CCSP

One question per exam domain, 6 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Cloud Concepts, Architecture, and Design

   Responders investigating an intrusion on an airline's IaaS web server want instance memory, the provider's control plane records, and assurance that no other tenant is involved. What is the MOST accurate expectation to set?

   1. AThe airline should demand a forensic image of the whole physical host, since the instance's memory lives there
   2. BThe airline must wait for the provider to lead, since the affected workloads sit on the provider's infrastructure
   3. CThe airline can capture memory, snapshots and its control plane logs; below the guest OS it needs the provider
   4. DThe airline can obtain the provider's hypervisor logs on request, since they record activity in the airline's account
   Show answer and explanation

   Correct answer

   The airline can capture memory, snapshots and its control plane logs; below the guest OS it needs the provider

   In an infrastructure service the customer controls the guest and its own account activity records, so memory acquisition, snapshots and management plane audit history are all within reach, while everything below the boundary or touching other tenants depends on provider cooperation that must have been negotiated in advance. Expecting hypervisor logs on demand misreads the boundary, because those records describe a shared component and would expose other customers. Waiting for the provider to lead surrenders evidence that is decaying now and that only the airline can collect. Demanding a physical host image asks for something that would expose co-tenants and that no multi-tenant provider will supply, so planning around it guarantees a stalled investigation.

   Source: NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing

2. Question 2 · Cloud Data Security

   A Havoc Interactive engineer creates volume snapshots as part of the sanctioned nightly backup workflow. The engineer then shares a snapshot of the block volume holding the player-account database with a partner studio's account, and the partner mounts a readable copy. Which control would MOST directly have prevented this?

   1. ARestricting the engineer's role so it cannot create snapshots of production volumes at all
   2. BPlacing the database instances in a private subnet with no internet gateway attached
   3. CEncrypting the volumes with a customer-managed key whose policy excludes the partner account
   4. DEnabling volume-level audit logging so every snapshot sharing action is recorded centrally
   Show answer and explanation

   Correct answer

   Encrypting the volumes with a customer-managed key whose policy excludes the partner account

   A snapshot of an encrypted volume carries the ciphertext, and the receiving account can only mount it if it is also granted use of the key, so key policy becomes the enforcement boundary that survives a sharing mistake in the storage layer. Audit logging records the event after the copy has already been read. Restricting snapshot creation would break the sanctioned nightly backup workflow this engineer runs, removing a needed capability rather than closing the sharing path. Network placement governs reachability of the running instance and has no bearing on a snapshot copied into another tenant's account.

   Source: AWS Documentation: Share an Amazon EBS snapshot

3. Question 3 · Cloud Platform and Infrastructure Security

   A manufacturer runs its estate in one flat virtual network where every workload can reach every other on any port, so one compromised web server opens a path to the production database. Which control BEST addresses this?

   1. AEnforce per-workload segmentation policy at each virtual network interface
   2. BDeploy a next-generation firewall on traffic entering and leaving the network
   3. CRoute all administrative access through a single hardened bastion host
   4. DEnable flow logging so lateral movement can be investigated afterwards
   Show answer and explanation

   Correct answer

   Enforce per-workload segmentation policy at each virtual network interface

   Unrestricted internal reachability is a lateral movement problem, and enforcing policy at each workload's virtual interface restricts east-west flows to the ones the application actually needs. An edge firewall inspects north-south traffic and never sees packets that stay inside the virtual network. A bastion host protects administrative access paths but not application-to-application traffic, which is the path the compromised web server took to the database. Flow logging supports investigation after the fact and prevents nothing.

   Source: NIST SP 800-125B: Secure Virtual Network Configuration for Virtual Machine (VM) Protection

4. Question 4 · Cloud Application Security

   Ashfield Council's payment page loads an analytics script from a vendor's CDN alongside the card entry form, and the vendor can change that file at any time. The analytics cannot be dropped. What is the BEST control?

   1. AObtain a contractual commitment that the vendor will not modify the script without prior notice.
   2. BLimit script sources with a content security policy and pin the file with subresource integrity.
   3. CLoad the analytics script asynchronously at the page end so it runs after the payment form renders.
   4. DProxy the vendor's script through the council's own domain so browsers get it from a trusted origin.
   Show answer and explanation

   Correct answer

   Limit script sources with a content security policy and pin the file with subresource integrity.

   Integrity pinning makes the browser refuse a file whose contents differ from the reviewed version, and a content security policy constrains where script may come from at all, together turning a silent vendor change into a visible failure rather than an executed payload. Contractual notice is a governance control with no technical enforcement and no effect if the vendor is compromised. Deferring execution changes only timing, since the script still runs in the page and can read the form. Proxying through the council's domain removes cross-origin friction but actually grants the third party code first-party origin trust, which weakens the position.

   Source: OWASP Third Party JavaScript Management Cheat Sheet

5. Question 5 · Cloud Security Operations

   A payments startup finds a web instance beaconing to an unfamiliar address. It belongs to a scaling group whose health checks will replace it shortly, and the responder has root. Which evidence should be collected FIRST?

   1. AAn export of the control plane audit log entries relating to the instance
   2. BA copy of the instance's application and system log files from disk
   3. CA snapshot of the instance's attached block storage volumes
   4. DA memory image captured from the instance while it is still running
   Show answer and explanation

   Correct answer

   A memory image captured from the instance while it is still running

   Collection follows the order of volatility, and memory is the most perishable source, holding the running processes, injected code, network connections and keys that vanish the moment the instance stops. Disk snapshots capture data that persists and can be taken afterward. Control plane logs are already stored durably on the provider's side and are not at risk from termination. Application and system log files are written to the same volumes a snapshot preserves, so collecting them first spends the one window in which volatile evidence still exists.

   Source: RFC 3227, Guidelines for Evidence Collection and Archiving

6. Question 6 · Legal, Risk, and Compliance

   It is November. Copperline Rail's vendor has a SOC 2 Type II report covering January through June; the next is due in February. The assessor does not want to delay the project by a quarter. How should the coverage gap be closed?

   1. ARequire an out-of-cycle Type I report as of today, giving fresh evidence without waiting for February
   2. BAccept the report as issued, since a period report is valid for 12 months from issue, a window covering February
   3. CTreat the vendor as unassessed and suspend onboarding until February, whatever the delay costs
   4. DRequest a bridge letter in which vendor management asserts no material change since the period ended
   Show answer and explanation

   Correct answer

   Request a bridge letter in which vendor management asserts no material change since the period ended

   The gap between a report period end and the present is routine, and the accepted practice is a management assertion covering the interval, valued honestly as an unaudited representation rather than as tested evidence. Treating the report as automatically good for a year invents a validity rule that does not exist and silently ignores the uncovered months. An out of cycle point in time report is theoretically possible but expensive, slow and still weaker than the period report already in hand, so it is a poor trade. Suspending onboarding is defensible if the risk is severe, yet it is disproportionate when a standard mechanism exists for exactly this situation.

   Source: AWS SOC Compliance FAQs