Courseiva

Certified Cloud Security Professional CCSP (CCSP) — Questions 151–225

964 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 13

Page 4
151
MCQmedium

A financial services company must store customer transaction data in a cloud that complies with PCI DSS. Which of the following is a primary requirement for the cloud environment?

A.Annual penetration testing by a qualified assessor
B.Public auditing of all access logs
C.Segmentation of cardholder data from other tenants
D.Encryption of data at rest using AES-256
AnswerC

PCI DSS mandates segmentation or compensating controls to isolate cardholder data.

Why this answer

PCI DSS requires segmentation or compensating controls to isolate cardholder data from other tenants. While encryption and testing are also required, segmentation is a key design requirement specific to multi-tenant environments. Public auditing of all access logs is not a requirement.

Full explanation →
152
MCQeasy

A cloud architect is designing a multi-region application to ensure high availability. The application must automatically fail over to a secondary region if the primary region becomes unavailable. Which strategy best meets this requirement?

A.Active-passive with manual failover
B.Active-passive with automated failover using health checks
C.Active-active with load balancing across regions
D.Read replicas in secondary region
AnswerB

Correct: Health checks trigger automatic failover.

Why this answer

Active-passive with automated failover using health checks is the correct strategy because it ensures that the secondary region automatically takes over when the primary region fails, without manual intervention. Health checks continuously monitor the primary region's endpoints (e.g., via HTTP/HTTPS probes or TCP checks), and upon detecting consecutive failures (e.g., 3 failed health checks), the failover mechanism—such as DNS-based routing with a low TTL (e.g., 60 seconds) or a global load balancer—automatically redirects traffic to the passive secondary region. This meets the high availability requirement by minimizing downtime while keeping the secondary region idle to reduce costs.

Exam trap

ISC2 often tests the misconception that active-active architectures inherently provide automatic failover, but they actually require both regions to be active and healthy, and failover is a separate mechanism; the trap is that candidates confuse load balancing with failover, leading them to choose active-active when the requirement explicitly calls for automatic failover from an unavailable primary region.

How to eliminate wrong answers

Option A is wrong because manual failover introduces significant downtime due to human reaction time and operational procedures, which contradicts the requirement for automatic failover. Option C is wrong because active-active with load balancing across regions is designed for distributing traffic and scaling, not for automatic failover from an unavailable primary region; it requires both regions to be active and healthy, and does not inherently provide a failover mechanism when one region fails. Option D is wrong because read replicas in a secondary region only support read operations and cannot serve as a failover target for write traffic; they lack the capability to automatically promote to a primary role without manual intervention or additional configuration.

Full explanation →
153
MCQmedium

An organization attempts to launch an instance in a specific availability zone but the launch fails. What is the most likely cause of the failure?

A.Instance type not available in that region
B.Resource exhaustion in the availability zone
C.Incorrect region
D.Insufficient CPU quota
AnswerB

The 'insufficient capacity' error is most commonly due to lack of available resources in that AZ.

Why this answer

The most likely cause is resource exhaustion in the availability zone. This occurs when the cloud provider has insufficient capacity in a specific zone to fulfill a request, even if the requested resource type is available in the region. This is a transient condition, unlike quotas which are static limits.

Instance type availability and region correctness would typically result in different error messages and are less likely to be the cause.

Exam trap

ISC2 often tests the distinction between resource exhaustion (capacity) and quota limits, where candidates mistakenly select quota errors when the real issue is transient capacity unavailability in a specific Availability Zone.

How to eliminate wrong answers

Option A is wrong because the instance type not being available in the region would typically result in a different error message indicating the instance type is not supported in that region, and the error would occur regardless of the specific Availability Zone selected. Option C is wrong because an incorrect region would cause a different failure, such as the region not being found or the resource not existing, not a capacity-related error. Option D is wrong because insufficient CPU quota would produce a quota exceeded error, which is distinct from a capacity or resource exhaustion error; quota limits are account-level, not zone-level.

Full explanation →
154
MCQmedium

Refer to the exhibit. A security analyst is investigating a potential unauthorized key pair creation. The CloudTrail log shows a successful CreateKeyPair event for an admin user. What additional step should the analyst take to determine if this was an authorized action?

A.Immediately revoke all admin privileges for the user.
B.Review the key pair's usage to see if it was used to launch instances.
C.Delete the key pair immediately to prevent any misuse.
D.Check the source IP address against the company's approved IP ranges.
AnswerD

This helps verify if the action came from a trusted location.

Why this answer

The first step in verifying whether a CreateKeyPair event was authorized is to check the source IP address against the company's approved IP ranges. CloudTrail logs include the sourceIPAddress field, which can be compared to a whitelist of administrative jump hosts or corporate VPN ranges. If the IP is outside those ranges, it strongly indicates unauthorized access, even if the user credentials were valid.

Exam trap

ISC2 often tests the misconception that the immediate response to a suspicious event should be a punitive action (like revoking privileges or deleting resources) rather than a methodical investigative step to confirm authorization.

How to eliminate wrong answers

Option A is wrong because immediately revoking all admin privileges is a drastic, premature action that could disrupt legitimate operations; the analyst must first gather evidence to confirm unauthorized activity. Option B is wrong because reviewing the key pair's usage to see if it was used to launch instances is a later forensic step, not the immediate action to determine authorization; a key pair can be created and used maliciously within seconds, and the creation event itself must be validated first. Option C is wrong because deleting the key pair immediately could destroy forensic evidence and alert an attacker, and it does not address the root cause of potential credential compromise.

Full explanation →
155
MCQeasy

Which phase of the cloud data lifecycle involves the removal of data in a manner that ensures it cannot be reconstructed, typically using techniques like cryptographic erasure or degaussing?

A.Destroy
B.Store
C.Share
D.Archive
AnswerA

Correct: Destroy securely eliminates data.

Why this answer

The Destroy phase is when data is securely disposed of, ensuring it cannot be recovered.

Full explanation →
156
Multi-Selecthard

A cloud security engineer is investigating a potential data breach in a cloud environment. The organization uses a cloud access security broker (CASB) and has deployed a security information and event management (SIEM) system. Which of the following are likely indicators that the CASB has detected unauthorized data exfiltration? (Choose two.)

Select 2 answers
A.Anomalous spike in outbound traffic to an unknown IP address
B.A change in the configuration of a firewall rule
C.A large number of file downloads by a single user outside of business hours
D.Multiple failed login attempts to a critical application
E.An alert for a known malware signature in an email attachment
AnswersA, C

Unusual outbound traffic patterns can indicate data exfiltration.

Why this answer

Options A and C are correct. A CASB detects anomalous data movements. An anomalous spike in outbound traffic to an unknown IP address (A) and a large number of file downloads by a single user outside business hours (C) are strong indicators of data exfiltration.

Option B, a change in firewall rule configuration, is a configuration change that does not directly indicate exfiltration. Option D, multiple failed login attempts, typically indicates a brute-force attack rather than exfiltration. Option E, an alert for a known malware signature, indicates a malware threat but not necessarily data exfiltration.

Full explanation →
157
MCQmedium

In a Kubernetes cluster, which resource should be used to restrict network traffic between pods based on source and destination labels?

A.Pod Security Admission
B.Network Policies
C.Secrets management with Vault
D.Role-Based Access Control (RBAC)
AnswerB

Network policies define ingress and egress rules for pods.

Why this answer

Network policies in Kubernetes act as a firewall for pods, allowing or denying traffic based on selectors.

Full explanation →
158
Multi-Selectmedium

A cloud customer is evaluating a provider's compliance with PCI DSS. Which two components are part of the PCI DSS shared responsibility model as referenced in Appendix A3? (Choose two.)

Select 2 answers
A.Network perimeter controls
B.Physical security of data centers
C.User access management
D.Application security for custom code
E.Encryption key management
AnswersB, C

The cloud provider is responsible for physical security.

Why this answer

PCI DSS Appendix A3 requires a Cloud Provider Responsibility Matrix that delineates responsibilities; typical shared responsibilities include physical security (provider) and access controls (customer).

Full explanation →
159
MCQhard

A large healthcare organization uses a hybrid cloud environment with on-premises systems and Microsoft Azure. They store protected health information (PHI) in Azure Blob Storage and use Azure SQL Database for transactional data. The organization must comply with HIPAA and has implemented encryption at rest using Azure Storage Service Encryption and Transparent Data Encryption (TDE) for SQL. During a recent audit, the security team discovered that the organization does not have a formal process to identify and respond to security incidents that involve PHI. Additionally, the organization's backup strategy stores encrypted backups in a separate Azure region, but the backup encryption keys are managed by Azure and are not customer-controlled. The compliance officer is concerned about the ability to demonstrate HIPAA compliance in the event of an audit. Which of the following actions should the organization take FIRST to address the most critical gap?

A.Conduct a vulnerability assessment of all cloud resources to identify and remediate security weaknesses.
B.Develop and implement a formal incident response plan that includes procedures for detecting, reporting, and responding to PHI breaches.
C.Implement customer-managed keys (CMK) for all Azure backups to ensure the organization controls encryption keys.
D.Implement a data classification policy to label all data assets according to sensitivity.
AnswerB

An incident response plan is a HIPAA requirement and addresses the identified gap.

Why this answer

The most critical gap is the lack of a formal incident response plan for PHI breaches. HIPAA requires covered entities to have documented policies and procedures for detecting, reporting, and responding to security incidents involving ePHI. Without this plan, the organization cannot demonstrate compliance during an audit, regardless of encryption or backup controls.

Exam trap

ISC2 often tests the distinction between proactive security controls (encryption, vulnerability assessment, data classification) and the mandatory reactive compliance process (incident response plan) required by regulations like HIPAA, leading candidates to prioritize technical fixes over procedural requirements.

How to eliminate wrong answers

Option A is wrong because vulnerability assessment addresses proactive security posture, not the reactive incident response capability that is the immediate compliance gap. Option C is wrong because while customer-managed keys (CMK) improve key control, they are not a substitute for the mandatory incident response process required by HIPAA; the backup encryption key management is a secondary concern. Option D is wrong because data classification supports labeling but does not fulfill the specific regulatory requirement for a documented incident response plan to handle PHI breaches.

