CCSP Practice Exam 61 — 20 Questions

Question 1

An organization uses a cloud storage service to share files with external partners. They want to ensure that the files are automatically deleted after 30 days. Which data lifecycle control should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lifecycle policy. A lifecycle policy is the correct data lifecycle control because it allows administrators to define rules that automatically expire and delete objects after a specified period, such as 30 days. This is a native feature of cloud storage services like Amazon S3, Azure Blob Storage, and Google Cloud Storage, enabling automated data retention and deletion without manual intervention.

Answer

Object lock

Answer

Versioning

Answer

Access control list

Question 2

A development team is adopting a DevSecOps approach for a cloud-native application. Which practice best exemplifies the shift-left security principle?

Accepted Answer

Scanning Infrastructure as Code (IaC) templates with Checkov before deployment. Scanning Infrastructure as Code (IaC) templates with Checkov before deployment embodies the shift-left security principle by identifying and remediating misconfigurations early in the development lifecycle. This proactive approach prevents security issues from reaching production, reducing risk and cost compared to post-deployment fixes.

Answer

Reviewing logs for security incidents weekly

Answer

Configuring a cloud WAF after the application is live

Answer

Performing runtime penetration testing after deployment

Question 3

An organization uses a cloud-based DLP solution to monitor outbound traffic. They want to prevent the exfiltration of credit card numbers. Which detection technique is most appropriate for this requirement?

Accepted Answer

Regular expression matching for credit card number patterns. Regular expression matching (option D) is the most appropriate technique because credit card numbers follow well-defined, predictable patterns (e.g., 16 digits, specific starting digits for each issuer like 4 for Visa, 5 for MasterCard, and Luhn algorithm validation). This allows the DLP solution to detect credit card numbers in outbound traffic without requiring a pre-populated list or prior training, making it ideal for real-time monitoring of unknown or new card numbers.

Answer

Exact data matching against a list of known card numbers

Answer

Machine learning classification of sensitive data

Answer

Fingerprinting of known credit card documents

Question 4

An organization experiences a data breach in the cloud. The CSP claims they are not liable because the breach was due to customer misconfiguration. The customer disagrees. What document should be reviewed to determine liability?

Accepted Answer

The shared responsibility matrix in the service contract. The shared responsibility matrix (SRM) is the definitive contractual document that delineates which security controls are managed by the cloud service provider (CSP) and which are the customer's obligation. In a breach caused by misconfiguration, the SRM specifies whether the configuration of the affected resource (e.g., an S3 bucket ACL or a security group rule) falls under the customer's responsibility. Without reviewing the SRM, liability cannot be determined because the matrix explicitly maps each control layer (e.g., network, compute, data) to the responsible party.

Answer

The CSP's privacy policy

Answer

The SOC 2 Type II report from the CSP

Answer

The incident response plan

Question 5

An organization stores archival data in cloud cold storage and requires each customer's data to be encrypted with unique keys managed by the customer. Which encryption approach meets this requirement?

Accepted Answer

Client-side encryption. Client-side encryption ensures that data is encrypted before it is sent to the cloud, and the customer retains sole control over the encryption keys. This approach meets the requirement for each customer's data to be encrypted with unique keys managed by the customer, as the cloud provider never has access to the keys or the unencrypted data.

Answer

Server-side encryption with customer-managed keys (SSE-KMS)

Answer

Server-side encryption with cloud-provider keys (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Question 6

The exhibit shows a bucket policy that grants public read access. What is the most effective way to remove this public access?

Accepted Answer

Enable public access prevention at the bucket or account level.. Public access prevention settings provide a definitive, override-capable mechanism to prevent any public access to a cloud storage bucket, regardless of other policies or ACLs. Applied at the bucket or account level, these settings block all public access even if a bucket policy explicitly grants it, making them the most effective and secure method to remove public access.

Answer

Add an access control list (ACL) that denies public access.

Answer

Change the bucket policy to deny all access.

Answer

Enable bucket versioning and delete the public objects.

Question 7

A US-based company uses a cloud provider with data centers in the US and Europe. To transfer personal data of EU citizens to the US, which mechanism is most appropriate under GDPR?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are the most appropriate mechanism because they provide a legally recognized data transfer tool under GDPR Article 46 for transferring personal data from the EU to a third country (the US) without an adequacy decision. SCCs are pre-approved contractual terms that both the data exporter (EU-based) and data importer (US-based) must sign, ensuring adequate safeguards for the data subjects' rights. This mechanism is specifically designed for scenarios where the cloud provider's data centers span jurisdictions without a current adequacy finding, as is the case with the US post-Schrems II.

