CCSP 2022 Intermediate Qu - Free Practice Quiz

Question 1 of 60

In the CCSP 2022 CBK, which term describes the right of an individual to inspect and correct personal data held about them?

A Data portability B Right of erasure C Data minimization D Right of access

1 / 60

Question 2 of 60

In the CCSP 2022 CBK, which standard provides a framework specifically for information security management systems (ISMS)?

A NIST SP 800-53 B SOC 2 C COBIT 2019 D ISO/IEC 27001

2 / 60

Question 3 of 60

Under the CCSP 2022 CBK, which document formally authorizes a project or system to operate based on accepted residual risk?

A System Security Plan B Incident Response Plan C Risk Register D Authorization to Operate (ATO)

3 / 60

Question 4 of 60

The CCSP 2022 CBK defines 'data in transit' protections as PRIMARILY achieved through:

A Applying data classification labels B Hashing data before transmission C Storing data only within one geographic region D TLS/SSL encryption for data moving across networks

4 / 60

Question 5 of 60

The CCSP 2022 CBK defines 'data remanence' as:

A Data cached in browser sessions B Encrypted backup data C Archived cold-storage data D Residual data that persists after deletion attempts

5 / 60

Question 6 of 60

The CCSP 2022 CBK describes 'multitenancy' as a cloud characteristic that introduces which UNIQUE risk?

A Higher latency due to shared bandwidth B Inability to scale horizontally C Lack of on-demand provisioning D Data commingling and cross-tenant information disclosure

6 / 60

Question 7 of 60

The CCSP 2022 CBK identifies 'elasticity' as a cloud benefit that specifically helps organizations:

A Eliminate all capital expenditure B Avoid software licensing fees C Guarantee 100% uptime SLAs D Scale resources up or down to match workload demand

7 / 60

Question 8 of 60

In the CCSP 2022 CBK, which identity federation protocol is commonly used to exchange authentication and authorization data between an identity provider and a cloud service provider?

A LDAP B Kerberos C RADIUS D SAML 2.0

8 / 60

Question 9 of 60

According to the CCSP 2022 CBK, which cloud deployment model gives a single organization exclusive use of infrastructure managed by a third-party provider off-premises?

A Public cloud B Community cloud C Hybrid cloud D Hosted private cloud

9 / 60

Question 10 of 60

Under the CCSP 2022 CBK, which control type BEST describes a firewall rule that blocks unauthorized access attempts?

A Corrective B Detective C Compensating D Preventive

10 / 60

Question 11 of 60

In the CCSP 2022 CBK, which approach to cryptographic key management is considered MOST secure for cloud workloads?

A Storing keys in the same database as encrypted data B Allowing the CSP to auto-generate and fully manage all keys C Embedding keys in application source code D Using customer-managed keys in a dedicated HSM

11 / 60

Question 12 of 60

The CCSP 2022 CBK classifies 'availability' as a security property BEST maintained through:

A Security information and event management (SIEM) B Data encryption and tokenization C Access control lists and MFA D Redundancy, failover, and disaster recovery planning

12 / 60

Question 13 of 60

In the CCSP 2022 CBK, 'egress monitoring' primarily refers to:

A Tracking inbound API requests B Auditing user login attempts C Scanning container images for vulnerabilities D Monitoring outbound data leaving the cloud environment

13 / 60

Question 14 of 60

The CCSP 2022 CBK identifies which of the following as the PRIMARY benefit of using a CASB?

A Replacing the need for encryption at rest B Eliminating the need for IAM policies C Performing penetration testing of cloud environments D Providing visibility and control over cloud service usage across the organization

14 / 60

Question 15 of 60

The CCSP 2022 CBK describes the 'shared responsibility model' as requiring cloud customers to ALWAYS be responsible for:

A Physical data center security B Hypervisor patching C Network hardware maintenance D Their own data and access management

15 / 60

Question 16 of 60

According to the CCSP 2022 CBK, which cloud security control directly addresses the risk of an insider threat exfiltrating sensitive data via a personal cloud storage account?