Full explanation →
160
MCQeasy

A fintech startup deploys a customer-facing web application on Azure App Service. The application uses OAuth 2.0 with Azure AD for authentication. Recently, users report being logged out unexpectedly during active sessions. Security logs show multiple token refresh attempts failing with 'invalid_grant' errors. The application uses a standard library for token management. What is the most likely cause and recommended action?

A.The Azure AD API is throttling requests; implement exponential backoff
B.The access token and refresh token lifetimes are misconfigured; align token lifetimes
C.The authorization code was reused; implement PKCE to prevent reuse
D.The user consent was revoked; advise users to re-consent
AnswerB

If the access token outlives the refresh token, refresh attempts fail.

Why this answer

The 'invalid_grant' error during token refresh typically indicates that the refresh token has expired or been revoked. In Azure AD, refresh token lifetimes are configurable and, if set too short or misaligned with the access token lifetime, users will be logged out unexpectedly when the refresh token expires before a new access token is requested. The standard library correctly handles the OAuth 2.0 flow, but the token lifetime configuration in the Azure AD app registration is the root cause.

Exam trap

ISC2 often tests the distinction between token refresh errors (invalid_grant) and other OAuth 2.0 errors (e.g., throttling, consent issues), and candidates mistakenly attribute the problem to PKCE or throttling without recognizing that token lifetime misconfiguration is the most common cause of unexpected logouts in Azure AD.

How to eliminate wrong answers

Option A is wrong because Azure AD API throttling would return HTTP 429 (Too Many Requests) or 'temporarily_unavailable' errors, not 'invalid_grant', and exponential backoff would not fix token expiration issues. Option C is wrong because authorization code reuse is prevented by the OAuth 2.0 spec itself (codes are single-use), and PKCE is designed to mitigate authorization code interception attacks, not to fix refresh token expiration; the error occurs during token refresh, not during the initial authorization code exchange. Option D is wrong because consent revocation would cause an 'invalid_grant' error only if the user explicitly revoked consent, but the scenario describes multiple users experiencing the same issue simultaneously, pointing to a configuration problem rather than individual consent changes.

Full explanation →
161
Multi-Selecthard

During a cloud incident response, the security team needs to eradicate a malicious Lambda function that was created by an attacker. Which THREE steps should be part of the eradication process? (Choose three.)

Select 3 answers
A.Delete the Lambda function
B.Review and remove any CloudWatch Events triggers
C.Revoke any IAM roles associated with the function
D.Disable CloudTrail logging in the affected region
E.Place the function in a quarantine VPC
AnswersA, B, C

This removes the malicious code.

Why this answer

Deleting the Lambda function is a direct eradication step because it removes the attacker's malicious code from the AWS environment. Once deleted, the function can no longer be invoked, and any associated execution logs or metrics will cease. This action is irreversible and ensures the attacker's foothold is eliminated.

Exam trap

CCSP often tests the misconception that placing a resource in a quarantine network (like a VPC) is sufficient for containment, but in serverless environments, the function's code and execution permissions remain active, so deletion and role revocation are mandatory.

Full explanation →
162
MCQmedium

A SaaS application allows users to upload profile pictures. The development team wants to prevent upload of malicious files that could compromise the server. Which control is most effective?

A.Store files in a CDN that only serves static content.
B.Set a maximum file size limit to 2 MB.
C.Implement server-side antivirus scanning on all uploaded files before saving.
D.Restrict file uploads to only image file types by checking the file extension.
AnswerC

Scans for known malware and can block dangerous files.

Why this answer

Server-side antivirus scanning detects and prevents malicious files from being stored, protecting the server. Option A is wrong because a CDN only caches and serves static content; it does not inspect file content for malware. Option B is wrong because a maximum file size limit does not address malicious content; a small file can still be harmful.

Option D is wrong because file extension validation can be easily bypassed by renaming a malicious file with a valid extension.

Full explanation →
163
MCQmedium

An organization exposes an API via Amazon API Gateway. They need to protect against common web exploits like SQL injection and cross-site scripting. Which integration should they enable?

A.IAM policies
B.Security groups on the API Gateway
C.AWS WAF
D.Network ACLs on the VPC
AnswerC

AWS WAF protects against web exploits at the application layer.

Why this answer

AWS WAF (Web Application Firewall) integrates with API Gateway to filter and monitor HTTP requests for common web exploits. Security groups operate at the network layer, not application layer.

Full explanation →
164
MCQeasy

A company's security policy requires that all data stored in the cloud must be encrypted at rest. The cloud provider offers server-side encryption with either cloud-managed keys or customer-managed keys (CMK). Which additional control should the company implement to ensure that the CMK is not compromised and that access is auditable?

A.Enable automatic key rotation and configure detailed audit logging for the key management service.
B.Implement a VPN for all management traffic to the cloud provider's API.
C.Enable multi-factor authentication (MFA) for all cloud console users.
D.Use encryption in transit (TLS) for all data transfers to and from the cloud.
AnswerA

Key rotation and audit logs are essential controls for CMK security.

Why this answer

Enabling automatic key rotation reduces the risk of key compromise by limiting the exposure window of any single key, while detailed audit logging for the key management service (e.g., AWS CloudTrail for KMS, Azure Monitor for Key Vault) provides an immutable record of all key usage and administrative actions. This combination ensures that even if a CMK is exposed, the window of vulnerability is minimized, and any unauthorized access or misuse is detectable through logs. Without these controls, the customer-managed key could remain static for long periods, increasing risk, and access events would not be auditable, violating the policy requirement.

Exam trap

ISC2 often tests the distinction between controls that protect the key itself (rotation and auditing) versus controls that protect the channel or user access (VPN, MFA, TLS), leading candidates to confuse network or identity safeguards with key management safeguards.

How to eliminate wrong answers

Option B is wrong because a VPN for management traffic protects data in transit to the cloud provider's API but does not address the security or auditability of the customer-managed key itself; it is a network-level control unrelated to key compromise or auditing. Option C is wrong because multi-factor authentication (MFA) for cloud console users protects against unauthorized account access but does not directly secure the CMK or provide audit logging for key usage; it is an identity control, not a key management control. Option D is wrong because encryption in transit (TLS) protects data during transfer but does not affect the security of the key at rest or provide audit trails for key access; it is a data protection control, not a key management control.

Full explanation →
165
MCQhard

A cloud customer wants to ensure they can audit their cloud provider's security controls annually. Which contractual provision should be included in the cloud service agreement?

A.Service level agreement (SLA) with uptime guarantees
B.Data deletion clause
C.Data portability clause
D.Right to audit clause
AnswerD

Correct. A right to audit clause provides the legal basis for auditing the provider.

Why this answer

A right to audit clause gives the customer the contractual ability to perform audits, review security reports, or bring in a third-party auditor.

Full explanation →
166
MCQmedium

An organization requires that all data at rest in a cloud storage service be encrypted using a key that is managed entirely on-premises and never exposed to the cloud provider. The organization wants to use server-side encryption. Which approach should be used?

A.Use server-side encryption with a key stored in the cloud provider's key management service (KMS).
B.Use server-side encryption with a customer-provided key (SSE-C).
C.Use server-side encryption with a cloud-managed key (SSE-S3).
D.Use client-side encryption where the application encrypts data before sending it to the cloud.
AnswerB

SSE-C encrypts data at rest using a key that you provide; the cloud does not store the key.

Why this answer

Server-side encryption with customer-provided keys (SSE-C) allows the organization to encrypt data at rest in the cloud while retaining full control of the encryption keys on-premises. With SSE-C, the customer provides the encryption key with each API request, and the cloud service uses it to encrypt/decrypt the data server-side, but the key is never stored by the provider. This meets the requirement of keeping the key entirely on-premises and never exposed to the cloud provider.

Exam trap

ISC2 often tests the distinction between server-side and client-side encryption, and candidates may mistakenly choose client-side encryption (Option D) because it keeps keys on-premises, but the question specifically requires server-side encryption, making SSE-C the only correct option.

How to eliminate wrong answers

Option A is wrong because using a key stored in the cloud provider's KMS means the provider manages and stores the key, which violates the requirement that the key never be exposed to the cloud provider. Option C is wrong because SSE-S3 uses a cloud-managed key that is fully controlled and stored by the provider, again exposing the key to the cloud. Option D is wrong because client-side encryption encrypts data before it is sent to the cloud, which is not server-side encryption; the question explicitly requires server-side encryption.

Full explanation →
167
MCQeasy

A company is implementing a data classification policy for cloud storage. They want to label objects with tags indicating the sensitivity level (e.g., 'Confidential'). Which benefit does tagging resources with classification labels provide?

A.It provides client-side encryption keys
B.It automatically encrypts data at rest
C.It reduces storage costs by moving data to cheaper tiers
D.It allows enforcement of data handling policies based on sensitivity
AnswerD

Tags enable policy-based controls such as preventing public access or requiring specific encryption for tagged objects.

Why this answer

Tags enable automated enforcement of access controls, encryption requirements, and retention policies. For example, a policy can prevent objects tagged 'Confidential' from being made public. Tags also facilitate auditing and reporting.

Full explanation →
168
MCQmedium

A cloud provider guarantees 99.99% availability for a service. What is the maximum allowed downtime per year (rounded to nearest minute)?

A.1.01 hours
B.5.26 minutes
C.8.76 hours
D.52.56 minutes
AnswerD

Correct: 0.01% of 525,600 minutes = 52.56 minutes.

Why this answer

99.99% implies 0.01% downtime. 365*24*60 = 525,600 minutes. 0.01% of 525,600 = 52.56 minutes, about 53 minutes.

Full explanation →
169
Multi-Selecteasy

A healthcare organization is planning to use a cloud provider to host protected health information (PHI) subject to HIPAA. Which THREE requirements must be addressed before the organization can lawfully use the cloud for PHI? (Choose three.)

