CCSP Quick Quiz — 10 Questions

Question 1

A cloud architect is designing a data loss prevention (DLP) solution for a SaaS application. The DLP must inspect data in transit between end users and the cloud as well as data at rest. Which combination of controls is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a cloud DLP service for content inspection and enforce encryption at rest.. A cloud DLP service (e.g., AWS Macie, Microsoft Purview) can inspect data in transit by analyzing API calls or traffic patterns, and encryption at rest (e.g., AES-256) protects stored data. This combination directly addresses both inspection of data in transit and protection of data at rest, which is the core requirement of the question.

Answer

Use network segmentation and security groups.

Answer

Use encryption at rest and backup retention policies.

Answer

Implement a web application firewall (WAF) and a VPN.

Question 2

Under GDPR, what is the maximum time allowed for a data controller to notify the supervisory authority of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 3

A security team is investigating a potential data exfiltration incident where a large volume of data was downloaded from a cloud storage bucket. Which log source would provide the most granular details about the GET requests, including the requester identity and source IP?

Accepted Answer

Cloud storage access logs. Cloud storage access logs provide detailed records of requests made to a bucket, including requester, source IP, and objects accessed. Cloud audit logs (data events) can also log storage operations, but storage access logs are more granular for this purpose.

Answer

VPC flow logs

Answer

Cloud management events (e.g., CloudTrail equivalent)

Answer

Log aggregation service for storage (e.g., CloudWatch equivalent)

Question 4

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Accepted Answer

General Data Protection Regulation (GDPR). The General Data Protection Regulation (GDPR) is the correct legal framework because it specifically governs the processing of personally identifiable information (PII) of European Union citizens, regardless of where the data is stored or processed. As the cloud customer is moving a customer database containing EU PII to a public cloud provider, GDPR imposes strict requirements on the data controller (the customer) for data protection, consent, breach notification, and cross-border data transfer safeguards.

Answer

Sarbanes-Oxley Act (SOX)

Answer

Health Insurance Portability and Accountability Act (HIPAA)

Answer

Payment Card Industry Data Security Standard (PCI DSS)

Question 5

A Kubernetes cluster is being hardened. Which THREE measures should be implemented to restrict container capabilities and reduce the risk of privilege escalation? (Select three.)

Accepted Answer

Running containers as a non-root user. Option C is correct because running containers as a non-root user (e.g., via securityContext.runAsNonRoot: true or a USER directive in the Dockerfile) prevents processes inside the container from having UID 0, which is the primary enabler of privilege-escalation exploits and container-escape techniques. Option D is correct because AppArmor or SELinux profiles enforce mandatory access control that confines container processes to a limited set of files, paths, and operations, blocking actions that even a compromised process could otherwise attempt. Option E is correct because dropping all Linux capabilities and adding back only those explicitly required (e.g., using cap-drop: ALL with a minimal cap-add list) removes dangerous privileges such as CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE that are commonly abused for privilege escalation. Option A is incorrect because privileged mode grants the container nearly all host capabilities and device access, dramatically increasing the attack surface rather than restricting it. Option B is incorrect because running containers as root gives the process full UID 0 privileges inside the container, which is exactly the risk the hardening measures are meant to eliminate.

Answer

Enabling privileged mode for containers that need host access

Answer

Running containers as root

Question 6

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

Accepted Answer

Deploy a virtual firewall between tiers.. Deploying a virtual firewall between tiers (e.g., between web, application, and database tiers) enforces micro-segmentation by inspecting and controlling east-west traffic at the application layer. This allows granular, stateful filtering of traffic based on specific protocols, ports, and even application-level attributes, preventing lateral movement of threats within the cloud environment.

Answer

Allow all traffic from the internet.

Answer

Use a bastion host for all administrative access.

Answer

Use a single network ACL for all subnets.

Question 7

A medium-sized e-commerce company uses a cloud provider's container orchestration service (e.g., Amazon ECS or Google Kubernetes Engine). They have a security requirement to ensure that all containers run with the least privilege principle. The development team often requests containers to run as root for debugging purposes. The security team wants to enforce a policy that prevents containers from running as root in the production environment. However, the development team still needs the ability to troubleshoot occasionally. The cloud security architect must design a solution that restricts root privilege in production but allows controlled troubleshooting. Which of the following approaches is the most effective?

Accepted Answer

Use a security context constraint (or PodSecurityPolicy) to deny all containers running as root, and require developers to use a sidecar container for debugging.. It uses a security context constraint (SCC) or PodSecurityPolicy (PSP) to enforce a deny-all policy for root containers in production, which aligns with the least privilege principle. The sidecar container provides a controlled debugging mechanism without granting root access to the main application container, allowing developers to troubleshoot via a separate, privileged sidecar that can be audited and restricted.

Answer

Allow containers to run as root but configure host-based intrusion detection to alert on suspicious activities.

Answer

Grant developers SSH access to the host nodes for troubleshooting.

Answer

Create two separate clusters, one for production with root restriction, and one for debugging where root is allowed.

Question 8

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

Accepted Answer

OAuth 2.0 with client credentials. OAuth 2.0 with the client credentials grant is the most appropriate mechanism for machine-to-machine API access because it allows the API to authenticate the third-party application itself (the client) using a client ID and client secret, without involving end-user credentials. This grant type is specifically designed for server-to-server integrations where the client is acting on its own behalf, providing a secure, token-based approach that avoids sharing long-lived secrets directly with each API call.

Answer

Basic authentication with API keys

Answer

SAML 2.0

Answer

X.509 certificates

Question 9

A company uses a hybrid cloud model where sensitive data resides in a private cloud, while compute-intensive analytics run in a public cloud using anonymized data. What is the primary security consideration for this architecture?

Accepted Answer

Maintaining consistent security policies and secure connectivity between environments. In hybrid cloud, consistent security policies must apply across both environments, and secure connectivity (e.g., VPN or dedicated connection) is essential to protect data in transit and prevent leakage.

Answer

Using the same hypervisor in both clouds

Answer

Implementing network segmentation only in the public cloud

Answer

Ensuring the public cloud provider has SOC 2 certification

Question 10

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Accepted Answer

The second statement allows unrestricted public read access to all objects. The second statement in the S3 bucket policy uses `"Effect": "Allow"` with `"Principal": "*"` and `"Action": "s3:GetObject"` without any condition restricting access (e.g., `IpAddress` or `Referer`). This effectively grants anonymous, unauthenticated read access to every object in the bucket, which is a critical data exposure risk. Such a policy violates the principle of least privilege and should be remediated immediately by removing the statement or adding a condition to restrict access.

Answer

The principal "*" grants access to all AWS services

Answer

The policy version is outdated and should be updated

Answer

The resource ARN does not include the bucket itself, only objects