Certified Cloud Security Professional practice questions

Question 1

A federal agency is preparing to release a public statistical dataset, and the privacy officer is evaluating how to break the link between each record and the individual it describes while still supporting analysis. Which NIST SP 800-188 process applies?

Accepted Answer

De-identification, the process of removing the association between a set of identifying data and the data subject

Answer

Media sanitization, rendering access to data on retired media infeasible for a given level of effort

Answer

Tokenization of primary keys so the records can later be re-linked to individuals on demand by analysts

Answer

Dynamic data masking that hides fields only inside live query results for nonprivileged database users

Question 2

A company is evaluating a cloud service provider and must decide which certification specifically attests to the protection of personally identifiable information in the cloud. Which standard from the supplier-evaluation criteria matches?

Accepted Answer

ISO 27018, the code of practice for cloud privacy and PII

Answer

PCI DSS, the standard that governs cardholder data environments

Answer

ISO 27017, the code of practice for cloud security controls

Answer

SOC 2 Type II, an attestation of operating control effectiveness

Question 3

An architect is documenting why a workload runs in full virtualization. Which characterization of full virtualization is correct per NIST SP 800-125?

Accepted Answer

Full virtualization runs one or more operating systems and their applications on top of virtual hardware.

Answer

Full virtualization is a hardware-only firmware partition that does not run an operating system or any application code.

Answer

Full virtualization is identical to operating-system containerization and does not involve any virtual hardware abstraction.

Answer

Full virtualization always requires a bare-metal hypervisor; hosted hypervisors are not considered full virtualization.

Question 4

An architect is designing SAML-based single sign-on between one IdP and many SPs and must choose between key sizes and signing algorithms that every party can support. Per the OWASP SAML Security cheat sheet, which combination is described as the most supported and currently secure?

Accepted Answer

RSA 2048-bit keys with SHA-256 used for the hashing and signing operations

Answer

RSA 1024-bit keys with legacy SHA-1 used for the hashing and signing operations

Answer

DSA 1024-bit keys with legacy MD5 used for the hashing and signing operations

Answer

ECDSA P-521 keys with SHA-512 used for the hashing and signing operations

Question 5

A team is tasked with planning a vulnerability assessment and penetration test for a production cloud system. Which NIST publication is the authoritative technical guide for security testing and assessment?

Accepted Answer

NIST SP 800-115, Technical Guide to Information Security Testing and Assessment.

Answer

NIST SP 800-145, which is the cloud-definition document and does not cover testing and assessment.

Answer

NIST SP 800-88, which is the media sanitization guideline and does not cover security testing.

Answer

NIST SP 800-30, which is the risk-assessment methodology and does not cover technical security testing.

Question 6

A compliance officer is tasked with finding the canonical NIST definition of a Business Continuity Plan. Which characterization is correct?

Accepted Answer

A predetermined set of instructions or procedures that describe how an organization's mission/business processes will be sustained during and after a significant disruption.

Answer

A vendor catalog listing all approved hardware suppliers for the data center under the documented best-practice guidance referenced for this scenario.

Answer

A code of ethics that all employees must sign at hire and does not address process continuity.

Answer

A marketing strategy document describing the organization's branding plan for the next fiscal year.

Question 7

A team is designing at-rest encryption for blob storage on Azure across SaaS, PaaS, and IaaS workloads. Which encryption strength does Azure documentation recommend for protecting data at rest?

Accepted Answer

AES 256 encryption to protect data at rest across SaaS, PaaS, and IaaS cloud models.

Answer

Cleartext storage with checksumming, since at-rest encryption is unnecessary in modern object storage services.

Answer

ROT13 substitution, which is sufficient for at-rest data on any Azure storage tier per Microsoft documentation.

Answer

Vendor-specific obfuscation with no published cryptographic primitive, which is the documented Azure default.

Question 8

A platform team is evaluating how to consistently benchmark a new AWS workload against current architectural best practices while weighing the trade-offs of each design decision. Which AWS resource is purpose-built for this?