A Implementing network segmentation between cloud workloads B Encrypting all data at rest within the primary cloud environment C A CASB configured to block uploads to unsanctioned cloud applications D Requiring MFA for all administrative accounts

16 / 60

Question 17 of 60

The CCSP 2022 CBK identifies which of the following as the PRIMARY goal of a Business Impact Analysis (BIA)?

A Listing all system vulnerabilities B Documenting recovery procedures C Identifying critical business functions and their recovery priorities D Defining backup media rotation schedules

17 / 60

Question 18 of 60

According to the CCSP 2022 CBK, which cloud storage type is MOST appropriate for structured relational data accessed frequently by applications?

A Object storage B Archive storage C Relational database as a service D Block storage

18 / 60

Question 19 of 60

According to the CCSP 2022 CBK, which threat modeling approach systematically identifies threats by category â€” Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege?

A PASTA B OCTAVE C STRIDE D DREAD

19 / 60

Question 20 of 60

The CCSP 2022 CBK defines the 'CSA Cloud Controls Matrix (CCM)' as:

A A pricing guide for comparing cloud service costs B A tool for measuring cloud provider latency and performance C A security control framework specifically designed for cloud environments, mapping controls to various compliance standards D A penetration testing methodology for cloud APIs

20 / 60

Question 21 of 60

Which CCSP 2022 CBK concept describes dividing a network into smaller segments to limit the blast radius of a breach?

A Defense in depth B Network segmentation C Microsegmentation D Zero trust

21 / 60

Question 22 of 60

The CCSP 2022 CBK defines 'data sovereignty' as the principle that:

A Data must always be encrypted at rest B Data owners retain rights regardless of geographic location C Data remains subject to the laws of the country in which it physically resides D Data must be replicated across at least two jurisdictions

22 / 60

Question 23 of 60

The CCSP 2022 CBK notes that 'right to be forgotten' or erasure requests in cloud environments are complicated PRIMARILY because:

A CSPs are legally prohibited from deleting data B Erasure requires root-level CSP access C Data may be replicated across multiple geographic regions making complete deletion difficult to verify D Most cloud contracts prohibit deletion

23 / 60

Question 24 of 60

In the CCSP 2022 CBK, which disaster recovery strategy provides the FASTEST recovery time by maintaining a fully operational duplicate environment?

A Cold site B Warm site C Hot site D Mobile recovery unit

24 / 60

Question 25 of 60

Under the CCSP 2022 CBK, which party is MOST responsible for defining the data classification policy in a cloud environment?

A Cloud service provider B Third-party auditor C Data owner (the cloud customer) D Cloud access security broker

25 / 60

Question 26 of 60

In the CCSP 2022 CBK, which incident response phase involves re-enabling affected systems and verifying normal operations?

A Identification B Eradication C Recovery D Lessons learned

26 / 60

Question 27 of 60

Under the CCSP 2022 CBK, which type of testing involves providing a tester with full knowledge of the system's architecture and source code?

A Black-box testing B Gray-box testing C White-box testing D Penetration testing (unauthenticated)

27 / 60

Question 28 of 60

The CCSP 2022 CBK defines 'attribute-based access control' (ABAC) as an access model that grants permissions based on:

A Network IP address ranges B Static role assignments in a directory C Attributes of the user, resource, and environment evaluated against policies D Time-of-day restrictions only

28 / 60

Question 29 of 60

The CCSP 2022 CBK describes 'capability maturity models' primarily as tools for:

A Grading hardware failure rates B Classifying cloud data sensitivity C Assessing and improving an organization's process maturity D Evaluating encryption algorithm strength

29 / 60

Question 30 of 60

Which CCSP 2022 CBK concept ensures that cryptographic keys are never directly accessible to cloud service providers?

A Key rotation B Key escrow C Bring Your Own Key (BYOK) D Hardware Security Module (HSM) shared hosting

30 / 60

Question 31 of 60

The CCSP 2022 CBK identifies which of the following as a PRIMARY advantage of containerization over traditional virtual machines?

