CCSP Cloud Security Prep practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q11A malicious script is embedded within a legitimate email sent to multiple recipients. When recipients open the email, their browser executes the script, leading to the theft of login credentials. What type of attack is being described?
✓ Correct answer: B. Cross-site scripting (XSS)
Answer: Cross-site scripting (XSS) Cross-site scripting (XSS) is an attack where malicious scripts are injected into otherwise benign and trusted websites or emails. These scripts can be executed by the browser of any user who views the compromised content, leading to activities like credential theft, hijacking user sessions, or defacing websites. CSRF involves tricking a user into executing unwanted actions on a different site where they are authenticated. For example, transferring funds or changing email addresses. SQL injection is a type of attack that allows an attacker to execute arbitrary SQL code on a database by inserting malicious SQL statements into a vulnerable application's input fields. XEE attacks exploit the XML processing capabilities of a system by embedding external entities in the XML data. This can lead to issues like data theft or denial of service.
Q12Which of the following organizations developed the Shared Responsibility Model for cloud security?
✓ Correct answer: D. AWS
Answer: AWS Several organizations provide models and frameworks to enhance cloud security understanding: Cloud Security Alliance (CSA): Offers various resources such as the Cloud Control Matrix, which highlights key security concepts and practices. Open Web Application Security Project (OWASP): Focuses on improving web application security by maintaining lists such as the OWASP Top 10 Web Application Security Risks. Sans Institute: Known for its extensive training and certification programs, SANS also maintains essential resources such as the CWE Top 25 Most Dangerous Software Errors. ISO (International Organization for Standardization): Publishes various standards for many areas, including cloud security (e.g., ISO/IEC 27018:2019 for cloud privacy). Amazon Web Services (AWS) is widely recognized for introducing the Shared Responsibility Model. This model delineates the responsibilities between the cloud service provider and its customers regarding security.
Q13Which of the following tools is primarily used to identify security vulnerabilities in container images?
✓ Correct answer: C. Container Security Scanner
Answer: Container Security Scanner <ul><li>Static Application Security Testing (SAST): SAST tools inspect the source code of an application for vulnerable code patterns. It can be performed early in the software development lifecycle but can’t catch some vulnerabilities, such as those visible only at runtime.</li> <li>Dynamic Application Security Testing (DAST): DAST bombards a running application with anomalous inputs or attempted exploits for known vulnerabilities. It has no knowledge of the application’s internals, so it can miss vulnerabilities. However, it is capable of detecting runtime vulnerabilities and configuration errors (unlike SAST).</li> <li>Interactive Application Security Testing (IAST): IAST places an agent inside an application and monitors its internal state while it is running. This enables it to identify unknown vulnerabilities based on their effects on the application.</li> <li>Container Security Scanner: A Container Security Scanner identifies vulnerabilities in container images by scanning and analyzing the software components and configurations within the container. This helps ensure that the containerized application's dependencies and setups are secure.</li></ul>
Q14During which phase of the SDLC are security requirements identified and documented?
✓ Correct answer: B. Requirements
Answer: Requirements The Software Development Lifecycle (SDLC) describes the main phases of software development from initial planning to end-of-life. While definitions of the phases differ, one commonly-used description includes these phases: Phase Description Requirements During the requirements phase, the team identifies the software's role and the applicable requirements. This includes business, functional, and security requirements. Design During this phase, the team creates a plan for the software that fulfills the previously identified requirements. Test cases may also be developed during this phase to verify the software against requirements. Development This phase is when the software is written. Unit testing should be performed regularly through the development phase to verify that individual components meet requirements. Testing After the software has been built, it undergoes more extensive testing to ensure that it fulfills all of the software’s requirements. Deployment During the deployment phase, the software moves from development to release and default configurations are defined and reviewed for security. Operations and Maintenance (O&M) The O&M phase covers the software from release to end-of-life. The software should undergo regular monitoring and testing to ensure that it remains secure and fit for purpose.
Q15At what phase of the cloud application lifecycle does the implementation and testing of security controls occur?
✓ Correct answer: A. Testing
Answer: Testing The testing phase entails the implementation and rigorous testing of security controls to ensure they function as intended. The planning phase involves identifying security requirements and planning for their incorporation. The deployment phase is when the application is put into use, typically in a production environment. Operations and maintenance involve the ongoing management and patching of security controls to address emerging threats and vulnerabilities.
Q16A mid-sized retail company decided to migrate its e-commerce platform from one cloud provider to another without experiencing downtime or data loss. What BEST describes the ability to do this?
✓ Correct answer: A. Reversibility to retrieve all assets from the initial provider and portability to migrate data seamlessly.