Select 3 answers
A.Configure access controls to limit PHI access to authorized personnel
B.Sign a Business Associate Agreement (BAA) with the cloud provider
C.Implement data portability features to export PHI
D.Ensure encryption of PHI at rest and in transit
E.Conduct quarterly penetration testing on the cloud infrastructure
AnswersA, B, D

Access controls are required to ensure only authorized individuals can access PHI.

Why this answer

Under HIPAA, a covered entity must have a Business Associate Agreement (BAA) with the cloud provider, ensure encryption of PHI at rest and in transit, and implement access controls. Penetration testing is not a HIPAA requirement but a good practice, and data portability is not a HIPAA requirement.

Full explanation →
170
Multi-Selectmedium

A security auditor is reviewing a Kubernetes cluster and identifies that containers are running as root with full Linux capabilities. Which TWO security measures would help mitigate container escape risks in this environment?

Select 2 answers
A.Set the container to run as a non-root user
B.Enable host networking mode
C.Use a privileged container
D.Drop all Linux capabilities except those needed
E.Mount the host filesystem as read-write
AnswersA, D

Running as non-root reduces the impact of a compromise.

Why this answer

Dropping all Linux capabilities and setting the container to run as a non-root user are effective. Running with a read-only root filesystem also helps, but the question asks for two measures: dropping capabilities and using a non-root user are the most direct.

Full explanation →
171
MCQmedium

Which design principle is MOST directly concerned with the ability to move workloads between cloud providers or back on-premises without significant re-architecture?

A.Reversibility
B.Portability
C.Isolation
D.Elasticity
AnswerB

Portability ensures workloads can run across different environments.

Why this answer

Portability focuses on minimizing vendor lock-in and enabling migration.

Full explanation →
172
Multi-Selectmedium

A security architect is designing network segmentation for a multi-tier application in the cloud. Which TWO configurations help enforce micro-segmentation? (Choose two.)

Select 2 answers
A.Allow all traffic from the internet.
B.Use a bastion host for all administrative access.
C.Use a single network ACL for all subnets.
D.Deploy a virtual firewall between tiers.
E.Implement security groups per application tier.
AnswersD, E

A virtual firewall enforces segmentation and inspection.

Why this answer

Deploying a virtual firewall between tiers (e.g., between web, application, and database tiers) enforces micro-segmentation by inspecting and controlling east-west traffic at the application layer. This allows granular, stateful filtering of traffic based on specific protocols, ports, and even application-level attributes, preventing lateral movement of threats within the cloud environment.

Exam trap

ISC2 often tests the distinction between coarse network controls (like a single ACL) and granular micro-segmentation mechanisms (like virtual firewalls or security groups), trapping candidates who confuse a bastion host or broad ACLs with proper tier isolation.

Full explanation →
173
Multi-Selecthard

An organization is evaluating a cloud service provider and reviewing their SLA. Which THREE metrics are most important for assessing the provider's reliability and accountability? (Choose three.)

Select 3 answers
A.Number of data center employees
B.Frequency of performance reporting
C.Service credits or compensation for downtime
D.Provider's stock price
E.Monthly uptime percentage guarantee
AnswersB, C, E

Allows customer to monitor compliance.

Why this answer

Uptime guarantee, compensation for failures, and reporting frequency are key SLA metrics.

Full explanation →
174
MCQhard

During litigation, a company receives a legal hold notice for electronically stored information (ESI) in a cloud environment. The cloud provider's standard service agreement includes a clause that automatically deletes data 30 days after termination of service. What should the company do to ensure compliance?

A.Ignore the legal hold notice
B.Download all data immediately
C.Terminate the account to stop further processing
D.Notify the provider to preserve the data
AnswerD

Correct. The provider must be instructed to retain data subject to legal hold.

Why this answer

A legal hold notice imposes a duty to preserve relevant ESI. The company must notify the cloud provider to suspend any automatic deletion policies, such as the 30-day post-termination deletion clause, to ensure data is preserved in accordance with eDiscovery obligations under FRCP Rule 37(e) or similar regulations.

Exam trap

ISC2 often tests the misconception that downloading data is sufficient for preservation, but the trap here is that the original ESI in the cloud must be preserved in place to maintain its native format, metadata, and chain of custody for eDiscovery.

How to eliminate wrong answers

Option A is wrong because ignoring a legal hold notice constitutes spoliation of evidence, which can lead to severe sanctions including adverse inference instructions or monetary penalties. Option B is wrong because downloading all data immediately may not capture metadata, logs, or dynamic data that the provider maintains, and it does not stop the provider's automatic deletion of the original ESI after termination. Option C is wrong because terminating the account triggers the 30-day deletion clause, destroying the very data that must be preserved, and violates the duty to preserve.

Full explanation →
175
MCQhard

A company runs its production workloads on a cloud infrastructure-as-a-service (IaaS) platform. The security operations team uses a SIEM to monitor security events. Over the past week, they have observed an increasing number of alerts indicating failed login attempts to a critical database server. The source IP addresses are varied and originate from different geographic regions. The team has also noticed that the database server's CPU usage has spiked during non-business hours. The database is not exposed to the internet; it is in a private subnet. The security team suspects that the database credentials have been compromised. Which of the following actions should the security team take FIRST to mitigate the risk?

A.Conduct a forensic investigation to determine how the credentials were compromised
B.Block the source IP ranges identified in the SIEM alerts at the network firewall
C.Enable multi-factor authentication on the database server
D.Rotate the database credentials immediately
AnswerD

Prevents further unauthorized access.

Why this answer

Rotating the database credentials immediately is the first priority because it stops any ongoing unauthorized access. The failed login attempts indicate the credentials are compromised, so changing them directly mitigates the risk. Option A is incorrect because conducting a forensic investigation should come after containment; the immediate focus is stopping the attack.

Option B is incorrect because blocking IPs is ineffective since the source IPs are varied and dynamic. Option C is incorrect because enabling multi-factor authentication is a good security improvement but does not stop an attacker who already has valid credentials; credential rotation is the immediate step.

Full explanation →
176
Multi-Selecthard

A DevOps team is implementing a secure container supply chain. Which THREE practices should they adopt to ensure image integrity and prevent tampering?

Select 3 answers
A.Sign container images using Cosign
B.Use admission controllers like Kyverno to verify signatures
C.Use the 'latest' tag for base images
D.Store images in a public registry
E.Generate attestation using in-toto
AnswersA, B, E

Signing provides cryptographic verification of image origin.

Why this answer

Image signing with Cosign ensures authenticity, attestation provides metadata about the build, and admission controller verification enforces policies before deployment.

Full explanation →
177
MCQhard

An organization uses a CI/CD pipeline that automatically builds and deploys container images to a Kubernetes cluster. A security scanner flags that the base image contains a critical vulnerability. What is the best course of action to prevent vulnerable images from being deployed?

A.Replace the base image with a minimal image like Alpine.
B.Manually review and patch the base image before each build.
C.Integrate a container image scanning tool into the CI/CD pipeline that blocks builds if critical vulnerabilities are found.
D.Configure the scanner to send alerts after deployment.
AnswerC

Automated prevention at the pipeline stage.

Why this answer

Integrating a container image scanning tool directly into the CI/CD pipeline and configuring it to block the build when critical vulnerabilities are found ensures that vulnerable images never reach the Kubernetes cluster. This shift-left approach enforces security gates automatically, preventing deployment of non-compliant images without relying on manual intervention or post-deployment alerts.

Exam trap

The trap here is that candidates may think replacing the base image with a minimal one (Option A) is sufficient, but ISC2 often tests that security must be automated and enforced as a gate in the pipeline, not just a manual or reactive measure.

How to eliminate wrong answers

Option A is wrong because simply replacing the base image with a minimal image like Alpine does not guarantee the absence of critical vulnerabilities; Alpine images can also contain vulnerabilities, and the approach does not address the need for automated scanning and blocking in the pipeline. Option B is wrong because manually reviewing and patching the base image before each build is not scalable, error-prone, and contradicts the automation principles of CI/CD; it also introduces delays and does not prevent human oversight. Option D is wrong because configuring the scanner to send alerts after deployment allows vulnerable images to be deployed into production, which defeats the purpose of preventing vulnerable images from being deployed; alerts after the fact do not block the deployment.

Full explanation →
178
MCQeasy

A company has implemented a centralized logging solution for its cloud environment. The security team notices that logs from a critical application are missing for the past hour. What is the MOST likely cause?

A.The log retention policy was set to 0 days
B.Log encryption was enabled causing a delay
C.The security team does not have read permission on the log bucket
D.The logging agent on the application server stopped working
AnswerD

A stopped logging agent would cause missing logs.

Why this answer

The most likely cause of missing logs from a critical application is that the logging agent on the application server stopped working. Logging agents are responsible for collecting and forwarding logs to the centralized solution; if they fail, logs are not generated or sent. Option A is incorrect because a retention policy of 0 days would delete logs immediately after collection, but logs would still be generated briefly.

Option B is incorrect because log encryption does not cause delays that result in missing logs; it may add processing time but not prevent generation. Option C is incorrect because the security team's lack of read permission would prevent viewing logs, not stop logs from being generated or sent.

Full explanation →
179
MCQmedium

A cloud customer is terminating its contract with a cloud provider and needs to ensure all data, including backups, is permanently deleted. Which contractual clause is most relevant?

A.Service Level Agreement
B.Data deletion clause
C.Data portability clause
D.Right to audit clause
AnswerB

This clause ensures data is securely deleted after contract end.

Why this answer

Data deletion clauses specify the provider's obligation to delete customer data, including from backups, upon termination.

Full explanation →
180
MCQmedium

A company is subject to PCI DSS because it processes credit card transactions. It plans to use a cloud provider that is not specifically listed as a PCI DSS validated service provider. What is the most important step the company must take to ensure compliance?

A.The company must sign a Business Associate Agreement (BAA) with the cloud provider.
B.The company must conduct its own on-site audit of the cloud provider's data centers.
C.The company must ensure that the cloud provider encrypts all cardholder data at rest and in transit.
D.The company must obtain a copy of the cloud provider's PCI DSS Attestation of Compliance (AOC) and ensure the provider is assessed by a Qualified Security Assessor (QSA).
AnswerD

The customer must verify the provider's PCI DSS compliance through a valid AOC.

