Courseiva

Certified Cloud Security Professional CCSP (CCSP) — Questions 601–675

964 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 13

Page 10
601
Multi-Selectmedium

A cloud security team is implementing a data discovery and classification program for their SaaS applications. Which TWO statements accurately describe best practices for data classification in the cloud?

Select 2 answers
A.Manual classification by users is more accurate than automated methods in large-scale cloud environments.
B.Tokenization can replace data classification by eliminating the need to identify sensitive data.
C.Automated tools can scan cloud storage and apply classification labels based on content inspection.
D.Data loss prevention (DLP) policies can enforce classification by monitoring and controlling data in motion and at rest.
E.Data classification labels must be applied by the cloud service provider to ensure consistency.
AnswersC, D

Correct: Automated tools are effective for identifying and labeling sensitive data across cloud environments.

Why this answer

Automated tools can efficiently scan cloud storage for sensitive data, and DLP policies can enforce classification during data usage. Manual classification is not more accurate than automated for large-scale cloud data, classification labels are not solely applied by the provider, and tokenization is a separate technique.

Full explanation →
602
MCQmedium

A company's security team is investigating an anomalous spike in outbound traffic from a cloud workload. The workload is a web server running in an IaaS environment. The team suspects data exfiltration. Which of the following is the BEST initial step to identify the source and type of traffic?

A.Immediately isolate the workload by blocking all outbound traffic in the security group.
B.Deploy a host-based intrusion detection system (HIDS) agent on the workload.
C.Run a vulnerability scanner against the workload to identify possible entry points.
D.Enable VPC flow logs for the subnet hosting the workload and analyze the logs.
AnswerD

VPC flow logs provide network-level visibility and can quickly show anomalous outbound connections without requiring agent installation.

Why this answer

VPC flow logs capture metadata about all IP traffic to and from network interfaces in a subnet, including source/destination IPs, ports, protocols, and packet/byte counts. Analyzing these logs allows the security team to identify the external destination IPs and ports involved in the anomalous outbound traffic, which is the fastest way to pinpoint the source workload and characterize the exfiltration pattern without disrupting service or requiring agent deployment.

Exam trap

ISC2 often tests the distinction between investigative actions and reactive containment; the trap here is that candidates may choose immediate isolation (Option A) as a 'best first step' when the question explicitly asks for the step to 'identify the source and type of traffic,' not to stop it.

How to eliminate wrong answers

Option A is wrong because immediately blocking all outbound traffic via security group is a reactive containment step, not an investigative one; it would halt all egress, potentially breaking legitimate services and destroying forensic evidence of the exfiltration path. Option B is wrong because deploying a HIDS agent is a proactive monitoring measure that requires installation time and may not capture the current traffic burst; it also does not provide immediate visibility into the network-level flow details needed to identify the exfiltration destination. Option C is wrong because running a vulnerability scanner identifies potential entry points but does not reveal current outbound traffic patterns or the specific data being exfiltrated; it is a post-incident forensic step, not an initial investigative action.

Full explanation →
603
MCQmedium

A cloud operations team manages a critical application on AWS that uses EC2 instances behind an Application Load Balancer (ALB). The application experiences occasional high latency and timeout errors. The team has enabled detailed monitoring and CloudWatch Logs. They notice that during peak hours, the CPU utilization on some instances reaches 95%, while others remain around 40%. The security group allows traffic from a wide range of IP addresses. The team needs to improve both performance and security. Which of the following actions would BEST address the performance imbalance and also enhance security posture?

A.Schedule a periodic cron job to launch additional instances during expected peak hours and configure the ALB to use sticky sessions.
B.Create an auto scaling group with a dynamic scaling policy based on average CPU utilization, change the ALB to a Network Load Balancer for lower latency, and restrict the security group rules to the minimal required IP addresses.
C.Increase the instance size to a larger type that can handle peak loads and reduce the security group to allow only known IP ranges.
D.Replace the ALB with a Classic Load Balancer and configure it to use round-robin routing without health checks to balance traffic quickly.
AnswerB

Dynamic auto scaling adjusts capacity based on load, NLB provides lower latency, and restricting security groups enhances security.

Why this answer

It addresses both the performance imbalance and security posture. A dynamic auto scaling policy based on average CPU utilization automatically adjusts capacity to handle peak loads, balancing the load across instances. Changing to a Network Load Balancer (NLB) reduces latency due to its lower overhead compared to an Application Load Balancer (ALB).

Restricting security group rules to minimal required IPs enhances security. Option A is incorrect because scheduled scaling may not match unpredictable traffic patterns, and sticky sessions can worsen imbalances. Option C is incorrect because increasing instance size is a static fix that doesn't address the imbalance during variable loads.

Option D is incorrect because Classic Load Balancers lack advanced features like health checks and are not suitable for modern applications; round-robin alone doesn't fix the imbalance.

Full explanation →
604
MCQmedium

A company is designing a data retention policy for cloud storage. Regulatory requirements mandate that certain records be kept for 7 years and then securely destroyed. Which combination of controls should be used?

A.Lifecycle policy and secure deletion
B.Data masking and encryption
C.Versioning and MFA delete
D.Lifecycle policy and object lock
AnswerA

Lifecycle policy automates deletion; cloud providers ensure secure deletion.

Why this answer

A lifecycle policy automates the transition and expiration of objects, allowing you to set a rule to delete objects after 7 years. Secure deletion (e.g., overwriting or cryptographic erasure) ensures the data is irrecoverable, meeting the regulatory requirement for secure destruction. Together, they provide a fully automated, auditable process for retention and destruction.

Exam trap

ISC2 often tests the distinction between 'preventing deletion' (object lock) and 'ensuring secure destruction' (secure deletion), leading candidates to choose object lock because it sounds like it handles retention, but it does not guarantee irrecoverable deletion after the retention period ends.

How to eliminate wrong answers

Option B is wrong because data masking and encryption protect data at rest or in use but do not automate deletion or ensure secure destruction after a retention period. Option C is wrong because versioning preserves multiple versions of an object, which could prevent complete deletion, and MFA delete only adds an extra authentication step to deletion operations, not secure destruction. Option D is wrong because object lock enforces a write-once-read-many (WORM) model that prevents deletion or modification during a retention period, but it does not provide secure deletion (e.g., overwriting or cryptographic erasure) after the lock expires; it only allows normal deletion, which may leave recoverable data.

Full explanation →
605
Matchingmedium

Match each cloud security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Cloud security posture management

Cloud workload protection platform

Cloud access security broker

Security information and event management

Why these pairings

These tools address different aspects of cloud security; CSPM focuses on configuration, CWPP on workloads.

Full explanation →
606
MCQmedium

A security team is implementing a web application firewall (WAF) for a cloud-based e-commerce application. The application is built on a microservices architecture and uses a RESTful API. Which of the following is the PRIMARY reason to deploy the WAF at the API gateway level rather than at the individual service level?

A.To provide centralized protection against common web exploits before traffic reaches the microservices.
B.To reduce latency by caching responses at the API gateway.
C.To offload authentication from the microservices to the API gateway.
D.To monitor API usage and detect anomalies in traffic patterns.
AnswerA

Centralized WAF at the API gateway ensures consistent policy enforcement and reduces attack surface.

Why this answer

Deploying the WAF at the API gateway provides a centralized security enforcement point that inspects and filters all incoming HTTP/HTTPS traffic before it is routed to any individual microservice. This ensures that common web exploits—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—are blocked at the perimeter, reducing the attack surface and preventing malicious payloads from ever reaching the internal services. It also simplifies policy management and avoids the need to configure and maintain separate WAF instances for each microservice, which would introduce operational complexity and potential gaps in coverage.

Exam trap

The trap here is that candidates confuse the WAF's primary security purpose (centralized exploit prevention) with other common API gateway features like caching, authentication offloading, or traffic monitoring, leading them to select a technically valid but non-primary reason for WAF placement.

How to eliminate wrong answers

Option B is wrong because caching responses at the API gateway is a performance optimization, not a primary security reason for deploying a WAF; WAFs do not inherently cache responses, and caching is typically handled by a separate reverse proxy or CDN. Option C is wrong because offloading authentication to the API gateway is an identity and access management function, not a WAF function; while an API gateway can handle authentication, a WAF's primary role is to inspect and filter traffic for malicious content, not to authenticate users. Option D is wrong because monitoring API usage and detecting anomalies in traffic patterns is typically the responsibility of an API management platform or a dedicated security analytics tool, not the core function of a WAF; a WAF focuses on blocking known attack signatures and behavioral anomalies, but its primary deployment reason is centralized threat protection, not monitoring alone.

Full explanation →
607
Multi-Selectmedium

Which THREE of the following are recommended practices for securing cloud application APIs? (Select three.)

Select 3 answers
A.Validate and sanitize all user inputs
B.Expose all API endpoints automatically for transparency
C.Allow mass assignment for ease of development
D.Implement rate limiting to prevent abuse
E.Apply least privilege to API keys and roles
AnswersA, D, E

Input validation prevents injection attacks.

Why this answer

Rate limiting, input validation, and least privilege are key API security practices. Mass assignment is a vulnerability to avoid, not a practice, and exposing all endpoints is contrary to security.

Full explanation →
608
MCQmedium

A healthcare provider is subject to HIPAA regulations. They are planning to use a public cloud provider. Which design consideration is most important to ensure compliance?

A.Containerization
B.Cost optimization
C.Multi-cloud strategy
D.Data residency
AnswerD

Data residency ensures data is stored in approved locations, meeting HIPAA requirements.

Why this answer

Data residency is the most critical design consideration for a healthcare provider subject to HIPAA when using a public cloud, because HIPAA requires that protected health information (PHI) be stored and processed only in jurisdictions where the cloud provider can guarantee compliance with the HIPAA Privacy and Security Rules. If the cloud provider replicates data across regions or countries without explicit control, the organization may violate the HIPAA requirement to ensure that PHI is not exposed to unauthorized access or disclosure, and may also breach the Breach Notification Rule if data crosses borders into regions with weaker protections.

Exam trap

ISC2 often tests the misconception that technical controls like containerization or multi-cloud strategies are primary compliance tools, when in reality, foundational legal and geographic controls like data residency are the first and most critical step for regulated data in the cloud.

How to eliminate wrong answers

Option A is wrong because containerization (e.g., Docker, Kubernetes) is a deployment and isolation technology that does not inherently address data location, access controls, or compliance with HIPAA's administrative, physical, and technical safeguards; it is a means to package applications, not a compliance mechanism. Option B is wrong because cost optimization focuses on reducing cloud spending, which is irrelevant to HIPAA's core requirements for protecting PHI; prioritizing cost over compliance could lead to using cheaper, non-compliant storage or processing regions. Option C is wrong because a multi-cloud strategy involves using multiple cloud providers, which can increase complexity and risk of non-compliance if data residency and data flow across providers are not meticulously controlled; it does not directly ensure that PHI remains in compliant jurisdictions.

Full explanation →
609
Multi-Selecteasy

Which TWO of the following are valid data states that must be protected in cloud computing?

Select 2 answers
A.Data encryption
B.Data at rest
C.Data in transit
D.Data integrity
E.Data in database
AnswersB, C

Data at rest is a standard state requiring protection.

Why this answer

In cloud computing, data exists in three primary states: at rest (stored on disk or in memory), in transit (moving across networks), and in use (being processed). The CCSP exam specifically identifies 'data at rest' and 'data in transit' as the two fundamental data states that require protection through encryption, access controls, and integrity mechanisms. Option B is correct because data at rest refers to inactive data stored physically on any digital device, such as databases, backups, or archives, and must be safeguarded against unauthorized access or theft.

Exam trap

ISC2 often tests the distinction between security controls (like encryption or integrity) and the actual data states that must be protected, causing candidates to confuse a protection mechanism with a state classification.

Full explanation →
610
Multi-Selecthard

A company is implementing a cloud risk management program. Which THREE of the following are essential components of a risk assessment according to NIST SP 800-30?

Select 3 answers
A.Control implementation
B.Risk determination
C.Threat identification
D.Impact analysis
E.Vulnerability scanning
AnswersB, C, D

Determining risk level based on likelihood and impact is an essential component.

Why this answer

NIST SP 800-30 risk assessment includes threat identification, impact analysis, and risk determination. Vulnerability scanning is a method used to identify vulnerabilities, not a component of the assessment itself. Control implementation is part of risk mitigation.

Full explanation →
611
MCQmedium

A multinational corporation operates across multiple cloud providers (AWS, Azure, GCP) and uses a variety of data storage services. They have a requirement to enforce a consistent encryption policy across all providers: all data at rest must be encrypted using a centrally managed key that is rotated every 90 days. The cloud security team is evaluating different key management solutions. They want to minimize operational overhead and avoid vendor lock-in. The team has experience with configuring cloud-native key management services (KMS) but is concerned about managing keys across different regions and providers. Which solution best meets the requirements?

A.Deploy a third-party cloud-agnostic key management solution that supports BYOK and integrates with all providers' KMS
B.Use each cloud provider's native KMS and create identical key policies manually
C.Store the key in an internal secrets manager and configure each provider's KMS to use that key as a root key
D.Implement client-side encryption using a single master key stored in the application configuration
AnswerA

Centralized policy management, consistent enforcement, and reduces vendor lock-in.

Why this answer

A third-party cloud-agnostic key management solution (e.g., HashiCorp Vault, Thales CipherTrust) that supports Bring Your Own Key (BYOK) allows the organization to centrally manage and rotate a single root key every 90 days, while integrating with each provider's native KMS via external key stores (e.g., AWS KMS custom key store, Azure Key Vault managed HSM, GCP Cloud HSM). This minimizes operational overhead by avoiding manual per-provider policy replication and prevents vendor lock-in by decoupling key management from any single cloud provider's proprietary KMS.

Exam trap

ISC2 often tests the misconception that cloud-native KMS services can be centrally managed by simply replicating policies or using an internal secrets manager as a root key, but the trap is that cloud KMS does not allow external key material to be used as a root key for automatic rotation across providers—only a third-party agnostic solution with BYOK can enforce consistent, centrally controlled rotation.

How to eliminate wrong answers

Option B is wrong because manually creating identical key policies across AWS, Azure, and GCP KMS does not centralize key management; each provider's KMS would still use its own independent key material, making consistent rotation every 90 days operationally complex and error-prone. Option C is wrong because storing the key in an internal secrets manager and configuring each provider's KMS to use that key as a root key is technically infeasible—cloud-native KMS services do not accept external keys as root keys; they require keys to be imported as customer-managed keys (CMKs) but still manage them independently, and the secrets manager cannot enforce rotation across all providers' KMS. Option D is wrong because client-side encryption using a single master key stored in application configuration violates the requirement for centrally managed key rotation (the key would be static in config files) and introduces significant security risks, such as key exposure in code repositories or configuration management systems.

Full explanation →
612
MCQmedium

A security team needs to implement automated remediation for non-compliant resources in a cloud environment. They want to automatically fix public object storage bucket policies. Which combination of services should be used?

A.Audit logging service and serverless compute function
B.Threat detection service and workflow orchestration service
C.Security hub and vulnerability management service
D.Configuration management service and serverless compute function
AnswerD

Correct. Configuration management service evaluates rules and invokes a serverless function to remediate non-compliant resources automatically.

Why this answer

A configuration management service can evaluate resources against compliance rules. When a resource is non-compliant, the service can invoke a serverless compute function to perform automated remediation, such as making a public bucket private.

Exam trap

Candidates may confuse security information and event management (SIEM) or vulnerability scanning tools with remediation capabilities.

Full explanation →
613
MCQeasy

A DevOps team is building a container image for a cloud-native application. To minimize the attack surface and reduce the number of vulnerabilities, which type of base image should they use?

A.A full distribution image like Ubuntu
B.An Alpine-based image
C.A distroless image
D.The 'latest' tag of any official image
AnswerC

Distroless images contain only the necessary runtime files, reducing attack surface.

Why this answer

Distroless images contain only the application and its runtime dependencies, removing package managers, shells, and other utilities that could be exploited. This reduces the attack surface significantly.

Full explanation →
614
MCQmedium

A cloud security engineer needs to de-identify a dataset containing credit card numbers before sharing it with a third-party analytics team. The engineer wants to replace each credit card number with a unique token that can be used for correlation but cannot be reversed to obtain the original number. Which de-identification technique should be used?

A.Tokenization
B.Pseudonymisation
C.Masking
D.Bucketing
AnswerA

Tokenization provides a non-reversible substitute for the original data.

Why this answer

Tokenization replaces sensitive data with a non-reversible token, preserving the ability to correlate records without exposing the original values.

Full explanation →
615
Multi-Selecteasy

Which TWO of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Select 2 answers
A.Measured service
B.Multitenancy
C.Virtualization
D.Auditability
E.Resource pooling
AnswersA, E

Correct; usage is metered and optimized.

Why this answer

NIST defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Measured service and resource pooling are correct; multitenancy and virtualization are enablers, not characteristics.

Full explanation →
616
MCQhard

A multi-tier web application is deployed across two VPCs connected via VPC peering. The web tier in VPC A must communicate with the database tier in VPC B on port 3306. Security groups are used for instance-level security. Which security group configuration is MOST secure?

A.In the database security group, add an inbound rule allowing TCP/3306 from the security group ID of the web servers.
B.Configure a VPN connection between VPCs and use route tables to direct traffic.
C.In the network ACL for VPC B's subnet, add an inbound rule allowing TCP/3306 from VPC A CIDR.
D.In the database security group, add an inbound rule allowing TCP/3306 from the VPC A CIDR.
AnswerA

Security group referencing ensures only instances in the web security group can connect.

Why this answer

The most secure approach is to allow inbound traffic to the database security group from the web server security group by referencing its ID (security group ID). This ensures that only instances in the web server security group can reach the database, regardless of IP changes. Option A is correct because it uses a security group ID reference, which is more specific and secure than using a CIDR range.

Options B, C, and D are less secure: B involves a VPN and routing, which are not instance-level; C uses a network ACL which is stateless and less granular; D uses a CIDR range which allows any instance in VPC A to connect, not just the web servers.

Full explanation →
617
MCQmedium

A cloud application allows users to upload profile pictures that are stored in Azure Blob Storage. Which vulnerability is most likely if the application does not validate the content type or size of uploaded files?

A.Unrestricted File Upload
B.Server-Side Request Forgery (SSRF)
C.Mass Assignment
D.Broken Object Level Authorization (BOLA)
AnswerA

Unrestricted file upload can lead to remote code execution if dangerous file types are allowed.

Why this answer

Without validation, an attacker could upload a malicious file (e.g., a web shell) that could be executed on the server, leading to remote code execution.

Full explanation →
618
Multi-Selectmedium

A security team is enhancing logging in AWS to capture detailed data events for S3 buckets. Which TWO of the following should be enabled to achieve comprehensive monitoring of S3 data access? (Choose two.)

Select 2 answers
A.S3 server access logs
B.AWS CloudTrail data events for S3
C.AWS Config
D.VPC Flow Logs
E.Amazon GuardDuty
AnswersA, B

S3 access logs provide detailed records of requests made to S3.

Why this answer

S3 server access logs provide detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. AWS CloudTrail data events for S3 capture API-level activities such as PutObject, GetObject, and DeleteObject. Together, they offer comprehensive monitoring of S3 data access at both the request level and API activity level.

Exam trap

A common pitfall is confusing AWS Config (which monitors configuration changes) with data access logging capabilities. Candidates often incorrectly select AWS Config for monitoring S3 data access because it records resource configurations, but it does not capture individual data access events. The correct choices for comprehensive data access monitoring are S3 server access logs and CloudTrail data events for S3.

Full explanation →
619
MCQmedium

A cloud customer wants to ensure that their data is not accessible to the cloud provider's employees. Which of the following controls would best address this requirement?

A.Enable detailed audit logging of all data access.
B.Implement strict IAM policies for CSP employees.
C.Encrypt data client-side before uploading to the cloud.
D.Enable server-side encryption with customer-provided keys.
AnswerC

Client-side encryption ensures only the customer holds the decryption keys.

Why this answer

Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider never has access to the plaintext or the encryption keys. This means that even if a cloud provider employee gains administrative access to the storage infrastructure, they can only retrieve ciphertext, which is useless without the customer-held keys. This control directly addresses the requirement of preventing the provider's employees from accessing the data.

Exam trap

ISC2 often tests the distinction between client-side encryption and server-side encryption with customer-provided keys (SSE-C), where candidates mistakenly think SSE-C gives the customer full control over key access, but the provider's server still handles the plaintext during encryption/decryption.

How to eliminate wrong answers

Option A is wrong because audit logging only records who accessed data and when, but does not prevent access by cloud provider employees. Option B is wrong because IAM policies for CSP employees are managed by the provider, not the customer, and the customer cannot enforce or verify those policies to guarantee data inaccessibility. Option D is wrong because server-side encryption with customer-provided keys (SSE-C) still involves the cloud provider's server performing the encryption/decryption, meaning the plaintext is exposed to the provider's infrastructure during processing, and the provider's employees could potentially access the data if they have administrative privileges to the key management or storage systems.

Full explanation →
620
Multi-Selectmedium

A security team is implementing container image scanning in a CI pipeline. Which TWO of the following actions should be performed? (Select TWO)

Select 2 answers
A.Disable scanning to speed up the pipeline
B.Scan the image before pushing to the registry
C.Scan the image after deployment to production
D.Sign the image to ensure integrity
E.Scan the image only if it is based on a public base image
AnswersB, D

Scanning before push prevents vulnerable images from being stored.

Why this answer

Scanning the image before pushing to a registry prevents vulnerable images from being stored. Signing images ensures integrity and authenticity, preventing tampered images from being deployed.

Full explanation →
621
MCQmedium

A company uses a cloud database that stores customer financial information. To ensure compliance with PCI DSS, which control is required?

A.Encryption of cardholder data stored in the database
B.Network segmentation between the database and other systems
C.Annual external vulnerability scans of the database
D.Multi-factor authentication for database administrators
AnswerA

PCI DSS requires encryption of stored cardholder data.

