CCSP Cloud Security Operations Practice Test 3 — 15 Questions

Question 1

A company is deploying a multi-tier application in a public cloud and needs to restrict traffic between tiers. The web tier must only accept HTTPS from the internet, and the app tier must only accept HTTP from the web tier. Which cloud networking feature should be used to enforce this?

Accepted Answer

Network access control lists (ACLs) attached to the subnets.. Network ACLs are stateless, meaning they filter traffic based on source and destination IP addresses, ports, and protocols at the subnet level. By configuring inbound rules on the web tier subnet to allow HTTPS (TCP/443) from the internet and outbound rules to allow HTTP (TCP/80) to the app tier subnet, and inbound rules on the app tier subnet to allow HTTP only from the web tier subnet, you enforce the required traffic restrictions without maintaining session state. This stateless behavior is essential for explicitly controlling traffic between tiers in a multi-tier architecture.

Answer

Security groups applied to each tier’s instances.

Answer

Internet gateway with appropriate routes.

Answer

VPC peering connection between tier subnets.

Question 2

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

Accepted Answer

Run automated policy compliance checks as part of the CI/CD pipeline.. Option D is correct because integrating policy-as-code scanning into the CI/CD pipeline catches non-compliance before deployment. Option A is incorrect because manual reviews are error-prone and slow. Option B is incorrect because post-deployment scanning is reactive. Option C is incorrect because only limiting user permissions does not prevent misconfigurations from valid users.

Answer

Restrict the IAM permissions of developers to only approved roles.

Answer

Conduct manual security reviews after each deployment.

Answer

Deploy resources and then scan for compliance after deployment.

Question 3

A cloud operations team has a process for making changes to production environments. Which change management practice is MOST important for reducing the risk of service disruption?

Accepted Answer

Testing all changes in a staging environment before production deployment.. Testing all changes in a staging environment before production deployment is the most important practice because it validates the change's behavior, performance, and compatibility in an isolated replica of production. This directly reduces the risk of service disruption by catching configuration errors, resource conflicts, or software defects that could cause outages. Without staging validation, even well-intentioned changes can introduce silent failures or cascading issues.

Answer

Allowing all changes to be made immediately with no approval process.

Answer

Notifying the security team after the change is completed.

Answer

Ensuring a rollback plan is documented after the change is made.

Question 4

A multinational corporation operates in a country where data sovereignty laws require that all customer data remain within the country's borders. The company uses a global public cloud provider. Which operational control is MOST critical to ensure compliance?

Accepted Answer

Implement cloud policy to restrict resource deployment to approved regions.. Option B is correct because implementing a cloud policy to restrict resource deployment to approved regions is the most direct and proactive operational control to enforce data sovereignty. By using Azure Policy, AWS Service Control Policies (SCPs), or GCP Organization Policies, the organization can programmatically prevent resources from being provisioned in non-compliant regions, ensuring customer data never leaves the required jurisdiction. This is a preventive control that operates at the infrastructure level, unlike detective or reactive measures.

Answer

Use a VPN to connect to the cloud provider's network.

Answer

Conduct quarterly audits of data storage locations.

Answer

Encrypt all data at rest and in transit.

Question 5

Which TWO responsibilities are typically shared between the cloud customer and the cloud provider in an IaaS model? (Choose two.)

Accepted Answer

Management of security group rules.. In an IaaS model, the cloud customer is responsible for managing security group rules, which act as virtual stateful firewalls controlling inbound and outbound traffic at the instance level. The cloud provider is responsible for the underlying network infrastructure, but the customer must configure these rules to enforce least-privilege access. This shared responsibility is explicitly defined in the AWS Shared Responsibility Model and similar frameworks.

Answer

Physical security of data centers.

Answer

Hypervisor security.

Answer

Patching the guest operating system.

Question 6

Which THREE components are essential for establishing a secure baseline configuration for a cloud virtual machine? (Choose three.)

Accepted Answer

Removing unnecessary software and services from the OS.. Option B is correct because removing unnecessary software and services from the OS reduces the attack surface by eliminating potential vulnerabilities and backdoors. A secure baseline configuration must minimize the number of running components to only those required for the VM's intended function, following the principle of least functionality.

Answer

Running applications as a service account.

Answer

Configuring network security groups at the subnet level.

Question 7

Which TWO cloud monitoring tools are used primarily for detecting anomalous behavior that may indicate a security incident? (Choose two.)

Accepted Answer

Intrusion detection system (IDS).. An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and system activities for signs of malicious activity or policy violations, making it a primary tool for detecting anomalous behavior indicative of a security incident. A Security Information and Event Management (SIEM) system aggregates and correlates logs from multiple sources, using rules and analytics to identify patterns of suspicious activity that may signal a security breach.

Answer

Infrastructure monitoring tool.

Answer

Cloud cost management tool.

Answer

Application performance monitoring (APM).

Question 8

Refer to the exhibit. An IAM policy is attached to a user. Which action is the user allowed to perform?

Accepted Answer

Read an existing object from the bucket.. The IAM policy grants the `s3:GetObject` action, which allows the user to read (download) an existing object from the specified S3 bucket. The policy explicitly allows this action for the bucket `my-bucket` and its objects, so the user can perform read operations on objects within that bucket.

