Step2Study

Certified Cloud Security Professional (CCSP) practice questions

200 free questions with answers and explanations.

Practice test
  1. 101.A development team is deploying a new microservices-based application using containers in a public cloud. The security architect is concerned about potential vulnerabilities in the container images themselves, as well as runtime threats. Which of the following security practices should the team prioritize to address these concerns effectively?Cloud Platform and Infrastructure Security
  2. 102.A security architect is evaluating a cloud provider's offerings for storing highly sensitive customer data. The architect is concerned about the potential for unauthorized access by cloud provider employees. Which security concept directly addresses this concern by ensuring that no single entity, including the cloud provider, has complete access to the data?Cloud Concepts, Architecture and Design
  3. 103.A startup is building a new application that will collect and process user data. To minimize costs and maximize scalability, they plan to use various cloud services from a single public cloud provider. However, the legal team is concerned about vendor lock-in and the potential difficulty of migrating to a different provider in the future. Which cloud security best practice should the startup prioritize to mitigate this risk?Cloud Concepts, Architecture and Design
  4. 104.A cloud security architect is tasked with ensuring that all cloud resources provisioned within their organization's accounts adhere to strict security baselines and compliance requirements. They need a mechanism to automatically evaluate configurations against predefined policies and prevent the deployment of non-compliant resources. Which cloud security concept is MOST relevant for this capability?Cloud Concepts, Architecture and Design
  5. 105.An organization is migrating its legacy applications to a public cloud. They discover that one critical application relies on a specific operating system version and proprietary hardware that is not supported by the cloud provider's standard Infrastructure as a Service (IaaS) offerings. Which cloud computing security challenge does this scenario primarily represent?Cloud Concepts, Architecture and Design
  6. 106.A cloud provider offers a storage service that automatically replicates data across multiple availability zones within a single region. This ensures high availability and durability in case of a localized outage. Which data replication strategy is the provider employing?Cloud Data Security
  7. 107.A cloud security engineer needs to configure network access for a group of virtual machines (VMs) that are part of a web application tier. These VMs should only accept inbound HTTP (port 80) and HTTPS (port 443) traffic from the internet and outbound traffic to a database tier (port 3306) within the same VPC. Which cloud networking construct is BEST suited for defining these stateful, instance-level rules?Cloud Platform and Infrastructure Security
  8. 108.A financial services company is implementing a new analytics platform in the cloud. This platform will process large volumes of transactional data, including credit card numbers and account details. To comply with PCI DSS and other regulations, they need to replace sensitive data with non-sensitive substitutes while maintaining the original data's format and referential integrity for testing and development environments. Which data security technology is best suited for this purpose?Cloud Data Security
  9. 109.A cloud customer is negotiating a new contract with a SaaS provider. The customer wants to ensure clear accountability for data breaches. Which section of the Cloud Service Agreement (CSA) should the customer MOST closely scrutinize to understand the provider's obligations and liabilities in the event of a security incident?Legal, Risk and Compliance
  10. 110.A financial institution is migrating its core banking applications to a public cloud environment. Before finalizing the contract, the institution's risk management team is conducting a thorough assessment. Which of the following risk management strategies is MOST appropriate for addressing the potential for vendor lock-in with a single cloud provider?Legal, Risk and Compliance
  11. 111.A small startup is utilizing a public cloud provider for all its IT infrastructure. The startup's budget is limited, and they need to prioritize their compliance efforts. Which of the following is the MOST cost-effective initial step for the startup to meet basic legal and regulatory compliance requirements in the cloud?Legal, Risk and Compliance
  12. 112.A company is migrating its entire on-premises infrastructure to a multi-cloud environment. The security team is conducting a comprehensive risk assessment. They identify that the process of transferring sensitive data between the on-premises data center and the cloud providers, and then between different cloud providers, introduces new attack surfaces. Which of the following risk management strategies is MOST effective in mitigating the risk associated with data transit across these diverse environments?Legal, Risk and Compliance
