CCSP Practice Test 7 — 10 Questions

Question 1

A cloud security administrator needs to ensure that all API calls to the cloud provider's management plane are logged for audit purposes. Which service should be enabled?

Accepted Answer

Cloud audit logging service. The cloud audit logging service (e.g., AWS CloudTrail) records API calls for auditing. Option A (monitoring) focuses on performance metrics. Option B (configuration) tracks resource changes but not all API calls. Option D (threat detection) is for security threats.

Answer

Cloud configuration service

Answer

Cloud threat detection service

Answer

Cloud monitoring service

Question 2

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 3

A company is negotiating a cloud contract and wants to ensure data ownership and deletion. Which TWO clauses should be included? (Select two.)

Accepted Answer

Data ownership clause. Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Answer

Right to audit clause

Answer

Non-disclosure agreement

Answer

Service level agreement

Question 4

During an audit of a containerized application, you notice that containers are running with the --privileged flag. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Container escape to the host. Privileged containers have nearly all capabilities of the host, significantly increasing the risk of container escape and host compromise.

Answer

Increased memory consumption

Answer

Inability to use secure base images

Answer

Excessive network bandwidth usage

Question 5

A financial institution is implementing a data classification scheme for their cloud environment. They have data that, if exposed, could cause severe damage to the organization and is subject to strict regulatory requirements. Which classification level should be applied to this data?

Accepted Answer

Restricted. Restricted data is the highest classification level, typically used for data that, if compromised, could cause severe damage and is subject to strict regulations.

Answer

Confidential

Answer

Public

Answer

Internal

Question 6

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Image signing, vulnerability scanning, and using admission controllers to verify signatures ensure integrity and trust.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag

Question 7

A DevSecOps team is integrating static application security testing (SAST) into their CI/CD pipeline. Which of the following is the PRIMARY benefit of performing SAST during the build phase rather than later in the pipeline?

Accepted Answer

It enables early detection of vulnerabilities before deployment. Performing SAST during the build phase allows the team to identify security vulnerabilities in the source code before the application is compiled, packaged, or deployed. This early detection reduces the cost and effort of remediation because issues are found at the point of code creation, not after deployment. The primary benefit is shifting security left to catch defects before they reach production.

Answer

It identifies runtime vulnerabilities such as SQL injection

Answer

It reduces false positives compared to dynamic analysis

Answer

It scans running applications to find configuration issues

Question 8

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Accepted Answer

Static application security testing (SAST). Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for early detection of vulnerabilities during the coding phase of the SSDLC. By integrating SAST into the CI/CD pipeline, developers receive immediate feedback on security flaws such as SQL injection or buffer overflows, enabling remediation before the code is built or deployed. This aligns with the 'shift left' principle, catching issues when they are cheapest and easiest to fix.

Answer

Penetration testing in production

Answer

Dynamic application security testing (DAST)

Answer

Manual code review

Question 9

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Dedicated secrets management services (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provide centralized, auditable, and policy-controlled storage for secrets like API keys and database credentials. These services enforce encryption at rest (e.g., using envelope encryption with AWS KMS) and in transit (TLS 1.2+), and support automatic rotation, reducing the risk of exposure compared to ad-hoc methods.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 10

A startup provides a cloud-based document collaboration platform. They store user-uploaded documents in a cloud object storage bucket. Compliance with data privacy laws requires that when a user deletes an account, all their documents must be permanently deleted within 30 days. The current process uses object versioning and lifecycle policies to expire objects after 30 days. However, during a recent audit, it was discovered that deleted user documents were still accessible via the bucket's previous versions for months after the deletion. The security team needs to ensure that all traces of a user's data are removed immediately upon account deletion. Which solution should be implemented?

Accepted Answer

Use a lifecycle policy to permanently delete current and previous object versions immediately after the user deletion request.. Object versioning in cloud storage (e.g., AWS S3) retains both current and previous versions of objects. A lifecycle policy that immediately expires both current and noncurrent versions upon user deletion ensures that all copies of the data are permanently removed, satisfying the 30-day compliance requirement. Without explicitly targeting previous versions, the default lifecycle policy only deletes current versions, leaving older versions accessible indefinitely.

Answer

Configure bucket policies to deny read access to all objects after the user deletion date.

Answer

Change the bucket's default encryption to use customer-managed keys and delete the key after 30 days.

Answer

Enable MFA Delete on the bucket to require additional authentication for deletions.