CCSP Multiple Select — 50 Questions

Question 1

Which TWO of the following are valid considerations when performing forensic imaging of virtual machines in a public cloud? (Choose two.)

Accepted Answer

Time synchronization between the imaging tool and the VM clock is essential. Options A and E are correct. A: Time synchronization is essential for forensic timeline analysis. E: Volatile data (e.g., RAM contents) is lost when the VM is powered off, so imaging should be performed while the VM is running. B is incorrect because the imaging tool does not need to reside in the same cloud region. C is incorrect because hypervisor-level isolation prevents accessing other tenants' VMs. D is incorrect because cloud providers typically do not provide hypervisor memory dumps upon request.

Answer

The imaging process must be performed from within the same cloud region

Answer

Images of other tenants' VMs can be accessed through the hypervisor if needed

Answer

The cloud provider will provide hypervisor memory dumps upon request

Question 2

An organization wants to prevent secrets from being exposed in source code. Which two practices should they adopt? (Choose TWO.)

Accepted Answer

Implement secret scanning in the CI/CD pipeline. Using a secrets manager (like AWS Secrets Manager or Vault) avoids hardcoding credentials. Scanning for secrets in code repositories (e.g., GitGuardian) helps detect and remove any secrets that might have been committed.

Answer

Encrypt all source code files

Answer

Use a firewall to block access to code repositories

Answer

Disable git history

Question 3

Which TWO best practices help secure a cloud application's runtime environment?

Accepted Answer

Use immutable infrastructure. Immutable infrastructure ensures that once a cloud application's runtime environment is deployed, it is never modified in place. Any change requires building a new image and redeploying, which eliminates configuration drift, reduces the attack surface, and prevents unauthorized modifications from persisting. This directly secures the runtime environment by enforcing a known-good state at all times.

Answer

Implement host-based intrusion detection

Answer

Enable automatic patching of dependencies

Answer

Use container orchestration platform

Question 4

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

Accepted Answer

Deploy a virtual firewall between tiers.. Deploying a virtual firewall between tiers (e.g., between web, application, and database tiers) enforces micro-segmentation by inspecting and controlling east-west traffic at the application layer. This allows granular, stateful filtering of traffic based on specific protocols, ports, and even application-level attributes, preventing lateral movement of threats within the cloud environment.

Answer

Allow all traffic from the internet.

Answer

Use a bastion host for all administrative access.

Answer

Use a single network ACL for all subnets.

Question 5

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Running containers with a non-root user is a fundamental security best practice because it limits the potential damage from a container breakout. By default, Docker containers run as root, which means if an attacker compromises the container, they have root privileges on the host kernel. Using the USER directive in a Dockerfile or specifying a non-root user at runtime reduces the attack surface and enforces the principle of least privilege.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.

Question 6

Which TWO of the following are key elements of a cloud service agreement (CSA) for legal compliance?

Accepted Answer

Audit rights. Data processing terms (DPA) and audit rights are standard CSA elements addressing legal compliance. Encryption key management and portability are more about security and operations, but not always considered 'key legal compliance' elements.

Answer

Encryption key management

Answer

Data portability tools

Answer

Service level agreements (SLA) uptime guarantee

Question 7

A security auditor is reviewing a cloud provider's virtualisation infrastructure. Which TWO mechanisms ensure VM isolation at the hardware level to prevent one tenant from accessing another's resources?

Accepted Answer

CPU Pinning. CPU Pinning (option A) ensures VM isolation at the hardware level by dedicating specific physical CPU cores exclusively to a particular VM. This prevents other VMs from scheduling on those cores, eliminating CPU-level side-channel attacks and resource contention. It is a hardware-enforced isolation mechanism because the hypervisor uses the CPU's hardware virtualization extensions (e.g., Intel VT-x or AMD-V) to enforce the pinning, ensuring that one tenant's VM cannot access another's CPU resources.

Answer

Hypervisor Introspection

Answer

Security Groups

Answer

Network ACLs

Question 8

A cloud security architect is implementing a CI/CD pipeline for a containerized application on AWS. Which TWO practices should be integrated to enforce container image security?

Accepted Answer

Scan container images for vulnerabilities before push to registry. Scanning container images for vulnerabilities before pushing them to a registry is a critical shift-left security practice. It ensures that known Common Vulnerabilities and Exposures (CVEs) in base images or application dependencies are detected and remediated early in the CI/CD pipeline, preventing insecure images from being deployed. Tools like Trivy, Clair, or AWS ECR image scanning integrate directly into the pipeline to enforce this policy.