Why this answer

PCI DSS Requirement 3.4 specifically mandates that stored cardholder data must be rendered unreadable anywhere it is stored, including in cloud databases. Encryption at rest (e.g., AES-256) is the primary control to achieve this, as it directly protects the confidentiality of Primary Account Numbers (PANs) if the storage layer is compromised. Without encryption, the data remains in clear text, violating PCI DSS compliance.

Exam trap

ISC2 often tests the distinction between required controls (e.g., encryption for data at rest) and recommended or supporting controls (e.g., network segmentation, MFA, vulnerability scans), leading candidates to pick a broader security measure that is not the specific PCI DSS mandate for stored data.

How to eliminate wrong answers

Option B is wrong because network segmentation is a recommended security practice (PCI DSS Requirement 1) but is not a required control specifically for stored data; it addresses scope reduction, not the direct protection of cardholder data at rest. Option C is wrong because annual external vulnerability scans (PCI DSS Requirement 11.2) are required for internet-facing systems, but they are a detection control, not a required control for protecting stored data; they do not render data unreadable. Option D is wrong because multi-factor authentication for database administrators (PCI DSS Requirement 8.3) is required for administrative access to systems handling cardholder data, but it is an access control, not a direct requirement for protecting the stored data itself; encryption is the specific mandate for data at rest.

Full explanation →
622
MCQeasy

A cloud security team wants to integrate security testing early in the development lifecycle to reduce vulnerabilities. Which approach best describes this concept?

A.Runtime application self-protection (RASP)
B.Software bill of materials (SBOM)
C.Web application firewall (WAF)
D.Shift-left security
AnswerD

Shift-left security refers to integrating security early in the SDLC, which aligns with the question.

Why this answer

Shift-left security is the practice of integrating security testing and controls early in the software development lifecycle (SDLC), such as during design and coding phases, rather than waiting until deployment. This proactive approach reduces vulnerabilities by catching flaws when they are cheaper and easier to fix, aligning with DevSecOps principles.

Exam trap

ISC2 often tests the distinction between runtime controls (RASP, WAF) and lifecycle integration practices (shift-left), so candidates mistakenly choose a runtime tool because they associate 'security testing' with active monitoring rather than early development phases.

How to eliminate wrong answers

Option A is wrong because Runtime Application Self-Protection (RASP) is a runtime security technology that monitors and blocks attacks from within the application during execution, not an early lifecycle integration approach. Option B is wrong because a Software Bill of Materials (SBOM) is a formal inventory of software components and dependencies, used for supply chain risk management and vulnerability tracking, not for shifting security left in the development process. Option C is wrong because a Web Application Firewall (WAF) is a network-level security control that filters HTTP traffic to protect applications in production, operating at runtime rather than early in the SDLC.

Full explanation →
623
MCQhard

A security architect applies the above bucket policy to an Amazon S3 bucket containing sensitive data. What is the net effect of this policy?

A.It denies all PutObject requests, regardless of encryption.
B.It denies all PutObject requests that do not specify an encryption header, enforcing encryption at rest.
C.It allows only PutObject requests using SSE-KMS (AWS KMS managed keys).
D.It allows PutObject requests only from principals that use an IAM role with encryption permissions.
AnswerB

Correct: The Deny with Null condition blocks requests where the encryption header is null (missing), thus requiring encryption.

Why this answer

The bucket policy uses a condition key `s3:x-amz-server-side-encryption` with a `StringNotEquals` condition to deny `PutObject` requests that do not include the `x-amz-server-side-encryption` header set to `AES256`. This effectively denies any upload that does not specify server-side encryption with S3-Managed Keys (SSE-S3), enforcing encryption at rest for all objects written to the bucket.

Exam trap

ISC2 often tests the distinction between SSE-S3 (`AES256`) and SSE-KMS (`aws:kms`) in bucket policy conditions, leading candidates to confuse the required header value and incorrectly select an option involving KMS.

How to eliminate wrong answers

Option A is wrong because the policy does not deny all PutObject requests; it only denies those that lack the required encryption header, so requests that include the correct encryption header are allowed. Option C is wrong because the policy requires the encryption header value `AES256`, which corresponds to SSE-S3, not SSE-KMS (which would require `aws:kms`). Option D is wrong because the policy does not reference IAM roles or encryption permissions; it only checks for the presence and value of the encryption header, regardless of the principal's IAM role.

Full explanation →
624
MCQmedium

A cloud security architect is designing a defense-in-depth strategy for a multi-tenant IaaS environment. Which of the following controls would BEST protect against workload isolation failure due to a hypervisor vulnerability?

A.Perform weekly vulnerability scans of the hypervisor and tenant workloads.
B.Deploy a dedicated virtual firewall instance for each tenant to enforce network segmentation.
C.Apply the latest hypervisor security patches and disable unnecessary services.
D.Use encrypted virtual disks for all tenant virtual machines.
AnswerB

Network segmentation using virtual firewalls provides an additional layer of isolation even if the hypervisor is compromised.

Why this answer

Deploying a dedicated virtual firewall instance for each tenant provides network-level isolation that is independent of the hypervisor, mitigating the risk of workload isolation failure due to a hypervisor vulnerability. Option A is wrong because weekly vulnerability scans are detective, not preventive, and do not actively prevent exploitation. Option C is wrong because while applying patches and disabling services reduces the attack surface, a zero-day hypervisor vulnerability could still exist and be exploited.

Option D is wrong because encrypted virtual disks protect data at rest but do not prevent a hypervisor escape or workload isolation failure.

Full explanation →
625
MCQeasy

A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?

A.Implement rate limiting on the authentication endpoint
B.Require API keys for all requests
C.Use TLS to encrypt the communication channel
D.Add input validation for all parameters
AnswerA

Rate limiting reduces the number of allowed attempts, blocking brute-force attacks.

Why this answer

Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.

Exam trap

ISC2 often tests the distinction between authentication-specific controls (rate limiting) and general security measures (encryption, input validation), leading candidates to choose TLS or API keys because they are commonly associated with API security but do not address brute-force frequency.

How to eliminate wrong answers

Option B is wrong because API keys authenticate the client application, not the user, and do not prevent an attacker from repeatedly trying different passwords or tokens against the authentication endpoint. Option C is wrong because TLS encrypts data in transit to prevent eavesdropping and tampering, but it does not limit the number of requests an attacker can send, leaving the endpoint vulnerable to brute-force attempts. Option D is wrong because input validation prevents injection attacks (e.g., SQLi, XSS) but does not restrict the frequency of requests, so an attacker can still submit unlimited login attempts with valid parameter formats.

Full explanation →
626
Multi-Selectmedium

A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?

Select 2 answers
A.Conduct regular tabletop exercises to simulate incident scenarios
B.Conduct a post-mortem analysis of previous incidents
C.Implement automated isolation of compromised instances
D.Define and document communication escalation paths
E.Deploy a security information and event management (SIEM) system
AnswersA, D

Tabletop exercises help validate the plan and train the response team before an incident.

Why this answer

Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.

Exam trap

ISC2 often tests the distinction between preparation-phase activities (planning, training, documentation) and operational-phase activities (detection, containment, recovery), leading candidates to mistakenly select automated response or monitoring tools as preparation steps.

Full explanation →
627
MCQhard

A healthcare organization recently migrated a patient records management application from on-premises infrastructure to a cloud environment using Infrastructure as a Service (IaaS). The application was originally designed as a monolithic workload running on bare-metal servers. After migration, the application is deployed on a fleet of virtual machines (VMs) of the same instance type. The organization is using a combination of Reserved Instances for baseline capacity and On-Demand instances to handle spikes. However, two months after the migration, the cloud bill is 40% higher than the estimated on-premises total cost of ownership. Additionally, performance reports indicate that the application experiences inconsistent latency and occasional timeouts during peak hours. The operations team has confirmed that the application code has not changed, and the cloud provider's infrastructure is healthy. There is no issue with network bandwidth or storage I/O. The team is considering several options to address both cost and performance issues. What should the team do first?

A.Migrate the application to serverless compute to eliminate the need to manage VMs.
B.Perform a rightsizing analysis of the current VM usage and adjust instance types accordingly.
C.Consolidate the workload into fewer, larger instances to reduce overhead and licensing costs.
D.Replace On-Demand instances with Spot Instances to reduce costs during spikes.
AnswerB

Rightsizing addresses both cost and performance by matching instance resources to actual workload demands. It is a standard first step in cloud optimization.

Why this answer

The symptoms (high cost and inconsistent performance) strongly suggest that the instances are not appropriately sized for the workload. Rightsizing based on actual metrics (CPU, memory, I/O) is the most direct and effective first step to reduce waste and improve performance. Option A is too drastic; moving to serverless would require significant architectural changes and is not a quick fix.

Option C (Spot Instances) is unsuitable for baseline capacity because they can be terminated with little notice, which would disrupt a monolithic application. Option D (consolidation into fewer, larger instances) might reduce licensing costs but assumes that the current instances are underutilized; it could exacerbate performance issues if the application is not designed to scale horizontally.

Full explanation →
628
MCQmedium

A cloud customer wants to ensure that when the contract ends, the cloud provider deletes all customer data, including from backups. Which contractual clause is essential?

A.Right to audit clause
B.Data deletion clause
C.Data portability clause
D.Service Level Agreement
AnswerB

This clause mandates the provider to delete all copies of customer data.

Why this answer

A data deletion clause should specify the obligation to delete customer data, including backups, upon termination.

Full explanation →
629
MCQhard

A cloud security architect is designing a CI/CD pipeline for a serverless application using AWS Lambda. The application processes sensitive user data and requires encryption at rest and in transit. Which of the following is the BEST approach to securely manage database credentials used by the Lambda function?

A.Store the credentials in AWS Systems Manager Parameter Store with a SecureString parameter.
B.Use AWS Secrets Manager to store the credentials and retrieve them at runtime with least-privilege IAM roles.
C.Store the credentials as encrypted environment variables in the Lambda function configuration.
D.Hardcode the credentials in the Lambda function code and encrypt the deployment package.
AnswerB

Secrets Manager provides secure storage, automatic rotation, and fine-grained access control via IAM.

Why this answer

AWS Secrets Manager is the best choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as database credentials. It integrates natively with AWS Lambda via the Secrets Manager API, allowing the function to fetch credentials at runtime using a least-privilege IAM role. This approach avoids embedding secrets in code or configuration and supports automatic rotation, which is critical for compliance with encryption and access control requirements.

Exam trap

ISC2 often tests the distinction between AWS Systems Manager Parameter Store (for configuration) and AWS Secrets Manager (for secrets), trapping candidates who think encryption alone is sufficient without considering rotation and lifecycle management.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store with SecureString provides encryption but lacks native automatic rotation and fine-grained access control for secrets; it is designed for configuration data, not secrets management. Option C is wrong because encrypted environment variables are still stored in the Lambda configuration and can be exposed through logs, error messages, or the AWS Management Console; they also do not support rotation. Option D is wrong because hardcoding credentials in code, even with an encrypted deployment package, violates the principle of not embedding secrets in code and makes rotation impossible without redeployment; the encryption key management also adds unnecessary complexity.

