CCSP Practice Exam 63 — 20 Questions

Question 1

A cloud security team needs to ensure that all data in transit between on-premises systems and the cloud is encrypted. Which TWO options should they consider? (Choose two.)

Accepted Answer

Set up a VPN between on-premises and cloud. TLS 1.2+ encrypts API communications, and VPN establishes an encrypted tunnel for hybrid connectivity. Both protect data in transit.

Answer

Use signed URLs for access

Answer

Enable bucket versioning

Answer

Enable server-side encryption with CMEK

Question 2

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 3

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 4

A cloud administrator is configuring log retention for a financial application that must comply with PCI DSS. What is the minimum log retention period required by PCI DSS?

Accepted Answer

At least one year with the most recent three months available online.. PCI DSS requirement 10.7 mandates that audit trail history must be retained for at least one year, with the most recent three months of logs immediately available for analysis. This ensures that historical data is preserved for forensic investigation while maintaining quick access to recent activity. Option D correctly states this dual requirement.

Answer

At least 90 days.

Answer

At least six months.

Answer

At least five years.

Question 5

A cloud administrator applies the bucket policy shown in the exhibit to an S3 bucket. What is the expected outcome?

Accepted Answer

All objects uploaded must be encrypted using server-side encryption with S3-managed keys (SSE-S3). The bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

Answer

All upload requests will be denied unless they include encryption metadata

Answer

All objects must be encrypted with AWS KMS keys

Answer

All objects uploaded must be client-side encrypted before uploading

Question 6

A small business recently migrated its file server to a cloud storage service like Amazon S3. They use bucket policies to control access. The IT manager, who is not a security expert, configured the bucket policy to allow all users within the company's AWS account to have read and write access. During an internal audit, it was discovered that the bucket also had a public ACL that allowed 'Everyone' to read objects. The security analyst needs to fix the misconfiguration and prevent future occurrences. Which of the following actions should the analyst take first?

Accepted Answer

Remove the public ACL and update the bucket policy to enforce least privilege.. The immediate priority is to remediate the active vulnerability by removing the public ACL that grants 'Everyone' read access, then updating the bucket policy to enforce least privilege for the company's AWS account. This directly addresses the misconfiguration and aligns with the principle of denying public access by default, which is a core security best practice for cloud storage services like Amazon S3.

Answer

Delete the bucket and recreate it with default private settings.

Answer

Set up a notification to alert when bucket policies change.

Answer

Enable bucket versioning to recover from accidental public exposure.

Question 7

An enterprise uses a Cloud Access Security Broker (CASB) to monitor cloud application usage. The CASB generates alerts about potential data loss prevention events. What is the primary purpose of the CASB's DLP capabilities?

Accepted Answer

To detect and prevent unauthorized sharing of sensitive data based on policies. The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Answer

To block all uploads of sensitive data to cloud apps

Answer

To classify data automatically using machine learning

Answer

To encrypt data before it is sent to cloud apps

Question 8

Which THREE statements about cryptographic key lifecycle management are correct?

Accepted Answer

Key usage should be logged and audited.. Auditing key usage is a fundamental requirement for accountability and compliance in cryptographic key management. Logging every key operation (e.g., generation, encryption, decryption, signing) allows detection of unauthorized use or policy violations, and is mandated by standards like NIST SP 800-57 Part 1, which states that audit logs must be protected and reviewed regularly.

Answer

Key backup must be encrypted and stored separately from the keys they protect.

Answer

Key rotation policies must ensure all data is re-encrypted with the new key immediately.

Question 9

Which TWO of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Measured service. NIST defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Measured service and resource pooling are correct; multitenancy and virtualization are enablers, not characteristics.

Answer

Multitenancy

Answer

Virtualization

Answer

Auditability

Question 10

Which risk assessment method uses subjective scales to assign probabilities and impacts?

Accepted Answer

Qualitative risk assessment. Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Answer

Semi-quantitative risk assessment

Answer

Quantitative risk assessment

Answer

Bottom-up risk assessment

Question 11

A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?

Accepted Answer

Implement a secrets detection tool in the pipeline. A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.

Answer

Use environment variables in the pipeline configuration

Answer

Use a separate build server

Answer

Encrypt the Git repository

Question 12

Which TWO of the following are secure coding practices that help prevent injection attacks?

Accepted Answer

Using parameterized queries for database calls. Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver treats the user-supplied values strictly as data, never as executable code, which prevents an attacker from injecting malicious SQL commands even if the input contains special characters like `' OR 1=1 --`.

Answer

Printing stack traces in production error messages

Answer

Using stored procedures exclusively

Answer

Storing user passwords in plaintext

Question 13

A multinational corporation uses a SaaS application for customer relationship management (CRM). The CRM application stores customer data including names, email addresses, and purchase history. The company has operations in the EU, California, and Japan. A new regulation in Japan requires that any transfer of personal data outside Japan must have the data subject's consent if the destination country does not have an adequacy decision. The company's cloud provider stores data in the United States. The company currently relies on the provider's data processing agreement that includes standard contractual clauses (SCCs). However, the Japanese regulator has stated that SCCs are not sufficient for transfers from Japan unless supplemented. You are tasked with ensuring compliance for Japanese data subjects. Which of the following is the most appropriate next step?
A. Obtain explicit consent from each Japanese data subject for data transfer to the US.
B. Move the data for Japanese subjects to a data center in Japan.
C. Continue using SCCs as they are recognized internationally.
D. Pseudonymize the data before transfer.

