CCSP Practice Test 8 — 10 Questions

Question 1

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run automated policy compliance checks as part of the CI/CD pipeline.. Running automated policy compliance checks inside the CI/CD pipeline enforces security policies before resources are deployed, shifting compliance left. Tools like Terraform Sentinel, Checkov, or OPA/Conftest evaluate the IaC against policy and fail the pipeline on violations, preventing non-compliant infrastructure from ever reaching the cloud. This is the most effective because it is preventive, automated, and repeatable.

Answer

Restrict the IAM permissions of developers to only approved roles.

Answer

Conduct manual security reviews after each deployment.

Answer

Deploy resources and then scan for compliance after deployment.

Question 2

A company is deploying a multi-tier application on AWS. They need to protect the application layer from common web attacks and also restrict traffic between tiers. Which TWO network security controls should they use?

Accepted Answer

AWS WAF integrated with Application Load Balancer. Option B (AWS WAF integrated with Application Load Balancer) is correct because AWS WAF inspects HTTP/HTTPS requests at Layer 7 and can block common web exploits such as SQL injection and cross-site scripting using managed rule groups attached to an ALB, directly satisfying the requirement to protect the application layer. Option C (Security groups between application tiers) is correct because security groups are stateful, instance-level virtual firewalls whose inbound rules can reference other security groups, allowing precise tier-to-tier traffic restriction (for example, permitting only the app tier's SG to reach the database tier on port 3306). Option A is not appropriate here because PrivateLink provides private connectivity to services and endpoints, not application-layer attack filtering or inter-tier traffic control. Option D is wrong because VPC peering only connects networks for routing and does not filter or restrict traffic between application tiers. Option E is less suitable because network ACLs are stateless, subnet-level filters that cannot reference security groups or enforce granular per-tier application rules as cleanly as security groups.

Answer

PrivateLink for database access

Answer

VPC peering with all VPCs

Answer

Network ACLs for each subnet

Question 3

An API endpoint returns user profile data including fields like 'credit_card_number' even when the client application does not need it. Which OWASP API security risk does this represent?

Accepted Answer

Excessive Data Exposure. The API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Answer

Injection

Answer

Broken Object Level Authorization

Answer

Mass Assignment

Question 4

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

Accepted Answer

To provide centralized protection against common web exploits before traffic reaches the microservices.. Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Answer

To reduce latency by caching responses at the API gateway.

Answer

To offload authentication from the microservices to the API gateway.

Answer

To monitor API usage and detect anomalies in traffic patterns.

Question 5

An organization has a cloud environment with many accounts. They want to prevent any account from using certain services that are not approved (e.g., outside of a defined list). What is the BEST way to enforce this at the organizational level?

Accepted Answer

Apply a cloud governance policy at the organization level that denies the services.. Cloud governance policies at the organization level are the correct mechanism because they operate across all accounts, allowing centrally defined whitelists or blacklists of services. Unlike account-level access control policies, organizational policies set a permissions boundary that cannot be overridden by account administrators, ensuring that non-approved services are denied across the entire organization. This provides a preventive control that blocks the use of prohibited services before any action can occur.

Answer

Configure each account's access control policy to deny the services.

Answer

Enable a cloud configuration monitoring service to detect and disable non-approved services.

Answer

Use resource-specific access policies on each resource to restrict usage.

Question 6

When assessing cloud risk, an organization identifies that if a single cloud provider fails, the organization cannot operate. This risk is known as:

Accepted Answer

Concentration risk. Concentration risk is the risk that arises from over-reliance on a single provider, system, or counterparty — in cloud terms, if one provider fails and the organization cannot operate, that dependency is a concentration risk. It is a well-known concept in financial services (e.g., reliance on a single clearing bank) and applies directly to cloud, where multi-cloud or hybrid strategies are often adopted specifically to mitigate it. The scenario describes exactly this single-point-of-failure dependency.

Answer

Third-party risk

Answer

Inherent risk

Answer

Residual risk

Question 7

Drag and drop the steps for managing identity and access in a multi-cloud environment using a centralized identity provider (IdP) into the correct order.

Accepted Answer

Integrate the centralized IdP → Create groups and roles → Configure attribute/role mapping → Assign users with MFA enforcement → Audit and review access. First integrate IdP, then create groups/roles, configure mapping, assign users with MFA, and audit.

Answer

Create groups and roles → Integrate the centralized IdP → Configure attribute/role mapping → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Configure attribute/role mapping → Create groups and roles → Assign users with MFA → Audit

Answer

Integrate the centralized IdP → Create groups and roles → Assign users with MFA → Configure attribute/role mapping → Audit

Question 8

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

Accepted Answer

Homomorphic encryption. Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Answer

Tokenization

Answer

Format-preserving encryption (FPE)

Answer

Cryptographic hashing

Question 9

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 10

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Accepted Answer

Implementing rate limiting and throttling. Option C is correct because rate limiting and throttling cap the number of requests a client can make in a given time window, mitigating brute-force, credential-stuffing, and denial-of-service abuse against API endpoints. Option D is correct because strong authentication (e.g., OAuth 2.0 tokens, mutual TLS) and authorization (e.g., scopes, RBAC, least privilege) ensure only verified, permitted identities can invoke API operations. Option E is correct because validating and sanitizing all inputs defends against injection flaws such as SQL injection, NoSQL injection, and command injection that arise from untrusted API parameters. Option A is not appropriate because enabling CORS for all domains (wildcard Access-Control-Allow-Origin) exposes the API to cross-origin abuse rather than restricting access to trusted origins. Option B is not appropriate because HTTP Basic authentication over plain HTTP transmits base64-encoded credentials in cleartext, which can be intercepted; it should only be used over TLS.

Answer

Enabling CORS (Cross-Origin Resource Sharing) for all domains

Answer

Using HTTP basic authentication over plain HTTP