  13. 113.A cloud service provider (CSP) is offering a new 'data analytics as a service' (DAaaS) solution. As part of their due diligence, the legal team is reviewing the terms of service to ensure compliance with global data privacy regulations. Which of the following is the MOST critical legal requirement for the CSP to address regarding data residency and cross-border data transfers?Legal, Risk and Compliance
  14. 114.An organization is preparing for an external audit of its cloud infrastructure to demonstrate compliance with ISO 27001. The audit team has requested access to various logs, configuration files, and incident reports. What is the PRIMARY purpose of this audit process from the organization's perspective?Legal, Risk and Compliance
  15. 115.A financial institution is evaluating a new cloud-based customer relationship management (CRM) system. During the due diligence process, the institution discovers that the proposed cloud service provider (CSP) relies heavily on several sub-processors located in different countries, some of which have less stringent data protection laws. What is the MOST critical risk the financial institution must address regarding these sub-processors?Legal, Risk and Compliance
  16. 116.A global technology company is developing an internal policy for cloud service adoption. The policy mandates that all cloud services must comply with the 'principle of least privilege' for data access. Which of the following best describes the primary rationale for applying this principle to cloud data?Legal, Risk and Compliance
  17. 117.An organization is migrating its customer database to a public cloud. The database contains sensitive personal data, and the organization is concerned about the implications of a data breach under GDPR (General Data Protection Regulation). If a data breach occurs at the cloud service provider (CSP) impacting this data, what is the MOST immediate and critical obligation of the organization (as the data controller) under GDPR?Legal, Risk and Compliance
  18. 118.A healthcare provider is evaluating cloud solutions for storing electronic health records (EHR). The provider must adhere to strict regulatory requirements, including HIPAA in the US and GDPR in Europe for its global patient base. Which of the following is the MOST effective approach to ensure continuous compliance with these diverse regulations in the cloud?Legal, Risk and Compliance
  19. 119.A SaaS provider is updating its terms of service. A key change involves a new clause stating that the provider reserves the right to suspend or terminate services without prior notice if a customer's usage is deemed to violate acceptable use policies. From a legal and risk perspective, what is the MOST significant concern for customers regarding this clause?Legal, Risk and Compliance
  20. 120.A small startup is utilizing a public cloud provider for all its IT infrastructure. To minimize operational costs while ensuring compliance with basic data protection regulations, the startup opts to use the CSP's native security services (e.g., IAM, encryption, logging) and relies on the CSP's shared responsibility model for infrastructure security. This approach BEST exemplifies which of the following strategies for cloud compliance?Legal, Risk and Compliance
  21. 121.A global software company is implementing a cloud-based development environment. Due to the highly sensitive nature of its intellectual property (IP), the company wants to ensure that all data, including source code and build artifacts, is protected against unauthorized access and disclosure throughout its entire lifecycle in the cloud. Which of the following data protection concepts is paramount in this scenario, emphasizing protection from creation to destruction?Legal, Risk and Compliance
  22. 122.A company is migrating its on-premises data center to a multi-cloud environment. During the risk assessment phase, the team identifies that different cloud providers have varying levels of transparency regarding their internal security practices and incident response procedures. What type of risk is this MOST directly associated with?Legal, Risk and Compliance
  23. 123.An organization is considering deploying a new application that will process highly sensitive personal data in a public cloud. The legal team advises that the organization must conduct a Data Protection Impact Assessment (DPIA) before deployment, as required by GDPR. Which of the following is the PRIMARY reason for conducting a DPIA in this scenario?Legal, Risk and Compliance
  24. 124.An organization is considering deploying a new Artificial Intelligence (AI) service in the public cloud that will process large volumes of sensitive customer data for predictive analytics. Before deployment, the organization must conduct a thorough assessment to identify and mitigate privacy risks. Which type of assessment is specifically designed for this purpose, focusing on the privacy implications of new technologies and projects?Legal, Risk and Compliance
