CCSP

One question per exam domain, 6 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Cloud Concepts, Architecture, and Design

   Responders to an intrusion on a regional airline's IaaS web server want instance memory, provider-side control plane records, and assurance that no other tenant is implicated. What is the MOST accurate expectation to set?

   1. AThe airline should demand a forensic image of the whole physical host, because the instance's memory ultimately resides within that host's memory
   2. BThe airline must wait for the provider to lead the investigation, because the affected workloads all reside on the provider's own infrastructure
   3. CThe airline can capture instance memory and snapshots and pull its own control plane records, while anything below that boundary needs the provider
   4. DThe airline can obtain the provider's own hypervisor logs on request, because those records describe activity that occurred inside the airline's account
   Show answer and explanation

   Correct answer

   The airline can capture instance memory and snapshots and pull its own control plane records, while anything below that boundary needs the provider

   In an infrastructure service the customer controls the guest and its own account activity records, so memory acquisition, snapshots and management plane audit history are all within reach, while everything below the boundary or touching other tenants depends on provider cooperation that must have been negotiated in advance. Expecting hypervisor logs on demand misreads the boundary, because those records describe a shared component and would expose other customers. Waiting for the provider to lead surrenders evidence that is decaying now and that only the airline can collect. Demanding a physical host image asks for something that would expose co-tenants and that no multi-tenant provider will supply, so planning around it guarantees a stalled investigation.

   Source: NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing

2. Question 2 · Cloud Data Security

   A Havoc Interactive engineer creates volume snapshots as part of the sanctioned nightly backup workflow, but shares one snapshot of the block volume holding the player-account database with a partner studio's account, and the partner mounts a readable copy. Which control would MOST directly have prevented this?

   1. ARestricting the engineer's role so it cannot create snapshots of production volumes at all
   2. BPlacing the database instances in a private subnet with no internet gateway attached
   3. CEncrypting the volumes with a customer-managed key whose policy excludes the partner account
   4. DEnabling volume-level audit logging so every snapshot sharing action is recorded centrally
   Show answer and explanation

   Correct answer

   Encrypting the volumes with a customer-managed key whose policy excludes the partner account

   A snapshot of an encrypted volume carries the ciphertext, and the receiving account can only mount it if it is also granted use of the key, so key policy becomes the enforcement boundary that survives a sharing mistake in the storage layer. Audit logging records the event after the copy has already been read. Restricting snapshot creation would break the sanctioned nightly backup workflow this engineer runs, removing a needed capability rather than closing the sharing path. Network placement governs reachability of the running instance and has no bearing on a snapshot copied into another tenant's account.

   Source: AWS Documentation: Share an Amazon EBS snapshot

3. Question 3 · Cloud Platform and Infrastructure Security

   Halcyon Tooling runs its factory estate in one flat virtual network where every workload can reach every other on any port, so one compromised web server opens a path to the production database. Which control BEST addresses this?

   1. AEnforce per-workload segmentation policy at each virtual network interface so only permitted flows pass
   2. BDeploy a next-generation firewall that inspects all traffic entering and leaving the whole virtual network
   3. CRequire all administrative access to the estate to pass through a single hardened bastion host
   4. DEnable flow logging across the virtual network so lateral movement can be investigated afterwards
   Show answer and explanation

   Correct answer

   Enforce per-workload segmentation policy at each virtual network interface so only permitted flows pass

   Unrestricted internal reachability is a lateral movement problem, and enforcing policy at each workload's virtual interface restricts east-west flows to the ones the application actually needs. An edge firewall inspects north-south traffic and never sees packets that stay inside the virtual network. A bastion host protects administrative access paths but not application-to-application traffic, which is the path the compromised web server took to the database. Flow logging supports investigation after the fact and prevents nothing.

   Source: NIST SP 800-125B: Secure Virtual Network Configuration for Virtual Machine (VM) Protection

4. Question 4 · Cloud Application Security

   Ashfield Council's payment page loads an analytics script from a marketing vendor's CDN into the same page as the card entry form, and the vendor can change that file at any time. The analytics cannot be dropped. What is the BEST control?

   1. AObtain a contractual commitment from the vendor not to modify the hosted script without prior written notice to the council.
   2. BRestrict permitted script sources with a content security policy and pin the third party file using subresource integrity.
   3. CLoad the analytics script asynchronously at the end of the page so that it executes only after the payment form has rendered.
   4. DProxy the vendor's script through the council's own domain so that it is delivered to browsers from a trusted origin.
   Show answer and explanation

   Correct answer

   Restrict permitted script sources with a content security policy and pin the third party file using subresource integrity.

   Integrity pinning makes the browser refuse a file whose contents differ from the reviewed version, and a content security policy constrains where script may come from at all, together turning a silent vendor change into a visible failure rather than an executed payload. Contractual notice is a governance control with no technical enforcement and no effect if the vendor is compromised. Deferring execution changes only timing, since the script still runs in the page and can read the form. Proxying through the council's domain removes cross-origin friction but actually grants the third party code first-party origin trust, which weakens the position.

   Source: OWASP Third Party JavaScript Management Cheat Sheet

5. Question 5 · Cloud Security Operations

   A payments startup finds a web instance beaconing to an unfamiliar address. It belongs to a scaling group whose health checks will replace it shortly, and the responder has root. Which evidence should be collected FIRST?

   1. AAn export of the control plane audit log entries relating to the instance
   2. BA copy of the instance's application and system log files from disk
   3. CA snapshot of the instance's attached block storage volumes
   4. DA memory image captured from the instance while it is still running
   Show answer and explanation

   Correct answer

   A memory image captured from the instance while it is still running

   Collection follows the order of volatility, and memory is the most perishable source, holding the running processes, injected code, network connections and keys that vanish the moment the instance stops. Disk snapshots capture data that persists and can be taken afterward. Control plane logs are already stored durably on the provider's side and are not at risk from termination. Application and system log files are written to the same volumes a snapshot preserves, so collecting them first spends the one window in which volatile evidence still exists.

   Source: RFC 3227, Guidelines for Evidence Collection and Archiving

6. Question 6 · Legal, Risk, and Compliance

   It is November. Copperline Rail's cloud vendor has a SOC 2 Type II report covering January through June, with the next due in February. The assessor will not delay the project a quarter. How should the gap be closed?

   1. ARequire the vendor to commission an out of cycle Type I report covering the current date, giving fresh evidence without waiting for February for the file
   2. BAccept the report as issued, since a period report is treated as valid for twelve months from its issue date and February falls inside that window
   3. CTreat the vendor as unassessed and suspend onboarding until the next report is issued in February, whatever that costs the project in lost time
   4. DRequest a bridge letter in which vendor management asserts no material change to the control environment since the period ended
   Show answer and explanation

   Correct answer

   Request a bridge letter in which vendor management asserts no material change to the control environment since the period ended

   The gap between a report period end and the present is routine, and the accepted practice is a management assertion covering the interval, valued honestly as an unaudited representation rather than as tested evidence. Treating the report as automatically good for a year invents a validity rule that does not exist and silently ignores the uncovered months. An out of cycle point in time report is theoretically possible but expensive, slow and still weaker than the period report already in hand, so it is a poor trade. Suspending onboarding is defensible if the risk is severe, yet it is disproportionate when a standard mechanism exists for exactly this situation.

   Source: AWS SOC Compliance FAQs