A Containers provide stronger hardware isolation than VMs B Containers share the host OS kernel making them faster and more lightweight C Containers eliminate the need for network segmentation D Containers include their own hypervisor

31 / 60

Question 32 of 60

According to the CCSP 2022 CBK, 'penetration testing' in cloud environments requires FIRST:

A Deploying additional monitoring agents B Obtaining written authorization from the CSP and customer stakeholders C Disabling existing IDS/IPS to avoid false positives D Notifying law enforcement

32 / 60

Question 33 of 60

Which CCSP 2022 CBK cloud characteristic allows resources to be automatically adjusted based on demand without manual intervention?

A Measured service B Rapid elasticity C On-demand self-service D Broad network access

33 / 60

Question 34 of 60

The CCSP 2022 CBK defines 'vendor lock-in' as a risk arising from:

A Excessive encryption of data at rest B Dependency on proprietary CSP services that make migration to another provider difficult C Over-provisioning of cloud resources D Insufficient SLA terms in contracts

34 / 60

Question 35 of 60

In the CCSP 2022 CBK, 'logical separation' between tenant data in a multitenant cloud is PRIMARILY enforced through:

A Physical server isolation per tenant B Access controls, network segmentation, and cryptographic separation C Contractual agreements in the SLA D Dedicated storage arrays per tenant

35 / 60

Question 36 of 60

The CCSP 2022 CBK notes that 'serverless computing' shifts security responsibility for runtime environments to:

A The customer's DevOps team B The cloud service provider C A third-party MSSP D The container orchestration platform

36 / 60

Question 37 of 60

According to the CCSP 2022 CBK, 'key escrow' is BEST described as:

A Storing encryption keys alongside encrypted data B Providing a trusted third party with a copy of encryption keys C Rotating keys on a defined schedule D Generating keys from hardware security modules

37 / 60

Question 38 of 60

According to the CCSP 2022 CBK, 'separation of duties' in cloud IAM primarily prevents:

A Unauthorized physical access B A single person from having enough privilege to commit and conceal fraud C Weak password policies D Over-provisioning of network bandwidth

38 / 60

Question 39 of 60

The CCSP 2022 CBK defines 'recovery time objective' (RTO) as:

A The amount of data loss an organization can tolerate B The maximum acceptable time to restore a system after an outage C The frequency at which backups must be created D The time required to fail over to a secondary site

39 / 60

Question 40 of 60

In the CCSP 2022 CBK, which standard specifically addresses payment card data security in cloud environments?

A ISO 27001 B PCI DSS C HIPAA D FISMA

40 / 60

Question 41 of 60

In the CCSP 2022 CBK, which audit standard is specifically designed for cloud service providers to demonstrate security and availability controls?

A ISO 27001 B SOC 2 Type II C NIST SP 800-53 D PCI DSS

41 / 60

Question 42 of 60

In the CCSP 2022 CBK, which risk treatment option involves accepting the risk without additional mitigation because its cost exceeds the potential impact?

A Risk avoidance B Risk acceptance C Risk transfer D Risk reduction

42 / 60

Question 43 of 60

According to the CCSP 2022 CBK, which governance framework is MOST commonly used to align IT management with business objectives in cloud environments?

A ISO 27001 B COBIT 2019 C PCI DSS D NIST CSF

43 / 60

Question 44 of 60

The CCSP 2022 CBK defines 'data masking' as a technique that:

A Encrypts data with a customer-managed key B Replaces sensitive data with realistic but fictitious data for non-production use C Permanently deletes data from storage D Hashes data to verify integrity

44 / 60

Question 45 of 60

The CCSP 2022 CBK defines the 'chain of custody' concept in forensics as:

A The process of hashing evidence files B Documentation proving evidence was collected, handled, and preserved without tampering C Encrypting evidence before storage D Notifying law enforcement before collection

45 / 60

Question 46 of 60

The CCSP 2022 CBK identifies which data state as occurring when data is actively processed by a CPU?