Which option best addresses the compliance requirement while considering the operational impact?

Accepted Answer

Obtain explicit consent from each Japanese data subject for data transfer to the US.. The Japanese regulator has explicitly stated that SCCs alone are insufficient for transfers from Japan, and obtaining explicit consent from each data subject directly satisfies the requirement for a valid transfer mechanism under Japanese law. This approach ensures compliance without requiring infrastructure changes, though it may be operationally burdensome. The other options either fail to meet regulatory requirements or introduce unnecessary operational impact.

Answer

Move the data for Japanese subjects to a data center in Japan.

Answer

Continue using SCCs as they are recognized internationally.

Answer

Pseudonymize the data before transfer.

Question 14

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 15

Which THREE of the following are effective strategies for ensuring data backup integrity and recoverability in the cloud?

Accepted Answer

Maintain at least three copies of data across two different locations.. The 3-2-1 backup rule (three copies, two different media types, one offsite) is a foundational strategy for data durability and recoverability. In cloud environments, this typically means maintaining a primary copy, a local backup in a different availability zone, and a cross-region copy to protect against region-wide failures. This ensures that even if two copies are compromised, a third remains available for recovery.

Answer

Encrypt all backups with a strong algorithm.

Answer

Set backup schedules to run daily for all critical data.

Question 16

A cloud application uses customer-managed encryption keys (CMK) stored in a cloud HSM. The application needs to decrypt data on demand. How should the key be accessed?

Accepted Answer

Use a key management service with IAM permissions. Cloud key management services (e.g., AWS KMS, Azure Key Vault) allow you to use customer-managed keys (CMK) stored in a cloud HSM without ever exposing the plaintext key to the application. The application calls the KMS API with IAM permissions to request decryption, and the HSM performs the decryption inside its hardware boundary, returning only the decrypted data. This ensures the key material never leaves the HSM's secure enclave, maintaining the security posture required for CMK usage.

Answer

Use the HSM to decrypt without exposing the key

Answer

Store the key in application configuration

Answer

Copy the key to the application's memory

Question 17

In a cloud environment, a data subject exercises their right to erasure under GDPR. The cloud provider has multiple replicas and backups. What is the primary technical challenge in fulfilling this request?

Accepted Answer

Ensuring deletion from backups and replicas within retention periods. GDPR's right to erasure requires deletion of all copies, including from backups and replicas, which is technically complex due to retention policies and storage architecture.

Answer

Transferring data to another controller

Answer

Obtaining consent from other data subjects

Answer

Identifying the data subject's data across all systems

Question 18

An organization uses a cloud key management service (KMS) for encryption keys. The security policy requires automatic rotation of keys every 90 days. Which rotation strategy best balances security and operational impact?

Accepted Answer

Configure the KMS to automatically generate new key versions and retire old ones with no application changes.. Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) support automatic key rotation by creating new key versions while retaining previous versions for decryption of existing data. This approach satisfies the 90-day rotation policy without requiring application changes, as the KMS handles versioning transparently and the encryption context or key ID abstraction allows seamless use of the latest key for encryption.

Answer

Retain the original key for decryption and use a new key only for new data.

Answer

Have administrators manually create new keys every 90 days and update applications.

Answer

Re-encrypt all data with a new master key each rotation to ensure full key separation.

Question 19

A cloud architect is designing a multi-tier application in a public cloud. The web tier must be accessible from the internet, while the application and database tiers must only be reachable from the web tier. The architect needs to ensure that even if the web server is compromised, the attacker cannot directly access the database. Which architecture BEST meets this requirement?

Accepted Answer

Place the web tier in a public subnet with a security group allowing HTTP/HTTPS from 0.0.0.0/0, and place the app and database tiers in private subnets with security groups allowing traffic only from the web tier's security group.. It implements defense-in-depth by placing the web tier in a public subnet with a security group that allows inbound HTTP/HTTPS from the internet, while the app and database tiers reside in private subnets with security groups that only permit traffic from the web tier's security group. This ensures that even if the web server is compromised, the attacker cannot directly reach the database because the database security group explicitly denies traffic from any source other than the web tier's security group, and the private subnets have no direct internet route.

Answer

Place all tiers in the same subnet and use a single security group to control inbound traffic.

Answer

Place all tiers in the same VPC but different subnets, and use network ACLs to restrict traffic.

Answer

Use a VPN to connect the tiers and rely on IPsec policies for segmentation.

Question 20

During a code review, a developer identifies that an application uses input from an HTTP request to generate a SQL query string. What is the primary security concern?

Accepted Answer

SQL injection. Directly concatenating user-supplied input from an HTTP request into a SQL query string allows an attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, data manipulation, or even complete database compromise. The primary security concern is SQL injection, which violates the confidentiality and integrity of cloud-hosted databases.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Cross-site scripting (XSS)