CCSP Hard Questions — 25 Difficult Questions

Question 1

A multinational corporation operates in a country where data sovereignty laws require that all customer data remain within the country's borders. The company uses a global public cloud provider. Which operational control is MOST critical to ensure compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement cloud policy to restrict resource deployment to approved regions.. Implementing a cloud policy to restrict resource deployment to approved regions is the most direct and proactive operational control to enforce data sovereignty. By using Azure Policy, AWS Service Control Policies (SCPs), or GCP Organization Policies, the organization can programmatically prevent resources from being provisioned in non-compliant regions, ensuring customer data never leaves the required jurisdiction. This is a preventive control that operates at the infrastructure level, unlike detective or reactive measures.

Answer

Use a VPN to connect to the cloud provider's network.

Answer

Conduct quarterly audits of data storage locations.

Answer

Encrypt all data at rest and in transit.

Question 2

A cloud application uses a service mesh for inter-service communication. The security team wants to enforce mutual TLS (mTLS) between all services and ensure that service identities are verified. What is the most effective way to achieve this?

Accepted Answer

Use the service mesh's built-in mTLS and certificate management. The service mesh's built-in mTLS and certificate management is the most effective approach because it provides automatic, transparent mutual TLS encryption and identity verification at the application layer, using X.509 certificates issued by the mesh's certificate authority (e.g., Istio's Citadel or Linkerd's identity controller). This ensures that every inter-service communication is authenticated and encrypted without requiring changes to application code, and it integrates directly with the service mesh's identity model (e.g., Kubernetes service accounts).

Answer

Set up Kerberos authentication between services

Answer

Configure a VPN between all service subnets

Answer

Implement IPsec in the network layer

Question 3

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 4

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 5

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault provides a cloud-agnostic secrets management service with automated rotation and cross-cloud capabilities. AWS Secrets Manager is AWS-specific. Azure Key Vault is Azure-specific. Encrypted environment variables are not easily rotated and require redeployment.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 6

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated. Consent is not generally practical for all data subjects.

Answer

Consent from all data subjects

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield

Question 7

A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?

Accepted Answer

CPU Pinning. CPU Pinning (option A) ensures VM isolation at the hardware level by dedicating specific physical CPU cores exclusively to a particular VM. This prevents other VMs from scheduling on those cores, eliminating CPU-level side-channel attacks and resource contention. It is a hardware-enforced isolation mechanism because the hypervisor uses the CPU's hardware virtualization extensions (e.g., Intel VT-x or AMD-V) to enforce the pinning, ensuring that one tenant's VM cannot access another's CPU resources.

Answer

Hypervisor Introspection

Answer

Security Groups

Answer

Network ACLs

Question 8

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 9

A company uses a cloud KMS with HSM-backed keys for regulatory compliance. They need to allow a cloud service to use a key for encryption while retaining the ability to revoke access at any time. Which TWO key management models satisfy this? (Choose two.)

Accepted Answer

Bring your own key (BYOK). BYOK is correct because it allows the customer to import their own key material into the cloud KMS, which is backed by an HSM, and the customer retains full control over the key's lifecycle, including the ability to revoke access at any time by disabling or deleting the key. CMEK is correct because it gives the customer direct management of the key (e.g., rotation, disabling, deletion) within the cloud KMS, while the HSM provides hardware-level protection, and the customer can revoke the cloud service's access by modifying key permissions or disabling the key.

Answer

Hold your own key (HYOK)

Answer

Customer-supplied keys (CSEK)

Answer

Cloud provider-managed keys

Question 10

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

Accepted Answer

Sub-processor authorization. GDPR requires that data controllers obtain prior authorization before a processor engages a sub-processor. The customer (controller) was not notified, violating the requirement for sub-processor authorization. Other rights like erasure are unrelated to this scenario.

Answer

Data protection by design

Answer

Data breach notification

Answer

Right to erasure

Question 11

An organization wants to ensure that its CSP does not access customer data for any purpose other than providing the service. Which clause should be included?

Accepted Answer

Data use restriction. A data use restriction clause explicitly limits the provider's use of customer data to only what is necessary to provide the service. Non-disclosure agreements protect confidentiality but don't restrict use. Right to audit provides oversight, and security incident response addresses breach management.

Answer

Right to audit

Answer

Security incident response

Answer

Non-disclosure agreement

Question 12

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 13

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 14

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 15

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 16

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 17

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 18

A financial institution is migrating sensitive transaction data to the cloud. They must comply with a regulation that requires data to be retained for 7 years, but also support immediate legal holds. The cloud storage service offers object lock with governance mode. What is the best practice to ensure compliance?

Accepted Answer

Use object lock in governance mode with a 7-year retention period and grant legal hold permissions to authorized users. Governance mode allows authorized users to override retention settings for legal holds while still enforcing a 7-year minimum retention period. This balances compliance with the need for immediate legal holds, as users with appropriate permissions can place a legal hold on objects without extending the retention period for all data.

Answer

Use object lock in compliance mode with a 7-year retention period

Answer

Apply a lifecycle policy to delete objects after 7 years and rely on backups

Answer

Encrypt all objects with a client-managed key and store deletion timestamps in a database

Question 19

During a cloud migration, a company discovers that some sensitive data was inadvertently stored in an object storage bucket with public read access. The security team needs to determine the scope of exposure and remediate. What is the FIRST step they should take?

Accepted Answer

Review the bucket's access logs to identify any unauthorized access.. The first step is to review the bucket's access logs (e.g., AWS CloudTrail or S3 server access logs) to identify any unauthorized access. This determines the scope of exposure—who accessed the data, when, and from where—before taking any remediation action. Without this forensic step, the company cannot assess breach notification obligations or legal liability.

Answer

Notify the data protection authority.

Answer

Change the bucket's permission to private.

Answer

Immediately delete all objects in the bucket.

Question 20

A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?

Accepted Answer

Post-build image scanning in registry. Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Answer

Runtime security monitoring

Answer

Pre-commit hook in source control

Answer

Admission controller in Kubernetes