CCSP Practice Test 9 — 10 Questions

Question 1

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 2

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Accepted Answer

Description of tests and results. The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Answer

System description

Answer

Opinion letter

Answer

Management's assertion

Question 3

Which TWO of the following are key components of a secure software development lifecycle (SSDLC) in a cloud environment?

Accepted Answer

Automated static application security testing (SAST) during code commit.. Automated SAST during code commit is a key component of a secure software development lifecycle (SSDLC) in a cloud environment because it enables early detection of vulnerabilities (e.g., injection flaws, buffer overflows) by scanning source code as it is committed to the repository. This shift-left approach integrates security directly into the CI/CD pipeline, preventing flaws from progressing to later stages where remediation is more costly and complex.

Answer

Performing security testing only after deployment to production.

Answer

Mandatory security awareness training for developers.

Answer

Integration of unit tests that check for security functionality.

Question 4

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. SOX requires organizations to maintain ITGCs over systems that support financial reporting. Logical access controls (e.g., user provisioning, authentication) are typically the responsibility of the customer (the financial institution) because they manage who can access the application and data.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines

Question 5

Which TWO of the following are requirements for a cloud service agreement to comply with the European Data Protection Board (EDPB) guidelines on data processing?

Accepted Answer

The processor must only process data on documented instructions from the controller. The EDPB guidelines mandate that a processor may only process personal data on documented instructions from the controller. This ensures the processor’s actions are strictly controlled and auditable, preventing unauthorized processing that could violate GDPR Article 28(3)(a).

Answer

The processor may subcontract processing without notification

Answer

The controller must ensure the processor agrees to audit rights

Answer

The processor must retain data indefinitely

Question 6

An organization uses a multi-cloud strategy and wants to perform a risk assessment that accounts for the shared responsibility model. Which approach is most appropriate?

Accepted Answer

Use cloud-specific risk assessment frameworks like CSA STAR. Cloud-specific frameworks like CSA STAR incorporate the shared responsibility model, making them suitable for multi-cloud risk assessments. Option A is wrong because ISO 27001 is general and not cloud-specific. Option B is wrong because NIST CSF is also general, not tailored to cloud. Option D is wrong because COBIT focuses on governance and management, not risk assessment.

Answer

Use ISO 27001 controls as the sole basis for assessment

Answer

Apply the NIST Cybersecurity Framework across all cloud providers

Answer

Adopt COBIT for risk management alignment

Question 7

Refer to the exhibit. A security analyst finds this access control policy attached to a cloud storage bucket. What is the primary security issue?

Accepted Answer

The policy grants public read access to all objects.. The policy statement includes "Principal": "*" and "Effect": "Allow" without any condition restricting access, which grants public read access to all objects in the cloud storage bucket. This violates the principle of least privilege and exposes sensitive data to anyone on the internet, making it a critical security misconfiguration.

Answer

The policy is missing a condition for encryption.

Answer

The policy does not specify a source IP.

Answer

The policy allows all actions.

Question 8

A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

Accepted Answer

It denies access to objects over HTTP, but allows HTTPS.. The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Answer

It allows all access to the bucket.

Answer

It denies access to objects over HTTPS, but allows HTTP.

Answer

It denies all access to the bucket.

Question 9

A company is subject to PCI DSS and plans to use a cloud provider to process credit card transactions. The cloud provider has been assessed by a Qualified Security Assessor (QSA). According to PCI DSS, what must the company obtain from the provider to demonstrate compliance?

Accepted Answer

The provider's PCI DSS Attestation of Compliance (AOC) and Responsibility Matrix. PCI DSS requires that the service provider's responsibilities are mapped in a Cloud Provider Responsibility Matrix, typically in Appendix A3. Additionally, the customer must obtain evidence of the provider's QSA assessment.

Answer

A signed Business Associate Agreement

Answer

An ISO 27001 certificate

Answer

A SOC 2 Type II report

Question 10

A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?

Accepted Answer

Insider threats from cloud provider employees. A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.

Answer

Misconfigured storage buckets exposing data

Answer

SQL injection vulnerabilities in the application

Answer

Side-channel attacks on shared physical hardware