Full explanation →
630
MCQeasy

A developer accidentally launched an EC2 instance with an overly permissive security group that allows SSH from 0.0.0.0/0. After a security review, the team wants to ensure this cannot happen again. What is the MOST effective preventive control?

A.Grant developers full access to EC2 and rely on training.
B.Attach an IAM policy to developer roles that denies the ec2:AuthorizeSecurityGroupIngress action if the CIDR is 0.0.0.0/0.
C.Use AWS Systems Manager to automatically remediate open SSH rules.
D.Enable AWS Config rules to detect and alert on open SSH.
AnswerB

This IAM policy condition prevents the action at the time of request.

Why this answer

IAM policies can enforce preventive controls by denying the ec2:AuthorizeSecurityGroupIngress action when the CIDR is 0.0.0.0/0, which blocks the action at the API level before any rule is created. This is a preventive control because it stops the insecure configuration from being applied, rather than detecting or remediating it after the fact. By attaching this policy to developer roles, the team ensures that even if a developer attempts to add an overly permissive SSH rule, the request is denied by AWS IAM.

Exam trap

ISC2 often tests the distinction between preventive controls (IAM deny policies) and detective/reactive controls (AWS Config, Systems Manager remediation), and the trap here is that candidates may choose a detective or reactive option because they think 'alerting' or 'auto-remediation' is sufficient, when the question explicitly asks for the 'most effective preventive control.'

How to eliminate wrong answers

Option A is wrong because granting full EC2 access and relying solely on training is not a technical control; it depends on human behavior and does not prevent the action from occurring. Option C is wrong because AWS Systems Manager automation for remediation is a detective/reactive control, not preventive; it only fixes the issue after the insecure rule has already been created. Option D is wrong because AWS Config rules are detective controls that alert on non-compliant resources after they exist, but they do not block the initial creation of the overly permissive security group rule.

Full explanation →
631
Multi-Selectmedium

Which TWO practices help protect against insecure deserialization attacks in cloud applications?

Select 2 answers
A.Allow deserialization from untrusted sources
B.Use strong encryption for all serialized data
C.Implement custom deserialization without validation
D.Validate serialized objects before deserialization
E.Restrict deserialization to a whitelist of classes
AnswersD, E

Validation can detect tampered objects.

Why this answer

Validating serialized objects before deserialization ensures that the data conforms to expected schemas and constraints, preventing malicious payloads from triggering arbitrary code execution. This practice is critical in cloud applications where deserialization of user-supplied data (e.g., JSON or XML) can lead to remote code execution (RCE) or denial-of-service (DoS) attacks if not validated.

Exam trap

ISC2 often tests the misconception that encryption alone (Option B) is sufficient to secure serialized data, but encryption only protects data at rest or in transit, not the deserialization process itself, which is where the attack occurs.

Full explanation →
632
Multi-Selecteasy

Which TWO of the following are benefits of using tokenization for credit card data?

Select 2 answers
A.Maintains data format for existing systems
B.Reversible without a key vault
C.Reduces PCI DSS compliance scope
D.Eliminates the need for encryption
E.Slows down database queries
AnswersA, C

Tokens can preserve format, aiding integration.

Why this answer

Tokenization replaces sensitive credit card data with a non-sensitive token that retains the same format (e.g., a 16-digit number) and length, allowing existing systems, databases, and applications to process the token without modification. This format-preserving property ensures that legacy systems, such as payment gateways or CRM platforms, can continue to operate without requiring costly re-engineering. By using a token instead of the actual PAN, the organization reduces the scope of PCI DSS compliance because the tokenized data is not considered cardholder data under the PCI DSS standard.

Exam trap

ISC2 often tests the misconception that tokenization eliminates the need for encryption entirely, but the correct understanding is that tokenization reduces PCI DSS scope while encryption (for the vault and transit) remains essential.

Full explanation →
633
MCQmedium

A company has multiple virtual private clouds in the same region and wants to enable direct IP connectivity between them using private IP addresses. However, they do not need transitive routing across multiple VPCs. Which solution should they use?

A.VPN Gateway
B.Virtual network peering
C.Private connectivity
D.Transit routing hub
AnswerB

VPC peering directly connects two VPCs and is not transitive.

Why this answer

Virtual network peering provides direct one-to-one connectivity without transitive routing.

Full explanation →
634
MCQhard

In a cloud environment using KVM, a security auditor wants to ensure that a tenant VM cannot access the memory of another tenant VM on the same physical host. Which resource isolation mechanism is specifically designed to prevent such memory access?

A.Seccomp profiles
B.CPU pinning
C.Extended Page Tables (EPT)
D.IOMMU
AnswerC

Correct; EPT provides hardware-assisted memory isolation between VMs.

Why this answer

Memory isolation is enforced by the hypervisor using Extended Page Tables (EPT) or similar technologies. EPT ensures that each VM's memory mappings are isolated, preventing one VM from accessing another's memory.

Full explanation →
635
MCQeasy

Under the CSA STAR program, which tier involves a third-party assessment resulting in a certification based on ISO 27001?

A.Tier 4: Nonexistent
B.Tier 1: Self-assessment
C.Tier 3: Continuous monitoring
D.Tier 2: Third-party assessment
AnswerD

Tier 2 includes STAR Certification (ISO 27001 + cloud controls) and STAR Attestation (SOC 2).

Why this answer

CSA STAR Tier 2 includes STAR Certification, which builds on ISO 27001 certification and includes cloud-specific controls.

Full explanation →
636
Multi-Selectmedium

A company is evaluating cloud providers for compliance with the GDPR. Which TWO of the following are mandatory data protection roles under the GDPR?

Select 2 answers
A.Data Processor
B.Data Protection Officer (DPO)
C.Cloud Security Architect
D.Data Controller
E.Data Steward
AnswersA, D

The Data Processor is a mandatory role under GDPR.

Why this answer

The GDPR defines the Data Controller and Data Processor as mandatory roles. The Data Protection Officer (DPO) is required only under certain conditions (e.g., large-scale monitoring). Cloud Security Architect and Data Steward are not GDPR-defined roles.

Full explanation →
637
MCQhard

A company uses a cloud key management service (KMS) and wants to ensure that keys can be used only within a specific geographic region. Which of the following should be configured?

A.VPC endpoint for KMS
B.CloudTrail logging
C.Key policy with a condition for allowed regions
D.Key rotation policy
AnswerC

Key policies with conditions can restrict use to specific regions.

Why this answer

A key policy with a condition using the `kms:CallerRegion` or `aws:RequestRegion` condition key can explicitly restrict the geographic region where the KMS key can be used. This ensures that any cryptographic operation (e.g., Encrypt, Decrypt) attempted from an unauthorized region is denied, enforcing regional data sovereignty requirements.

Exam trap

ISC2 often tests the distinction between network-level controls (like VPC endpoints) and policy-level controls (like key policy conditions), leading candidates to mistakenly choose VPC endpoints for geographic restrictions when only a condition-based policy can enforce regional key usage.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint for KMS only restricts network access to the KMS API via a private IP within a VPC, but does not enforce geographic region restrictions on key usage; the key could still be used from any region if the request reaches the endpoint. Option B is wrong because CloudTrail logging records API calls for auditing but does not enforce any access control or geographic restriction on key usage. Option D is wrong because a key rotation policy controls how often the key material is rotated, not where the key can be used; it has no effect on geographic restrictions.

Full explanation →
638
MCQhard

During a security incident, the security team suspects that an attacker has tampered with the cloud audit logs to cover their tracks. Which feature would the team use to verify that the log files have not been modified since they were delivered?

A.Automated anomaly detection for audit logs
B.Log file integrity validation
C.Storage access logs
D.Configuration compliance rules
AnswerB

Log file integrity validation uses hash chains to ensure logs have not been tampered with.

Why this answer

Log file integrity validation uses a cryptographic hash chain to create a digital signature for each log file, which is stored in a separate digest file. By computing the hash of a delivered log file and comparing it to the hash in the digest, the team can detect any tampering or modification after delivery. This feature is specifically designed to verify the integrity and authenticity of cloud audit logs.

Exam trap

ISC2 CCSP exams often test the distinction between features that detect suspicious activity (like CloudTrail Insights) and features that provide cryptographic integrity verification (like log file validation). Candidates may confuse the two and select Insights because it sounds like it would detect tampering.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights is a feature that detects unusual API activity and potential security threats by analyzing management and data events, but it does not provide any mechanism to verify the integrity or detect tampering of log files after delivery. Option C is wrong because S3 server access logs record requests made to an S3 bucket, not CloudTrail logs, and they do not offer a cryptographic validation mechanism to confirm that CloudTrail log files have not been modified. Option D is wrong because AWS Config rules evaluate resource configurations against desired policies and can detect changes to resources, but they cannot validate the cryptographic integrity of CloudTrail log files or confirm that the logs have not been altered after delivery.

Full explanation →
639
Multi-Selecthard

Which THREE of the following are typical requirements for compliance with eDiscovery in a cloud environment?

Select 3 answers
A.Documentation of chain of custody
B.Search and retrieval capabilities across data sources
C.Ability to place legal hold on data
D.Encryption of data at rest
E.Data minimization principles
AnswersA, B, C

Ensures evidence integrity.

Why this answer

Legal hold preservation, search capabilities, and chain-of-custody documentation are fundamental to eDiscovery. Encryption is about security, not discovery; data minimization is a privacy principle but not specific to eDiscovery.

Full explanation →
640
Matchingmedium

Match each cloud auditing term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Service organization control report for security

Assessment of cloud provider controls

Analysis of logs for incident investigation

Real-time assessment of security controls

Why these pairings

Auditing in cloud requires continuous monitoring and third-party attestations like SOC 2.

Full explanation →
641
MCQeasy

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

A.GDPR
B.PCI DSS
C.HIPAA
D.ISO 27001
AnswerB

PCI DSS applies to credit card data handling.

Why this answer

PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Exam trap

ISC2 often tests the distinction between mandatory regulatory standards (like PCI DSS) and voluntary frameworks (like ISO 27001), leading candidates to mistakenly choose ISO 27001 because it is a well-known security standard.

How to eliminate wrong answers

Option A is wrong because GDPR (General Data Protection Regulation) governs the protection of personal data of EU citizens, not specifically credit card transaction security. Option C is wrong because HIPAA (Health Insurance Portability and Accountability Act) applies to protected health information (PHI) in healthcare, not payment card data. Option D is wrong because ISO 27001 is a voluntary international standard for information security management systems (ISMS), not a mandatory compliance requirement for credit card processing.

Full explanation →
642
MCQmedium

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

A.Restrict the IAM permissions of developers to only approved roles.
B.Run automated policy compliance checks as part of the CI/CD pipeline.
C.Conduct manual security reviews after each deployment.
D.Deploy resources and then scan for compliance after deployment.
AnswerB

Policy-as-code checks block non-compliant deployments before they go live.

Why this answer

Integrating automated policy-as-code compliance checks into the CI/CD pipeline catches non-compliance before deployment. Option A is incorrect because restricting IAM permissions alone does not prevent misconfigurations from authorized users. Option C is incorrect because manual reviews after deployment are error-prone and slow.

Option D is incorrect because post-deployment scanning is reactive and may allow non-compliant resources to be deployed.

Full explanation →
643
MCQeasy

Which risk assessment method uses subjective scales to assign probabilities and impacts?

A.Semi-quantitative risk assessment
B.Quantitative risk assessment
C.Qualitative risk assessment
D.Bottom-up risk assessment
AnswerC

Uses subjective scales like high/medium/low.

Why this answer

Qualitative risk assessment (option C) is correct because it relies on subjective scales (e.g., high, medium, low) to assign probabilities and impacts, rather than numerical data. This method is commonly used in cloud security to quickly evaluate risks when precise data is unavailable, aligning with the CCSP domain of Legal, Risk and Compliance.

Exam trap

ISC2 often tests the distinction between qualitative and semi-quantitative methods, where candidates confuse subjective scales (qualitative) with ordinal numerical scales (semi-quantitative), leading them to incorrectly select semi-quantitative risk assessment.

How to eliminate wrong answers

Option A is wrong because semi-quantitative risk assessment uses numerical values (e.g., 1-5 scales) to assign probabilities and impacts, not purely subjective scales. Option B is wrong because quantitative risk assessment uses objective numerical data (e.g., monetary values, statistical probabilities) to calculate risk, not subjective scales. Option D is wrong because bottom-up risk assessment is a structural approach that identifies risks from individual components upward, not a method for assigning probabilities and impacts via subjective scales.

Full explanation →
644
MCQhard

The exhibit shows a key policy for a customer master key (CMK) in a cloud KMS. An administrator wants to prevent the AppRole from using the key to decrypt data. Which change to the policy would accomplish this?

A.Add a deny statement for AppRole with effect "Deny" for kms:Decrypt.
B.Remove the entire "Allow use of the key" statement.
C.Change the AppRole action list to include only kms:Encrypt.
D.Remove "kms:Decrypt" from the action list in the AppRole statement.
AnswerD

Decrypt is the specific action needed for decryption. Removing it prevents decryption but allows encryption.

Why this answer

The AppRole's current policy statement explicitly includes 'kms:Decrypt' in the action list, granting it permission to decrypt data. By removing 'kms:Decrypt' from that action list, the AppRole retains its other allowed actions (such as kms:Encrypt) but can no longer perform decryption operations. This is the most precise and least disruptive change, as it only removes the specific permission needed to prevent decryption without affecting other allowed actions.

Exam trap

ISC2 often tests the principle of least privilege and the precise modification of permissions, where candidates may incorrectly choose to add a deny statement (Option A) instead of simply removing the specific action from the allow list, misunderstanding that an explicit deny is not the most efficient or correct way to revoke a permission that was previously granted.

How to eliminate wrong answers

Option A is wrong because adding a deny statement for kms:Decrypt would create an explicit deny, which in IAM policy evaluation logic overrides any allow, but it is unnecessarily complex and could introduce unintended conflicts; the simpler and more direct approach is to remove the permission from the allow statement. Option B is wrong because removing the entire 'Allow use of the key' statement would revoke all permissions for the AppRole, including necessary actions like kms:Encrypt, which is overly broad and not the minimal change required. Option C is wrong because changing the action list to include only kms:Encrypt would also remove kms:Decrypt, but it would also remove any other actions currently allowed (e.g., kms:GenerateDataKey, kms:DescribeKey) that might be needed; the question specifically asks to prevent decryption, so removing only kms:Decrypt is more targeted.

Full explanation →
645
MCQhard

Refer to the exhibit. A cloud security analyst is reviewing an S3 bucket policy. The bucket contains sensitive data and must only be accessible over HTTPS from the internal network (10.0.0.0/24). Which of the following correctly describes the behavior of this policy?

A.Requests from 10.0.0.0/24 over HTTPS are allowed; all other requests are denied.
B.Requests from 10.0.0.0/24 over HTTP are allowed because the Allow statement matches.
C.The policy is invalid because it combines Allow and Deny statements.
D.All requests from 10.0.0.0/24 are denied because the Deny statement applies to all actions.
AnswerA

The Allow statement permits GetObject from the internal IP range, and the Deny blocks non-HTTPS requests. Requests from external IPs are implicitly denied.

Why this answer

The policy uses an explicit Deny for any request that is not using HTTPS (i.e., aws:SecureTransport is false) or does not originate from the 10.0.0.0/24 IP range. This Deny overrides the Allow statement, ensuring that only requests meeting both conditions (source IP 10.0.0.0/24 AND HTTPS) are permitted. Requests from 10.0.0.0/24 over HTTPS satisfy the Allow and are not caught by the Deny, so they are allowed; all other requests are denied.

Exam trap

ISC2 often tests the misconception that an Allow statement alone is sufficient to grant access, ignoring that an explicit Deny with broader conditions can override it, or that a policy with both Allow and Deny is automatically invalid.

How to eliminate wrong answers

Option B is wrong because the Deny statement explicitly denies requests over HTTP (when aws:SecureTransport is false), so even if the source IP matches 10.0.0.0/24, the request is blocked. Option C is wrong because combining Allow and Deny statements is valid in AWS IAM policy evaluation; explicit Deny always takes precedence, but the policy is syntactically and logically correct. Option D is wrong because the Deny statement does not apply to all actions from 10.0.0.0/24; it only denies requests that are not using HTTPS (i.e., aws:SecureTransport is false) or that come from outside the 10.0.0.0/24 range, so requests from 10.0.0.0/24 over HTTPS are allowed.

Full explanation →
646
MCQmedium

A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?

A.Implement a secrets detection tool in the pipeline
B.Use environment variables in the pipeline configuration
C.Use a separate build server
D.Encrypt the Git repository
AnswerA

Automated secrets detection scans for and blocks credentials in build output.

Why this answer

A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.

Exam trap

The trap here is that candidates often confuse 'using environment variables' (a secure storage method) with 'preventing secrets from being logged' (a detection and blocking mechanism), leading them to choose Option B even though environment variables do not stop accidental output.

How to eliminate wrong answers

Option B is wrong because environment variables in pipeline configuration (e.g., CI/CD variables in GitLab) are a secure way to pass secrets, but they do not prevent secrets from being accidentally logged in build output if the application or script explicitly prints them. Option C is wrong because using a separate build server does not address the root cause—secrets can still be logged regardless of where the build runs; it only changes the execution environment. Option D is wrong because encrypting the Git repository protects data at rest but does not prevent secrets from being exposed in plaintext during the build process or in logs.

Full explanation →
647
Multi-Selectmedium

Which TWO of the following are primary objectives of a cloud application security program?

Select 2 answers
A.Maintaining application availability
B.Performing continuous deployment
C.Implementing a microservices architecture
D.Ensuring data confidentiality and integrity
E.Adopting Agile development practices
AnswersA, D

Availability is a key security objective (CIA triad).

Why this answer

Maintaining application availability is a primary objective of a cloud application security program because it directly supports the security triad of confidentiality, integrity, and availability (CIA). In a cloud environment, availability ensures that authorized users can access applications and data when needed, which is critical for business continuity and is often enforced through SLAs, redundancy, and DDoS protection mechanisms. Without availability, security controls become irrelevant as the service is effectively denied.

Exam trap

ISC2 often tests the distinction between security objectives and operational or architectural practices, trapping candidates who confuse 'continuous deployment' or 'microservices' with security goals because they are commonly discussed in cloud security contexts but are not primary objectives.

Full explanation →
648
MCQmedium

A cloud security team wants to automatically block malicious requests to a web application before they reach the application servers. Which solution should they implement?

A.Intrusion Detection System (IDS)
B.Runtime Application Self-Protection (RASP)
C.Cloud Web Application Firewall (WAF)
D.Static Application Security Testing (SAST)
AnswerC

A cloud WAF inspects incoming traffic and blocks malicious requests at the network edge.

Why this answer

A Cloud Web Application Firewall (WAF) is the correct solution because it operates at the application layer (Layer 7) to inspect HTTP/HTTPS traffic and block malicious requests—such as SQL injection, cross-site scripting (XSS), and OWASP Top 10 attacks—before they reach the application servers. Unlike an IDS, a WAF can actively block traffic in real time, and it is deployed at the network edge or cloud gateway, providing inline prevention without requiring changes to the application code.

Exam trap

The trap here is that candidates confuse IDS (passive alerting) with IPS (inline blocking), or assume RASP can block traffic before it reaches the application, when in fact RASP operates within the application runtime and cannot prevent initial request arrival at the server boundary.

How to eliminate wrong answers

Option A is wrong because an Intrusion Detection System (IDS) is a passive monitoring tool that only alerts on suspicious activity (e.g., via signature matching or anomaly detection) and cannot automatically block malicious requests; it lacks inline enforcement capabilities. Option B is wrong because Runtime Application Self-Protection (RASP) runs inside the application runtime environment (e.g., integrated into the JVM or .NET CLR) to detect and block attacks from within the application, but it does not operate before requests reach the application servers—it protects the application from the inside, not at the perimeter. Option D is wrong because Static Application Security Testing (SAST) is a development-phase code analysis tool that scans source code for vulnerabilities (e.g., buffer overflows, insecure APIs) but does not provide runtime protection or block live traffic; it is a preventive measure, not a real-time defense.

Full explanation →
649
MCQhard

A cloud customer is considering adopting a multi-cloud strategy to avoid vendor lock-in. Which risk is this strategy primarily intended to mitigate?

A.Third-party risk from a specific provider
B.Concentration risk
C.Residual risk after controls
D.Inherent risk of data leaving premises
AnswerB

Multi-cloud spreads workloads across providers to avoid single point of failure.

Why this answer

Multi-cloud reduces dependency on a single provider, thus mitigating concentration risk.

Full explanation →
650
MCQhard

A cloud application uses containers orchestrated by Kubernetes. The security team wants to enforce that containers cannot run as root and that file systems are read-only at runtime. Which Kubernetes security context configuration should be applied?

A.Use a RuntimeClass that disables root capabilities
B.Set the container's user to a non-root user in the Dockerfile
C.Apply a PodSecurityPolicy that blocks privileged containers
D.Configure a SecurityContext with runAsNonRoot: true and readOnlyRootFilesystem: true
AnswerD

Directly sets the required properties in the container specification.

Why this answer

Kubernetes SecurityContext allows fine-grained control over container permissions at the pod or container level. Setting `runAsNonRoot: true` ensures the container cannot run as UID 0, and `readOnlyRootFilesystem: true` mounts the container's root filesystem as read-only, preventing unauthorized writes at runtime. This directly satisfies the security team's requirements without relying on external policies or image-level configurations.

Exam trap

The trap here is that candidates confuse image-level defaults (like a non-root user in a Dockerfile) with runtime enforcement via SecurityContext, or they think PodSecurityPolicy (a deprecated feature) is the only way to enforce these restrictions, when in fact SecurityContext is the direct and correct mechanism.

