CCSP Timed Practice Test 2 — 10 Questions

Question 1

Which TWO of the following are required elements of a valid Business Continuity Plan (BCP) in the cloud?

Accepted Answer

Communication plan for notifying stakeholders during a disruption.. Option A is correct because a communication plan is a mandatory component of any BCP, as defined by ISO 22301 and NIST SP 800-34. In a cloud context, this plan must specify how to notify stakeholders—including the CSP, internal teams, and customers—during a disruption, ensuring coordinated response and compliance with SLAs.

Answer

Strategy to avoid vendor lock-in with the CSP.

Answer

A detailed risk assessment for all cloud services.

Answer

Network topology diagrams of the cloud environment.

Question 2

A company is migrating to the cloud and must comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to store electronic protected health information (ePHI) in a cloud database. Which of the following is a mandatory requirement for the cloud service agreement?

Accepted Answer

The CSP must sign a Business Associate Agreement (BAA).. Under HIPAA, a covered entity or business associate must have a written Business Associate Agreement (BAA) with any cloud service provider (CSP) that creates, receives, maintains, or transmits electronic protected health information (ePHI) on their behalf. The BAA is a mandatory contractual requirement that establishes the CSP's permitted uses and disclosures of ePHI, as well as its obligations to safeguard the data. Without a signed BAA, the CSP cannot lawfully handle ePHI, making this the only option that is a direct regulatory mandate under HIPAA.

Answer

The CSP must store data in a specific geographic location.

Answer

The CSP must perform quarterly penetration tests.

Answer

The CSP must encrypt all data at rest using AES-256.

Question 3

A regional bank is migrating its customer data to a cloud provider that offers services in multiple jurisdictions. The bank's legal team is concerned about compliance with data protection regulations, specifically regarding the right to be forgotten. During a review, the bank discovers that the cloud provider's data deletion process takes up to 90 days for archived data. The bank needs to ensure it can comply with customer deletion requests within 30 days as required by GDPR. What should the bank do?

Accepted Answer

Implement a process to request immediate deletion from the provider and verify completion within 30 days.. Option C is correct because the bank must maintain compliance with GDPR's 30-day deletion requirement. By implementing a process to request immediate deletion from the provider and verifying completion within 30 days, the bank ensures it can meet the regulatory deadline regardless of the provider's standard 90-day archival deletion cycle. This approach leverages the provider's ability to perform expedited deletion upon request, which is a common capability in cloud services for compliance purposes.

Answer

Store all customer data on-premises and only use the cloud for non-sensitive data.

Answer

Accept the 90-day timeline and rely on a contractual clause that shifts liability to the provider.

Answer

Negotiate a service level agreement that requires the provider to complete deletion within 30 days for all data.

Question 4

A financial services company uses a cloud-based logging service for audit trails. A regulatory investigation is initiated, and the company is required to preserve all logs from the past 18 months. The cloud provider's default retention policy is 12 months, and logs older than that are automatically deleted. The company did not configure custom retention. What is the most appropriate action to ensure compliance?

Accepted Answer

Request that the provider place a legal hold on all logs and verify implementation.. Option C is correct because a legal hold (or litigation hold) is a cloud provider feature that overrides the default retention policy to preserve data indefinitely or for a specified period, preventing automated deletion. This ensures compliance with regulatory requirements without relying on manual exports or backups, and the company must verify implementation through provider tools or APIs to confirm the hold is active.

Answer

Accept the data loss and explain to regulators that the provider has a limited retention policy.

Answer

Export all available logs and store them locally immediately.

Answer

Rely on the provider's backup policy, which may retain data for up to 24 months.

Question 5

A cloud security architect is designing a data loss prevention (DLP) strategy for a multi-cloud environment. Which TWO actions are effective in preventing unauthorized exfiltration of sensitive data?

Accepted Answer

Implement strict Identity and Access Management (IAM) policies with least privilege. Option D is correct because implementing strict IAM policies with least privilege ensures that users and services have only the minimum permissions necessary to perform their functions. This directly limits the attack surface and prevents unauthorized access to sensitive data, which is a foundational control against exfiltration. Without least privilege, even with other controls in place, an over-privileged account could be exploited to move or copy data out of the environment.

Answer

Enable detailed logging and monitoring of all data access events

Answer

Encrypt all data at rest using provider-managed keys

Answer

Use a cloud access security broker (CASB) to enforce data classification

Question 6

A cloud security engineer reviews the S3 bucket policy shown in the exhibit. What is the net effect of this policy when a request originates from IP address 203.0.113.10 over HTTPS?

Accepted Answer

Deny access because the request is from the specified IP range. The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Answer

Deny access because the request does not meet the SecureTransport condition

Answer

Allow access because the condition for Deny does not include SecureTransport

Answer

Allow access because the request uses HTTPS

Question 7

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.. Option B is correct because a SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Answer

Deploy a basic monitoring tool that triggers alerts based on static thresholds.

Answer

Use a cloud-native log storage service with long retention and no analysis.

Answer

Store logs in a centralized log server and have SOC analysts manually review them.

Question 8

Which TWO of the following are primary responsibilities of a cloud service customer under the shared responsibility model regarding compliance with regulations such as GDPR?

Accepted Answer

Implementing data encryption for sensitive data at rest. The customer is responsible for data encryption and access controls (B and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

Answer

Conducting annual penetration tests on the provider's infrastructure

Answer

Ensuring the cloud provider's physical security controls are adequate

Answer

Verifying the provider's compliance certifications are current

Question 9

A cloud security engineer reviews the IAM policy shown in the exhibit, which is attached to an S3 bucket. The engineer finds that users from outside the 10.0.0.0/8 network can still download objects from the bucket. What is the most likely reason for this behavior?

Accepted Answer

The second Allow statement does not include the IP restriction, allowing any IP to read objects. Option C is correct because the second Allow statement in the IAM policy grants s3:GetObject access to all principals without any condition, effectively overriding the IP restriction in the first statement. AWS IAM policy evaluation is explicit deny by default, but when multiple statements apply, an Allow without conditions will permit the action even if another statement restricts it. Since the second statement has no aws:SourceIp condition, any IP address, including those outside 10.0.0.0/8, can download objects.

Answer

The condition key 'aws:SourceIp' does not apply to S3 operations

Answer

The first statement's condition explicitly denies access to IPs outside 10.0.0.0/8

Answer

The policy document has a syntax error that causes the first statement to be ignored

Question 10

Which TWO of the following are primary objectives of a cloud application security program?

Accepted Answer

Maintaining application availability. Maintaining application availability is a primary objective of a cloud application security program because it directly supports the security triad of confidentiality, integrity, and availability (CIA). In a cloud environment, availability ensures that authorized users can access applications and data when needed, which is critical for business continuity and is often enforced through SLAs, redundancy, and DDoS protection mechanisms. Without availability, security controls become irrelevant as the service is effectively denied.

Answer

Performing continuous deployment

Answer

Implementing a microservices architecture

Answer

Adopting Agile development practices