to prevent clients from sending excessive requests.

Answer

Enable mutual TLS on the API gateway so clients must present certificates to connect.

Answer

Enable access logging on the API gateway and forward logs to a central monitoring service.

Question 20

A cloud security architect is designing a data retention and deletion strategy for a multi-tenant SaaS application hosted in a public cloud. The application stores customer data in a database service and object storage. Regulations require that customer data be permanently deleted upon request, including from backups and disaster recovery sites. Which TWO controls are MOST critical to ensure compliance? (Choose two.)

Accepted Answer

Ensure that the cloud provider's backup and disaster recovery processes include mechanisms to propagate deletions to all copies.. To ensure permanent deletion across backups and DR sites, cryptographic erase (destroying keys) and propagating deletions to all copies are critical. Key rotation and audit logs do not delete data, and versioning can retain data. These two controls together ensure that data is irrecoverable and removed from all storage locations.

Answer

Maintain an immutable audit log of all deletion requests and actions taken.

Answer

Use a centralized key management system with automated key rotation every 30 days.

Answer

Enable versioning on object storage buckets to prevent accidental deletion.