Answer

Change the bucket's policy.

Answer

Upload a new object to the bucket.

Answer

Delete an object from the bucket.

Question 9

Refer to the exhibit. An administrator attaches security group sg-12345 to a web server. Which of the following describes the traffic that will be allowed by the security group?

Accepted Answer

Inbound HTTP and HTTPS from anywhere, and SSH only from the internal network are allowed.. Option D is correct. Inbound HTTP and HTTPS from anywhere (0.0.0.0/0) are allowed. SSH is allowed only from the internal network (10.0.0.0/8). Outbound all traffic is allowed. Options A, B, and C are incorrect because they misrepresent the rules.

Answer

Only SSH traffic from the internal network is allowed inbound.

Answer

The server cannot initiate any outbound connections.

Answer

All inbound traffic from the internet is allowed.

Question 10

Refer to the exhibit. A data sync job fails with the error shown. The IAM role 'data-sync-role' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:*:*:data-bucket-2024/*"
    }
  ]
}

What is the MOST likely cause of the failure?

Accepted Answer

The resource ARN in the policy is incorrectly formatted, causing the action to not be applied.. Option C is correct. The resource ARN in the policy uses wildcards incorrectly: 'arn:aws:s3:*:*:data-bucket-2024/*' is not a valid S3 object ARN. The correct format is 'arn:aws:s3:::data-bucket-2024/*'. The malformed ARN means the policy does not actually grant access to the object. Option A is incorrect because the bucket exists. Option B is incorrect because the role is attached. Option D is incorrect because there is no explicit deny.

Answer

The role 'data-sync-role' is not attached to the sync job.

Answer

The bucket 'data-bucket-2024' does not exist.

Answer

There is an explicit Deny policy blocking the action.

Question 11

A security analyst notices that a cloud storage bucket contains objects with public read access. The organization's policy prohibits public access. What is the most efficient way to remediate this issue across all objects in the bucket?

Accepted Answer

Apply a bucket policy that denies public access and update the bucket ACL to block public access. Option B is correct because applying a bucket policy that denies public access and updating the bucket ACL to block public access will override any object-level public ACLs. Option A is inefficient as it requires manual object updates. Option C is unnecessarily disruptive. Option D may not be needed.

Answer

Delete the bucket and recreate it

Answer

Use a third-party tool to scan and fix

Answer

Manually update each object's ACL

Question 12

A cloud operations team is implementing a logging strategy for their hybrid cloud environment. They need to ensure that logs from on-premises systems are collected and stored in a centralized cloud logging service with low latency. Which configuration is most appropriate?

Accepted Answer

Use a VPN connection and forward syslog directly to the cloud endpoint. Option A is correct because using a VPN connection and forwarding syslog directly to the cloud endpoint provides a dedicated, low-latency path. Option B (syslog over the internet) may introduce latency. Option C (cloud logging agent) may buffer and delay logs. Option D (email) is not suitable for real-time logging.

Answer

Transfer logs via email attachments

Answer

Configure on-premises systems to send logs via syslog over the internet with TLS

Answer

Use a cloud logging agent on-premises that buffers and sends logs via HTTPS

Question 13

During a security audit, it is discovered that a cloud service provider's infrastructure-as-a-service (IaaS) environment has virtual machines that were provisioned with default firewall rules allowing all inbound traffic from the internet. The organization's cloud security policy requires that all VM firewall rules follow a least-privilege model. What is the most effective approach to enforce this policy going forward?

Accepted Answer

Implement infrastructure as code templates with built-in security controls that enforce least-privilege firewall rules. Option B is correct because using infrastructure as code (IaC) templates with built-in security controls ensures that all new VM deployments comply with the least-privilege policy, preventing non-compliant deployments. Options A and D are reactive or detective. Option C may miss non-compliant resources if not properly configured.

Answer

Manually review each VM's firewall rules during deployment

Answer

Use a configuration management tool to periodically audit and correct firewall rules

Answer

Use a cloud security posture management (CSPM) tool that continuously monitors and alerts on non-compliant rules

Question 14

A cloud security administrator is reviewing the security controls for a SaaS application. Which of the following are typically the responsibility of the cloud customer (tenant) in a SaaS model? (Choose two.)

Accepted Answer

Managing user access and identity. In a SaaS model, the customer is responsible for managing user access and identity (B) and data classification and encryption at rest (D). The provider handles patching the underlying OS (A), physical security (C), and network infrastructure security (E).

Answer

Physical security of data center

Answer

Network infrastructure security

Answer

Patching the underlying operating system

Question 15

A cloud operations team is implementing a disaster recovery plan. Which of the following are valid strategies for data replication in a cloud environment? (Choose three.)

Accepted Answer

Asynchronous replication across regions. Asynchronous replication across regions is a valid DR strategy because it allows data to be copied to a geographically distant region without requiring an immediate acknowledgment from the target, which minimizes latency impact on the primary site. This approach is suitable for cloud environments where recovery point objectives (RPOs) of minutes to hours are acceptable, and it leverages the cloud provider's high-latency inter-region network links without stalling write operations.

Answer

Periodic snapshots to object storage

Answer

Active-active replication with load balancing