Certified Cloud Security Professional CCSP practice test

Refer to the exhibit. An administrator is reviewing an AWS S3 bucket policy. Based on the policy, which of the following is true?

Exhibit

Refer to the exhibit.

exhibit:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

Trap 1: The policy grants full administrative access to the bucket

Only s3:GetObject is allowed, not administrative actions.

Trap 2: The policy denies all access from the specified IP range

The effect is Allow, not Deny.

Trap 3: The bucket is publicly accessible to any IP address

The condition restricts access to the specified IP range.

A
The policy grants full administrative access to the bucket
Why wrong: Only s3:GetObject is allowed, not administrative actions.
B
The policy allows GetObject requests only from the specified IP range
Correct. The condition aws:SourceIp limits the Allow effect to that IP range.
C
The policy denies all access from the specified IP range
Why wrong: The effect is Allow, not Deny.
D
The bucket is publicly accessible to any IP address
Why wrong: The condition restricts access to the specified IP range.

Question 2mediummulti select

Which TWO of the following are required for GDPR compliance when processing personal data in the cloud?

Trap 1: Appoint a Data Protection Officer (DPO) for all organizations

DPO appointment is mandatory only for certain entities.

Trap 2: Store data only within the European Union

Data can be transferred outside EU with appropriate safeguards.

Trap 3: Use only ISO 27001 certified cloud service providers

GDPR does not require specific certification.

A
Appoint a Data Protection Officer (DPO) for all organizations
Why wrong: DPO appointment is mandatory only for certain entities.
B
Store data only within the European Union
Why wrong: Data can be transferred outside EU with appropriate safeguards.
C
Use only ISO 27001 certified cloud service providers
Why wrong: GDPR does not require specific certification.
D
Conduct a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk
GDPR requires DPIA for high-risk processing.
E
Maintain a record of processing activities
Article 30 requires records of processing.

Question 3hardmultiple choice

A cloud provider experiences a data breach affecting customer data. Which of the following laws most likely requires the provider to notify affected customers within 72 hours?

Trap 1: SOX

SOX does not mandate breach notification to customers.

Trap 2: HIPAA

HIPAA requires notification within 60 days, not 72 hours.

Trap 3: PCI DSS

PCI DSS requires notification to payment card brands, not directly to customers.

A
SOX
Why wrong: SOX does not mandate breach notification to customers.
B
HIPAA
Why wrong: HIPAA requires notification within 60 days, not 72 hours.
C
PCI DSS
Why wrong: PCI DSS requires notification to payment card brands, not directly to customers.
D
GDPR
Correct. GDPR requires notification to data subjects within 72 hours of becoming aware of a breach.

Question 4mediummultiple choice

A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?

Trap 1: 12

12 is the inherent risk score, not residual.

Trap 2: 4

4 is not the correct product of likelihood and impact after controls.

Trap 3: 3

3 is not the correct product.

A
12
Why wrong: 12 is the inherent risk score, not residual.
B
4
Why wrong: 4 is not the correct product of likelihood and impact after controls.
C
2
Correct. Residual risk = 2 (likelihood) * 1 (impact) = 2.
D
3
Why wrong: 3 is not the correct product.

Read the full NAT/PAT explanation →

Question 5easymultiple choice

A company is implementing a secure software development lifecycle (SSDLC) for its cloud-native applications. Which practice should be automated to detect vulnerabilities early in the development process?

Trap 1: Penetration testing in production

Penetration testing is typically performed later and is not automated in early stages.

Trap 2: Dynamic application security testing (DAST)

DAST is performed on running applications, which is later in the lifecycle.

Trap 3: Manual code review

Manual code review is not automated, though it can catch issues.

A
Static application security testing (SAST)
SAST scans source code early in development, enabling early vulnerability detection.
B
Penetration testing in production
Why wrong: Penetration testing is typically performed later and is not automated in early stages.
C
Dynamic application security testing (DAST)
Why wrong: DAST is performed on running applications, which is later in the lifecycle.
D
Manual code review
Why wrong: Manual code review is not automated, though it can catch issues.

Question 6easymultiple choice

A company wants to ensure that its cloud provider's data deletion process is verifiable. Which of the following should the company require in the service level agreement?

Trap 1: Service level credits

Service level credits are for performance metrics, not data deletion.

Trap 2: Annual penetration testing

Penetration testing assesses security vulnerabilities, not deletion processes.

Trap 3: Right to audit

Right to audit allows inspection but does not specifically verify deletion.

A
Service level credits
Why wrong: Service level credits are for performance metrics, not data deletion.
B
Certificate of destruction
Correct. A certificate of destruction provides verifiable proof that data has been securely deleted.
C
Annual penetration testing
Why wrong: Penetration testing assesses security vulnerabilities, not deletion processes.
D
Right to audit
Why wrong: Right to audit allows inspection but does not specifically verify deletion.