Why this answer

PCI DSS requires that if a cloud provider is not already validated, the customer must ensure the provider undergoes a PCI DSS assessment. The shared responsibility matrix (SRM) is used to delineate which controls are the provider's and which are the customer's.

Full explanation →
181
Multi-Selecteasy

A cloud security administrator is reviewing the security controls for a SaaS application. Which of the following are typically the responsibility of the cloud customer (tenant) in a SaaS model? (Choose two.)

Select 2 answers
A.Physical security of data center
B.Managing user access and identity
C.Network infrastructure security
D.Patching the underlying operating system
E.Data classification and encryption at rest
AnswersB, E

Customers control user identities and access permissions.

Why this answer

In a SaaS model, the customer is responsible for managing user access and identity (B) and data classification and encryption at rest (E). The provider handles physical security (A), network infrastructure security (C), and patching the underlying operating system (D).

Full explanation →
182
MCQhard

An organization uses a cloud storage service with versioning enabled. They discover that a ransomware attack encrypted all current versions of their files. However, they can still recover the data. Which feature protects them?

A.Pre-signed URLs
B.Versioning
C.Cross-region replication
D.Object lock
AnswerB

Versioning preserves previous object versions, allowing restoration of unencrypted versions.

Why this answer

Versioning retains previous versions of objects, so even if current versions are encrypted, previous unencrypted versions can be restored. This protects against ransomware and accidental deletion.

Full explanation →
183
Multi-Selectmedium

Which TWO responsibilities are typically shared between the cloud customer and the cloud provider in an IaaS model? (Choose two.)

Select 2 answers
A.Physical security of data centers.
B.Hypervisor security.
C.Management of security group rules.
D.Patching the guest operating system.
E.Configuration of virtual network firewalls.
AnswersC, E

Both customer (defines rules) and provider (enforces them) share this.

Why this answer

In an IaaS model, the cloud customer is responsible for managing security group rules, which act as virtual stateful firewalls controlling inbound and outbound traffic at the instance level. The cloud provider is responsible for the underlying network infrastructure, but the customer must configure these rules to enforce least-privilege access. This shared responsibility is explicitly defined in the AWS Shared Responsibility Model and similar frameworks.

Exam trap

ISC2 often tests the misconception that hypervisor security is a shared responsibility, but in IaaS, the provider alone secures the hypervisor, while the customer is responsible for guest OS and application-level security controls like security groups and virtual firewalls.

Full explanation →
184
Multi-Selecthard

A security team is implementing a DevSecOps pipeline for a cloud-native application. Which three practices should be included to enhance application security? (Choose THREE.)

Select 3 answers
A.Static application security testing (SAST) in CI/CD
B.Infrastructure as code (IaC) scanning
C.Dependency scanning for open source components
D.Manual penetration testing only at final stage
E.Runtime application self-protection (RASP) deployment
AnswersA, B, C

SAST scans source code early in the pipeline.

Why this answer

Shift-left security involves integrating security early. IaC scanning detects misconfigurations before deployment. SAST scans source code for vulnerabilities.

These three are key DevSecOps practices.

Full explanation →
185
MCQeasy

A company is contracting with a cloud provider and wants to ensure they have visibility into the provider's security controls. Which contract clause is most important to include?

A.Indemnification clause
B.Right to audit clause
C.Service Level Agreement (SLA) for uptime
D.Data portability clause
AnswerB

This clause allows the customer to audit the provider's security controls, providing visibility.

Why this answer

A right to audit clause gives the customer the ability to review the provider's security controls, policies, and procedures. The SLA for uptime focuses on availability, not security. Data portability is about moving data.

Indemnification covers liability, not visibility.

Full explanation →
186
MCQhard

An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?

A.Store credentials in the function code
B.Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles
C.Hardcode credentials in environment variables
D.Use database temporary tokens generated on the fly
AnswerB

Parameter Store with KMS and IAM roles provides secure storage and access control.

Why this answer

AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.

Exam trap

The trap here is that candidates often confuse 'temporary tokens' (Option D) with a secure credential storage method, but the CCSP exam expects you to recognize that managing the initial secret (the token's root of trust) is still required, and Parameter Store with KMS is the definitive best practice for protecting static credentials in serverless architectures.

How to eliminate wrong answers

Option A is wrong because storing credentials directly in the function code exposes them to anyone with read access to the code repository or deployment artifacts, violating the principle of least privilege and making secrets management impossible. Option C is wrong because hardcoding credentials in environment variables is insecure; environment variables can be viewed in the Lambda console, CloudWatch logs, or through AWS CLI, and they are not encrypted by default, leading to potential credential leakage. Option D is wrong because database temporary tokens generated on the fly (e.g., using IAM database authentication for RDS) are a valid security practice for some databases, but the question specifically asks about protecting database credentials; temporary tokens are not credentials themselves but an alternative authentication method, and the option does not specify how the initial secret (e.g., the token generation key) is secured, making it an incomplete or misleading answer in this context.

Full explanation →
187
MCQeasy

A small business recently migrated its file server to a cloud storage service like Amazon S3. They use bucket policies to control access. The IT manager, who is not a security expert, configured the bucket policy to allow all users within the company's AWS account to have read and write access. During an internal audit, it was discovered that the bucket also had a public ACL that allowed 'Everyone' to read objects. The security analyst needs to fix the misconfiguration and prevent future occurrences. Which of the following actions should the analyst take first?

A.Delete the bucket and recreate it with default private settings.
B.Set up a notification to alert when bucket policies change.
C.Remove the public ACL and update the bucket policy to enforce least privilege.
D.Enable bucket versioning to recover from accidental public exposure.
AnswerC

Directly fixes the public exposure and tightens access.

Why this answer

The immediate priority is to remediate the active vulnerability by removing the public ACL that grants 'Everyone' read access, then updating the bucket policy to enforce least privilege for the company's AWS account. This directly addresses the misconfiguration and aligns with the principle of denying public access by default, which is a core security best practice for cloud storage services like Amazon S3.

Exam trap

ISC2 often tests the misconception that deleting and recreating a resource is the safest or quickest fix, when in reality the proper remediation is to modify the existing access controls without destroying the resource.

How to eliminate wrong answers

Option A is wrong because deleting and recreating the bucket is an unnecessarily destructive and time-consuming approach; the misconfiguration can be fixed by simply removing the public ACL and adjusting the bucket policy, and it does not address the root cause of why the public ACL was allowed in the first place. Option B is wrong because setting up a notification for bucket policy changes is a detective control that would alert on future changes, but it does not fix the current public ACL exposure; the immediate action must be to remediate the existing vulnerability. Option D is wrong because enabling bucket versioning helps recover from accidental deletion or overwrite of objects, but it does not prevent or fix public access; versioning does not affect access control permissions and would not remove the existing public ACL.

Full explanation →
188
MCQmedium

A company is negotiating a cloud service agreement and wants to ensure it can periodically assess the security of the cloud provider's operations. Which contractual clause is most directly relevant to this requirement?

A.Right to Audit clause permitting the customer to review the provider's security controls and certifications
B.Data portability clause ensuring data can be exported in a usable format
C.Service Level Agreement (SLA) with uptime guarantees
D.Data deletion clause specifying how data is deleted after contract termination
AnswerA

This is the correct clause for security assessment.

Why this answer

A right to audit clause allows the customer to conduct or commission audits of the provider's controls. This is a key contract consideration for cloud customers.

Full explanation →
189
MCQhard

A security engineer is reviewing a Terraform configuration and wants to prevent deployment of an S3 bucket with public read access. Which IaC scanning tool is best suited for this task?

A.Checkov
B.GitGuardian
C.Snyk
D.Dependabot
AnswerA

Checkov scans Terraform, CloudFormation, etc. for security misconfigurations.

Why this answer

Checkov is a popular tool for scanning Infrastructure as Code (e.g., Terraform) for misconfigurations before deployment.

Full explanation →
190
MCQeasy

A healthcare company stores patient records in a cloud storage bucket. They need to encrypt the data at rest using encryption keys that they manage themselves, but they want to generate the keys within the cloud provider's key management service. Which encryption option should they choose?

A.Client-side encryption
B.Server-side encryption with Amazon S3-managed keys (SSE-S3)
C.Customer-Managed Encryption Keys (CMEK)
D.Customer-Supplied Encryption Keys (CSEK)
AnswerC

CMEK allows customers to create and manage keys in the cloud KMS, meeting the requirement.

Why this answer

CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys within the cloud provider's KMS, giving them control over key lifecycle without the operational overhead of generating keys externally.

Full explanation →
191
Multi-Selecthard

A cloud architect is implementing data loss prevention (DLP) for a data lake containing PII. They want to automatically detect and transform sensitive data like Social Security numbers and medical record numbers. Which THREE actions should they take? (Choose three.)

Select 3 answers
A.Apply de-identification transforms such as masking or tokenization
B.Enable bucket versioning
C.Use cloud DLP API to scan for sensitive data types
D.Configure automated classification labels based on DLP findings
E.Set up cross-region replication for durability
AnswersA, C, D

Transforms protect sensitive data by obscuring it.

Why this answer

Cloud DLP can scan data, apply de-identification transforms, and categorize data for further protection. These are core DLP capabilities.

Full explanation →
192
MCQhard

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

A.Use client-side encryption but store the key in the cloud provider's key vault
B.Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data
C.Continue using client-side encryption and provide the analytics service with the encryption key
D.Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)
AnswerC

This approach uses client-side encryption, so the provider does not have access to the key. Providing the key to the analytics service allows processing while keeping the key away from the provider's infrastructure.

Why this answer

Client-side encryption ensures the cloud provider does not have access to the encryption keys because the keys are never stored in or managed by the provider. To allow a cloud-based analytics service to process the data, the customer can securely provide the encryption key directly to the analytics service. This approach maintains key control while enabling processing.