How to eliminate wrong answers

Option A is wrong because a RuntimeClass primarily selects a container runtime (e.g., gVisor, Kata Containers) for isolation, not a mechanism to disable root capabilities or enforce read-only filesystems; it does not directly set runAsNonRoot or readOnlyRootFilesystem. Option B is wrong because setting a non-root user in the Dockerfile only affects the image's default user; it can be overridden at runtime (e.g., by specifying `securityContext.runAsUser: 0`), so it does not enforce the restriction. Option C is wrong because PodSecurityPolicy (PSP) is a deprecated, cluster-level admission controller that can block privileged containers but does not directly enforce `runAsNonRoot: true` or `readOnlyRootFilesystem: true`; it requires additional policy rules and is being replaced by Pod Security Standards.

Full explanation →
651
MCQmedium

A healthcare organization has deployed a cloud-based application that handles protected health information (PHI). The application runs on virtual machines in a virtual private cloud (VPC). The security team has implemented security groups to control traffic to the VMs. Recently, an external penetration test revealed that a web server VM is accessible from the internet on port 22 (SSH) from any IP address (0.0.0.0/0). The security team also discovered that the SSH key pair used for the web server was created with a weak algorithm (1024-bit RSA). The team needs to remediate these issues without causing downtime for the application. Additionally, the application logs must be sent to a centralized logging solution that is encrypted in transit and at rest. Which combination of actions should the security team take?

A.Restrict inbound SSH access to only a bastion host's IP address, generate a new 2048-bit RSA key pair, configure the application to send logs via TLS to a centralized logging service, and enable server-side encryption for the logging bucket.
B.Implement a VPN connection for all administrative access, keep the existing key pair, and use a third-party logging tool with TLS.
C.Change the SSH port to a non-standard port, keep the existing key pair, and enable logging to a cloud storage bucket without encryption.
D.Disable SSH access entirely and use a serial console for administration, keep the existing key pair, and send logs via plaintext syslog to a logging server.
AnswerA

This fully addresses both vulnerabilities and logging requirements.

Why this answer

It addresses both critical vulnerabilities without downtime: restricting SSH to a bastion host's IP eliminates internet-wide exposure, and generating a new 2048-bit RSA key pair replaces the weak 1024-bit key. For logging, TLS ensures encryption in transit, and server-side encryption for the logging bucket ensures encryption at rest, meeting compliance requirements for PHI.

Exam trap

ISC2 often tests the distinction between security by obscurity (e.g., changing ports) and actual security controls (e.g., restricting IPs and using strong keys), leading candidates to pick options that seem quick but fail compliance requirements.

How to eliminate wrong answers

Option B is wrong because keeping the existing 1024-bit RSA key pair leaves a weak cryptographic algorithm in place, which is a security risk and non-compliant with standards like NIST SP 800-57. Option C is wrong because changing the SSH port to a non-standard port is security by obscurity and does not prevent scanning or brute-force attacks, and sending logs to a bucket without encryption violates encryption-at-rest requirements for PHI. Option D is wrong because disabling SSH entirely and using a serial console is impractical for cloud VMs and often causes downtime, and sending logs via plaintext syslog lacks encryption in transit, violating HIPAA and other regulations.

Full explanation →
652
MCQmedium

A company uses a cloud provider's managed database service. The security team is concerned about the shared responsibility model for patching the operating system and database engine. According to the shared responsibility model, who is responsible for applying security patches to the database engine?

A.The customer, because they control the database configuration
B.A third-party vendor contracted by the customer
C.The cloud provider, because it is a managed service
D.Both the customer and the cloud provider equally
AnswerC

Managed services include engine patching by the provider.

Why this answer

For managed services, the cloud provider is responsible for patching the underlying database engine. Option A is wrong because the customer is responsible for the data and access, not the engine. Option B is wrong because both parties do not share this responsibility.

Option D is wrong because the database engine is part of the service.

Full explanation →
653
MCQhard

A company is deploying a multi-tier application in a public cloud and needs to restrict traffic between tiers. The web tier must only accept HTTPS from the internet, and the app tier must only accept HTTP from the web tier. Which cloud networking feature should be used to enforce this?

A.Network access control lists (ACLs) attached to the subnets.
B.Security groups applied to each tier’s instances.
C.Internet gateway with appropriate routes.
D.VPC peering connection between tier subnets.
AnswerA

Network ACLs are stateless and can enforce explicit allow rules between subnets.

Why this answer

Network ACLs are stateless, meaning they filter traffic based on source and destination IP addresses, ports, and protocols at the subnet level. By configuring inbound rules on the web tier subnet to allow HTTPS (TCP/443) from the internet and outbound rules to allow HTTP (TCP/80) to the app tier subnet, and inbound rules on the app tier subnet to allow HTTP only from the web tier subnet, you enforce the required traffic restrictions without maintaining session state. This stateless behavior is essential for explicitly controlling traffic between tiers in a multi-tier architecture.

Exam trap

ISC2 often tests the distinction between stateless (network ACLs) and stateful (security groups) filtering, and the trap here is that candidates assume security groups can enforce inter-tier traffic restrictions as effectively as ACLs, overlooking that security groups are stateful and instance-specific, not subnet-wide.

How to eliminate wrong answers

Option B is wrong because security groups are stateful, meaning if you allow inbound HTTPS to the web tier, the return traffic is automatically allowed, but they cannot enforce outbound restrictions from the web tier to the app tier without additional rules; more critically, security groups are applied at the instance level, not the subnet level, making them less suitable for controlling traffic between entire tiers. Option C is wrong because an internet gateway only provides a target for routing traffic to and from the internet; it does not filter or restrict traffic between subnets or tiers. Option D is wrong because VPC peering connects two VPCs for routing, but it does not provide any filtering or access control; it merely establishes a network path, leaving traffic restrictions to ACLs or security groups.

Full explanation →
654
MCQhard

A healthcare company, MedSecure, is migrating its critical patient record application to a public cloud IaaS environment. The application processes Protected Health Information (PHI) subject to HIPAA in the US and also includes some patient data from EU residents subject to GDPR. MedSecure has signed Business Associate Agreements (BAAs) with the cloud provider covering US HIPAA compliance. However, the compliance officer is concerned about GDPR requirements for EU patient data. The architecture uses AWS EC2 instances behind an Application Load Balancer, with data stored in Amazon RDS (MySQL) using encryption at rest and TLS for transmission. The company uses AWS CloudTrail for logging but only retains logs for 90 days. The compliance officer has identified that the current logging retention does not meet the GDPR requirement for logs to be retained for a minimum of 12 months for audit purposes. Additionally, the data stored in RDS is in a single AWS region in the US (us-east-1). The company plans to expand to EU customers. The GDPR requires that personal data of EU residents be stored in the EU or have adequate safeguards for transfer. Currently, the company has not implemented any data residency controls. What course of action should MedSecure take to address the most critical compliance gaps?

A.Extend CloudTrail log retention to 12 months by configuring a new trail in a separate account and storing logs in an S3 bucket with a lifecycle policy to delete after 12 months. For data residency, use AWS DMS to replicate the RDS database to a second RDS instance in the eu-west-1 region and enable cross-region replication for continuous sync.
B.Implement AWS Config rules to monitor compliance with both HIPAA and GDPR, and enable AWS CloudTrail Insights to detect unusual activity. For data residency, sign a Standard Contractual Clauses (SCCs) with the cloud provider for the existing US-based data.
C.Enable S3 Object Lock for CloudTrail logs to ensure they cannot be deleted before 12 months, and use AWS DMS with CDC to replicate data to a eu-west-1 region. Also, sign a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage.
D.Use AWS Lambda to copy CloudTrail logs from the existing trail to a separate S3 bucket with a retention policy of 12 months. For data residency, configure the RDS instance to have a read replica in eu-west-1 and implement a DPA with AWS for GDPR.
AnswerC

This comprehensively addresses both gaps: immutable log retention, EU data replication, and a DPA to cover legal transfer safeguards.

Why this answer

It directly addresses the two most critical compliance gaps: GDPR log retention (12 months) and data residency for EU patient data. Enabling S3 Object Lock on CloudTrail logs ensures they cannot be deleted or altered before 12 months, meeting GDPR audit requirements. Using AWS DMS with Change Data Capture (CDC) to replicate the RDS database to eu-west-1 provides a continuous, low-latency copy of PHI within the EU, satisfying GDPR data residency.

Signing a Data Processing Agreement (DPA) with AWS specifically for GDPR coverage is essential because the existing BAA only covers HIPAA, and GDPR requires a separate DPA to establish the cloud provider as a data processor under EU law.

Exam trap

ISC2 often tests the distinction between data replication mechanisms (e.g., read replicas vs. DMS with CDC) and the specific legal documents required for different regulations (BAA for HIPAA vs. DPA for GDPR), leading candidates to choose options that mix correct concepts with incorrect implementations.

How to eliminate wrong answers

Option A is wrong because configuring a new trail in a separate account does not prevent premature deletion of logs; a lifecycle policy alone does not enforce immutability, and GDPR requires logs to be retained for 12 months with protection against deletion or alteration. Additionally, using AWS DMS to replicate the RDS database to a second RDS instance with cross-region replication does not inherently provide continuous CDC synchronization for real-time data residency compliance. Option B is wrong because AWS Config rules and CloudTrail Insights are monitoring and detection tools, not mechanisms to enforce log retention or data residency; signing SCCs for existing US-based data does not satisfy the GDPR requirement that EU personal data be stored in the EU or have adequate safeguards for transfer, and SCCs alone do not replace the need for a DPA with the cloud provider.

Option D is wrong because using a Lambda function to copy logs to a separate S3 bucket does not ensure immutability or prevent deletion before 12 months; a read replica in eu-west-1 is read-only and cannot accept writes, so it does not provide a writable copy of the database for EU data residency, and implementing a DPA is correct but the log retention and data residency solutions are insufficient.

Full explanation →
655
Multi-Selecteasy

Which TWO of the following are secure coding practices that help prevent injection attacks?

Select 2 answers
A.Printing stack traces in production error messages
B.Using parameterized queries for database calls
C.Using stored procedures exclusively
D.Validating and sanitizing all user inputs
E.Storing user passwords in plaintext
AnswersB, D

Parameterized queries separate SQL logic from data, preventing injection.

Why this answer

Parameterized queries (also known as prepared statements) separate SQL logic from data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver treats the user-supplied values strictly as data, never as executable code, which prevents an attacker from injecting malicious SQL commands even if the input contains special characters like `' OR 1=1 --`.

Exam trap

ISC2 often tests the misconception that stored procedures are inherently safe against injection, but the trap is that stored procedures can still be vulnerable if they dynamically construct SQL strings using concatenated input, so parameterization must be applied inside the procedure as well.

Full explanation →
656
MCQeasy

Which characteristic of cloud computing allows a user to provision resources automatically without requiring human interaction with the service provider?

A.Rapid elasticity
B.Broad network access
C.On-demand self-service
D.Resource pooling
AnswerC

Correct. On-demand self-service allows automatic provisioning.

Why this answer

On-demand self-service enables users to provision and manage resources as needed via a web portal or API without manual provider intervention.

Full explanation →
657
Multi-Selectmedium

A company is using Azure and wants to implement cloud security posture management (CSPM) to detect misconfigurations. Which TWO services can provide CSPM capabilities? (Choose two.)

Select 2 answers
A.Azure Key Vault
B.Azure Policy
C.Azure Monitor
D.Azure Sentinel
E.Microsoft Defender for Cloud
AnswersB, E

Azure Policy can enforce and evaluate compliance with security benchmarks, contributing to CSPM.