Answer: Reversibility to retrieve all assets from the initial provider and portability to migrate data seamlessly. Reversibility refers to the ability of a cloud customer to retrieve all data, applications, and artifacts from a cloud provider's environment. Portability is the capability of transferring data (or software) from one provider to another without requiring reentry of the data. Interoperability implies using data across different systems. These terms are defined in ISO/IEC 17788.
Q17Which of the following is PRIMARILY a concern when integrating cloud-based applications with on-premises systems?
✓ Correct answer: B. Interoperability
Answer: Interoperability Some important cloud considerations have to do with its effects on operations. These include: Availability: The data and applications that an organization hosts in the cloud must be available to provide value to the company. Contracts with cloud providers commonly include service level agreements (SLAs) mandating that the service is available a certain percentage of the time. Resiliency: Resiliency refers to the ability of a system to weather disruptions. Resiliency in the cloud may include the use of redundancy and load balancing to avoid single points of failure. Performance: Cloud contracts also often include SLAs regarding performance. This ensures that the cloud-based services can maintain an acceptable level of operations even under heavy load. Maintenance and Versioning: Maintenance and versioning help to manage the process of changing software and other systems. Updates should only be made via clear, well-defined processes. Reversibility: Reversibility refers to the ability to recover from a change that went wrong. For example, how difficult it is to restore on-site operations after a transition to an outsourced service (like a cloud provider). Portability: Different cloud providers have different infrastructures and may do things in different ways. If an organization’s cloud environment relies too much on a provider’s unique implementation or the provider doesn’t offer easy export, the company may be stuck with that provider due to vendor lock-in. Interoperability: When integrating cloud-based applications with on-premises systems, it is important to ensure that these platforms and the applications hosted on them are capable of interoperating. Outsourcing: Using cloud environments requires handing over control of a portion of an organization’s infrastructure to a third party, which introduces operational and security concerns.
Q18A multinational corporation intends to integrate their existing HR management system with a cloud-based platform. Their cloud security specialist, Ethan, collaborates with IT admins to make the transition smooth. They plan to maintain their current user authentication methods within their on-premises data centers for a period. Employee data and applications will be hosted in the cloud. Which protocol can they employ for their IAM solution to ensure seamless integration between their on-premises data centers and the cloud?
✓ Correct answer: C. Lightweight Directory Access Protocol (LDAP)
Correct answer: Lightweight Directory Access Protocol (LDAP) Lightweight Directory Access Protocol (LDAP) is a widely adopted protocol for accessing and managing directory services, which helps to store and organize information about users, groups, devices, and other resources in a hierarchical structure. LDAP can be used as a foundational protocol for cloud-based directory services, allowing organizations to maintain user accounts, groups, and other directory-related information seamlessly. This supports scalability, centralized management, and cross-cloud region availability. Security Assertion Markup Language (SAML) facilitates Single Sign-On (SSO) by enabling the secure exchange of authentication and authorization data between entities. Although important for IAM, it is not typically used within data centers, making LDAP a more suitable choice. Domain Name Service (DNS) translates domain names into IP addresses, operating similarly to a distributed directory service. However, DNS is not designed for IAM. Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network configurations within local networks. Though useful for network administration, it does not pertain to IAM.
Q19A cloud security architect is advising a company on migrating their applications to a cloud provider. The company wants to ensure they can easily move their applications to another provider if needed, avoiding vendor lock-in. What key cloud concept should they focus on to address this requirement?
✓ Correct answer: D. Portability
Answer: Portability Portability is defined in ISO/IEC 17788 as the "ability to easily transfer data and applications from one cloud service provider to another without requiring significant changes or modification." This is crucial for minimizing vendor lock-in. Interoperability, as defined in ISO/IEC 17788, is the "ability of different systems or applications to communicate and exchange data effectively." While important, it is not directly related to moving applications between providers. Reversibility refers to the "process allowing cloud service customers to retrieve their data and application artifacts, in order to move away from the cloud service provider." Availability is the "property that ensures cloud services are accessible and usable upon demand by authorized entities."
Q20When a company plans to migrate its applications to a cloud provider's Infrastructure as a Service (IaaS) platform, what is the most critical factor to evaluate before signing contracts?
✓ Correct answer: D. Ensuring data integrity and security
Answer: Ensuring data integrity and security When migrating applications to an IaaS provider, it is crucial to ensure that the data's integrity and security are preserved. Any compromise on these aspects can lead to data breaches, loss of sensitive information, and potential compliance issues. While cost-efficiency, vendor reputation, and service level agreements are also important, the priority should be on maintaining the integrity and security of the data being transferred to the cloud.
Use the free CCSP Cloud Security Prep sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory