Step2Study

Certified Cloud Security Professional (CCSP) practice questions

200 free questions with answers and explanations.

Practice test
  1. 151.A cloud security team is establishing a robust incident response process for a critical SaaS application. They recognize that during an incident, it's crucial to preserve volatile data from compromised cloud instances before they are potentially shut down or re-imaged. Which of the following is the most effective technique for collecting volatile data during a cloud forensic investigation?Cloud Security Operations
  2. 152.A cloud application development team is implementing a new feature that allows users to upload profile pictures. They need to implement a mechanism to prevent malicious files from being uploaded and processed by the application. Which of the following is the MOST effective control to implement at the upload stage?Cloud Application Security
  3. 153.A security operations team is implementing a cloud forensics process for an IaaS environment. After identifying a compromised virtual machine, the next critical step is to preserve the integrity of the evidence. Which of the following actions is most crucial for achieving this goal?Cloud Security Operations
  4. 154.A cloud security architect is tasked with implementing continuous security monitoring for a serverless application that processes sensitive financial transactions. Due to the ephemeral nature and rapid scaling of serverless functions, traditional agent-based monitoring is impractical. Which approach is best suited for real-time security visibility in this serverless environment?Cloud Security Operations
  5. 155.A cloud security architect is evaluating a new Security Information and Event Management (SIEM) solution for a hybrid cloud environment. The primary concern is ensuring that security events from both on-premises data centers and various public cloud services are normalized and correlated effectively. Which key capability of a cloud SIEM is most critical for addressing this specific concern?Cloud Security Operations
  6. 156.A cloud application development team is adopting a DevSecOps approach. They want to ensure that security is integrated throughout the entire software development lifecycle (SDLC), not just as a final audit. During which phase should security requirements and threat modeling be initially performed?Cloud Application Security
  7. 157.A cloud application development team is adopting a DevSecOps approach. They want to integrate security testing into their Continuous Integration/Continuous Delivery (CI/CD) pipeline to identify vulnerabilities early in the development lifecycle. Which type of security testing is BEST suited for automatically analyzing source code for potential vulnerabilities without executing the application?Cloud Application Security
  8. 158.A cloud application development team is designing a new microservice that will interact with an object storage service to store user-generated content. To adhere to the principle of least privilege, the team needs to define an IAM policy that grants the microservice ONLY the necessary permissions to perform its function. The microservice needs to be able to upload, download, and delete objects from a specific bucket named 'user-content-prod'. Which IAM action set represents the LEAST PRIVILEGE required for this microservice?Cloud Application Security
  9. 159.A multinational corporation is implementing a cloud-based Security Information and Event Management (SIEM) solution. The corporation operates in multiple jurisdictions, each with strict data residency and privacy regulations (e.g., GDPR, CCPA). What is the most critical consideration for the SIEM's data ingestion and storage architecture to ensure compliance with these regulations?Cloud Security Operations
  10. 160.A cloud security team is establishing a robust Business Continuity and Disaster Recovery (BCDR) plan for a critical application that processes real-time financial transactions. The application has a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following data backup and recovery strategies is most suitable for meeting both of these objectives?Cloud Security Operations
  11. 161.A cloud customer is performing a security audit of their IaaS environment. The audit team needs to verify that all virtual machines (VMs) are using approved, hardened operating system images and that no unauthorized software has been installed. They also need to ensure that security patches are applied consistently. What type of cloud security assessment would be most effective for continuously monitoring and enforcing these configuration standards?Cloud Security Operations
  12. 162.A cloud-native application uses a highly distributed architecture with numerous microservices interacting asynchronously via message queues. The security team needs to implement robust logging and monitoring to detect and respond to security incidents across these inter-service communications. Which of the following is the MOST effective approach for gaining comprehensive visibility into these interactions?Cloud Application Security
  13. 163.A cloud security team is establishing a robust Business Continuity and Disaster Recovery (BCDR) plan for a critical application hosted on a public cloud IaaS platform. The application uses a relational database that processes high transaction volumes. The RPO (Recovery Point Objective) for this database is extremely stringent, requiring minimal data loss (measured in seconds). Which data replication strategy would best meet this RPO requirement?Cloud Security Operations
  14. 164.A cloud service provider (CSP) offers an 'always-on' service level agreement (SLA) with 99.999% availability for a critical application. To meet this stringent requirement, the CSP's operations team implements a strategy that includes active-active deployments across multiple geographically dispersed regions, automated failover mechanisms, and continuous health checks. This strategy primarily aligns with which aspect of Business Continuity and Disaster Recovery (BCDR)?Cloud Security Operations
  15. 165.A development team is building a new cloud-native application using a microservices architecture. They need to ensure secure communication between these microservices, which are deployed across different cloud accounts and virtual networks. The solution must provide mutual authentication and encryption for all inter-service traffic without requiring developers to manage TLS certificates directly within each microservice application code. Which security technology is BEST suited for this requirement?Cloud Application Security
  16. 166.A cloud service consumer is evaluating different cloud providers for hosting a critical application. The consumer's incident response plan mandates that in the event of a major disruption, the application must be fully operational within 4 hours. This requirement directly defines which of the following Business Continuity and Disaster Recovery (BCDR) metrics?Cloud Security Operations
  17. 167.A cloud-native application uses serverless functions to process incoming data streams. These functions need to interact with a NoSQL database and a third-party API. To adhere to the principle of least privilege, how should access to these resources be managed for each serverless function?Cloud Application Security
  18. 168.A security operations center (SOC) is integrating a new cloud-native application into its SIEM system. The application generates logs in a proprietary JSON format, which the existing SIEM cannot directly parse for meaningful security events. What is the MOST critical step required to ensure these logs can be effectively analyzed by the SIEM?Cloud Security Operations
  19. 169.A cloud application needs to communicate with external APIs from different vendors. Each external API has its own authentication mechanism (e.g., OAuth 2.0, API key in header, custom token). To simplify secure access for the application developers and centralize credential management, what is the most appropriate solution?Cloud Application Security
  20. 170.A cloud security team is tasked with ensuring the ongoing compliance of their multi-cloud environment with various industry standards. They need a solution that can continuously assess configurations, identify misconfigurations, and provide actionable remediation guidance across different cloud providers. Which tool category is specifically designed to address these requirements?Cloud Security Operations
  21. 171.A cloud security analyst is investigating a potential insider threat where a privileged user is suspected of unauthorized data access. Which of the following cloud security monitoring tools would provide the most relevant information for detecting and analyzing this specific type of activity?Cloud Security Operations
  22. 172.A cloud application needs to retrieve sensitive configuration data, such as database connection strings and API keys, from a central repository. This data must be encrypted at rest, accessible only by authorized application instances, and rotated automatically without requiring application downtime. Which of the following cloud application security technologies is specifically designed to manage these requirements?Cloud Application Security
  23. 173.A financial institution is migrating its legacy monolithic application to a cloud-native microservices architecture. The new architecture requires secure communication between microservices, each running in its own container. The security team wants to ensure that communication is encrypted and mutually authenticated, and that policies can be uniformly applied across all services. What is the most effective technology to achieve this within the microservices environment?Cloud Application Security
  24. 174.A cloud development team is implementing a new microservices architecture. They need to ensure that each microservice can securely identify itself when communicating with other microservices within the same cloud environment, without relying on shared secrets or manual credential rotation. Which of the following identity mechanisms is most appropriate for this scenario?Cloud Application Security
  25. 175.A cloud security engineer is tasked with ensuring that all virtual machines (VMs) deployed in a public cloud environment automatically conform to the organization's security baseline, including specific operating system hardening, anti-malware installation, and logging configurations. Which cloud security operational control should the engineer primarily leverage to achieve this consistent and automated enforcement?Cloud Security Operations
  26. 176.A cloud security architect is tasked with ensuring the continuous security of a highly dynamic microservices architecture deployed on a Kubernetes cluster in a public cloud. Given the ephemeral nature of containers and the frequent deployments, which security monitoring approach is most effective for identifying runtime anomalies and policy violations?Cloud Security Operations
  27. 177.A cloud security engineer is designing a disaster recovery strategy for a critical application hosted in a public cloud. The application requires near-instantaneous recovery with minimal data loss. Which of the following disaster recovery strategies would best meet these requirements?Cloud Security Operations
  28. 178.A financial institution is migrating its highly sensitive customer data to a public cloud environment. Regulatory compliance mandates that all data at rest must be encrypted with customer-managed keys and that the encryption keys themselves must be stored in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which cloud security operational control is primarily responsible for ensuring these key management requirements are met?Cloud Security Operations
  29. 179.A cloud application development team is migrating a legacy application that relies heavily on a relational database containing highly sensitive customer information. The team needs to ensure that this data is protected from unauthorized access, both from outside the cloud environment and from other applications within the same cloud provider, even if the underlying infrastructure is compromised. Which data isolation strategy offers the STRONGEST protection for this scenario?Cloud Application Security
  30. 180.A financial services company is developing a new cloud-native application that will process sensitive customer financial data. Due to regulatory compliance requirements (e.g., GDPR, PCI DSS), they must ensure that all data is encrypted at rest and in transit, and that access to encryption keys is strictly controlled. They also need robust auditing of key usage. Which cloud service category is specifically designed to meet these cryptographic key management and security requirements?Cloud Application Security
  31. 181.A security operations center (SOC) is integrating a new cloud-native application into its monitoring tools. The application generates a high volume of specialized logs in a unique format that existing SIEM connectors do not natively support. To ensure these logs are effectively ingested, parsed, and correlated with other security events, what immediate operational step should the SOC take?Cloud Security Operations
  32. 182.An organization is experiencing a distributed denial-of-service (DDoS) attack targeting its web application hosted on a public cloud. The security operations team needs to quickly identify the source and nature of the attack, filter malicious traffic, and restore normal service without disrupting legitimate users. Which of the following incident response steps should be prioritized immediately after detection to mitigate the ongoing attack?Cloud Security Operations
  33. 183.A cloud security architect is designing a monitoring strategy for a multi-cloud environment that includes IaaS and PaaS services. The architect needs to ensure comprehensive visibility into security events across all platforms, including both infrastructure and application layers, while minimizing the operational overhead of managing disparate tools. Which of the following approaches best addresses these requirements?Cloud Security Operations
  34. 184.A cloud application processes sensitive customer data and must comply with GDPR. The development team is using serverless functions and object storage. They need to ensure that data in object storage is encrypted at rest and that the encryption keys are managed separately from the data itself, with strong access controls. Which of the following approaches best addresses this requirement?Cloud Application Security
  35. 185.A cloud provider is designing a new service offering that requires compliance with various industry-specific regulations, including HIPAA and PCI DSS. The provider needs to demonstrate continuous adherence to these compliance requirements for its customers. Which type of cloud security audit would be most effective for this purpose?Cloud Security Operations
  36. 186.During a cloud security incident involving a suspected data exfiltration from a storage bucket, a forensic investigator needs to collect immutable logs that record all access attempts, modifications, and deletions to the bucket, including the identity of the actor and the timestamp. Which cloud service or feature would be most critical for the investigator to analyze to establish a chain of custody and reconstruct the event timeline?Cloud Security Operations
  37. 187.A company is migrating a critical legacy application to a cloud-native architecture. The application currently relies on a centralized, on-premises directory service for user authentication and authorization. The new cloud environment needs to integrate with this existing directory service without replicating user credentials to the cloud provider's IAM system. Which identity management approach is MOST suitable for this scenario?Cloud Application Security
  38. 188.A cloud application processes user-uploaded images. Before storing these images in object storage, the application must scan them for malware and ensure they do not contain sensitive metadata (EXIF data) that could expose user privacy. Which of the following security best practices should be implemented to address these requirements?Cloud Application Security
  39. 189.A cloud development team is building a new application that uses a multi-tenant architecture. Each tenant's data must be logically isolated and inaccessible to other tenants, even if they share the same underlying infrastructure. Which of the following security best practices is most crucial to implement for data isolation in this scenario?Cloud Application Security
  40. 190.A cloud customer is performing a security assessment of their IaaS environment. They discover several virtual machines (VMs) with default administrator passwords that have not been changed. This finding indicates a failure in which aspect of cloud security operations?Cloud Security Operations
  41. 191.During the 'testing' phase of the Cloud Application Development Lifecycle, a security architect wants to integrate automated checks to identify common security vulnerabilities in the application's code and dependencies before deployment. Which of the following security practices is most suitable for this purpose within a CI/CD pipeline?Cloud Application Security
  42. 192.A cloud security team is developing a new incident response plan for a critical SaaS application. After containment and initial analysis, the team needs to ensure the root cause of the incident is fully eliminated and the environment is clean before restoration. Which phase of the incident response process does this activity primarily fall under?Cloud Security Operations
  43. 193.A company is developing a cloud-native mobile application that interacts with backend APIs. The security team is concerned about unauthorized access to the APIs, especially from malicious applications impersonating legitimate users. Which of the following security mechanisms is most effective for ensuring that API requests originate from the legitimate mobile application and not from unauthorized clients?Cloud Application Security
  44. 194.During a cloud incident response, the security team determines that a critical database containing sensitive customer information may have been compromised. To preserve the integrity of potential evidence and ensure proper chain of custody, which of the following is the MOST critical initial step for cloud forensics within an IaaS environment?Cloud Security Operations
  45. 195.A cloud development team is building a new application that will process sensitive customer data. They want to ensure that all data at rest within the cloud storage is encrypted using keys that they fully control and manage outside of the cloud provider's direct control. Which encryption strategy should they implement?Cloud Application Security
  46. 196.During a cloud incident response, the team determines that a critical database containing sensitive customer data has been exfiltrated. The next immediate step, after containing the breach, is to determine what specific data was accessed and by whom, to assess the impact and fulfill notification requirements. Which type of log data is most crucial for this specific activity?Cloud Security Operations
  47. 197.A cloud application needs to communicate with several external third-party APIs, each requiring a unique API key for authentication. The development team wants to securely store and retrieve these API keys without hardcoding them into the application's source code or configuration files. Which cloud security best practice should they implement?Cloud Application Security
  48. 198.A cloud security architect is designing a monitoring strategy for a critical, highly dynamic microservices application deployed across multiple cloud regions. The architect needs a solution that can automatically detect deviations from expected behavior without relying solely on predefined static thresholds, which are difficult to maintain in such an environment. Which of the following monitoring techniques would be most effective for this requirement?Cloud Security Operations
  49. 199.A cloud security architect is designing a continuous security monitoring solution for a serverless application that utilizes API Gateway, Lambda functions, and DynamoDB. Traditional agent-based monitoring is not feasible. Which combination of cloud-native services would provide the most comprehensive security visibility for this serverless architecture?Cloud Security Operations
  50. 200.A cloud security team is developing a new incident response plan for a critical SaaS application. During the 'Eradication' phase, the team needs to ensure that all remnants of the attacker's presence are removed from the cloud environment. Which of the following actions is most appropriate for this phase?Cloud Security Operations