Why this answer

Azure Policy is correct because it enforces organizational standards and assesses compliance at scale, providing CSPM capabilities by evaluating Azure resources against defined rules to detect misconfigurations. It integrates with Microsoft Defender for Cloud to offer continuous monitoring and remediation of security posture issues.

Exam trap

The ISC2 CCSP exam often tests the distinction between CSPM (configuration assessment) and SIEM/SOAR (threat detection), so candidates mistakenly choose Azure Sentinel or Azure Monitor because they associate 'security monitoring' with CSPM, but Sentinel focuses on log analysis and incident response, not configuration compliance.

Full explanation →
658
MCQmedium

A cloud security team wants to automatically remediate misconfigured S3 buckets that are publicly accessible. Which combination of AWS services can be used to detect and automatically fix this issue?

A.AWS GuardDuty and AWS Lambda
B.AWS CloudTrail and AWS Lambda
C.AWS Config and AWS Lambda
D.AWS Security Hub and AWS CloudTrail
AnswerC

AWS Config rule triggers a Lambda function to remediate non-compliant S3 buckets.

Why this answer

AWS Config evaluates resource configurations against rules (e.g., 's3-bucket-public-read-prohibited'). When a non-compliant resource is detected, AWS Config can trigger a Lambda function via a custom remediation action to modify the bucket policy. GuardDuty detects threats but does not remediate.

Security Hub aggregates findings but does not automatically fix issues. CloudTrail logs events but does not evaluate configurations.

Full explanation →
659
Multi-Selectmedium

A company is deploying a critical application on a public cloud IaaS platform. To ensure high availability and disaster recovery, which TWO of the following strategies should the company implement? (Choose two.)

Select 2 answers
A.Deploy the application across multiple availability zones within a region.
B.Use an active-passive configuration with both instances in the same availability zone.
C.Configure the application to run in only one region to simplify management.
D.Implement automated snapshots and replicate data to a different geographic region.
E.Use a single, large virtual machine instance to handle all traffic.
AnswersA, D

This provides high availability within a region.

Why this answer

Deploying across multiple availability zones (AZs) within a region ensures that if one AZ experiences an outage, the application can continue serving traffic from another AZ, providing high availability. This is a fundamental cloud architecture pattern for fault tolerance, as each AZ is an isolated data center with independent power, cooling, and networking.

Exam trap

ISC2 often tests the distinction between high availability (fault tolerance within a region using multiple AZs) and disaster recovery (cross-region data replication and failover), and the trap is that candidates confuse active-passive in the same AZ (which is not HA) with a valid HA strategy.

Full explanation →
660
MCQmedium

A multinational corporation uses a SaaS application for customer relationship management (CRM). The CRM application stores customer data including names, email addresses, and purchase history. The company has operations in the EU, California, and Japan. A new regulation in Japan requires that any transfer of personal data outside Japan must have the data subject's consent if the destination country does not have an adequacy decision. The company's cloud provider stores data in the United States. The company currently relies on the provider's data processing agreement that includes standard contractual clauses (SCCs). However, the Japanese regulator has stated that SCCs are not sufficient for transfers from Japan unless supplemented. You are tasked with ensuring compliance for Japanese data subjects. Which of the following is the most appropriate next step? A. Obtain explicit consent from each Japanese data subject for data transfer to the US. B. Move the data for Japanese subjects to a data center in Japan. C. Continue using SCCs as they are recognized internationally. D. Pseudonymize the data before transfer. Which option best addresses the compliance requirement while considering the operational impact?

A.Move the data for Japanese subjects to a data center in Japan.
B.Continue using SCCs as they are recognized internationally.
C.Pseudonymize the data before transfer.
D.Obtain explicit consent from each Japanese data subject for data transfer to the US.
AnswerD

Correct. Explicit consent is a valid legal basis under Japanese law when other mechanisms are insufficient.

Why this answer

The Japanese regulator has explicitly stated that SCCs alone are insufficient for transfers from Japan, and obtaining explicit consent from each data subject directly satisfies the requirement for a valid transfer mechanism under Japanese law. This approach ensures compliance without requiring infrastructure changes, though it may be operationally burdensome. The other options either fail to meet regulatory requirements or introduce unnecessary operational impact.

Exam trap

ISC2 often tests the misconception that pseudonymization or data localization alone can bypass cross-border transfer restrictions, when in fact explicit consent or an approved mechanism is required under the specific regulation.

How to eliminate wrong answers

Option A (moving data to a Japan data center) is wrong because it does not address the transfer to the US for processing; the data would still need to be transferred to the US for the SaaS CRM to function, and the regulation applies to any transfer outside Japan. Option B (continuing with SCCs) is wrong because the Japanese regulator has stated SCCs are not sufficient unless supplemented, so relying on them alone would violate the regulation. Option C (pseudonymization) is wrong because pseudonymization does not eliminate the need for a valid transfer mechanism under Japanese law; the data remains personal data subject to transfer restrictions.

Full explanation →
661
MCQhard

A healthcare organization wants to perform analytics on encrypted patient data without decrypting it first, to maintain privacy. Which cryptographic technique supports this use case?

A.Homomorphic encryption
B.Tokenization
C.Format-preserving encryption (FPE)
D.Cryptographic hashing
AnswerA

Allows computation on encrypted data without decryption.

Why this answer

Homomorphic encryption allows computations to be performed directly on ciphertext, producing an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. This enables the healthcare organization to run analytics on encrypted patient data without ever exposing the underlying sensitive information, thus preserving privacy throughout the processing lifecycle.

Exam trap

ISC2 often tests the distinction between 'processing on encrypted data' and 'protecting data at rest or in transit'—candidates mistakenly choose FPE or tokenization because they see 'encrypted' or 'token' and assume it supports analytics, but neither allows computation without decryption.

How to eliminate wrong answers

Option B (Tokenization) is wrong because it replaces sensitive data with non-sensitive tokens, but the original data must be stored in a separate vault and analytics cannot be performed on the tokens without detokenization, which breaks the 'no decryption' requirement. Option C (Format-preserving encryption) is wrong because it produces ciphertext that retains the original data format (e.g., 16-digit credit card numbers), but all operations require decryption first; it does not support computation on encrypted data. Option D (Cryptographic hashing) is wrong because it is a one-way function that cannot be reversed, and it does not allow any meaningful analytics on the hash values (e.g., you cannot compute an average or sum of hashed patient ages).

Full explanation →
662
MCQmedium

A cloud security analyst is troubleshooting an access denied error when an application attempts to read an object from an S3 bucket. The application uses an IAM user that is not associated with the role specified in the policy. Which of the following is the most likely cause of the error?

A.The IAM user is not assuming the role before accessing the bucket.
B.The IAM user is not the specified role and is explicitly denied by the Deny statement.
C.The bucket policy has a conflicting Allow and Deny statement, causing an implicit deny.
D.The bucket policy is missing a condition for region restriction.
AnswerB

The Deny statement explicitly denies all principals that are not the specified role, so any other principal (including this IAM user) is denied access.

Why this answer

The bucket policy likely includes a Deny statement that explicitly denies all principals except the specified role. Since the IAM user is not that role, the Deny overrides any Allow and blocks access. Option A is incorrect because even if the user were to assume the role, it would then be the role and gain access; however, the issue is that the user is not assuming the role.

Option C is incorrect because a conflicting Allow and Deny would result in an explicit Deny, not an implicit deny—the Deny always overrides. Option D is incorrect because region restriction is not mentioned as a factor in the access denied error.

Full explanation →
663
MCQhard

A cloud architect is designing VPC connectivity for a global organization with multiple AWS accounts. They need a central hub for connecting many VPCs together, supporting transitive routing. Which service should they use?

A.Private Link
B.Transit Gateway
C.VPN Connection
D.VPC Peering
AnswerB

Transit Gateway provides a hub-and-spoke architecture with transitive routing.

Why this answer

AWS Transit Gateway acts as a central hub that allows transitive routing between multiple VPCs and on-premises networks.

Full explanation →
664
Multi-Selecteasy

A multinational corporation stores customer data in an AWS S3 bucket located in the US. The company's European customers' personal data must comply with GDPR. Which TWO actions should the company take to ensure compliance with GDPR data transfer requirements?

Select 2 answers
A.Implement encryption at rest using AWS KMS with a key stored in the US.
B.Sign Standard Contractual Clauses (SCCs) with the cloud provider.
C.Ensure that the data is only accessed by employees in the EU.
D.Use AWS Direct Connect to route traffic exclusively through EU-based links.
E.Implement a Data Processing Agreement (DPA) with AWS.
AnswersB, E

SCCs are a valid adequacy mechanism for transferring personal data to third countries under GDPR.

Why this answer

Standard Contractual Clauses (SCCs) are a lawful mechanism under GDPR for transferring personal data from the EU to a third country (the US) without an adequacy decision. By signing SCCs with AWS, the company contractually binds the cloud provider to ensure adequate data protection for the European customers' data stored in the US S3 bucket. This directly addresses the GDPR requirement for a valid transfer tool.

Exam trap

The CCSP exam often tests the distinction between security controls (encryption, access restrictions) and legal transfer mechanisms (SCCs, DPA), trapping candidates who think technical measures alone satisfy GDPR transfer requirements.

Full explanation →
665
Multi-Selectmedium

A cloud security architect is designing a multi-tenant SaaS application that must ensure strong isolation between tenants. Which TWO mechanisms are most effective for achieving multitenancy isolation?

Select 2 answers
A.Hypervisor-based virtual machine isolation
B.Network micro-segmentation
C.Encryption at rest for all tenant data
D.Database row-level permissions
E.API rate limiting per tenant
AnswersA, B

Hypervisor isolation separates VMs of different tenants.

Why this answer

Network micro-segmentation and hypervisor-level isolation are key for multi-tenant isolation. Encryption at rest protects data but does not isolate compute; database row-level permissions provide logical but not strong isolation; API rate limiting controls usage but not isolation.

Full explanation →
666
MCQhard

A cloud service provider (CSP) includes a limitation of liability clause capped at the total fees paid in the past 12 months. A customer suffers a data breach due to provider negligence, losing $2M in business. The customer's annual spend is $500K. What is the customer's likely recovery?

A.The amount of direct damages only
B.Up to $500K, the total fees paid in the past 12 months
C.Full $2M because negligence overrides liability caps
D.Zero because the customer accepted the terms
AnswerB

The explicit cap is based on fees paid.

Why this answer

The clause limits liability to fees paid (12 months = $500K), so the customer can recover up to that amount, not the full $2M loss. Option B correctly states this limitation.

Full explanation →
667
MCQmedium

A security engineer is reviewing container image security. Which of the following practices best ensures that a container image has not been tampered with and originates from a trusted source?

A.Scanning the image with Trivy for CVEs
B.Using a minimal base image like Alpine
C.Setting the image tag to :latest
D.Signing the image with Cosign and verifying it at deployment
AnswerD

Image signing ensures authenticity and integrity; verification enforces trust.

Why this answer

Image signing using tools like Cosign provides cryptographic verification of image integrity and authenticity. Scanning for CVEs identifies vulnerabilities but does not verify origin.

