CCSP Practice Exam 62 — 20 Questions

Question 1

An Azure application uses a key vault key for client-side encryption of data. The application also communicates with a cloud service over HTTPS. After deploying, the handshake failure occurs. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The client and server do not have a common TLS version or cipher suite. The handshake failure occurs at the transport layer (TLS/SSL), which is independent of client-side encryption using a key vault key. The most likely cause is a mismatch in TLS versions or cipher suites between the client and server, as HTTPS relies on a successful TLS handshake. Options A, B, and D relate to the key vault key's availability or configuration, which would not cause a TLS handshake failure.

Answer

The application is using the wrong key version

Answer

The key vault key is not accessible due to network restrictions

Answer

The key vault key is not enabled for encryption

Question 2

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) for cloud applications?

Accepted Answer

Security regression testing to validate that new code does not reintroduce vulnerabilities.. Security regression testing (C) is essential because it ensures that new code changes do not reintroduce previously fixed vulnerabilities, which is critical in the continuous integration/continuous delivery (CI/CD) pipelines typical of cloud applications. This testing validates that security patches remain effective across rapid iterations, directly supporting the 'verify' phase of the SSDLC.

Answer

Manual penetration testing after every code commit.

Answer

Security awareness training for all developers.

Question 3

Which THREE of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Resource pooling. Resource pooling is correct because NIST SP 800-145 defines it as one of the five essential characteristics, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. This enables economies of scale and location independence, as the customer generally has no control or knowledge over the exact location of the provided resources.

Answer

Multi-tenancy

Answer

Virtualization

Question 4

A healthcare organization is migrating its electronic health record (EHR) system to a public cloud. The system stores sensitive patient data subject to HIPAA. The cloud architect has designed a multi-tier architecture with load balancers, web servers, application servers, and a PostgreSQL database. The database contains ePHI. To meet compliance, the architect plans to encrypt the database at rest using AWS RDS encryption with KMS. However, during a security review, the compliance officer notes that the database backups are stored in an S3 bucket that is not encrypted. Additionally, the application logs, which may contain patient data, are sent to CloudWatch Logs without encryption. The compliance officer insists that all data stores containing ePHI must be encrypted at rest. Which action should the architect take to ensure compliance?

Accepted Answer

Enable S3 bucket encryption for backups and enable encryption for CloudWatch Logs using KMS.. HIPAA requires encryption of ePHI at rest in all data stores. The S3 bucket containing unencrypted database backups and the CloudWatch Logs that may contain patient data both need encryption enabled via KMS to meet compliance. AWS RDS encryption protects the live database, but backups and logs are separate storage locations that must also be encrypted.

Answer

Disable automated backups and rely on point-in-time recovery.

Answer

Enable encryption on the RDS instance and use encrypted replicas.

Answer

Enable encryption on the S3 bucket only, since backups are the main concern.

Question 5

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) in the cloud? (Choose three.)

Accepted Answer

Static application security testing (SAST) in CI/CD. SAST tools scan source code, bytecode, or binaries for vulnerabilities like SQL injection or buffer overflows early in the development cycle. Integrating SAST into the CI/CD pipeline enables automated, continuous security checks on every commit or build, which is a core practice of a Secure Software Development Lifecycle (SSDLC) in the cloud. This shift-left approach catches flaws before they reach production, reducing remediation cost and risk.

Answer

Manual code reviews without automation

Answer

Annual penetration testing only

Question 6

In a public cloud IaaS model, which of the following security controls is the cloud customer primarily responsible for implementing?

Accepted Answer

Guest OS patch management. The customer is responsible for securing the guest OS and applications.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of data centers

Question 7

The security team notices that the request above is from a known malicious IP address. However, the load balancer did not block it. What is the most likely reason?

Accepted Answer

The load balancer's access control list does not include the IP address. C is correct because a load balancer's access control list (ACL) is a stateless or stateful rule set that explicitly defines which source IP addresses are allowed or denied. If the malicious IP address is not listed in the ACL, the load balancer will not block the traffic, regardless of the request's content or encryption status. The security team's observation that the request was from a known malicious IP but was not blocked directly points to a missing or incomplete ACL entry.

Answer

The user-agent indicates it is a legitimate search engine

Answer

The response code indicates success

Answer

The request was encrypted with TLS

Question 8

A company uses AWS CloudTrail with log file validation enabled. An auditor wants to verify that a specific log file has not been tampered with. Which process should the auditor use to confirm the integrity of the CloudTrail log file?