Note: This assumes the analytics service is trusted and the key is transmitted securely.

Full explanation →
193
MCQhard

A security analyst reviews the above cloud storage bucket policy. The bucket stores sensitive application data. What is the primary security issue with this policy?

A.The resource identifier should not include a wildcard
B.The Deny statement will block all access, including from authorized IPs
C.The policy should use a condition with source VPC instead of IP
D.The IP address range is too broad
AnswerB

Correct. The Deny with NotIpAddress blocks all IPs not in the range, overriding any Allow.

Why this answer

The Deny statement with a condition that denies all requests not matching the specified IP range will block access from any IP address that is not in the listed range, including authorized IPs that the policy intended to allow. This creates a complete denial of service for legitimate users, making it the primary security issue.

Exam trap

ISC2 often tests the nuance that a Deny statement with a condition that denies all traffic not matching the IP range will block all traffic, including from authorized IPs, because candidates mistakenly think the Allow statement will override the Deny.

How to eliminate wrong answers

Option A is wrong because using a wildcard in the Resource ARN is acceptable for bucket-level policies when the intent is to apply the policy to all objects in the bucket, and it is not inherently a security issue. Option C is wrong because using aws:SourceVpc is a valid condition for restricting access to a specific VPC, but it is not required here; the IP-based condition is also valid, and the primary issue is the logic error in the Deny statement, not the condition type. Option D is wrong because the IP address range being broad is not the primary issue; the critical flaw is that the Deny statement incorrectly blocks all traffic outside the range, including authorized IPs, rather than the breadth of the range itself.

Full explanation →
194
MCQmedium

A cloud security architect is evaluating a CSP for a financial services client. Which of the following audit reports would provide the most comprehensive assurance regarding the CSP's controls over security, availability, processing integrity, confidentiality, and privacy?

A.PCI DSS Attestation of Compliance
B.SOC 2 Type II
C.SOC 1 Type II
D.ISO 27001 certification
AnswerB

SOC 2 Type II covers the five trust service criteria.

Why this answer

SOC 2 Type II reports on controls over security, availability, processing integrity, confidentiality, and privacy over a period.

Full explanation →
195
MCQmedium

A healthcare organization stores patient records in a cloud database. They need to ensure that database administrators cannot view sensitive columns like SSN and diagnosis. Which data masking technique should be applied?

A.Dynamic data masking
B.Static data masking
C.Encryption at rest
D.Tokenization
AnswerA

DDM masks data in query results based on user privileges.

Why this answer

Dynamic data masking (DDM) is the correct choice because it allows the healthcare organization to mask sensitive columns (e.g., SSN, diagnosis) in real-time at the database query layer, based on user permissions. DDM does not alter the underlying stored data; it transforms the result set on-the-fly for unauthorized users (like DBAs), ensuring they see masked values while authorized personnel see the actual data. This meets the requirement of preventing database administrators from viewing sensitive columns without changing the data at rest.

Exam trap

ISC2 often tests the distinction between masking at query time (dynamic) versus masking at rest (static), and candidates mistakenly choose static masking because they think it 'permanently' protects data, but the key requirement is that DBAs cannot view sensitive columns in the live production database, which only dynamic masking addresses without altering the original data.

How to eliminate wrong answers

Option B (Static data masking) is wrong because it creates a separate, permanently masked copy of the database, which does not prevent DBAs from accessing the original unmasked data in the production database. Option C (Encryption at rest) is wrong because it protects data on disk but does not control visibility at query time; DBAs with database access can still decrypt and view the data when querying. Option D (Tokenization) is wrong because it replaces sensitive data with tokens and stores the mapping in a separate vault, which is overkill for this use case and does not provide real-time, role-based masking within the database itself.

Full explanation →
196
MCQmedium

A multinational company operating in the EU uses a cloud service provider based in the US to process personal data of EU data subjects. The company is considered a data controller under the GDPR. Which of the following must the company ensure is in place to lawfully transfer personal data from the EU to the US?

A.A binding corporate rule approved by the US Department of Commerce
B.Standard Contractual Clauses adopted by the European Commission
C.An adequacy decision by the US Federal Trade Commission
D.A data processing agreement solely between the cloud provider and the data subjects
AnswerB

SCCs are a standard data transfer mechanism under GDPR for transfers to third countries.

Why this answer

Under GDPR, transfers of personal data to third countries require an adequate level of protection. Standard Contractual Clauses (SCCs) are a valid transfer mechanism approved by the European Commission.

Full explanation →
197
Multi-Selecthard

Which THREE of the following are essential components of a Secure Software Development Lifecycle (SSDLC) for cloud applications?

Select 3 answers
A.Manual penetration testing after every code commit.
B.Security awareness training for all developers.
C.Security regression testing to validate that new code does not reintroduce vulnerabilities.
D.Static application security testing (SAST) integrated into the CI/CD pipeline.
E.Dynamic application security testing (DAST) against staging environments.
AnswersC, D, E

Regression testing ensures that security fixes remain effective over time.

Why this answer

Security regression testing (C) is essential because it ensures that new code changes do not reintroduce previously fixed vulnerabilities, which is critical in the continuous integration/continuous delivery (CI/CD) pipelines typical of cloud applications. This testing validates that security patches remain effective across rapid iterations, directly supporting the 'verify' phase of the SSDLC.

Exam trap

ISC2 often tests the distinction between 'essential SSDLC components' (technical controls integrated into the pipeline) and 'supporting activities' (like training or manual testing), leading candidates to select B or A as they confuse general best practices with mandatory lifecycle components.

Full explanation →
198
MCQhard

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

A.SOX
B.HIPAA
C.PCI DSS
D.GDPR
AnswerD

Correct. GDPR requires notification to data subjects within 72 hours of becoming aware of a breach.

Why this answer

The GDPR (General Data Protection Regulation) explicitly requires data controllers to notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to communicate the breach to affected data subjects without undue delay if it poses a high risk to their rights and freedoms. This 72-hour notification mandate is unique to GDPR among the listed options, making it the correct answer for a cloud provider experiencing a data breach affecting customer data.

Exam trap

ISC2 often tests the distinction between regulatory laws (like GDPR) and industry standards or frameworks (like PCI DSS), causing candidates to mistakenly select PCI DSS because it is commonly associated with data security, even though it is not a law and lacks a 72-hour notification requirement.

How to eliminate wrong answers

Option A (SOX) is wrong because the Sarbanes-Oxley Act focuses on financial reporting accuracy and internal controls for publicly traded companies, not on data breach notification timelines or customer data protection. Option B (HIPAA) is wrong because while HIPAA requires notification of breaches of protected health information (PHI), the timeline is 'without unreasonable delay' and within 60 days for breaches affecting 500 or more individuals, not 72 hours. Option C (PCI DSS) is wrong because the Payment Card Industry Data Security Standard is a contractual security standard for cardholder data, not a law, and its breach notification requirements vary by acquiring bank and card brand, with no fixed 72-hour regulatory mandate.

Full explanation →
199
MCQmedium

A security team is implementing vulnerability management in a hybrid cloud environment. They need to scan virtual machines without installing an agent. Which approach is most suitable?

A.Deploying a third-party vulnerability scanner on each VM
B.Agentless scanning using cloud APIs
C.Agent-based scanning with AWS Inspector
D.Using container image scanning in registry
AnswerB

Agentless scanning leverages cloud provider APIs to assess VM vulnerabilities.

Why this answer

Agentless scanning using cloud APIs (Option B) is the correct approach because it allows the security team to scan virtual machines without installing any software on the VMs themselves. This method leverages cloud provider APIs (e.g., AWS EC2 DescribeInstances, Azure VM REST APIs) to query the hypervisor or management plane for VM configurations, patch levels, and vulnerabilities, making it ideal for hybrid cloud environments where agent deployment may be impractical or restricted.

Exam trap

The trap here is that candidates often confuse 'agentless scanning' with 'agent-based scanning' or assume that container image scanning applies to VMs, but ISC2 tests the specific requirement of scanning VMs without installing an agent, which only agentless cloud API-based scanning satisfies.

How to eliminate wrong answers

Option A is wrong because deploying a third-party vulnerability scanner on each VM requires installing an agent, which directly contradicts the requirement to scan without installing an agent. Option C is wrong because agent-based scanning with AWS Inspector requires the AWS Systems Manager Agent (SSM Agent) to be installed on each EC2 instance, which is an agent-based approach. Option D is wrong because container image scanning in a registry (e.g., Amazon ECR scanning) is designed for container images, not for virtual machines, and does not address the requirement to scan VMs.

Full explanation →
200
Multi-Selectmedium

Which TWO of the following are effective methods for preventing hardcoded credentials from being committed to a cloud application's source code repository? (Select TWO)

Select 2 answers
A.Implementing pre-commit hooks with secret scanning
B.Disabling SSH keys for developers
C.Enforcing code reviews by senior developers
D.Encrypting the entire repository
E.Using environment variables instead of hardcoding
AnswersA, E

Pre-commit hooks can scan for secrets before commit.

Why this answer

Pre-commit hooks with secret scanning (Option A) automatically scan code for patterns matching credentials (e.g., AWS access keys, passwords) before a commit is finalized. Tools like GitLeaks or TruffleHog integrate into the local Git workflow, blocking commits that contain secrets and preventing them from ever reaching the remote repository.

Exam trap

ISC2 CCSP often tests the distinction between preventive controls (pre-commit hooks, environment variables) and detective/reactive controls (code reviews, encryption) to see if candidates understand that only proactive measures can stop secrets from entering the repository in the first place.

Full explanation →
201
MCQeasy

A cloud security engineer is troubleshooting a failure in automated backups for a production database. The backup job runs nightly but has failed for the past three nights. The logs show permission denied errors when the backup service attempts to write to the storage bucket. Which action should the engineer take first?

A.Open a support ticket with the cloud provider for incident response.
B.Check the IAM roles and bucket ACLs assigned to the service account.
C.Restart the backup service and retry the job.
D.Rotate the service account keys used for authentication.
AnswerB

The error indicates a permission issue, so this is the correct first step.

