Courseiva
← Back to Certified Cloud Security Professional CCSP questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Certified Cloud Security Professional CCSP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
CCSP
exam code
ISC2
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related CCSP topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Cloud Application Security practice questions

Work through CCSP questions on Cloud Application Security.

Cloud Security Operations practice questions

Sharpen your CCSP knowledge of Cloud Security Operations.

Legal, Risk, and Compliance practice questions

Work through CCSP questions on Legal, Risk, and Compliance.

Cloud Data Security practice questions

Cloud Data Security practice questions for CCSP.

Cloud Platform and Infrastructure Security practice questions

Sharpen your CCSP knowledge of Cloud Platform and Infrastructure Security.

Cloud Concepts, Architecture, and Design practice questions

Sharpen your CCSP knowledge of Cloud Concepts, Architecture, and Design.

CCSP fundamentals practice questions

Practise CCSP questions linked to CCSP fundamentals.

CCSP scenario practice questions

CCSP scenario practice questions for CCSP.

CCSP troubleshooting practice questions

Work through CCSP questions on CCSP troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

Refer to the exhibit. A security analyst sees this alert. According to the shared responsibility model, who is primarily responsible for ensuring that the IAM policy correctly restricts access?

Exhibit

[2023-10-05 14:23:11] ALERT: Unauthorized access attempt detected from IP 203.0.113.50 to customer data bucket. Access denied due to IAM policy restriction. Incident ID: INC-78901.
Question 2hardmultiple choice
Full question →

A security engineer reviews the S3 bucket policy shown in the exhibit. Which security concern should be addressed immediately?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}
Question 3mediummultiple choice
Full question →

Refer to the exhibit. An organization has this S3 bucket policy for a bucket containing sensitive customer data. What is the primary risk associated with this policy?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
Question 4mediummultiple choice
Full question →

Refer to the exhibit. An administrator applies this S3 bucket policy. What is the overall effect?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpc": "vpc-12345678"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpc": "vpc-12345678"
        }
      }
    }
  ]
}
Question 5hardmultiple choice
Full question →

An AWS S3 bucket policy is configured as shown in the exhibit. The security team wants to ensure that only requests from the corporate IP range (203.0.113.0/24) can read objects in the bucket. However, they notice that a CloudFront distribution configured to serve content from this bucket is returning 403 Forbidden errors. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}
```
Question 6mediummultiple choice
Full question →

Refer to the exhibit. A security analyst finds this access control policy attached to a cloud storage bucket. What is the primary security issue?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Principal": "*"
    }
  ]
}
Question 7easymultiple choice
Full question →

Refer to the exhibit. A cloud administrator discovers this Azure role assignment in the Finance resource group. The role definition ID corresponds to 'Storage Blob Data Contributor'. What is the immediate compliance concern?

Exhibit

{
  "properties": {
    "roleDefinitionId": "/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
    "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "scope": "/subscriptions/.../resourceGroups/Finance/providers/Microsoft.Storage/storageAccounts/finance-data",
    "condition": null
  }
}
Question 8easymultiple choice
Full question →

Refer to the exhibit. An administrator attaches security group sg-12345 to a web server. Which of the following describes the traffic that will be allowed by the security group?

Exhibit

Refer to the exhibit.

Security Group: sg-12345 (web-sg)
Inbound Rules:
  - Type: HTTP (80), Protocol: TCP, Port Range: 80, Source: 0.0.0.0/0
  - Type: HTTPS (443), Protocol: TCP, Port Range: 443, Source: 0.0.0.0/0
  - Type: SSH (22), Protocol: TCP, Port Range: 22, Source: 10.0.0.0/8
Outbound Rules:
  - Type: All traffic, Protocol: All, Port Range: All, Destination: 0.0.0.0/0
Question 9mediummultiple choice
Full question →

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Exhibit

Refer to the exhibit.

exhibit:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}
Question 10mediummultiple choice
Full question →

Refer to the exhibit. A cloud administrator sees this error log from AWS CloudTrail. The user [email protected] is a member of the 'Analysts' group. Which of the following is the most likely cause of the AccessDenied error?

Exhibit

Refer to the exhibit.
Error Log Entry:
Timestamp: 2024-08-15T14:23:10Z
User: [email protected]
Action: PutObject
Resource: s3://finance-reports/quarterly.xlsx
Status: AccessDenied
Source IP: 203.0.113.45
UserAgent: [ConsoleLogin]
Additional: The user does not have permissions to write to this bucket.
Question 11easymultiple choice
Full question →

Refer to the exhibit. A cloud administrator ran the Azure CLI command to list virtual machines. One VM shows a ProvisioningState of 'Failed'. What is the most likely cause of this state?

Network Topology
$ az vm listoutput tableRefer to the exhibit.```Name ResourceGroup Location ProvisioningStatevm-prod-1 rg-prod eastus Succeededvm-prod-2 rg-prod eastus Succeededvm-dev-1 rg-dev eastus Failed
Question 12hardmultiple choice
Full question →

Refer to the exhibit. A security engineer reviews this CloudTrail log entry. The company has a policy that all deletion operations must be approved by the compliance team. What is the most likely compliance issue?

Exhibit

{
  "eventSource": "s3.amazonaws.com",
  "eventName": "DeleteObject",
  "requestParameters": {
    "bucketName": "prod-customer-data",
    "key": "records/2023/01/taxinfo.csv"
  },
  "userIdentity": {
    "arn": "arn:aws:iam::123456789012:user/john.doe",
    "accountId": "123456789012"
  },
  "sourceIPAddress": "10.0.0.5",
  "responseElements": {
    "x-amz-id-2": "example"
  }
}
Question 13hardmultiple choice
Full question →

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/24"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```
Question 14hardmultiple choice
Full question →

Refer to the exhibit. A security analyst reviews this CloudTrail log entry. What is the most immediate concern?

Exhibit

Refer to the exhibit.

[CloudTrail Log Entry]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "arn": "arn:aws:iam::123456789012:user/john.doe",
    "accountId": "123456789012"
  },
  "eventTime": "2024-04-01T14:30:00Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "AuthorizeSecurityGroupIngress",
  "requestParameters": {
    "groupId": "sg-0123456789abcdef0",
    "ipPermissions": {
      "items": [
        {
          "ipProtocol": "tcp",
          "fromPort": 22,
          "toPort": 22,
          "ipRanges": [
            {"cidrIp": "0.0.0.0/0"}
          ]
        }
      ]
    }
  },
  "responseElements": {
    "requestId": "abc123",
    "_return": true
  }
}
Question 15hardmultiple choice
Full question →

An administrator notices the log entries in the exhibit from a cloud-hosted server. What is the MOST likely security concern indicated by these logs?

Exhibit

Refer to the exhibit.

```
Oct 12 09:15:22 cloudhost sshd[1234]: Failed password for admin from 203.0.113.55 port 2213 ssh2
Oct 12 09:15:25 cloudhost sshd[1234]: Accepted password for admin from 203.0.113.55 port 2213 ssh2
Oct 12 09:15:30 cloudhost sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/mysql -h db-internal -u root -pS3cur3P@ss
Oct 12 09:16:00 cloudhost mysqld[2345]: 2023-10-12 9:16:00 2 [Note] Access denied for user 'root'@'cloudhost' (using password: YES)
```

These CCSP practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style CCSP questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.