Answer

Implement runtime application self-protection (RASP)

Answer

Use a cloud WAF to protect the containerized application

Answer

Run SAST on the application source code

Question 9

A company uses a cloud KMS with HSM-backed keys for regulatory compliance. They need to allow a cloud service to use a key for encryption while retaining the ability to revoke access at any time. Which TWO key management models satisfy this? (Choose two.)

Accepted Answer

Bring your own key (BYOK). BYOK is correct because it allows the customer to import their own key material into the cloud KMS, which is backed by an HSM, and the customer retains full control over the key's lifecycle, including the ability to revoke access at any time by disabling or deleting the key. CMEK is correct because it gives the customer direct management of the key (e.g., rotation, disabling, deletion) within the cloud KMS, while the HSM provides hardware-level protection, and the customer can revoke the cloud service's access by modifying key permissions or disabling the key.

Answer

Hold your own key (HYOK)

Answer

Customer-supplied keys (CSEK)

Answer

Cloud provider-managed keys

Question 10

A company's cloud security policy mandates strict control over encryption keys used for data at rest. Which THREE practices are recommended for secure key management in the cloud?

Accepted Answer

Rotate encryption keys on a regular schedule.. Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Answer

Use a single master key for all encryption operations.

Answer

Store keys in the same cloud region as the data to reduce latency.

Question 11

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. A communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 12

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 13

Which THREE of the following are key considerations when conducting a cloud risk assessment?

Accepted Answer

Reviewing legal and regulatory requirements applicable to the organization. Legal and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS) directly dictate data residency, privacy controls, and breach notification obligations. A cloud risk assessment must map these requirements to the specific cloud deployment to identify compliance gaps and potential liabilities.

Answer

Analyzing network latency between cloud regions

Answer

Evaluating the CSP's physical security controls in detail

Question 14

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. The correct best practices are A (using separate keys per tenant/application) and D (regular key rotation). Option B (hard-coding keys) is a security risk. Option C (storing keys in the same region) is not a security best practice. Option E (single master key) defeats the purpose of encryption key separation.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.

Question 15

A security architect is designing a cloud workload protection platform (CWPP) for a hybrid cloud environment. The architect needs to ensure that security policies are consistently applied across virtual machines running in both on-premises and public cloud environments. Which TWO components are essential for achieving this goal?

Accepted Answer

Unified agent software installed on each VM. Unified agent software installed on each VM is essential because it provides a consistent security monitoring and enforcement layer across heterogeneous environments. The agent communicates with the centralized policy management console to receive and enforce policies locally, ensuring that security controls such as file integrity monitoring, vulnerability scanning, and host-based firewall rules are applied uniformly regardless of whether the VM runs on-premises or in a public cloud.

Answer

Software-defined perimeter (SDP) architecture

Answer

Virtual private cloud (VPC) network ACLs

Answer

Infrastructure as code templates

Question 16

A company is negotiating a cloud contract and wants to ensure data ownership and deletion. Which TWO clauses should be included? (Select two.)

Accepted Answer

Data ownership clause. Data ownership clause clarifies that the customer owns the data. Data deletion clause ensures the provider deletes data upon termination, including backups.

Answer

Right to audit clause

Answer

Non-disclosure agreement

Answer

Service level agreement

Question 17

A DevSecOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and trust from build to deployment?

Accepted Answer

Signing container images with Cosign. Image signing, vulnerability scanning, and using admission controllers to verify signatures ensure integrity and trust.

Answer

Storing images in a private registry without scanning

Answer

Allowing any image with a :latest tag

Question 18

Which THREE are best practices for implementing secrets management in cloud applications?

Accepted Answer

Use a dedicated secrets management service. Dedicated secrets management services (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provide centralized, auditable, and policy-controlled storage for secrets like API keys and database credentials. These services enforce encryption at rest (e.g., using envelope encryption with AWS KMS) and in transit (TLS 1.2+), and support automatic rotation, reducing the risk of exposure compared to ad-hoc methods.

Answer

Embed secrets in application logs for debugging

Answer

Store secrets in version control repositories

Question 19

A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?

Accepted Answer

Conduct regular tabletop exercises to simulate incident scenarios. Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.

Answer

Conduct a post-mortem analysis of previous incidents

Answer

Implement automated isolation of compromised instances

Answer

Deploy a security information and event management (SIEM) system

Question 20

Which THREE of the following are key considerations when designing a key management lifecycle for cloud data encryption?

Accepted Answer

Key rotation. Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

Answer

Key usage monitoring

Answer

Key escrow