Certified Cloud Security Professional CCSP (CCSP) — Questions 1–75

PCI DSS requires that the service provider's responsibilities are mapped in a Cloud Provider Responsibility Matrix, typically in Appendix A3. Additionally, the customer must obtain evidence of the provider's QSA assessment.

Using the cloud provider's data residency policy with region-restricted storage buckets enforces data at rest to be physically stored only in the specified geographic region. This is a technical control implemented at the infrastructure layer, ensuring that the cloud provider's storage service will not replicate or move data outside the designated region, providing the strongest assurance against data leaving the region.

Governance mode allows authorized users to override retention settings for legal holds while still enforcing a 7-year minimum retention period. This balances compliance with the need for immediate legal holds, as users with appropriate permissions can place a legal hold on objects without extending the retention period for all data.

A cloud transit gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management and enabling centralized security policies. Virtual network peering is point-to-point and does not scale well for many VPCs.

CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys in cloud KMS, and BYOK (Bring Your Own Key) allows importing keys into cloud KMS. In both cases, the provider can access the keys when authorized.

In cloud environments, data may be replicated across multiple regions or stored in backups. A legal hold must prevent deletion or alteration of all copies, including replicas and backups. Failure to apply hold to all copies can result in spoliation.

VM escape attacks exploit hypervisor vulnerabilities. The primary defense is to keep the hypervisor patched and hardened, as other controls like IDS/IPS or guest OS hardening do not directly prevent escape.

IaaS provides virtual machines where the customer can install and configure the OS and middleware without modifying the application code.

Implementing abstraction layers such as containers (e.g., Docker, Kubernetes) or cloud-agnostic APIs (e.g., Terraform, OpenStack) decouples application code from underlying cloud infrastructure. This allows workloads to be migrated between providers without rewriting core logic, directly addressing vendor lock-in by standardizing deployment and orchestration interfaces.

Community cloud is designed for organizations with shared concerns.

In PaaS, the customer manages applications and data, while the provider manages the runtime, OS, and infrastructure. IaaS gives more control; SaaS gives less.

This is a dependency confusion attack, where an attacker uploads a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as a private package used internally by the target organization. When a build system or developer's package manager is configured to check public registries first (or as a fallback), it may download the attacker's malicious version instead of the legitimate internal package, leading to code execution or data exfiltration.

Uptime percentage (e.g., 99.9%) and RTO/RPO are key availability and disaster recovery metrics. Latency and throughput are performance, not availability; support response time is operational.

Regular key rotation limits the window of exposure if a key is compromised and aligns with cryptographic best practices (e.g., NIST SP 800-57). In cloud environments, automated rotation policies (e.g., AWS KMS automatic yearly rotation or manual rotation for customer-managed keys) ensure that even if an attacker obtains an old key, it cannot decrypt current data.

Degaussing (A) is effective because it uses a strong magnetic field to completely randomize the magnetic domains on hard disk drives (HDDs), rendering all stored data unrecoverable even with advanced forensic tools. This method is approved for the highest security classifications (e.g., NSA/CSS Policy Manual 9-12) but physically destroys the media's ability to store data, making it suitable only for end-of-life disposal.

AWS WAF protects the application from web exploits, and security groups act as instance-level firewalls to control traffic between tiers. NACLs are subnet-level and less granular.

SOX IT general controls include change management (ensuring system changes are controlled), access controls (preventing unauthorized access), and audit logs (monitoring and accountability).

The API returns sensitive data (credit_card_number) that the client application does not need, violating the principle of least data exposure. This is a classic Excessive Data Exposure risk (OWASP API Security Top 10 #3), where the server trusts the client to filter the response rather than limiting the fields returned based on the client's actual authorization or need.

Static Application Security Testing (SAST) analyzes source code or binaries for security vulnerabilities without executing the application, making it suitable for early integration in CI/CD.

Data residency policies restrict data storage to specific geographic regions. By selecting cloud regions within the EU, the organization ensures data does not leave the EU, complying with GDPR data localization requirements.