Answer

Explicit consent

Answer

Binding Corporate Rules (BCRs)

Answer

Adequacy decision

Question 8

Refer to the exhibit. A developer reports that users are being denied access to a cloud application. The error log shows the above. What is the most likely cause of the denial?

Accepted Answer

The token's expiration time has passed. The error log indicates that the token's expiration time has passed, which is a standard validation check in OAuth 2.0 and OpenID Connect (OIDC) flows. When a token's `exp` claim is less than the current server time, the authorization server or resource server rejects the request with an 'access denied' or similar error. This is the most direct cause of the denial shown in the exhibit.

Answer

The token was issued by an untrusted issuer

Answer

The token lacks required permissions

Answer

The token's signature is invalid

Question 9

A financial services company uses a cloud-based logging service for audit trails. A regulatory investigation is initiated, and the company is required to preserve all logs from the past 18 months. The cloud provider's default retention policy is 12 months, and logs older than that are automatically deleted. The company did not configure custom retention. What is the most appropriate action to ensure compliance?

Accepted Answer

Request that the provider place a legal hold on all logs and verify implementation.. A legal hold (or litigation hold) is a cloud provider feature that overrides the default retention policy to preserve data indefinitely or for a specified period, preventing automated deletion. This ensures compliance with regulatory requirements without relying on manual exports or backups, and the company must verify implementation through provider tools or APIs to confirm the hold is active.

Answer

Accept the data loss and explain to regulators that the provider has a limited retention policy.

Answer

Export all available logs and store them locally immediately.

Answer

Rely on the provider's backup policy, which may retain data for up to 24 months.

Question 10

Which of the following is a benefit of enabling log file validation for cloud audit logs?

Accepted Answer

It ensures the integrity of log files by allowing you to confirm that they have not been modified.. Log file validation uses a hash-based digital signature (such as SHA-256) to create a digest file for each log file. This allows you to verify that the log files have not been tampered with, deleted, or modified after they were delivered, ensuring their integrity for forensic analysis and compliance.

Answer

It automatically deletes old log files based on a retention policy.

Answer

It encrypts log files at rest.

Answer

It compresses log files to save storage space.

Question 11

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is the correct legal framework because it specifically governs the processing of personally identifiable information (PII) of European Union citizens, regardless of where the data is stored or processed. As the cloud customer is moving a customer database containing EU PII to a public cloud provider, GDPR imposes strict requirements on the data controller (the customer) for data protection, consent, breach notification, and cross-border data transfer safeguards.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Question 12

A company's cloud infrastructure is subject to GDPR. The DPO requires that all customer personal data be encrypted at rest and in transit. The cloud provider offers SSE-S3 for object storage and enforces TLS 1.2 for API calls. Which additional control should the company implement to meet GDPR accountability requirements?

Accepted Answer

Enable detailed logging of all access to encrypted data.. While SSE-S3 and TLS 1.2 address encryption at rest and in transit, GDPR accountability requires the company to demonstrate compliance through audit trails. Enabling detailed logging of all access to encrypted data (Option B) provides the necessary records to prove who accessed personal data, when, and from where, fulfilling the 'demonstrate compliance' principle under Article 5(2) and Article 30 of the GDPR.

Answer

Implement client-side encryption with a key management service.

Answer

Automatically delete backups older than 30 days.

Answer

Apply data masking to all personal data fields before storage.

Question 13

A healthcare company uses a cloud-based patient management system. The cloud provider experiences a security incident that may have exposed protected health information (PHI). The provider notifies the company within 72 hours, as required by the service agreement. The company's internal breach response policy requires a legal review of the incident before notifying affected individuals. The legal review typically takes 48 hours. However, the company is required to notify patients within 60 days under HIPAA. With the 72-hour notification from the provider, the company has 60 days to notify patients. What is the most effective approach to meet the 60-day notification requirement while ensuring compliance with internal policy?

Accepted Answer

Begin the legal review immediately and prepare patient notification in parallel.. It allows the company to satisfy both the HIPAA 60-day notification requirement and its internal legal review policy by running the legal review and patient notification preparation concurrently. This parallel approach minimizes delay while ensuring that the notification content is legally vetted before release, which is critical for PHI incidents under HIPAA's Breach Notification Rule (45 CFR § 164.404).

Answer

Notify patients immediately and then perform the legal review.

Answer

Wait for the legal review to complete before notifying patients.

Answer

Notify patients immediately based on the provider's notification.