Accepted Answer

Use the AWS CLI command 'aws cloudtrail validate-logs' which automatically verifies the digital signature and hash. CloudTrail log file validation uses SHA-256 hashing and digital signatures. The log file digest file contains the hash of the log file and is signed by a private key. To verify, the auditor uses the public key (from AWS) to verify the signature on the digest, then compares the hash of the log file to the hash in the digest.

Answer

Check the log file’s last modified timestamp against the CloudTrail delivery timestamp

Answer

Compare the log file’s SHA-256 hash with the hash stored in AWS Key Management Service (KMS)

Answer

Review the log file’s integrity using the SHA-256 checksum provided in the S3 object metadata

Question 9

A large enterprise is migrating a legacy .NET application to Azure App Service. The application currently stores session state in-memory on the web server. During the migration, the team plans to horizontally scale the application across multiple instances. The security team requires that session data remain confidential and be available even if an instance fails. Which solution should the team implement?

Accepted Answer

Use Azure Redis Cache to store session state with encryption enabled. Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.

Answer

Store session data in Azure SQL Database with column-level encryption

Answer

Encrypt session data and store it as a client-side cookie

Answer

Configure Application Gateway with cookie-based affinity (sticky sessions)

Question 10

The exhibit shows the versioning configuration for an S3 bucket. What effect does enabling MFADelete have on data protection?

Accepted Answer

It requires MFA to permanently delete an object version. Enabling MFADelete on an S3 bucket requires multi-factor authentication to permanently delete an object version or to suspend versioning on the bucket. This adds a critical layer of protection against accidental or malicious deletion of object versions, ensuring that even with administrative credentials, a second factor is needed to complete the destructive operation. It does not affect encryption, overwrite prevention, or all operations—only permanent deletion and versioning suspension.

Answer

It automatically encrypts all new object versions

Answer

It prevents any version of an object from being overwritten

Answer

It requires MFA for all operations on the bucket

Question 11

A cloud security architect is designing a data classification and labeling solution for a multinational corporation with offices in multiple countries. The corporation uses various SaaS applications (Office 365, Salesforce, etc.) and IaaS services. They require automatic classification of documents based on content (e.g., credit card numbers, social security numbers) and enforcement of protection policies (e.g., encryption, access restrictions) based on the classification. The solution must work across all cloud services and provide a unified management console. The corporation also needs to maintain data residency—data must not be stored in a different geographic region than where it was classified. Which cloud security solution BEST meets these requirements?

Accepted Answer

Deploy a cloud access security broker (CASB) with integrated DLP capabilities that can classify and enforce policies across multiple cloud apps.. A CASB with integrated DLP can classify content across multiple cloud apps and enforce policies from a single console, while also supporting data residency through policy configuration. Option B lacks unified management. Option C is complex and may not scale. Option D does not provide classification.

Answer

Use each cloud provider's native DLP service (e.g., Microsoft Information Protection, AWS Macie) and manage them individually.

Answer

Use a third-party encryption gateway that encrypts all data leaving the on-premises network.

Answer

Implement a custom data classification system running on a virtual machine that inspects data via APIs.

Question 12

Which runtime security control monitors application behavior and can block attacks by analyzing application logic and context?

Accepted Answer

Runtime application self-protection (RASP). C is correct because Runtime Application Self-Protection (RASP) is a security technology that is integrated into an application's runtime environment, allowing it to monitor actual application behavior and context (e.g., input validation, SQL queries, API calls) in real time. Unlike external controls, RASP can understand the application's logic and data flow, enabling it to block attacks such as SQL injection or command injection by analyzing the specific context of each request.

Answer

Web application firewall (WAF)

Answer

Intrusion detection system (IDS)

Answer

Static application security testing (SAST)

Question 13

Drag and drop the steps for responding to a security incident involving a compromised cloud VM into the correct order.

Accepted Answer

Isolate, then Capture Forensics, then Terminate, then Analyze, then Remediate and Restore. First isolate, then capture forensics, terminate, analyze, and finally remediate and restore.

Answer

Isolate, then Terminate, then Capture Forensics, then Analyze, then Remediate and Restore

Answer

Analyze, then Isolate, then Capture Forensics, then Terminate, then Remediate and Restore

Answer

Isolate, then Capture Forensics, then Terminate, then Remediate and Restore, then Analyze

Question 14

Which TWO statements about data classification are correct?

Accepted Answer

Data classification can be based on context and content.. Data classification can be based on both context (e.g., source, creator, location) and content (e.g., keywords, patterns, data values). This dual approach allows organizations to apply classification rules that consider the environment and the actual data, enabling more accurate and granular protection. For example, a document containing a credit card number (content) created by the finance department (context) could be classified as 'Confidential'.