A hot standby in a different availability zone with automated failover can achieve an RTO of 4 hours and an RPO of 1 hour. The standby environment is fully operational and synchronized, allowing near-instant failover to meet the RTO, while automated replication keeps data loss within the 1-hour RPO window. This strategy is suitable for financial services requiring high availability and minimal data loss.

Cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) offer a built-in automatic key rotation feature that can be configured to rotate the key material every 90 days without any manual intervention. Enabling this setting ensures that new cryptographic material is generated for the key, while the old key material remains available for decrypting data encrypted with it, maintaining seamless security compliance.

A VPN (Virtual Private Network) creates an encrypted tunnel between the on-premises network and the cloud VPC, ensuring all traffic in transit is encrypted.

Security groups are stateful and allow return traffic automatically. For inbound control, security groups with source references provide the required micro-segmentation.

The error indicates a resource capacity failure, which means the specific zone lacks enough resources (e.g., CPU, memory, or network capacity) to launch the requested virtual machine instance type. The best course of action is to launch the instance in a different zone within the same region, as capacity constraints are typically zone-specific and not region-wide. This approach avoids unnecessary virtual network creation or waiting, and it directly addresses the resource scarcity at the zone level.

Private ACLs (or bucket policies denying public access), enabling block public access settings, and requiring IAM authentication limit access to authorized entities. Versioning and encryption help with data protection but do not prevent unauthorized access.

Azure Defender for Cloud provides integrated security protections for Azure resources. Enabling the 'Defender for Databases' plan specifically protects Azure SQL databases by detecting anomalous activities, SQL injection attempts, and potential vulnerabilities. This plan extends to other database types like Azure SQL Managed Instance and Azure Synapse SQL pools, ensuring comprehensive database security.

VPC peering allows direct routing using private IP addresses, but it is not transitive: if VPC A peers with VPC B and VPC B peers with VPC C, traffic cannot flow from A to C via B.

Credit card information (Option B) is classified as 'restricted' because PCI DSS explicitly mandates strict controls for cardholder data, including primary account numbers (PANs), expiration dates, and CVV codes. This data requires encryption at rest and in transit, access controls, and regular security audits to comply with the Payment Card Industry Data Security Standard.

When a cloud storage object is encrypted with a customer-managed encryption key (CMEK), the GetObject API call requires the user to have both GetObject permission on the bucket policy and Decrypt permission on the specific encryption key. Even if the bucket policy and user IAM permissions appear correct for storage actions, the absence of the decrypt permission on the key will cause an access denied error. This is a common misconfiguration because the error message does not explicitly mention the key, leading analysts to overlook the key permission.

Granting access to the account administrator of a cloud account is a major security risk because the administrator has unrestricted access and bypasses access management controls. While the policy lacks conditions and allows read access, the principal being the administrator is the most critical issue.

File-level encryption (C) encrypts individual files or directories, ensuring that data at rest remains protected even if the underlying storage is compromised. This is a direct data-at-rest security control because it applies cryptographic protection to the data itself, independent of the storage layer. Transparent data encryption (D) encrypts data at the database level, typically at the page or file level, without requiring changes to the application, making it another effective strategy for securing data at rest.

Client-side encryption with customer-managed keys stored on-premises ensures that the encryption keys never leave the company's control, and the data is encrypted before it is uploaded to the cloud object storage service. This satisfies both the requirement for encryption at rest and exclusive key control, as the cloud provider never has access to the plaintext keys or the ability to decrypt the data.

Detecting impossible travel requires authentication logs (who logged in and from where) and timestamps. Cloud provider authentication logs (e.g., AWS CloudTrail for console logins, Azure AD sign-in logs) provide the necessary data.

Data residency is achieved by selecting a cloud region (e.g., 'EU-West-1') and configuring storage buckets or databases with region-specific policies. Additionally, bucket policies can explicitly deny access from outside the region, and replication features should be disabled or configured to stay within the region.

