CCSP Practice Test 8 — 10 Questions

Question 1

A cloud security architect is implementing a data classification scheme. They need to ensure that data labeled 'confidential' is automatically encrypted when stored in cloud storage. Which approach best achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure cloud storage bucket policies to enforce encryption for objects with a 'confidential' tag. Cloud storage bucket policies can be configured to enforce server-side encryption for objects that carry a specific metadata tag (e.g., 'confidential'). This approach automates encryption at the point of storage without requiring separate buckets or manual intervention, ensuring that all tagged data is encrypted as a condition of the write operation.

Answer

Use a separate storage bucket for confidential data with default encryption enabled

Answer

Deploy a data loss prevention (DLP) tool to scan and encrypt on upload

Answer

Train users to manually encrypt files before uploading

Question 2

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

Accepted Answer

Network ACL (NACL). NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Answer

Transit gateway

Answer

Security group

Answer

VPC peering connection

Question 3

A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?

Accepted Answer

Conduct regular tabletop exercises to simulate incident scenarios. Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.

Answer

Conduct a post-mortem analysis of previous incidents

Answer

Implement automated isolation of compromised instances

Answer

Deploy a security information and event management (SIEM) system

Question 4

Which THREE of the following are key considerations when designing a key management lifecycle for cloud data encryption?

Accepted Answer

Key rotation. Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

Answer

Key usage monitoring

Answer

Key escrow

Question 5

A developer needs to store session state for a cloud-based web application. Which of the following is the most secure approach?

Accepted Answer

Store session data in an encrypted server-side storage. Storing session state in encrypted server-side storage ensures that session data is never exposed to the client, mitigating risks of tampering, replay, or information disclosure. Encryption at rest (e.g., using AES-256) protects against unauthorized access to the storage layer, while server-side control prevents client-side manipulation of session tokens or data. This approach aligns with the principle of least privilege and is recommended by OWASP for secure session management in cloud applications.

Answer

Store session data in a database with SSL

Answer

Store session data in client-side cookies

Answer

Store session data in a distributed cache

Question 6

A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?

Accepted Answer

Restricted. In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.

Answer

Internal

Answer

Confidential

Answer

Public

Question 7

Refer to the exhibit. An administrator applies this S3 bucket policy. What is the overall effect?

Accepted Answer

Only requests originating from VPC vpc-12345678 are allowed to retrieve objects. The S3 bucket policy includes an Allow statement that grants s3:GetObject access only to the VPC endpoint vpc-12345678, using the aws:SourceVpce condition key. This means only requests originating from that specific VPC endpoint are permitted to retrieve objects. The Deny statement with a NotPrincipal condition is redundant or misconfigured, but the Allow statement's condition effectively restricts access to the VPC endpoint, making option A correct.

Answer

All requests are denied because the Deny statement overrides the Allow statement

Answer

All requests are allowed because there is an Allow statement

Answer

Only requests made with HTTPS are allowed

Question 8

Which of the following is a key benefit of using a software composition analysis (SCA) tool in a cloud application security program?

Accepted Answer

Detects known vulnerabilities in open-source libraries. SCA tools automate the identification of open-source components within a codebase and cross-reference them against databases like the National Vulnerability Database (NVD) to detect known vulnerabilities (CVEs). This is a key benefit because cloud applications often heavily rely on open-source libraries, and SCA provides a scalable way to manage that risk without manual auditing.

Answer

Enforces runtime policies

Answer

Simulates attacks on running applications

Answer

Identifies vulnerabilities in proprietary code

Question 9

A data governance officer wants to classify all data in a cloud environment using a classification scheme. They need to tag resources automatically and enforce access controls based on the tags. Which THREE steps should they take? (Choose three.)

Accepted Answer

Define classification labels (e.g., public, internal, confidential, restricted). Creating tags based on classification levels, applying them automatically using DLP or policy, and using IAM conditions to enforce access based on tags are key steps.

Answer

Enable cross-region replication for tagged resources

Answer

Configure signed URLs for public data

Question 10

A cloud security team is implementing a DevSecOps pipeline for a Kubernetes-based application. Which THREE scanning tools should be integrated to detect IaC misconfigurations before deployment?

Accepted Answer

KICS. KICS (Keeping Infrastructure as Code Secure) is an open-source tool specifically designed to scan IaC files for security misconfigurations, vulnerabilities, and compliance violations before deployment. It supports multiple IaC formats including Terraform, Kubernetes manifests, Dockerfiles, and CloudFormation, making it a strong choice for a DevSecOps pipeline targeting Kubernetes-based applications.

Answer

GitGuardian

Answer

Snyk