CCSP Timed Practice Test 4 — 10 Questions

Question 1

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Accepted Answer

Deploy the application across multiple availability zones within a region.. Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Answer

Use an active-passive configuration with both instances in the same availability zone.

Answer

Configure the application to run in only one region to simplify management.

Answer

Use a single, large virtual machine instance to handle all traffic.

Question 2

Which THREE of the following are typical responsibilities of a cloud customer under the shared responsibility model?

Accepted Answer

Classifying data and managing data encryption.. Option A is correct because under the shared responsibility model, the cloud customer is responsible for classifying their data and managing encryption (both at rest and in transit) using tools like AWS KMS, Azure Key Vault, or client-side encryption libraries. The provider secures the infrastructure, but the customer controls access to the data itself.

Answer

Physical security of data centers.

Answer

Patching the hypervisor.

Question 3

Drag and drop the steps for implementing a secure DevOps (DevSecOps) pipeline in a cloud environment into the correct order.

Question 4

Drag and drop the steps for setting up a virtual private cloud (VPC) with public and private subnets in AWS into the correct order.

Question 5

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Accepted Answer

CloudFront requests originate from CloudFront IP addresses, not the end user's IP.. D is correct because when CloudFront fetches objects from an S3 origin, it uses its own IP addresses, not the end user's IP address. The bucket policy restricts access to the corporate IP range (203.0.113.0/24), but CloudFront's requests come from AWS's CloudFront edge IP range, which falls outside that range. This causes S3 to deny the request, resulting in a 403 Forbidden error.

Answer

The bucket policy has a syntax error in the Condition block.

Answer

There is an implicit deny that overrides the explicit allow.

Answer

The bucket policy does not allow the s3:GetObject action.

Question 6

A company is migrating a legacy monolithic application to a cloud-native microservices architecture. The security architect is concerned about securing inter-service communication. Which of the following should be implemented to ensure mutual authentication and encryption between services?

Accepted Answer

Deploy a service mesh with mutual TLS (mTLS) for all inter-service communication.. A service mesh with mutual TLS (mTLS) provides both encryption and mutual authentication for inter-service communication, ensuring that each service verifies the identity of the other before exchanging data. This is the recommended approach for cloud-native microservices because it offloads security concerns from application code and uses X.509 certificates to establish trust, aligning with zero-trust principles.

Answer

Use shared API keys embedded in each service's configuration.

Answer

Implement TLS termination at the load balancer with internal certificates.

Answer

Place all services in the same Virtual Private Cloud (VPC) and restrict ingress with security groups.

Question 7

A cloud application developer is using a containerized application with Docker. The security team requires that the application runs with the least privilege possible. Which of the following is the BEST practice to ensure the container does not run as root?

Accepted Answer

Include a USER directive in the Dockerfile to specify a non-root user.. The USER directive in a Dockerfile sets the user for any subsequent RUN, CMD, or ENTRYPOINT instructions, ensuring the container process runs as a non-root user by default. This is the most direct and persistent method to enforce least privilege at build time, as it becomes part of the image itself and applies regardless of runtime flags.

Answer

Use the --no-root flag when starting the container.

Answer

Set the securityContext.runAsNonRoot parameter in the container manifest.

Answer

Use the --cap-drop=ALL option when running the container.

Question 8

Refer to the exhibit. A cloud security analyst reviews the bucket policy for example-bucket. Based on the policy, which of the following is true?

Accepted Answer

Requests from IP 192.0.2.10 over HTTPS are allowed.. Option A is correct because the bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

Answer

Access is denied because the Principal is set to "*", which is insecure.

Answer

Requests from IP 192.0.2.10 over HTTP are allowed because the deny statement only applies when SecureTransport is false.

Answer

Any IP address can perform GetObject requests if they use HTTPS.

Question 9

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.. AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Answer

Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Store the credentials as encrypted environment variables in the Lambda function configuration.

Answer

Hardcode the credentials in the Lambda function code and encrypt the deployment package.

Question 10

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)