The error indicates the user lacks permission to encrypt with the specified KMS key. Since the key is customer-managed, its key policy must explicitly grant the `kms:Encrypt` action to the user or role. Without this permission, AWS KMS denies the request, even if the user has other IAM permissions.

The cloud data lifecycle consists of Create, Store, Use, Share, Archive, Destroy. The 'Use' phase is when data is accessed and processed.

Whitelisting allowed outbound destinations is a primary defense against SSRF. By explicitly permitting only trusted external hosts (e.g., specific API endpoints or internal services), the application cannot be tricked into making requests to arbitrary internal or external targets, even if an attacker controls the URL parameter.

With customer-managed keys, the customer controls the key and can revoke the cloud service's access by disabling the key or removing the access permission that allows the service to use the key. Deleting the key would also work but is irreversible. Disabling the key is reversible and immediate.

AWS Config can continuously evaluate S3 bucket settings against a custom or managed rule (e.g., s3-bucket-public-read-prohibited). When the rule detects a noncompliant bucket, it triggers an AWS Lambda function via auto-remediation, which can modify the bucket's ACL or policy to remove public access. This combination provides fully automated, event-driven remediation without manual steps.

Cloud KMS with HSM-backed key storage ensures keys are generated and stored in an HSM. CMEK and BYOK typically use software-backed keys unless HSM is specified. HYOK keeps keys on-premises, not in cloud HSM.

Modifying the Condition value to "aws:SourceIp": "10.0.1.0/24" directly restricts the S3 bucket policy to allow read access only from the security team's subnet. The original policy uses the aws:SourceIp condition key with the broader 10.0.0.0/16 range, so narrowing it to 10.0.1.0/24 precisely enforces the required access control. This approach leverages AWS IAM policy evaluation logic where an explicit Allow with a condition must be satisfied for access to be granted.

CloudTrail Log File Validation (option B) uses a SHA-256 hash chain to create a digital signature for each log file, enabling integrity verification. When enabled, CloudTrail delivers digest files that contain hashes of log files, allowing you to confirm that log files were not modified, deleted, or tampered with after delivery. This directly addresses the requirement to detect unauthorized API calls by ensuring the logs themselves are trustworthy.

AWS Organizations Service Control Policies (SCPs) can be applied at the account level to deny the creation of EC2 instances that do not include the required 'Environment' and 'Owner' tags. SCPs are evaluated before the resource is created, providing a preventive control that blocks non-compliant launches at the API level, unlike detective or reactive approaches.

Masking is a de-identification transform that replaces part of the sensitive data with a placeholder, such as showing only the last four digits of a credit card number.

The policy grants kms:Decrypt using a wildcard resource ("arn:aws:kms:*:*:key/*") instead of specifying the exact KMS key ARN used to encrypt the S3 objects. When an S3 object is encrypted with SSE-KMS, the backup application must have explicit permission to use that specific KMS key. Without the correct key ARN in the KMS action's Resource element, KMS denies the decryption request, causing the access denied error.

Connection pooling reuses a set of established database connections, avoiding the overhead of repeatedly opening and closing connections during high concurrency. This directly resolves intermittent timeouts caused by connection exhaustion or slow connection establishment under peak load, without requiring additional infrastructure.

The customer is responsible for data encryption and access controls (C and E). Physical security and penetration testing are provider responsibilities. Verifying certifications is a customer due diligence task but not a primary responsibility compared to direct data protection measures.

DLP scanning should ideally occur during the Create stage, as data is being created or ingested, to prevent sensitive data from being stored without proper protections. Scanning at Store stage may allow data to persist. Scanning at Use or Share stages is reactive and may already have exposed data.

VPN and dedicated private connections (like AWS Direct Connect or Azure ExpressRoute) are standard for secure hybrid cloud connectivity. Cloud access security brokers (CASBs) are for monitoring, not connectivity; public internet is not secure; MPLS is a type of private connection but less common in cloud contexts.