Why this answer

The permission denied errors indicate that the service account used by the backup job lacks the necessary permissions to write to the storage bucket. Checking the IAM roles and bucket ACLs is the first logical step to identify and resolve the misconfiguration, as it directly addresses the root cause without introducing unnecessary changes or escalations.

Exam trap

ISC2 often tests the distinction between authentication (who you are) and authorization (what you can do), leading candidates to mistakenly rotate keys or restart services instead of checking permissions.

How to eliminate wrong answers

Option A is wrong because opening a support ticket is premature; the engineer should first investigate and resolve the permission issue internally, as it is likely a configuration problem rather than a provider-side incident. Option C is wrong because restarting the backup service and retrying the job will not fix the underlying permission denial; the same error will recur until the IAM or ACL configuration is corrected. Option D is wrong because rotating service account keys addresses authentication (who you are), not authorization (what you are allowed to do); the error is about permission to write, not about invalid credentials.

Full explanation →
202
Multi-Selecteasy

A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)

Select 2 answers
A.Encryption at rest for all classified data
B.A process to tag resources with the appropriate classification labels
C.Access control policies based on classification
D.Automated DLP scanning to enforce classification
E.A classification scheme with defined labels (e.g., public, internal, confidential, restricted)
AnswersB, E

Tagging ensures resources are labeled correctly.

Why this answer

A classification scheme with defined labels (e.g., public, internal, confidential, restricted) and a process for tagging resources with those labels are essential. Automated DLP scanning can enforce classification but is not essential for the scheme itself. Encryption and access controls are separate security controls.

Full explanation →
203
MCQeasy

A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?

A.Rotate API keys more frequently
B.Implement cross-origin resource sharing (CORS) policies
C.Configure a web application firewall (WAF) with rate limiting and IP blacklisting
D.Require encryption of session tokens
AnswerC

WAF can detect and block malicious traffic patterns.

Why this answer

A Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.

Exam trap

The trap here is that candidates may confuse session token management (e.g., rotation, encryption) with the need for a perimeter defense that controls request volume and source, leading them to pick options that address token validity rather than the automated, high-volume nature of the attack.

How to eliminate wrong answers

Option A is wrong because rotating API keys more frequently does not mitigate automated attacks using invalid session tokens; API keys are typically used for service-to-service authentication, not for user session validation, and rotation does not stop a flood of requests from a single IP. Option B is wrong because CORS policies control which origins (domains) can make cross-origin requests from a browser, but they do not block automated scripts or tools (e.g., cURL, Postman) that ignore CORS headers, nor do they rate-limit or blacklist IPs. Option D is wrong because requiring encryption of session tokens (e.g., via TLS) protects token confidentiality in transit but does not prevent an attacker from sending many requests with invalid tokens; encryption does not address the volume or source of the attack.

Full explanation →
204
MCQhard

A media streaming company uses a multi-cloud strategy with AWS and GCP. Their application uses a message queue (Amazon SQS and Google Pub/Sub) for asynchronous processing. The security team discovers that messages contain sensitive user data (e.g., email addresses) that are not encrypted at the broker level. The compliance team mandates encryption of data at rest and in transit for all sensitive data. However, the application already uses TLS for message delivery. What is the most secure and operationally efficient way to meet compliance?

A.Enable server-side encryption with SQS (SSE-SQS) and Pub/Sub (CSEK) and rely on TLS for in transit
B.Separate sensitive and non-sensitive messages into different queues with different retention policies
C.Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service
D.Use a third-party encryption gateway that wraps messages before they reach the queues
AnswerC

Client-side encryption ensures data is encrypted end-to-end, both in transit and at rest in the broker.

Why this answer

Client-side encryption ensures that sensitive data is encrypted before it ever leaves the application, meeting the compliance mandate for encryption at rest and in transit regardless of the broker's native encryption capabilities. Since TLS already protects data in transit, adding client-side encryption with a centralized key management service (e.g., AWS KMS or GCP Cloud KMS) provides end-to-end confidentiality: the message payload is encrypted by the producer, remains encrypted in the queue, and is decrypted only by the authorized consumer. This approach is operationally efficient because it avoids vendor lock-in and works uniformly across AWS SQS and GCP Pub/Sub without relying on broker-specific SSE features that may not cover all states (e.g., broker logs or backups).

Exam trap

ISC2 often tests the misconception that server-side encryption (SSE) alone satisfies 'encryption at rest' requirements, but the trap here is that SSE does not protect data from exposure within the broker's internal processing or logs, and client-side encryption is the only way to guarantee end-to-end confidentiality across heterogeneous multi-cloud environments.

How to eliminate wrong answers

Option A is wrong because server-side encryption (SSE-SQS and CSEK) only protects data at rest within the broker's storage, but the compliance mandate requires encryption at rest and in transit; TLS already covers in transit, but SSE does not protect the data while it is being processed or if the broker's internal logs capture the plaintext payload. Option B is wrong because separating messages into different queues with different retention policies does not encrypt the sensitive data; it merely segregates it, leaving the sensitive payloads still in plaintext within the queue, which fails the encryption requirement. Option D is wrong because a third-party encryption gateway introduces additional latency, operational complexity, and a potential single point of failure; it also does not provide end-to-end encryption if the gateway itself must decrypt and re-encrypt, potentially exposing plaintext in transit between the application and the gateway.

Full explanation →
205
MCQeasy

An organization stores archival data in cloud cold storage and requires each customer's data to be encrypted with unique keys managed by the customer. Which encryption approach meets this requirement?

A.Server-side encryption with customer-managed keys (SSE-KMS)
B.Server-side encryption with cloud-provider keys (SSE-S3)
C.Server-side encryption with customer-provided keys (SSE-C)
D.Client-side encryption
AnswerD

Customer encrypts data before upload with their own keys, ensuring uniqueness and control.

Why this answer

Client-side encryption ensures that data is encrypted before it is sent to the cloud, and the customer retains sole control over the encryption keys. This approach meets the requirement for each customer's data to be encrypted with unique keys managed by the customer, as the cloud provider never has access to the keys or the unencrypted data.

Exam trap

ISC2 often tests the distinction between where encryption occurs (client-side vs. server-side) and who manages the keys, leading candidates to mistakenly choose SSE-C because it involves customer-provided keys, even though the encryption still happens on the server side.

How to eliminate wrong answers

Option A is wrong because SSE-KMS uses a key managed by the customer but stored and managed within the cloud provider's KMS service, meaning the provider has potential access to the key material and the decryption process occurs server-side. Option B is wrong because SSE-S3 uses keys managed entirely by the cloud provider, not the customer, violating the requirement for customer-managed keys. Option C is wrong because SSE-C allows the customer to provide their own encryption key, but the encryption operation is performed server-side by the cloud provider, meaning the provider temporarily has access to the key during the encryption/decryption process, which does not meet the strict requirement for customer-managed keys where the provider never has access.

Full explanation →
206
MCQmedium

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

A.The third-party auditor
B.The customer
C.Both equally
D.The cloud provider
AnswerB

The customer is responsible for configuring IAM policies to restrict access.

Why this answer

Under the shared responsibility model, the customer is responsible for configuring IAM policies to control access to their data. The provider is responsible for the infrastructure that enforces the policy. Both are not equally responsible for the policy content.

The auditor is not responsible for configuration.

Full explanation →
207
MCQhard

During a forensic investigation of a suspected data exfiltration incident in AWS, a security team needs to analyze network traffic to identify the destination IP addresses and volume of data transferred. Which data source is most appropriate for this analysis?

A.VPC Flow Logs
B.AWS Config configuration history
C.AWS CloudTrail management events
D.Amazon S3 access logs
AnswerA

VPC Flow Logs provide detailed network traffic information needed for exfiltration analysis.

Why this answer

VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and the number of bytes transferred. This makes them the ideal data source for identifying the destination IP addresses and volume of data exfiltrated, as they provide per-flow byte counts and packet-level details without requiring packet capture.

Exam trap

ISC2 CCSP often tests the distinction between logs that capture API-level activity (CloudTrail) versus network-level metadata (Flow Logs), and candidates mistakenly choose CloudTrail because they think 'management events' includes network traffic, but it only records control plane operations, not data plane flows.

How to eliminate wrong answers

Option B (AWS Config configuration history) is wrong because it records resource configuration changes (e.g., security group rules, instance types) over time, not network traffic or data transfer volumes. Option C (AWS CloudTrail management events) is wrong because it logs API calls that modify AWS resources (e.g., CreateInstance, AuthorizeSecurityGroupIngress), not the actual network packets or byte counts flowing through the VPC. Option D (Amazon S3 access logs) is wrong because they only log requests made to S3 buckets (e.g., GET, PUT, DELETE operations) and do not capture general VPC network traffic or destination IP addresses for exfiltration outside of S3 interactions.

Full explanation →
208
MCQhard

A software company develops a mobile application that communicates with a cloud backend using REST APIs. The application uses OAuth 2.0 with the authorization code grant and PKCE for authentication. After a security audit, the team identifies that the backend API accepts both a client secret (from the authorization code grant) and a PKCE code verifier. The security team wants to remove unnecessary attack surface. Which change should be made?

A.Switch to the implicit grant (response_type=token) to avoid client secrets
B.Keep both mechanisms but use short-lived tokens to reduce risk
C.Remove the client_secret parameter from the token endpoint and rely solely on PKCE
D.Require a stronger client secret (e.g., 256-bit) and store it in the app's encrypted storage
AnswerC

PKCE is designed for public clients without a secret, reducing attack surface.

Why this answer

PKCE (Proof Key for Code Exchange, RFC 7636) was specifically designed to secure the authorization code grant for public clients like mobile apps, where a client secret cannot be reliably kept confidential. By removing the client_secret parameter and relying solely on PKCE, the team eliminates an unnecessary attack surface—since the secret is effectively a static credential that can be extracted from the app binary—while maintaining strong protection against authorization code interception attacks. The backend should enforce PKCE verification using the code_challenge and code_verifier, making the client_secret redundant for public clients.

