CCSP Cloud Security Operations — Timed 10 Questions

Question 1

A cloud security engineer is troubleshooting a failure in automated backups for a production database. The backup job runs nightly but has failed for the past three nights. The logs show permission denied errors when the backup service attempts to write to the storage bucket. Which action should the engineer take first?

Accepted Answer

Check the IAM roles and bucket ACLs assigned to the service account.. The permission denied errors indicate that the service account used by the backup job lacks the necessary permissions to write to the storage bucket. Checking the IAM roles and bucket ACLs is the first logical step to identify and resolve the misconfiguration, as it directly addresses the root cause without introducing unnecessary changes or escalations.

Answer

Open a support ticket with the cloud provider for incident response.

Answer

Restart the backup service and retry the job.

Answer

Rotate the service account keys used for authentication.

Question 2

An organization is designing a cloud storage solution for highly sensitive customer data. The data must be encrypted at rest and the encryption keys must be managed by the customer, not the cloud provider. Additionally, the solution must allow granular access control based on data classification. Which combination of services should the architect recommend?

Accepted Answer

Cloud HSM for key management and a cloud storage service with object-level ACLs.. Option C is correct because Cloud HSM provides customer-managed keys for encryption at rest, ensuring the customer retains sole control over the keys. Combined with a cloud storage service that supports object-level ACLs, this allows granular access control based on data classification, meeting both requirements.

Answer

Server-side encryption with customer-managed keys and a storage bucket with bucket-level policies.

Answer

Server-side encryption with cloud-managed keys and a storage bucket with bucket-level policies.

Answer

Client-side encryption with a cloud KMS and a storage bucket with bucket-level policies.

Question 3

A company uses a cloud-based SIEM to aggregate logs from multiple sources. Recently, the SIEM stopped receiving logs from a critical application server. The server is running and the application is functioning normally. The security team has verified that the log forwarder service is running on the server and the network path to the SIEM is open. Which additional step should the team take to diagnose the issue?

Accepted Answer

Inspect the log forwarder's configuration and recent log files for errors.. Option D is correct because the most likely cause of logs not being received by the SIEM, when the server is running and the network path is open, is a misconfiguration or error within the log forwarder itself. Inspecting the forwarder's configuration (e.g., destination IP, port, protocol) and its local log files (e.g., syslog, Windows Event Forwarding logs) can reveal authentication failures, queue overflows, or parsing errors that prevent log transmission. This step directly addresses the log generation and forwarding pipeline, which is the remaining point of failure after verifying network connectivity and service status.

Answer

Check the server's CPU and memory utilization.

Answer

Review the firewall rules between the server and the SIEM.

Answer

Restart the SIEM collector service.

Question 4

Which TWO of the following are best practices for securing a cloud-based container orchestration platform?

Accepted Answer

Use minimal base images to reduce the attack surface.. Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Answer

Store secrets in environment variables for ease of use.

Answer

Run containers with root privileges by default.

Answer

Disable TLS certificate validation for internal communications.

Question 5

Which THREE of the following are key considerations when designing a disaster recovery plan for a cloud-based application?

Accepted Answer

Implementing cross-region replication for critical data.. Option C is correct because cross-region replication ensures that critical data is asynchronously or synchronously copied to a geographically separate cloud region, providing resilience against regional outages. This design directly supports disaster recovery by enabling failover to a secondary site with minimal data loss, often leveraging cloud-native services like AWS S3 Cross-Region Replication or Azure Geo-Redundant Storage.

Answer

Performing manual failover testing only once a year.

Answer

Eliminating all security controls to speed up recovery.

Question 6

Which TWO of the following are valid methods for securing data at rest in a cloud storage service?

Accepted Answer

Implementing client-side encryption before uploading data.. Option B is correct because client-side encryption ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to the plaintext. This is a valid method for securing data at rest in cloud storage, as the encrypted objects are stored in the service and can only be decrypted by the client holding the keys.

Answer

Disabling encryption to reduce latency.

Answer

Setting the storage bucket to public read access.

Answer

Enabling access logging for the storage bucket.

Question 7

Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?

Accepted Answer

Check the source IP address against the company's approved IP ranges.. Option D is correct because the first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.

Answer

Immediately revoke all admin privileges for the user.

Answer

Review the key pair's usage to see if it was used to launch instances.

Answer

Delete the key pair immediately to prevent any misuse.

Question 8

Refer to the exhibit. A security engineer has attached the above IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user can upload objects only if they specify server-side encryption with AES256.. Option D is correct because the IAM policy uses a `Condition` block with `s3:x-amz-server-side-encryption` set to `AES256`. This condition ensures that any `s3:PutObject` request must include the `x-amz-server-side-encryption` header with the value `AES256`. Without this header or with a different encryption value, the request is denied. The `Deny` effect overrides any `Allow` that might exist, so the user is forced to specify SSE-S3 (AES-256) encryption on every upload.

Answer

The user can upload objects only to the my-bucket bucket with no restrictions.

Answer

The user can upload objects only if they use customer-managed KMS keys.

Answer

The user is denied from uploading objects without encryption.

Question 9

Refer to the exhibit. A cloud administrator ran the Azure CLI command to list virtual machines. One VM shows a ProvisioningState of 'Failed'. What is the most likely cause of this state?

Accepted Answer

The VM failed to start due to a resource quota limit or configuration error.. Option C is correct because a 'ProvisioningState' of 'Failed' in Azure indicates that the VM could not be created or started due to a resource quota limit (e.g., vCPU quota exceeded) or a configuration error (e.g., invalid network interface, unsupported VM size). This state is set by the Azure Resource Manager when the deployment or update operation fails, and it persists until the underlying issue is resolved and the VM is redeployed or reconfigured.

Answer

The VM's resource group has been moved to another subscription.

Answer

The VM is in a deallocated state.

Answer

The VM was deleted by another administrator.

Question 10

A financial services company runs a critical application on a cloud infrastructure. The application consists of a web tier, an application tier, and a database tier, all deployed in a single cloud region. The database is a managed relational database service with automated backups enabled. The company's disaster recovery plan requires a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. During a recent regional outage, the primary region became unavailable for 6 hours. The company attempted to restore the database from the latest automated backup in a different region, but the restore took 5 hours due to the large database size, exceeding the RTO. Additionally, the backup was 2 hours old at the time of the outage, exceeding the RPO. The security team has also noted that the backup data is encrypted with a cloud-managed key, which may not meet future compliance requirements for customer-managed encryption keys. Which course of action should the company take to meet both the RTO and RPO objectives while also addressing the encryption requirement?

Accepted Answer

Implement cross-region read replicas with synchronous replication and enable encryption with a customer-managed key that is replicated to the disaster recovery region.. Option A is correct because cross-region read replicas with synchronous replication can provide a standby database in another region with an RPO of effectively zero (synchronous replication ensures no data loss) and an RTO measured in minutes (promote the replica to primary), meeting both the 4-hour RTO and 1-hour RPO. Using a customer-managed key (CMK) replicated to the DR region satisfies the compliance requirement for customer-managed encryption keys, as the key can be controlled and audited independently of the cloud provider.

Answer

Store the backup in a different region using cross-region copy and use a cloud HSM to manage the encryption key.

Answer

Use cross-region asynchronous replication with a separate database instance and encrypt with a cloud-managed key.

Answer

Increase the frequency of automated backups to every 30 minutes and use faster storage for the database restore process.