Full explanation →
668
MCQeasy

During a cloud security audit, it is discovered that a cloud storage bucket is configured to allow access from any IP address. The bucket contains sensitive customer data. What is the BEST immediate action to secure the bucket?

A.Modify the bucket policy to deny access from all IP addresses except trusted ranges.
B.Enable bucket logging to track access attempts.
C.Notify the security team and wait for a formal change request.
D.Enable server-side encryption on the bucket.
AnswerA

This directly removes public access and restricts to trusted IPs.

Why this answer

The immediate risk is that the bucket is publicly accessible from any IP address, exposing sensitive customer data. Modifying the bucket policy to deny access from all IP addresses except trusted ranges directly addresses this exposure by restricting network-level access. This is the most effective first step because it removes the broad, unrestricted access while maintaining necessary access for authorized users.

Exam trap

ISC2 often tests the distinction between access control and other security controls, trapping candidates who confuse encryption or logging with network-level access restriction.

How to eliminate wrong answers

Option B is wrong because enabling bucket logging only records access attempts; it does not prevent unauthorized access, so the data remains exposed. Option C is wrong because waiting for a formal change request delays remediation, leaving the sensitive data vulnerable during the wait period. Option D is wrong because server-side encryption protects data at rest but does not control network access; the bucket remains accessible from any IP address, so encryption alone does not secure the bucket from unauthorized access.

Full explanation →
669
MCQeasy

A company wants to enforce data classification in its cloud environment. They need to automatically identify and label sensitive data such as credit card numbers in cloud storage. Which service should they use?

A.Cloud KMS
B.Cloud DLP
C.Cloud Audit Logs
D.Cloud IAM
AnswerB

Cloud DLP is designed to discover, classify, and protect sensitive data in cloud storage.

Why this answer

Cloud DLP (Data Loss Prevention) can scan cloud storage for sensitive data like credit card numbers and apply classification labels or de-identification transforms.

Full explanation →
670
MCQhard

A company is migrating a critical application to the cloud and must ensure that its security operations center (SOC) can detect and respond to threats in real time. The application generates high volumes of logs. Which combination of services would provide the MOST efficient and cost-effective solution for centralized logging, analysis, and alerting?

A.Deploy a basic monitoring tool that triggers alerts based on static thresholds.
B.Implement a Security Information and Event Management (SIEM) system with real-time correlation and a log management solution that auto-scales.
C.Use a cloud-native log storage service with long retention and no analysis.
D.Store logs in a centralized log server and have SOC analysts manually review them.
AnswerB

SIEM provides real-time correlation and auto-scaling handles high volumes efficiently.

Why this answer

A SIEM system with real-time correlation enables the SOC to detect threats as they occur by analyzing log data across multiple sources, while an auto-scaling log management solution ensures cost efficiency by dynamically adjusting resources to handle high log volumes without over-provisioning. This combination provides centralized logging, real-time analysis, and alerting, meeting the requirement for efficient and cost-effective threat detection.

Exam trap

ISC2 often tests the misconception that simple storage or manual review is sufficient for real-time threat detection, but the CCSP emphasizes that centralized logging without analysis and correlation fails to meet SOC operational requirements for real-time response.

How to eliminate wrong answers

Option A is wrong because a basic monitoring tool with static thresholds cannot perform real-time correlation across diverse log sources, leading to high false positives and missed advanced threats, and it lacks the scalability to handle high-volume logs efficiently. Option C is wrong because a cloud-native log storage service with long retention and no analysis fails to provide the real-time detection and alerting required by the SOC, as it only stores logs without any correlation or threat identification. Option D is wrong because storing logs in a centralized log server with manual review is neither efficient nor real-time, as SOC analysts cannot manually analyze high-volume logs quickly enough to detect and respond to threats promptly, and it does not scale cost-effectively.

Full explanation →
671
MCQeasy

A developer is implementing a cloud application that stores sensitive user data. To minimize the risk of data exposure during transit, which security control should be enforced as a baseline requirement?

A.Implement IPsec tunnels between components
B.Use HTTPS without additional controls
C.Require SSH for all connections
D.Enforce TLS for all data in transit
AnswerD

TLS encrypts data in transit, protecting confidentiality and integrity.

Why this answer

TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, providing confidentiality, integrity, and authentication. Enforcing TLS for all communications ensures that sensitive user data is protected from eavesdropping and tampering during transmission, making it a baseline requirement for cloud application security.

Exam trap

ISC2 often tests the misconception that HTTPS alone is sufficient, but the trap here is that 'HTTPS without additional controls' (Option B) is not a baseline requirement because it lacks enforcement of strong TLS versions, certificate validation, and protections like HSTS, making it vulnerable to attacks that TLS enforcement (Option D) explicitly mitigates.

How to eliminate wrong answers

Option A is wrong because IPsec tunnels are typically used for site-to-site VPNs or network-layer encryption between entire subnets, not as a baseline for individual application-level connections; they add complexity and overhead without providing the same granular per-connection authentication and encryption as TLS. Option B is wrong because HTTPS without additional controls (like enforcing TLS 1.2 or higher, proper certificate validation, and HSTS) can still be vulnerable to downgrade attacks, man-in-the-middle attacks, and certificate spoofing, so it is not sufficient as a baseline requirement. Option C is wrong because SSH is designed for secure remote shell access and file transfer, not for general application data transit; it is not suitable for encrypting HTTP-based API calls or database connections between cloud components.

Full explanation →
672
Multi-Selecteasy

Which THREE of the following are effective strategies for ensuring data backup integrity and recoverability in the cloud?

Select 3 answers
A.Maintain at least three copies of data across two different locations.
B.Encrypt all backups with a strong algorithm.
C.Perform regular restore tests to validate backup usability.
D.Set backup schedules to run daily for all critical data.
E.Store backups in immutable storage to prevent modification or deletion.
AnswersA, C, E

Multiple copies and geographic diversity improve recoverability.

Why this answer

The 3-2-1 backup rule (three copies, two different media types, one offsite) is a foundational strategy for data durability and recoverability. In cloud environments, this typically means maintaining a primary copy, a local backup in a different availability zone, and a cross-region copy to protect against region-wide failures. This ensures that even if two copies are compromised, a third remains available for recovery.

Exam trap

ISC2 often tests the distinction between backup security (encryption) and backup integrity/recoverability, leading candidates to mistakenly select encryption as a strategy for recoverability when it only addresses confidentiality.

Full explanation →
673
MCQmedium

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

A.SAML assertion
B.JWT
C.Kerberos ticket
D.OAuth access token
AnswerA

SAML assertions are used in SSO to convey user identity and attributes.

Why this answer

A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.

Exam trap

ISC2 often tests the distinction between authentication tokens (SAML) and authorization tokens (OAuth access tokens), leading candidates to pick OAuth access token because they confuse it with OpenID Connect ID tokens, which are actually JWTs used for identity in modern SSO.

How to eliminate wrong answers

Option B is wrong because a JWT (JSON Web Token) is a compact, self-contained token often used for stateless API authorization, but it is not inherently tied to SSO identity verification; it typically carries claims like user ID and expiration, but the application would still need to validate the JWT's signature and trust the issuer, which is not the standard SSO token format for cloud-based identity providers. Option C is wrong because a Kerberos ticket is a symmetric-key-based authentication token used in on-premises Windows domain environments, not in cloud-based identity provider SSO scenarios; it relies on a Key Distribution Center (KDC) and is not designed for cross-domain or cloud federation. Option D is wrong because an OAuth access token is primarily an authorization token that grants access to resources, not an identity token; it does not carry user identity claims in a standardized way for SSO verification, and the application would need a separate ID token (like OpenID Connect) to verify the user's identity.

Full explanation →
674
MCQmedium

A cloud architect is tasked with designing a disaster recovery plan for a critical application. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. The application runs on IaaS with data stored in a relational database. Which replication strategy is MOST cost-effective while meeting the objectives?

A.Daily full backups to another region
B.Synchronous database mirroring across regions
C.Multi-region active-active deployment with load balancing
D.Asynchronous storage-level replication with 15-minute snapshots
AnswerD

Asynchronous replication with frequent snapshots meets the RPO cost-effectively.

Why this answer

Asynchronous storage-level replication with 15-minute snapshots meets the RPO of 15 minutes and the RTO of 1 hour, while being more cost-effective than synchronous replication. Asynchronous replication avoids the latency and bandwidth costs of synchronous mirroring across regions, and the 15-minute snapshot schedule ensures data loss is limited to the RPO window. This strategy is suitable for IaaS relational databases where near-real-time consistency is acceptable.

Exam trap

ISC2 often tests the misconception that synchronous replication is always required for low RPOs, but here the RPO is 15 minutes, which asynchronous replication with snapshots can meet at lower cost, and candidates may incorrectly choose synchronous mirroring due to assuming zero data loss is needed.

How to eliminate wrong answers

Option A is wrong because daily full backups to another region cannot achieve an RPO of 15 minutes; the backup interval is 24 hours, leading to potential data loss of up to a day, which far exceeds the 15-minute RPO. Option B is wrong because synchronous database mirroring across regions introduces significant network latency and cost, and while it can achieve near-zero RPO, it is overkill for a 15-minute RPO and may degrade application performance due to synchronous writes. Option C is wrong because multi-region active-active deployment with load balancing is designed for high availability and traffic distribution, not specifically for data replication with a defined RPO; it does not inherently provide point-in-time recovery snapshots and is more expensive than necessary for the stated RPO/RTO.

Full explanation →
675
MCQhard

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

A.The deletion was performed from an internal IP address
B.The deletion was performed by a user who may not have authorization
C.The log entry does not include the object's encryption status
D.The deletion was performed without evidence of compliance team approval
AnswerD

The policy requires approval, but the log shows no approval step.

Why this answer

The company policy explicitly requires compliance team approval for all deletion operations, and the CloudTrail log entry does not contain any evidence of such approval (e.g., no MFA context, no approval token, no IAM policy condition key indicating approval). CloudTrail logs record API calls but do not inherently capture external approval workflows; the absence of an approval artifact in the log indicates a policy violation.

Exam trap

ISC2 often tests the distinction between 'authorization' (who can perform an action) and 'approval' (a separate governance step), leading candidates to choose Option B when the real issue is the missing compliance approval artifact.

How to eliminate wrong answers

Option A is wrong because the source IP address being internal is irrelevant to the compliance issue; the policy concerns authorization, not network origin. Option B is wrong because the log entry shows the user identity (e.g., user ARN) and the action was performed, but the core issue is not whether the user 'may not have authorization'—the log itself does not indicate unauthorized access; the problem is the missing approval step. Option C is wrong because encryption status of the object is not required in a CloudTrail log for deletion compliance; the policy focuses on approval, not encryption metadata.

Full explanation →
Page 8

Page 9 of 13

Page 10

All pages

12345678910111213

Practice CCSP by domain

Target a specific domain to shore up weak areas.

Cloud Application SecurityCloud Security OperationsLegal, Risk, and ComplianceCloud Data SecurityCloud Platform and Infrastructure SecurityCloud Concepts, Architecture, and Design
See all domains with question counts →