UEBA uses machine learning to establish baselines of normal user and entity behavior, then generates alerts only when deviations occur. This directly reduces false positives by filtering out benign anomalies and enriches alerts with behavioral context, enabling analysts to triage and prioritize incidents more efficiently without increasing headcount.

Integrity verification of audit logs is typically achieved through cryptographic hashing (e.g., SHA-256) and digital signatures provided by the cloud service provider's logging service. This allows the analyst to confirm that logs have not been altered since they were created.

99.999% availability means 0.001% downtime per year. Yearly minutes = 365 * 24 * 60 = 525,600. 0.001% of 525,600 = 5.256 minutes.

Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.

GitGuardian is a tool specifically designed to detect secrets (like cloud provider access keys) committed to code repositories. It monitors for hardcoded credentials and alerts.

Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify malicious activity.

A cloud security monitoring service detects threats by analyzing network traffic logs, DNS logs, and API call logs. A finding of communication with a known cryptocurrency mining pool indicates that the virtual machine instance is likely compromised and running crypto mining software, which consumes excessive compute resources and represents a malicious activity type known as crypto mining.

SSH (port 22) should never be open to the internet (0.0.0.0/0) on a web server. Removing Rule 1 eliminates this unnecessary exposure while the web server's HTTP/HTTPS rules remain intact, preserving application functionality. This aligns with the principle of least privilege and reduces the attack surface.

Client-side encryption ensures data is encrypted before it reaches the cloud, so the cloud provider never sees plaintext or keys. Hold Your Own Key (HYOK) keeps the key on-premises in an HSM, never exposing it to the cloud. Both give the customer exclusive control.

Full-disk encryption ensures that any residual data left on the original host's local storage after live migration is unreadable without the encryption key. Even if temporary files remain, encryption at rest renders the data inaccessible, directly addressing data remanence concerns without relying on the cloud provider's cleanup processes.

A centralized key management system (KMS) that integrates with all cloud providers enables consistent key lifecycle management, reduces the risk of key sprawl, and ensures uniform access control policies across a multi-cloud environment. This approach aligns with the principle of separation of duties and allows for centralized auditing and rotation without vendor lock-in.

GDPR right to erasure requires deletion of all copies. Versioning creates multiple versions that must be deleted. Cross-region replication creates additional copies in other regions that must also be deleted.

The CSA STAR (Security, Trust, Assurance, and Risk) program has three tiers: Tier 1 (Self-Assessment), Tier 2 (Third-Party Assessment), and Tier 3 (Continuous Monitoring). Tier 2 specifically requires a third-party assessment against the ISO/IEC 27001 standard, where an accredited certification body audits the cloud service provider's Information Security Management System (ISMS) for compliance. This tier provides a higher level of assurance than self-assessment, as it involves independent validation of security controls.

Distroless images contain only the application and its runtime dependencies, minimizing the attack surface.

Implementing key rotation with a short interval ensures that even if a customer-managed key is compromised or accessed by unauthorized personnel, the window of exposure is minimized. TDE with a customer-managed key in a cloud KMS relies on the key's secrecy; frequent rotation invalidates older key material, reducing the risk of long-term unauthorized decryption of data at rest.

GCP Cloud Audit Logs record all admin activities and data access, including IAM changes and authentication, making them the best source for timeline reconstruction.

The bucket policy includes an explicit Allow statement granting s3:GetObject to all principals (Principal: "*") from the IP address 192.0.2.10, and the condition "Bool": {"aws:SecureTransport": "true"} ensures that only HTTPS requests are allowed. Since the request originates from the specified IP and uses HTTPS, it satisfies both the Allow condition and is not blocked by the Deny statement, which only denies requests when SecureTransport is false (i.e., HTTP). Thus, the request is permitted.

The policy allows any AWS user (Principal: "*") to read objects if they are from the specified IP range. This is overly permissive, granting access to the entire internet at that range, which could include malicious actors. The condition is correctly applied (B is false), encryption is not the main issue (C), and NotPrincipal is not required (D).