Question 14

A global e-commerce platform uses AWS API Gateway to expose REST APIs to third-party developers. The security team notices that a malicious user is repeatedly sending large payloads to a /submit endpoint, causing high CPU usage on backend Lambda functions. The API uses a simple API key for authentication. Which combination of controls should be implemented to mitigate this attack while preserving legitimate access?

Accepted Answer

Configure API Gateway throttling and request body size validation. It directly addresses the two attack vectors: large payloads causing CPU exhaustion and excessive request volume. API Gateway request body size validation (up to 10 MB by default, configurable) rejects oversized payloads before they reach the backend Lambda, while throttling (e.g., 10,000 requests per second with a burst limit) prevents a single user from overwhelming the system. Together, these controls preserve legitimate access by only limiting anomalous traffic, not blocking all users.

Answer

Subscribe to AWS Shield Advanced for DDoS protection

Answer

Change authentication to IAM roles with temporary credentials

Answer

Enable AWS WAF with a rate-based rule and block IP addresses

Question 15

A cloud application is being designed to handle highly sensitive financial data. The security architect wants to ensure that encryption keys are managed outside the application's memory space. Which service model should they use?

Accepted Answer

Hardware Security Module (HSM). A Hardware Security Module (HSM) is a dedicated hardware appliance that manages encryption keys in a physically and logically isolated environment, entirely separate from the application's memory space. For highly sensitive financial data, an HSM provides FIPS 140-2 Level 3 or higher certification, ensuring keys never leave the device and are protected against memory-scraping attacks. This aligns with the requirement to keep key management outside the application's memory.

Answer

Cloud Hardware Security Module (CloudHSM)

Answer

Key Management Service (KMS)

Answer

Trusted Platform Module (TPM)

Question 16

A company is implementing a hybrid cloud architecture. Which two components are essential for establishing a secure connection between on-premises and cloud environments? (Choose two.)

Accepted Answer

Direct connect or dedicated interconnect. A Direct Connect or dedicated interconnect provides a private, dedicated network connection from on-premises to the cloud provider, bypassing the public internet for lower latency and more consistent bandwidth. A VPN gateway establishes an encrypted tunnel over the public internet using protocols like IPsec (IKEv2) to secure data in transit. Together, these two components form the essential hybrid connectivity layer: the dedicated circuit for primary, high-throughput traffic and the VPN as a secure backup or for lower-cost, lower-bandwidth needs.

Answer

Identity and access management (IAM)

Answer

Cloud access security broker (CASB)

Answer

Web application firewall (WAF)

Question 17

Which TWO of the following are key components of a cloud incident response plan that should be tested regularly?

Accepted Answer

Automation playbooks for containment and eradication.. Automation playbooks for containment and eradication (B) are critical because they enable rapid, consistent response to incidents in cloud environments, where manual intervention can be too slow to prevent lateral movement or data exfiltration. Regular testing ensures these playbooks execute correctly against live cloud APIs (e.g., AWS Lambda, Azure Automation) and that they properly isolate compromised resources without disrupting legitimate workloads.

Answer

Encryption key management procedures.

Answer

Backup and restore procedures.

Answer

Service level agreements (SLAs) with cloud provider.

Question 18

Which THREE are key considerations when designing a secure software development lifecycle (SSDLC) for cloud applications?

Accepted Answer

Static code analysis during development. Static code analysis (SAST) is a key SSDLC practice because it automatically scans source code for security vulnerabilities (e.g., SQL injection, buffer overflows) during the development phase, enabling early remediation before code is deployed. This aligns with the 'shift left' principle, reducing the cost and effort of fixing flaws later in the lifecycle.

Answer

Security testing in production

Answer

Using a single cloud provider

Question 19

Which THREE of the following are common challenges in securing serverless applications?

Accepted Answer

Insecure handling of event source inputs. Serverless functions rely on event-driven architectures where inputs from sources like HTTP requests, database changes, or message queues are processed directly. If these inputs are not properly validated and sanitized, attackers can inject malicious payloads (e.g., SQL injection, command injection) that execute within the function's runtime, leading to data breaches or unauthorized actions. This is a primary attack vector unique to serverless, as the function code directly consumes untrusted data without traditional perimeter defenses.

Answer

Lack of control over the underlying kernel and OS

Answer

Difficulty in applying stateful firewall rules

Question 20

Which THREE of the following are key components of a data protection impact assessment (DPIA) under GDPR?

Accepted Answer

Measures to address risks. Article 35 of the GDPR explicitly requires a DPIA to include 'measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data.' This is a core component that demonstrates how the controller will mitigate identified privacy risks to an acceptable level.

Answer

List of all data subjects' names

Answer

Copy of the encryption algorithm