  25. 125.A software development company uses various cloud services for its development, testing, and production environments. The company's legal department is reviewing the existing Cloud Service Agreements (CSAs) and notes a clause in one CSA that states, 'Customer shall indemnify, defend, and hold harmless Provider from and against any and all claims, damages, liabilities, costs, and expenses arising out of or relating to Customer's use of the Services.' What is the MOST significant risk this clause poses to the software development company?Legal, Risk and Compliance
  26. 126.A cloud customer is preparing for a regulatory compliance audit regarding their use of a public cloud provider. The auditor requests evidence of the CSP's adherence to industry-specific data protection standards. Which of the following documents would BEST demonstrate the CSP's commitment and capability in meeting these standards?Legal, Risk and Compliance
  27. 127.A company is conducting a pre-migration risk assessment for moving its sensitive intellectual property (IP) to a multi-tenant public cloud. The assessment reveals that the cloud provider uses shared underlying infrastructure for multiple customers. What is the MOST significant privacy concern arising from this multi-tenant architecture for the company's sensitive IP?Legal, Risk and Compliance
  28. 128.A multinational corporation is implementing a new global Enterprise Risk Management (ERM) framework that includes its cloud operations. The ERM framework aims to provide a holistic view of risks across the entire organization. In the context of cloud adoption, which of the following is a key benefit of integrating cloud risks into an overarching ERM framework?Legal, Risk and Compliance
  29. 129.A global enterprise is evaluating its cloud strategy and aims to create a unified approach to managing risks across its on-premises, private cloud, and public cloud environments. The objective is to provide a holistic view of risk to senior management and ensure consistent risk treatment regardless of where assets reside. Which framework is BEST suited for achieving this comprehensive, integrated risk management approach?Legal, Risk and Compliance
  30. 130.A healthcare organization is adopting a hybrid cloud strategy to store patient health information (PHI). Some PHI will reside in a private cloud, while other PHI will be processed by a public cloud analytics service. The organization needs to ensure that the public cloud portion meets HIPAA (Health Insurance Portability and Accountability Act) requirements. Which of the following is the MOST crucial contractual element to include in the agreement with the public cloud service provider (CSP) to address HIPAA compliance?Legal, Risk and Compliance
  31. 131.A global e-commerce company is expanding its cloud presence and using multiple third-party vendors for specialized services (e.g., payment processing, content delivery, analytics). To effectively manage the associated risks, the company is developing a comprehensive supply chain risk management program. Which of the following is a foundational step in establishing this program?Legal, Risk and Compliance
  32. 132.A multinational corporation is migrating its human resources data to a public cloud. The data includes personally identifiable information (PII) of employees across various jurisdictions, each with distinct data protection laws. The legal team is concerned about ensuring continuous compliance with these differing regulations. Which of the following approaches is MOST effective for addressing this challenge?Legal, Risk and Compliance
  33. 133.A financial services firm is migrating its data analytics platform to a public cloud environment. As part of its due diligence, the firm is negotiating the Cloud Service Agreement (CSA) with the chosen Cloud Service Provider (CSP). The firm specifically wants to ensure that it retains sufficient rights to conduct independent security audits of the CSP's environment where its data is processed. Which section of the CSA should the firm MOST critically focus on to achieve this objective?Legal, Risk and Compliance
  34. 134.A global e-commerce company is implementing a new cloud governance framework. As part of this framework, they are defining roles and responsibilities for managing cloud resources, ensuring security configurations, and overseeing financial spend. Which of the following principles is MOST essential to incorporate into the governance framework to prevent conflicts of interest and ensure effective security posture management?Legal, Risk and Compliance
  35. 135.A cloud development team is adopting a DevSecOps approach for their new microservices project. They want to integrate security testing early and continuously into their CI/CD pipeline. Which type of security testing is most effective for identifying vulnerabilities in custom code during the build phase before deployment to a staging environment?Cloud Application Security
  36. 136.A cloud application uses serverless functions (e.g., AWS Lambda, Azure Functions) to process user requests. Each function has specific permissions defined by an associated IAM role. To adhere to the principle of least privilege, how should these permissions be configured for optimal security?Cloud Application Security
  37. 137.A software development team is designing a new cloud-native application that will interact with various third-party services via APIs. To minimize the risk of a compromised API key leading to unauthorized access, which of the following is the MOST secure practice for managing and accessing these API keys?Cloud Application Security