A Data in use B Data in transit C Data at rest D Data archived

46 / 60

Question 47 of 60

The CCSP 2022 CBK identifies 'supply chain risk' in cloud environments as arising PRIMARILY from:

A Third-party components (libraries, containers, hardware) that may contain vulnerabilities or backdoors B CSP pricing model changes C Insufficient redundancy in the provider's data centers D Customers using multiple CSPs simultaneously

47 / 60

Question 48 of 60

According to the CCSP 2022 CBK, which threat category does a denial-of-service attack PRIMARILY target?

A Availability B Confidentiality C Integrity D Non-repudiation

48 / 60

Question 49 of 60

Which CCSP 2022 CBK term describes a legally binding agreement specifying security and privacy obligations when a CSP processes personal data on behalf of a data controller?

A Data processing agreement B Service level agreement C Acceptable use policy D Non-disclosure agreement

49 / 60

Question 50 of 60

According to the CCSP 2022 CBK, which privacy principle requires that personal data collected be limited to what is necessary for the stated purpose?

A Data minimization B Storage limitation C Purpose limitation D Accountability

50 / 60

Question 51 of 60

In the CCSP 2022 CBK, which encryption mode is MOST appropriate for ensuring the confidentiality of block storage volumes?

A AES-256 in CBC or GCM mode B ECB (Electronic Codebook) C ROT13 D MD5 hashing

51 / 60

Question 52 of 60

The CCSP 2022 CBK identifies 'DevSecOps' as a practice that integrates security into:

A Every phase of the software development and delivery pipeline B Only the final QA testing phase before production deployment C The monitoring and incident response phases only D Contract negotiations with CSPs

52 / 60

Question 53 of 60

According to the CCSP 2022 CBK, which technique allows multiple organizations to share cryptographic verification without any single party controlling the ledger?

A Distributed ledger technology B Federated identity management C Homomorphic encryption D Public key infrastructure

53 / 60

Question 54 of 60

The CCSP 2022 CBK describes 'infrastructure as code' (IaC) security risks as including:

A Hard-coded secrets and misconfigurations embedded in code templates B Lack of support for containerized workloads C Inability to version-control configurations D Inability to deploy across multiple regions

54 / 60

Question 55 of 60

The CCSP 2022 CBK notes that 'application-layer firewalls' differ from traditional packet-filtering firewalls because they:

A Inspect application-layer content (HTTP, SQL, etc.) to detect protocol-aware attacks B Operate at Layer 2 of the OSI model C Block all encrypted traffic D Require dedicated hardware appliances

55 / 60

Question 56 of 60

In the CCSP 2022 CBK, which mechanism provides tamper-evident logging to support forensic investigations?

A Cryptographically signed, immutable audit logs B Standard syslog forwarding C Application performance monitoring dashboards D Periodic manual log reviews

56 / 60

Question 57 of 60

The CCSP 2022 CBK identifies 'shadow IT' as a risk because:

A Unsanctioned cloud services bypass organizational security controls and policies B It exposes systems to power outages C It requires additional licensing costs D It uses stronger encryption than approved tools

57 / 60

Question 58 of 60

In the CCSP 2022 CBK, which concept describes a federated identity arrangement where a user authenticates once and is granted access across multiple cloud services?

A Single sign-on (SSO) B Attribute-based access control C Role-based access control D Privileged access management

58 / 60

Question 59 of 60

According to the CCSP 2022 CBK, a 'gap analysis' in cloud compliance is PRIMARILY used to:

A Compare current security posture against a target framework to identify deficiencies B Measure network latency between data centers C Define encryption key rotation schedules D Inventory cloud assets and their owners

59 / 60

Question 60 of 60

The CCSP 2022 CBK describes 'quantum-resistant cryptography' as necessary because:

A Sufficiently powerful quantum computers could break current asymmetric encryption algorithms like RSA and ECC B Quantum computers are faster at hashing than classical computers C Quantum computing eliminates the need for encryption keys D Current AES-256 encryption is already considered broken

60 / 60

CCSP 2022 Intermediate Quiz