CCSP Hard Questions — 25 Difficult Questions

Question 1

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 2

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Accepted Answer

Running containers as a non-root user. Option C is correct because running containers as a non-root user (e.g., via securityContext.runAsNonRoot: true or a USER directive in the Dockerfile) prevents processes inside the container from having UID 0, which is the primary enabler of privilege-escalation exploits and container-escape techniques. Option D is correct because AppArmor or SELinux profiles enforce mandatory access control that confines container processes to a limited set of files, paths, and operations, blocking actions that even a compromised process could otherwise attempt. Option E is correct because dropping all Linux capabilities and adding back only those explicitly required (e.g., using cap-drop: ALL with a minimal cap-add list) removes dangerous privileges such as CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE that are commonly abused for privilege escalation. Option A is incorrect because privileged mode grants the container nearly all host capabilities and device access, dramatically increasing the attack surface rather than restricting it. Option B is incorrect because running containers as root gives the process full UID 0 privileges inside the container, which is exactly the risk the hardening measures are meant to eliminate.

Answer

Enabling privileged mode for containers that need host access

Answer

Running containers as root

Question 3

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are pre-approved model clauses by the European Commission that provide appropriate safeguards for transferring personal data outside the EEA. They are the most widely used and practical mechanism for legitimizing cross-border data transfers under the GDPR, especially for multinational corporations using SaaS applications. SCCs are flexible, can be implemented quickly, and do not require approval from a supervisory authority, making them ideal for dynamic cloud environments.

Answer

Consent from all data subjects

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield

Question 4

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects

Question 5

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 6

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 7

A cloud security engineer needs to ensure that a containerized application running in a Kubernetes cluster securely stores and rotates database credentials. Which is the most appropriate solution?

Accepted Answer

Use a secrets management system integrated with Kubernetes, such as HashiCorp Vault with CSI driver. HashiCorp Vault integrated with the Kubernetes CSI (Container Storage Interface) driver allows dynamic, short-lived database credentials to be injected into pods as volumes, enabling automatic rotation without application changes. This approach ensures secrets are never stored in the cluster's etcd or exposed in environment variables, aligning with the principle of least privilege and compliance requirements for credential rotation.

Answer

Store credentials as environment variables in the pod manifest

Answer

Embed credentials in the container image during build

Answer

Use Kubernetes Secrets without encryption at rest

Question 8

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 9

Which THREE of the following are essential steps in a cloud data discovery process?

Accepted Answer

Map data flows between systems. Mapping data flows between systems is a foundational step in cloud data discovery. It enables organizations to understand how data moves across cloud services, APIs, and storage tiers, which is critical for identifying where sensitive data may be transmitted or stored. Without this mapping, discovery efforts may miss data in transit or in transient storage, leading to incomplete visibility.

Answer

Encrypt all discovered data

Answer

Create backup copies of data

Question 10

A security team is deploying a Kubernetes cluster on a cloud platform and wants to harden the worker nodes against container breakout and privilege escalation. They are reviewing kubelet and container runtime configurations. Which TWO of the following measures are MOST effective at reducing the attack surface and preventing a compromised container from gaining node-level privileges? (Choose two.)

Accepted Answer

Run containers with a read-only root filesystem and drop all Linux capabilities except those explicitly required.. Hardening worker nodes against container breakout requires preventive controls that limit what a compromised container can do. Running with a read-only root filesystem and dropping unnecessary Linux capabilities removes the tools and privileges needed for escalation. Enforcing the restricted Pod Security Standard via Pod Security Admission ensures workloads cannot run as root, cannot escalate privileges, and must meet seccomp and capability restrictions. Together these measures significantly reduce the attack surface and block common escape techniques.

Answer

Enable the kubelet read-only port and disable anonymous authentication to the kubelet API.

Answer

Configure the container runtime to use the overlay2 storage driver with a dedicated volume for each container.

Answer

Enable audit logging on the Kubernetes API server and ship logs to a central SIEM for alerting.