Answer

Data classification is performed once at creation.

Answer

Data classification must be automated to be effective.

Answer

Data classification is solely based on regulatory requirements.

Question 15

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

Accepted Answer

Enable automatic key rotation and configure detailed audit logging for the key management service.. Enabling automatic key rotation reduces the risk of key compromise by limiting the exposure window of any single key, while detailed audit logging for the key management service (e.g., AWS CloudTrail for KMS, Azure Monitor for Key Vault) provides an immutable record of all key usage and administrative actions. This combination ensures that even if a CMK is exposed, the window of vulnerability is minimized, and any unauthorized access or misuse is detectable through logs. Without these controls, the customer-managed key could remain static for long periods, increasing risk, and access events would not be auditable, violating the policy requirement.

Answer

Implement a VPN for all management traffic to the cloud provider's API.

Answer

Enable multi-factor authentication (MFA) for all cloud console users.

Answer

Use encryption in transit (TLS) for all data transfers to and from the cloud.

Question 16

A cloud customer wants to ensure they can audit their cloud provider's security controls annually. Which contractual provision should be included in the cloud service agreement?

Accepted Answer

Right to audit clause. A right to audit clause gives the customer the contractual ability to perform audits, review security reports, or bring in a third-party auditor.

Answer

Service level agreement (SLA) with uptime guarantees

Answer

Data deletion clause

Answer

Data portability clause

Question 17

A company uses a cloud key management service (KMS) with an HSM-backed key for encrypting sensitive data. They want to ensure that the key is automatically rotated every 90 days and that older key versions are retained for decryption of previously encrypted data. Which KMS feature should be configured?

Accepted Answer

Automatic key rotation with version retention. Key rotation in cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) can be set to automatic rotation with a specified period. Old key versions are retained so that data encrypted with older keys can still be decrypted. The key material changes, but key ID remains the same.

Answer

Key aliasing

Answer

Key destruction schedule

Answer

Key revocation policy

Question 18

A company is migrating to the cloud to reduce capital expenditures. They want to pay only for the resources they consume with no upfront investment. Which financial model does this describe?

Accepted Answer

Opex. The operating expenditure (Opex) model allows a company to pay for cloud resources on a consumption basis without any upfront capital investment. This aligns with the goal of reducing capital expenditures (Capex) by shifting costs to variable, pay-as-you-go operational expenses.

Answer

Amortization

Answer

Capex

Answer

Leasing

Question 19

A cloud security engineer is designing a disaster recovery plan for a critical application running on virtual machines. The RTO is 4 hours and RPO is 1 hour. Which approach meets these requirements?

Accepted Answer

Keep a warm standby in another region with continuous data replication.. Meets both the RTO of 4 hours and RPO of 1 hour by maintaining a warm standby in another region with continuous data replication. Continuous replication ensures data is synchronized with minimal lag (well under 1 hour), and the warm standby VM can be activated quickly to meet the 4-hour RTO. This approach balances cost and recovery speed, as a warm standby is partially running and can be promoted to production faster than a cold standby.

Answer

Take daily snapshots and restore to a different region.

Answer

Use synchronous replication to a secondary availability zone.

Answer

Use asynchronous replication with a 1-hour lag to a secondary site.

Question 20

A financial services company uses a hybrid cloud environment with an on-premises data center and AWS. They have deployed a Cloud Access Security Broker (CASB) to enforce data loss prevention (DLP) policies for SaaS applications. Recently, the security team noticed that sensitive customer data is being exfiltrated via encrypted traffic to a sanctioned cloud storage application. The CASB logs show the traffic is identified as HTTPS, but the DLP policy is not blocking it. The team verifies that the CASB is configured with a forward proxy and SSL inspection is enabled. Which action should the security team take to prevent this exfiltration?

Accepted Answer

Ensure the CASB's SSL certificate is deployed to all endpoint devices. The CASB is configured as a forward proxy with SSL inspection enabled, but for SSL inspection to work, the CASB's certificate must be trusted by the endpoint devices. Without the CASB's certificate deployed to the endpoints, the SSL inspection fails (the CASB cannot decrypt the traffic), so the DLP policy cannot inspect the payload of HTTPS traffic, allowing sensitive data to be exfiltrated. Deploying the CASB's certificate to all endpoint devices ensures that the endpoints trust the CASB's man-in-the-middle decryption, enabling the CASB to decrypt, inspect, and enforce DLP policies on encrypted traffic.

Answer

Block all HTTPS traffic to the cloud storage application

Answer

Configure the CASB to log only metadata for encrypted traffic

Answer

Disable HTTPS for the cloud storage application and force HTTP