Accepted Answer

The AWS Well-Architected Framework, to measure a workload against best practice

Answer

The CSA Cloud Controls Matrix, a vendor-neutral catalog scored per cloud service

Answer

The Microsoft cloud security benchmark, applied across AWS service baselines

Answer

NIST SP 800-145, the cloud definition repurposed as a workload scoring rubric

Question 9

An engineer is designing inbound access for an EC2 instance and needs to know exactly what an AWS security group governs once it is associated with that instance. Which statement is correct?

Accepted Answer

It controls the inbound and outbound traffic allowed to reach and leave the associated instance.

Answer

It encrypts all data in transit between the instance and other resources inside the same subnet.

Answer

It assigns static private IP addresses to every instance launched within the attached subnet range.

Answer

It applies operating-system patches to the instance on a schedule defined in the group's rule set.

Question 10

An organization is rolling out adaptive authentication and the security lead must decide what the system should do when a login is scored as elevated risk. Per the OWASP Multifactor Authentication cheat sheet, which TWO responses are appropriate? (Select all that apply.)

Accepted Answer

Prompt the user for an additional factor, such as a one-time passcode (OTP), before granting access

Accepted Answer

Deny access and trigger alerting or account-protection flows for the elevated-risk session attempt

Answer

Silently lower the account's privileges for the rest of the day without notifying the user or staff

Answer

Permanently delete the user's account and require a brand-new self-service registration to recover

Question 11

An engineer is tasked with detecting unauthorized changes to critical OS files, suspicious process execution, and local privilege escalation on individual cloud VM instances, where encrypted east-west traffic leaves network sensors blind. Per NIST SP 800-94, which IDPS class best fits this requirement?

Accepted Answer

Host-based IDPS, which monitors activity and integrity on each individual host

Answer

Network-based IDPS, which inspects on-the-wire packets at network choke points

Answer

Wireless IDPS, which monitors wireless protocols for rogue or misconfigured APs

Answer

Network behavior analysis, which baselines flows and detects volume anomalies

Question 12

An incident responder is investigating an event inside a multi-tenant cloud, and a team is tasked with anticipating the obstacles that make cloud forensics harder than on-premises forensics. Per NIST IR 8006, what does that document primarily provide?

Accepted Answer

A categorized catalog of the forensic challenges experts face when responding to incidents in a cloud-computing ecosystem.

Answer

A binding certification standard that cloud providers must pass before they may host any regulated customer workloads at all.

Answer

A pricing model that ranks the major cloud providers by the monthly cost of their built-in forensic logging toolsets.

Answer

A data-residency treaty that dictates which national jurisdiction may subpoena evidence stored in a public cloud service.

Question 13

A cloud architect is tasked with answering where keys should be stored across the cloud estate. Which mechanism set does OWASP's Cryptographic Storage cheat sheet recommend?

Accepted Answer

Secure storage mechanisms provided by the operating system, framework or cloud service provider, including HSMs, key vaults, and secrets management services.

Answer

Plaintext environment variables exported globally to every container in the cluster as the documented storage mechanism.

Answer

Plaintext entries in a public source-code repository so any reader of the repo can decrypt data at will.

Answer

Plaintext columns inside an unencrypted application database table that anyone with read access can query.

Question 14

A startup is documenting why its new platform qualifies as cloud computing, and a reviewer asks which item is one of the five essential characteristics defined for cloud computing. Which option qualifies?

Accepted Answer

Rapid elasticity that scales resources up and down with on demand

Answer

Defense in depth applied across multiple layered security controls

Answer

Secure multi-tenancy enforcing logical isolation between workloads

Answer

Zero trust architecture assuming no implicit trust inside the network

Question 15

A platform team is rolling out secure virtual network configuration for VM protection following NIST SP 800-125B. Which of the following are virtual network configuration areas the guide analyzes? (Select all that apply.)

Accepted Answer

Network segmentation between VM groups, applied to constrain lateral movement across the fabric.

Accepted Answer

VM traffic monitoring, applied to observe the flows to and from the protected virtual machines.

Answer

Per-VM CPU and memory quota tuning, applied to balance the hypervisor's overall compute load.

Answer

Automated rotation of guest-OS local administrator passwords, applied on a fixed weekly cadence.

Certified Cloud Security Professional

Sample questions

Sources

Similar exams