  38. 138.A cloud service provider offers various APIs for managing its infrastructure. A customer wants to automate the deployment and management of their cloud resources using these APIs. To ensure the principle of least privilege, how should the customer manage the API credentials used by their automation scripts?Cloud Application Security
  39. 139.A team is developing a critical cloud application that requires high availability and resilience. They are implementing a DevSecOps pipeline and want to ensure that security is 'baked in' from the start. To achieve continuous security validation and rapid feedback on potential misconfigurations or vulnerabilities in deployed infrastructure, which DevSecOps practice should be prioritized?Cloud Application Security
  40. 140.A financial institution is migrating a legacy monolithic application to a microservices architecture in the cloud. Each microservice will expose APIs, and sensitive data will flow between them. The security architect needs to ensure secure communication and proper authorization between these services without relying solely on network-level controls. Which security technology is best suited for this requirement?Cloud Application Security
  41. 141.A company is migrating its on-premises web application to a public cloud environment. The application uses a custom authentication system. To enhance security and provide a seamless user experience across multiple cloud services, the security architect proposes implementing a federated identity solution. Which of the following is a primary benefit of adopting federated identity in this scenario?Cloud Application Security
  42. 142.A cloud application processes user-uploaded files, which are then stored in object storage. A potential vulnerability exists if malicious files are uploaded and then served directly to other users without proper validation. Which security best practice should be implemented to mitigate the risk of content-related attacks (e.g., XSS via uploaded HTML, executable code) in this scenario?Cloud Application Security
  43. 143.A development team is building a new cloud-native application that will handle sensitive customer data. They are planning to use an API Gateway to manage access to backend microservices. Which of the following security best practices should be implemented at the API Gateway to protect against common API-related threats?Cloud Application Security
  44. 144.A cloud-native application utilizes a RESTful API for all communications between its front-end and back-end services. A security audit has identified the potential for Cross-Site Request Forgery (CSRF) attacks as a significant risk. Which of the following is the most effective mitigation technique against CSRF for this API?Cloud Application Security
  45. 145.During the 'design' phase of a cloud application's development lifecycle, a security architect is reviewing the proposed architecture for potential security vulnerabilities. Which of the following activities is most crucial at this stage to proactively identify and mitigate design-level security flaws?Cloud Application Security
  46. 146.A company is developing a cloud application that processes payment card data. To achieve PCI DSS compliance requirement 6.5, which mandates addressing common coding vulnerabilities, the development team must integrate specific security practices into their software development lifecycle. Which of the following best satisfies this requirement?Cloud Application Security
  47. 147.A cloud provider is designing a new region that must adhere to stringent physical security and environmental controls, including redundant power, cooling, fire suppression, and restricted access zones. Which certification is specifically designed to assess and validate the security of data centers and cloud infrastructure, covering these physical and environmental aspects?Cloud Security Operations
  48. 148.A cloud application exposes several APIs that are consumed by both internal microservices and external partner applications. To protect these APIs from common web-based attacks, enforce rate limiting, and centralize authentication/authorization, which security component should be implemented?Cloud Application Security
  49. 149.An organization is migrating its on-premises Security Operations Center (SOC) to a cloud-native model. The team wants to leverage cloud capabilities to enhance incident response speed and efficiency. Which cloud operational model offers the greatest potential for automated and rapid scaling of incident response tools and data processing during a major security incident?Cloud Security Operations
  50. 150.An organization is migrating its on-premises Security Operations Center (SOC) to a cloud-native architecture. The security team wants to leverage cloud services to automate incident response tasks, such as isolating compromised resources and enriching incident data. Which cloud service model would be most suitable for building these automated incident response playbooks and functions?Cloud Security Operations