Question 11

A company uses a serverless architecture with AWS Lambda to process user-uploaded files. The Lambda function is triggered by an S3 bucket event. While reviewing security, the architect wants to ensure that the Lambda function cannot be invoked by unauthorized S3 buckets or accounts. What is the most secure configuration?

Accepted Answer

Configure the Lambda function's resource-based policy to grant permission only to the specific S3 bucket ARN and its owner account.. The most secure way to restrict Lambda invocation to a specific S3 bucket is to use a resource-based policy that explicitly grants the `lambda:InvokeFunction` permission only to the trusted bucket's ARN and the owning AWS account. This ensures that even if another S3 bucket or account attempts to trigger the function, the invocation is denied by the Lambda permission model, which evaluates both the resource-based policy and the caller's identity.

Answer

Use a condition in the policy that checks the source IP address.

Answer

Place the Lambda function inside a VPC with a VPC endpoint for S3.

Answer

Attach a resource-based policy that allows any S3 bucket to invoke the function.

Question 12

Refer to the exhibit. A Kubernetes pod is configured as shown. Which security enhancement should be added to follow cloud security best practices?

Accepted Answer

Set readOnlyRootFilesystem to true. Setting `readOnlyRootFilesystem` to true ensures the container's root filesystem is mounted as read-only, preventing attackers from modifying binaries, libraries, or configuration files at runtime. This is a key container hardening practice that limits the blast radius of a compromise, aligning with the CIS Benchmark for Kubernetes and cloud security best practices.

Answer

Set allowPrivilegeEscalation to true

Answer

Use a more restrictive runAsUser value like 2000

Answer

Use a trusted image from a private registry

Question 13

A financial services company uses a CI/CD pipeline to deploy microservices to a Kubernetes cluster. The security team wants to ensure container images are scanned for vulnerabilities before deployment. Which integration point in the pipeline is most effective?

Accepted Answer

Post-build image scanning in registry. Post-build image scanning in the registry (Option C) is the most effective integration point because it automatically scans container images after they are built and pushed, catching vulnerabilities before the image is deployed to production. This ensures that only compliant images proceed through the pipeline, aligning with the principle of shift-left security without blocking developer velocity.

Answer

Runtime security monitoring

Answer

Pre-commit hook in source control

Answer

Admission controller in Kubernetes

Question 14

A cloud customer is subject to the Health Insurance Portability and Accountability Act (HIPAA). They are considering using a cloud provider that offers infrastructure as a service (IaaS). Which of the following is the customer's responsibility under the HIPAA shared responsibility model?

Accepted Answer

Encryption of data at rest. Under the HIPAA shared responsibility model for IaaS, the customer retains responsibility for securing the data they store and process, including encryption of data at rest. The cloud provider manages the underlying infrastructure (hypervisor, physical security, network fabric), but the customer must implement and manage encryption mechanisms for their stored data, such as using AES-256 encryption with customer-managed keys via services like AWS KMS or Azure Key Vault.

Answer

Patching of the hypervisor

Answer

Network firewall configuration

Answer

Physical security of the data center

Question 15

A cloud security engineer reviews the S3 bucket policy shown in the exhibit. What is the net effect of this policy when a request originates from IP address 203.0.113.10 over HTTPS?

Accepted Answer

Deny access because the request is from the specified IP range. The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Answer

Deny access because the request does not meet the SecureTransport condition

Answer

Allow access because the condition for Deny does not include SecureTransport

Answer

Allow access because the request uses HTTPS

Question 16

Refer to the exhibit. A security analyst reviews the S3 bucket policy shown. Which security issue should be flagged?

Accepted Answer

The policy allows unauthenticated write access to the bucket. The S3 bucket policy contains a Principal element set to "*" with an Effect of "Allow" on the s3:PutObject action, which grants unauthenticated write access to the bucket. This means anyone on the internet can upload objects without any authentication, leading to potential data corruption, storage cost abuse, or malware hosting. The policy does not include any condition (e.g., aws:SourceIp or aws:SecureTransport) to restrict the write operation, making it a critical security misconfiguration.

Answer

The policy restricts read access to a specific role, which is too permissive

Answer

The policy does not enable server-side encryption

Answer

The policy contains a syntax error in the JSON

Question 17

Refer to the exhibit. A cloud security analyst is reviewing an S3 bucket policy. The bucket contains sensitive data and must only be accessible over HTTPS from the internal network (10.0.0.0/24). Which of the following correctly describes the behavior of this policy?

Accepted Answer

Requests from 10.0.0.0/24 over HTTPS are allowed; all other requests are denied.. The policy uses an explicit Deny for any request that is not using HTTPS (i.e., aws:SecureTransport is false) or does not originate from the 10.0.0.0/24 IP range. This Deny overrides the Allow statement, ensuring that only requests meeting both conditions (source IP 10.0.0.0/24 AND HTTPS) are permitted. Requests from 10.0.0.0/24 over HTTPS satisfy the Allow and are not caught by the Deny, so they are allowed; all other requests are denied.

Answer

Requests from 10.0.0.0/24 over HTTP are allowed because the Allow statement matches.

Answer

The policy is invalid because it combines Allow and Deny statements.

Answer

All requests from 10.0.0.0/24 are denied because the Deny statement applies to all actions.

Question 18

A cloud security architect is designing an API gateway for a microservices application. The gateway must authenticate requests, enforce rate limiting, and log all transactions for audit. Which of the following security controls is most critical to protect against API abuse?

Accepted Answer

Implement rate limiting and throttling based on client identity and request volume.. Rate limiting and throttling directly prevent API abuse by limiting request frequency based on client identity and volume. Option B is incorrect because encryption protects data in transit but does not prevent abuse. Option C is incorrect because input validation prevents injection attacks but not volume-based abuse. Option D is incorrect because API keys authenticate clients but do not limit usage; rate limiting is required for abuse protection.

Answer

Use TLS 1.3 to encrypt all traffic between clients and the gateway.

Answer

Validate and sanitize all input parameters to prevent injection attacks.

Answer

Require API keys for all requests and revoke keys of suspicious clients.

Question 19

A global company uses a cloud provider that stores data in multiple jurisdictions. During an eDiscovery request from a US court, which three challenges are most likely to arise? (Choose three.)

Accepted Answer

Jurisdictional conflicts over which court has authority. Option A is correct because when data resides in multiple jurisdictions, US court orders can conflict with local data-protection or blocking statutes (e.g., GDPR or foreign blocking laws), creating disputes over which court or legal regime has authority over the data. Option C is correct because eDiscovery requires a legal hold to preserve potentially relevant data in place, and in multi-jurisdiction cloud environments this is complicated by distributed storage, automated lifecycle deletion, and differing retention rules that can alter or destroy evidence. Option D is correct because cloud tenants typically lack physical access to the provider's hardware, so forensically sound collection must rely on provider APIs, snapshots, and chain-of-custody documentation rather than direct disk imaging, which can be challenged in court. Option B is not correct because major cloud providers offer extensive encryption options (at rest, in transit, and customer-managed keys), so lack of encryption is not an inherent eDiscovery challenge. Option E is not correct because while cloud storage costs exist, excessive cost is not a legal or forensic challenge specific to cross-jurisdiction eDiscovery and is not among the primary issues courts focus on.

Answer

Lack of encryption options

Answer

Excessive cost of cloud storage

Question 20

A financial institution is required to comply with the Sarbanes-Oxley Act (SOX) for its cloud-hosted financial applications. The cloud provider is responsible for the underlying infrastructure. Which of the following controls is most likely the responsibility of the financial institution as part of IT general controls (ITGC)?

Accepted Answer

Logical access controls to the financial application, including user provisioning and segregation of duties. Under the shared responsibility model, the cloud provider secures the infrastructure (data centers, hypervisors, network fabric), while the customer is responsible for controls over their own data, applications, and access. Logical access controls — user provisioning, authentication, authorization, and segregation of duties — are IT general controls that the financial institution must implement and evidence for SOX compliance, since they directly affect the integrity of financial reporting systems.

Answer

Physical security of the data center housing the cloud servers

Answer

Network intrusion detection at the cloud perimeter

Answer

Patching of the hypervisor that hosts the virtual machines