Exam trap

ISC2 often tests the misconception that removing the client_secret weakens security, when in fact for public clients (mobile apps, SPAs) PKCE makes the secret unnecessary and its removal reduces attack surface; candidates may incorrectly think keeping the secret adds a layer of defense, but it actually introduces a static credential that can be stolen.

How to eliminate wrong answers

Option A is wrong because switching to the implicit grant (response_type=token) would actually increase attack surface by exposing the access token directly in the URL fragment, making it vulnerable to leakage via browser history, referrer headers, and other side channels; it also removes the authorization code exchange step that PKCE protects. Option B is wrong because keeping both mechanisms does not reduce attack surface—it leaves the client_secret as an exploitable static credential that can be extracted from the app, and short-lived tokens do not mitigate the risk of secret theft or replay of the secret at the token endpoint. Option D is wrong because requiring a stronger client secret and storing it in encrypted storage still leaves the secret extractable from the mobile device at runtime (via memory dumps or reverse engineering), and encrypted storage keys are also accessible on the device; the fundamental issue is that public clients cannot securely hold secrets, so any reliance on a client_secret is a design flaw.

Full explanation →
209
Multi-Selecthard

Which THREE statements about tokenization compared to encryption are correct?

Select 3 answers
A.Encryption is always more secure than tokenization.
B.Tokenization is typically used for payment card data.
C.Tokenization preserves data format and length.
D.Tokenization is reversible if the mapping is maintained.
E.Tokenization requires a secure token vault.
AnswersB, D, E

Tokenization is widely used for PCI DSS compliance.

Why this answer

Tokenization is commonly used for payment card data (e.g., PCI DSS compliance) because it replaces sensitive PANs with non-sensitive tokens that have no exploitable value outside the tokenization system. This allows organizations to reduce their compliance scope by not storing actual card numbers, while encryption still leaves ciphertext that could be decrypted if keys are compromised.

Exam trap

ISC2 often tests the misconception that tokenization always preserves format and length, but in reality, format preservation is an optional feature, not a core requirement, and many tokenization systems produce tokens of different lengths or formats.

Full explanation →
210
MCQeasy

Under GDPR, what is the maximum time allowed for a data controller to notify the supervisory authority of a personal data breach?

A.7 days
B.24 hours
C.72 hours
D.48 hours
AnswerC

Correct. The GDPR requires notification within 72 hours.

Why this answer

GDPR Article 33 requires notification within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Full explanation →
211
MCQeasy

What is the primary purpose of a Software Bill of Materials (SBOM) in cloud application security?

A.To list all third-party components and dependencies
B.To track user access permissions
C.To monitor runtime application performance
D.To document the software architecture
AnswerA

SBOM provides a comprehensive inventory for vulnerability management.

Why this answer

The primary purpose of a Software Bill of Materials (SBOM) is to provide a formal, machine-readable inventory of all third-party components, libraries, and dependencies used in a cloud application. This enables automated vulnerability scanning, license compliance checks, and supply chain risk management, which are critical for securing cloud-native applications against known exploits in transitive dependencies.

Exam trap

The CCSP exam often tests the distinction between an SBOM and a software architecture document, leading candidates to mistakenly choose 'document the software architecture' because both involve listing components, but an SBOM is exclusively about third-party dependencies and their provenance, not the application's internal design or structure.

How to eliminate wrong answers

Option B is wrong because tracking user access permissions is the function of Identity and Access Management (IAM) systems, not an SBOM. Option C is wrong because monitoring runtime application performance is the role of Application Performance Monitoring (APM) tools, not an SBOM. Option D is wrong because documenting the software architecture is typically done through architectural diagrams or design documents, while an SBOM focuses specifically on component inventory and dependency relationships.

Full explanation →
212
Multi-Selecteasy

Which TWO of the following are key components of an Information Security Management System (ISMS) as defined by ISO 27001?

Select 2 answers
A.Business continuity plan.
B.Continuous improvement process.
C.Annual penetration testing.
D.Encryption of all data at rest.
E.Risk assessment and treatment.
AnswersB, E

ISMS requires ongoing improvement based on monitoring.

Why this answer

The ISO 27001 standard defines an ISMS as a systematic approach to managing sensitive information, and it explicitly requires a continuous improvement process (Clause 10.1) to ensure the ISMS remains effective over time. This is a core component, not an optional add-on, and is implemented through the Plan-Do-Check-Act (PDCA) cycle.

Exam trap

ISC2 often tests the distinction between mandatory ISMS components (like risk assessment and continuous improvement) and optional security controls (like encryption or penetration testing), leading candidates to mistakenly select specific technical controls as core ISMS elements.

Full explanation →
213
MCQeasy

An enterprise uses a cloud access security broker (CASB) to protect data in cloud applications. They want to prevent users from uploading files containing credit card numbers to a cloud storage service. Which CASB feature should be configured?

A.Encryption in transit settings
B.User activity monitoring
C.Single sign-on (SSO) integration
D.Data loss prevention (DLP) policies
AnswerD

DLP scans content and can block uploads containing sensitive data.

Why this answer

Data loss prevention (DLP) policies are the correct CASB feature because they allow the enterprise to define content inspection rules that scan files for sensitive data patterns, such as credit card numbers (matching Luhn algorithm or regex patterns like those in PCI DSS). When a match is detected, the CASB can block the upload, quarantine the file, or trigger an alert, directly preventing data exfiltration to the cloud storage service.

Exam trap

The trap here is that candidates confuse user activity monitoring (which logs behavior) with DLP (which enforces content-based policies), or they assume encryption alone can prevent data leakage, not realizing encryption protects data in transit but does not inspect or block the data itself.

How to eliminate wrong answers

Option A is wrong because encryption in transit (e.g., TLS 1.2/1.3) protects data during transmission between the user and the cloud service, but it does not inspect or block the content of files being uploaded; it only ensures confidentiality over the network. Option B is wrong because user activity monitoring tracks and logs user actions (e.g., login times, file access) for auditing and anomaly detection, but it lacks the content-aware inspection engine needed to identify and block specific data patterns like credit card numbers. Option C is wrong because single sign-on (SSO) integration (e.g., SAML 2.0 or OIDC) manages authentication and access control, but it does not perform deep packet inspection or content analysis on uploaded files to prevent sensitive data leakage.

Full explanation →
214
MCQeasy

Under GDPR, what is the role of a cloud provider that processes personal data solely on behalf of a customer?

A.Data controller
B.Supervisory authority
C.Data subject
D.Data processor
AnswerD

Correct. The provider processes data on behalf of the controller.

Why this answer

The cloud provider is a data processor, as it processes data on behalf of the data controller (the customer).

Full explanation →
215
MCQhard

A company deploys microservices in Kubernetes. Each service communicates via gRPC with mutual TLS. A security assessment reveals that some services use self-signed certificates. What is the primary risk?

A.Inability to revoke certificates
B.Exposure of private keys in the container image
C.Increased latency due to certificate validation
D.Man-in-the-middle (MITM) attacks between services
AnswerD

Without trusted CA validation, MITM is possible.

Why this answer

The primary risk of using self-signed certificates in a gRPC mutual TLS environment is that there is no trusted Certificate Authority (CA) to verify the identity of the communicating services. Without proper CA-signed certificates, an attacker can easily perform a man-in-the-middle (MITM) attack by presenting a forged self-signed certificate, intercepting and modifying gRPC traffic between microservices.

Exam trap

ISC2 often tests the misconception that self-signed certificates are only a problem for revocation or key exposure, when the core issue is the lack of trusted identity verification enabling MITM attacks.

How to eliminate wrong answers

Option A is wrong because self-signed certificates can still be revoked using mechanisms like CRLs or OCSP, though it is more cumbersome; the inability to revoke is not the primary risk. Option B is wrong because private keys are not inherently exposed in the container image; exposure is a separate misconfiguration issue, not a direct consequence of using self-signed certificates. Option C is wrong because certificate validation does not introduce significant latency; the overhead of TLS handshake is negligible compared to the security benefits, and self-signed certificates do not inherently increase validation time.

Full explanation →
216
MCQmedium

A company uses a cloud provider's object storage service for backup data. The security policy requires that data be encrypted at rest using keys managed by the company's on-premises hardware security module (HSM). Which encryption method should be used?

A.Client-side encryption
B.Server-side encryption with customer-provided keys (SSE-C)
C.Server-side encryption with cloud provider-managed keys (SSE-S3)
D.Server-side encryption with customer-managed keys (SSE-KMS)
AnswerA

Correct: Encrypts data on-premises, keys remain on-premises HSM.

Why this answer

Client-side encryption is the only method where the encryption keys are generated and managed entirely within the customer's on-premises HSM, and data is encrypted before it is sent to the cloud provider's object storage. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, fully satisfying the policy requirement that keys be managed by the company's on-premises HSM.

Exam trap

ISC2 often tests the distinction between 'customer-provided keys' (SSE-C) and 'customer-managed keys' (SSE-KMS) versus true client-side encryption, where candidates mistakenly assume that providing or managing keys in the cloud satisfies on-premises HSM control, but the trap is that SSE-C and SSE-KMS still involve the cloud provider's servers performing encryption/decryption, which exposes the key or plaintext to the provider's environment.

How to eliminate wrong answers

Option B (SSE-C) is wrong because while the customer provides the encryption key, the encryption and decryption operations are performed by the cloud provider's server, meaning the key is temporarily exposed to the provider's infrastructure, which violates the requirement that keys be managed solely by the on-premises HSM. Option C (SSE-S3) is wrong because the cloud provider manages the encryption keys entirely, giving the provider full control over key lifecycle and access, which does not meet the policy of customer-managed keys on an on-premises HSM. Option D (SSE-KMS) is wrong because although the customer manages the key through a cloud-based KMS, the key material is stored and used within the cloud provider's environment, not on the customer's on-premises HSM, thus failing the requirement for on-premises key management.

