CCSP Timed Practice Test 2 — 10 Questions

Question 1

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

10 minute time limit — choose an answer to begin.

Accepted Answer

Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.. Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Answer

Replace the base image with a minimal image like Alpine.

Answer

Manually review and patch the base image before each build.

Answer

Configure the scanner to send alerts after deployment.

Question 2

Which TWO of the following are considered best practices for securing containerized applications in a cloud environment?

Accepted Answer

Run containers with a non-root user.. Running containers with a non-root user is a fundamental security best practice because it limits the potential damage from a container breakout. By default, Docker containers run as root, which means if an attacker compromises the container, they have root privileges on the host kernel. Using the USER directive in a Dockerfile or specifying a non-root user at runtime reduces the attack surface and enforces the principle of least privilege.

Answer

Enable SSH inside the container for remote administration.

Answer

Use the 'latest' tag for base images to get the newest features.

Answer

Include debugging tools inside the container for troubleshooting.

Question 3

A medium-sized e-commerce company uses a cloud provider's container orchestration service (e.g., Amazon ECS or Google Kubernetes Engine). They have a security requirement to ensure that all containers run with the least privilege principle. The development team often requests containers to run as root for debugging purposes. The security team wants to enforce a policy that prevents containers from running as root in the production environment. However, the development team still needs the ability to troubleshoot occasionally. The cloud security architect must design a solution that restricts root privilege in production but allows controlled troubleshooting. Which of the following approaches is the most effective?

Accepted Answer

Use a security context constraint (or PodSecurityPolicy) to deny all containers running as root, and require developers to use a sidecar container for debugging.. It uses a security context constraint (SCC) or PodSecurityPolicy (PSP) to enforce a deny-all policy for root containers in production, which aligns with the least privilege principle. The sidecar container provides a controlled debugging mechanism without granting root access to the main application container, allowing developers to troubleshoot via a separate, privileged sidecar that can be audited and restricted.

Answer

Allow containers to run as root but configure host-based intrusion detection to alert on suspicious activities.

Answer

Grant developers SSH access to the host nodes for troubleshooting.

Answer

Create two separate clusters, one for production with root restriction, and one for debugging where root is allowed.

Question 4

A software company develops an API for third-party integrations. They want to ensure that only authorized partners can access the API. Which authentication mechanism is most appropriate?

Accepted Answer

OAuth 2.0 with client credentials. OAuth 2.0 with the client credentials grant is the most appropriate mechanism for machine-to-machine API access because it allows the API to authenticate the third-party application itself (the client) using a client ID and client secret, without involving end-user credentials. This grant type is specifically designed for server-to-server integrations where the client is acting on its own behalf, providing a secure, token-based approach that avoids sharing long-lived secrets directly with each API call.

Answer

Basic authentication with API keys

Answer

SAML 2.0

Answer

X.509 certificates

Question 5

An organization uses a multi-cloud architecture with applications running on both AWS and Azure. They need to implement a secrets management solution that works across both platforms and supports automated rotation. Which approach best meets these requirements?

Accepted Answer

Deploy HashiCorp Vault as a centralized secrets manager. HashiCorp Vault provides a cloud-agnostic secrets management service with automated rotation and cross-cloud capabilities. AWS Secrets Manager is AWS-specific. Azure Key Vault is Azure-specific. Encrypted environment variables are not easily rotated and require redeployment.

Answer

Store secrets as encrypted environment variables in each environment

Answer

Use Azure Key Vault with a federation bridge to AWS

Answer

Use AWS Secrets Manager for all secrets

Question 6

A security team is reviewing a cloud application's CI/CD pipeline. They want to ensure that only approved open-source libraries are used in production builds. Which approach best addresses this requirement?

Accepted Answer

Implement a software composition analysis (SCA) tool in the pipeline. A Software Composition Analysis (SCA) tool is specifically designed to automatically scan open-source libraries for known vulnerabilities, licensing issues, and version compliance. By integrating SCA into the CI/CD pipeline, the team can enforce a policy that only approved libraries (e.g., those passing a security and license review) are allowed in production builds, blocking unapproved or vulnerable components before deployment.

Answer

Segment the build network to limit internet access

Answer

Perform static code analysis after each build

Answer

Require manual approval for all library updates

Question 7

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring IAM policies to control access to their data. The provider is responsible for the infrastructure that enforces the policy. Both are not equally responsible for the policy content. The auditor is not responsible for configuration.

Answer

The third-party auditor

Answer

Both equally

Answer

The cloud provider

Question 8

A multinational corporation uses a SaaS application that stores data in multiple jurisdictions. The company's legal team is concerned about cross-border data transfers under the GDPR. What is the recommended mechanism to legitimize such transfers?

Accepted Answer

Standard Contractual Clauses (SCCs). Standard Contractual Clauses (SCCs) are a common mechanism for legitimizing transfers to third countries under GDPR. Binding Corporate Rules (BCRs) are for intra-group transfers. Privacy Shield was invalidated. Consent is not generally practical for all data subjects.

Answer

Consent from all data subjects

Answer

Binding Corporate Rules (BCRs)

Answer

Privacy Shield

Question 9

A company uses a cloud provider's managed database service. The security team is concerned about the shared responsibility model for patching the operating system and database engine. According to the shared responsibility model, who is responsible for applying security patches to the database engine?

Accepted Answer

The cloud provider, because it is a managed service. For managed services, the cloud provider is responsible for patching the underlying database engine. Option A is wrong because the customer is responsible for the data and access, not the engine. Option B is wrong because both parties do not share this responsibility. Option D is wrong because the database engine is part of the service.

Answer

The customer, because they control the database configuration

Answer

A third-party vendor contracted by the customer

Answer

Both the customer and the cloud provider equally

Question 10

Which TWO of the following are key elements of a cloud service agreement (CSA) for legal compliance?

Accepted Answer

Audit rights. Data processing terms (DPA) and audit rights are standard CSA elements addressing legal compliance. Encryption key management and portability are more about security and operations, but not always considered 'key legal compliance' elements.

Answer

Encryption key management

Answer

Data portability tools

Answer

Service level agreements (SLA) uptime guarantee