Full explanation →
217
MCQhard

A large e-commerce company uses a multi-cloud environment with workloads in AWS and Azure. They store customer payment data in an AWS S3 bucket and use Azure SQL Database for transactional data. The company requires that all data at rest be encrypted using keys managed by their on-premises HSM. They have implemented AWS KMS with custom key store (CloudHSM) for S3, and Azure SQL TDE with Azure Key Vault (using BYOK) for the database. Recently, the security team noticed that some S3 objects are not encrypted with the expected key, and there are intermittent access failures to the Azure SQL database. Investigation reveals that the AWS KMS key ID changed after a recent security incident, and the Azure Key Vault key has been disabled due to a misconfigured access policy. What is the most effective course of action to restore encryption compliance and service availability?

A.Re-establish synchronization between on-premises HSM and cloud key stores: update AWS KMS custom key store with correct key and fix Azure Key Vault access policies.
B.Implement client-side encryption for all data, bypassing cloud KMS.
C.Switch S3 to use SSE-S3 and Azure SQL to use service-managed keys.
D.Roll back all encryption to use cloud-provided managed keys to simplify operations.
AnswerA

Correct: This directly resolves the key ID change and access policy issues, restoring compliance and availability.

Why this answer

The root cause is a loss of synchronization between the on-premises HSM and the cloud key stores. Updating the AWS KMS custom key store (CloudHSM) with the correct key restores S3 encryption compliance, while fixing the Azure Key Vault access policy re-enables the BYOK key for SQL TDE, restoring service availability. This directly addresses the specific failures: the changed KMS key ID and the disabled Key Vault key.

Exam trap

ISC2 often tests the misconception that switching to simpler cloud-managed keys (SSE-S3 or service-managed) is a valid fix, but the trap is that this violates the explicit compliance requirement for on-premises HSM-managed keys, making such options non-compliant.

How to eliminate wrong answers

Option B is wrong because client-side encryption would bypass the required on-premises HSM key management, violating the compliance mandate that all keys be managed by the on-premises HSM. Option C is wrong because switching to SSE-S3 and service-managed keys would replace the customer-managed keys (CMK) with cloud-provided keys, which does not meet the requirement for keys managed by the on-premises HSM. Option D is wrong because rolling back to cloud-provided managed keys abandons the on-premises HSM key control, failing the compliance requirement and not addressing the specific access policy misconfiguration in Azure Key Vault.

Full explanation →
218
MCQeasy

A developer is tasked with securely storing a session token in a browser-based web application. Which storage mechanism is most secure?

A.HTTP-only cookies with Secure and SameSite flags
B.sessionStorage
C.URL query parameters
D.localStorage
AnswerA

HTTP-only cookies are not accessible via JavaScript and Secure flag ensures HTTPS.

Why this answer

HTTP-only cookies with Secure and SameSite flags are the most secure storage mechanism for session tokens because they prevent client-side script access (mitigating XSS-based token theft), ensure transmission only over HTTPS (mitigating network eavesdropping), and restrict cross-origin request inclusion (mitigating CSRF). This combination aligns with OWASP best practices for session management, as the token is never exposed to JavaScript or sent over unencrypted channels.

Exam trap

ISC2 often tests the misconception that localStorage or sessionStorage is secure because they are 'client-side only,' but the trap is that both are fully accessible via JavaScript and thus vulnerable to XSS, whereas HTTP-only cookies are the only option that prevents script-level access.

How to eliminate wrong answers

Option B is wrong because sessionStorage is accessible via JavaScript, making it vulnerable to XSS attacks where an attacker can read the token directly. Option C is wrong because URL query parameters are logged in server logs, browser history, and referrer headers, exposing the session token to interception and persistent storage. Option D is wrong because localStorage persists data indefinitely and is fully accessible via JavaScript, offering no protection against XSS or CSRF, and lacks built-in expiration or secure transmission controls.

Full explanation →
219
Multi-Selectmedium

An organization is adopting a hybrid cloud strategy. Which THREE considerations are vital for maintaining consistent security across environments? (Select THREE.)

Select 3 answers
A.Dedicated security team for each environment
B.Unified identity and access management (IAM)
C.Consistent network segmentation and firewall rules
D.Harmonized data encryption and key management
E.Different encryption standards for public and private clouds
AnswersB, C, D

Correct. Consistent IAM ensures same policies across clouds.

Why this answer

Consistent identity and access management (IAM) ensures uniform access controls; network segmentation policies prevent unauthorized movement; encryption standards protect data across environments. Patch management is important but not unique to hybrid cloud consistency.

Full explanation →
220
MCQmedium

A defense contractor uses a cloud provider that is FedRAMP authorized at the Moderate impact level. The contractor's contract requires compliance with DFARS 252.204-7012, which mandates safeguarding covered defense information (CDI) and reporting cyber incidents. The contractor's security team wants to ensure the cloud provider's security controls are adequate. The provider offers a FedRAMP package that includes a System Security Plan (SSP) and a Security Assessment Report (SAR). The contractor's legal department has determined that if the provider is FedRAMP authorized, the audit requirements are satisfied. What is the most efficient way to verify compliance?

A.Use the FedRAMP authorization letter as evidence without further audit.
B.Request the provider's SSP and SAR and compare against DFARS requirements.
C.Engage a third-party auditing firm to assess the provider.
D.Perform an independent penetration test on the provider's infrastructure.
AnswerA

This aligns with the legal department's determination and is efficient.

Why this answer

The FedRAMP authorization letter is the most efficient verification because FedRAMP Moderate authorization is explicitly recognized by the DoD as meeting the security control baseline for DFARS 252.204-7012. The legal department has already determined that FedRAMP authorization satisfies audit requirements, so no additional analysis of the SSP/SAR or third-party testing is needed. Using the authorization letter alone avoids redundant effort while still providing auditable evidence of compliance.

Exam trap

ISC2 often tests the misconception that you must independently verify cloud provider controls (e.g., by reviewing SSP/SAR or conducting your own tests) even when a recognized certification like FedRAMP already satisfies the compliance requirement, leading candidates to over-audit and waste resources.

How to eliminate wrong answers

Option B is wrong because requesting and comparing the provider's SSP and SAR against DFARS requirements is inefficient and unnecessary; FedRAMP authorization already certifies that the controls meet or exceed the DFARS baseline, so a manual comparison duplicates the FedRAMP assessment process. Option C is wrong because engaging a third-party auditing firm to assess the provider is redundant and costly; the FedRAMP authorization letter is the accepted government-wide proof of compliance, and a separate audit would not add legal or contractual value. Option D is wrong because performing an independent penetration test on the provider's infrastructure is outside the contractor's scope and violates the shared responsibility model; the provider's FedRAMP authorization already includes penetration testing as part of the SAR, and the contractor's legal determination makes further testing unnecessary.

Full explanation →
221
MCQmedium

Which cloud design principle ensures that resources can be dynamically adjusted to meet changing demand, often using auto-scaling groups?

A.Elasticity
B.Resource pooling
C.Resiliency
D.Measured service
AnswerA

Correct. Elasticity allows dynamic resource adjustment.

Why this answer

Rapid elasticity is the ability to scale resources up or down quickly and automatically in response to demand.

Full explanation →
222
MCQeasy

Which of the following is a cloud-specific vulnerability that can lead to exposure of IAM credentials through the metadata service?

A.SQL injection
B.SSRF to metadata endpoint
C.Insecure deserialization
D.Cross-site scripting (XSS)
AnswerB

SSRF to cloud metadata is a cloud-specific attack vector.

Why this answer

Server-Side Request Forgery (SSRF) that targets the cloud metadata endpoint (e.g., http://169.254.169.254) can retrieve IAM credentials. This is a cloud-specific issue.

Full explanation →
223
Multi-Selecthard

Which THREE of the following are effective controls to secure a RESTful API in the cloud?

Select 3 answers
A.Enabling CORS (Cross-Origin Resource Sharing) for all domains
B.Using HTTP basic authentication over plain HTTP
C.Implementing rate limiting and throttling
D.Enforcing strong authentication and authorization mechanisms
E.Validating and sanitizing all inputs to avoid injection attacks
AnswersC, D, E

Prevents DoS and brute-force attacks.

Why this answer

Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.

Exam trap

ISC2 often tests the misconception that CORS is a security control that should be broadly enabled, when in fact it is a relaxation of the same-origin policy and must be tightly scoped to prevent cross-origin attacks.

Full explanation →
224
Multi-Selectmedium

A cloud security engineer is reviewing an AWS IAM policy that includes the following statement: 'Effect: Allow, Action: iam:*, Resource: *'. Which two security concerns does this configuration create? (Choose TWO.)

Select 2 answers
A.Over-permissive IAM role
B.Exposed S3 bucket
C.Hardcoded credentials
D.SSRF vulnerability
E.Privilege escalation risk
AnswersA, E

Assigning a role with iam:* to all resources gives excessive permissions.

Why this answer

The policy allows all IAM actions (iam:*) on all resources (*), which is over-permissive. It can lead to privilege escalation and unauthorized actions.

Full explanation →
225
MCQmedium

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

A.12
B.4
C.2
D.3
AnswerC

Correct. Residual risk = 2 (likelihood) * 1 (impact) = 2.

Why this answer

The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.

Exam trap

ISC2 often tests the distinction between inherent risk (before controls) and residual risk (after controls), and the trap here is that candidates mistakenly use the original likelihood or impact values in the multiplication instead of the reduced values after controls are applied.

How to eliminate wrong answers

Option A is wrong because 12 is the inherent risk score (4×3) before controls, not the residual risk after controls reduce likelihood to 2 and impact to 1. Option B is wrong because 4 would result from multiplying the original likelihood (4) by the reduced impact (1) or vice versa, which is a common miscalculation that ignores the dual reduction. Option D is wrong because 3 is the original impact value alone, not a product of the reduced likelihood and impact, and does not represent a risk score calculation.

Full explanation →
Page 2

Page 3 of 13

Page 4

All pages

12345678910111213

Practice CCSP by domain

Target a specific domain to shore up weak areas.

Cloud Application SecurityCloud Security OperationsLegal, Risk, and ComplianceCloud Data SecurityCloud Platform and Infrastructure SecurityCloud Concepts, Architecture, and Design
See all domains with question counts →