Free Certified Cloud Security Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Cloud Security Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A cloud consumer provisions a virtual machine through an API without waiting for a provider employee to approve each request. Which NIST cloud characteristic does this illustrate?

   1. A.Broad network access
   2. B.On-demand self-serviceCorrect answer: B
   3. C.Measured service
   4. D.Resource pooling

   Explanation: NIST states, "A consumer can unilaterally provision computing capabilities," and specifies "without requiring human interaction with each service provider." Automated provisioning without individual provider intervention is on-demand self-service. Network access concerns how services are reached; measurement concerns metering; pooling concerns sharing resources.

   Reference: NIST SP 800-145: The NIST Definition of Cloud Computing — Section 2, Essential Characteristics: On-demand self-service, printed p. 2

2. 2A team needs a logically isolated virtual network in which to launch its AWS resources. Which resource provides this boundary?

   1. A.An AWS Availability Zone
   2. B.An Amazon VPC security group
   3. C.An Amazon Virtual Private CloudCorrect answer: C
   4. D.An Amazon VPC route table

   Explanation: AWS defines Amazon VPC as "a logically isolated virtual network that you've defined." An Availability Zone is a placement/failure domain; a security group filters associated resources' traffic, and a route table directs traffic. Those components do not replace the VPC network boundary.

   Reference: What is Amazon VPC? — What is Amazon VPC?

3. 3A cloud application concatenates user input into SQL statements. Which change directly prevents input values from being interpreted as SQL syntax?

   1. A.Give the database account read-only access
   2. B.Encrypt the database volume at rest
   3. C.Bind input values in parameterized queriesCorrect answer: C
   4. D.Increase the database connection timeout

   Explanation: OWASP states, "Prepared statements treat bound values as data rather than SQL syntax." Binding values separately from the SQL structure addresses injection. Least privilege limits impact but does not prevent injection; encryption and timeouts do not separate data from syntax.

   Reference: SQL Injection Prevention Cheat Sheet — Defense Option 1: Prepared Statements (with Parameterized Queries)

4. 4A control is intended to prevent unauthorized changes to cloud-hosted financial records. Which information-security objective does this directly support?

   1. A.Availability
   2. B.Confidentiality
   3. C.Portability
   4. D.IntegrityCorrect answer: D

   Explanation: NIST defines integrity as "Guarding against improper information modification or destruction". Preventing unauthorized changes directly supports integrity. Confidentiality addresses disclosure, availability addresses access when needed, and portability is a different property.

   Reference: NIST Glossary: Integrity — Definitions: FIPS 200 definition

5. 5A cloud operations team needs standard security controls to be deployed consistently and their changes to be traceable. Which workflow best meets both goals?

   1. A.Test version-controlled IaC templates and deploy them through a pipelineCorrect answer: A
   2. B.Apply console changes first and document only failed deployments
   3. C.Copy the last environment manually and discard its change history
   4. D.Let each administrator maintain an independent unreviewed baseline

   Explanation: AWS recommends defining controls with IaC and says to "capture changes in a version control system, test changes as part of a CI/CD pipeline". This provides traceable changes and consistent deployment. The other workflows lack reliable control over changes or the shared baseline.

   Reference: Automate deployment of standard security controls — SEC01-BP06

6. 6An incident response team must coordinate even if its normal corporate communication system is compromised. What should its incident response plan include?

   1. A.A rule to postpone all communication until recovery is complete
   2. B.An assumption that the affected system is always trustworthy
   3. C.An out-of-band backup communication methodCorrect answer: C
   4. D.A requirement to send incident credentials through the affected channel

   Explanation: AWS states, "It’s a best practice to have out-of-band communication as a backup for incident communication." An independent backup supports coordination when the primary channel is unreliable. Postponing coordination or relying on the compromised channel fails that objective.

   Reference: Develop incident management plans — Develop the incident response plan: Backup communication methods

7. 7An authorized investigation needs evidence from a running cloud VM's memory. Why should the collection plan consider capturing this data before powering the VM down?

   1. A.Memory contents are automatically included in every storage backup
   2. B.Volatile data can be lost when the system is powered downCorrect answer: B
   3. C.Powering down permanently increases the reliability of memory contents
   4. D.Volatile data cannot contain information relevant to an incident

   Explanation: NIST states, "Volatile data refers to data on a live system that is lost after a computer is powered down or due to the passage of time." This makes timely acquisition important when memory evidence is needed. It does not imply that availability, safety, or legal constraints can be ignored.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 3.1.2, Acquiring the Data: Volatility

8. 8A business specifies that recovery must lose no more than 15 minutes of data preceding a disaster. Which recovery objective expresses this tolerance?

   1. A.Recovery time objective
   2. B.Mean time to repair
   3. C.Service response-time objective
   4. D.Recovery point objectiveCorrect answer: D

   Explanation: AWS defines RPO as "the maximum acceptable amount of time since the last data recovery point." The requirement concerns the age of recoverable data, not the time needed to restore service or a mean repair duration.

   Reference: Disaster Recovery objectives — Recovery Point Objective

9. 9A team is defining cloud security control objectives. Which inputs should drive those objectives?

   1. A.Only the controls that are easiest to configure in the console
   2. B.Only the names of services already purchased
   3. C.Applicable compliance requirements and risks from the threat modelCorrect answer: C
   4. D.A fixed checklist without regard to the workload's requirements

   Explanation: AWS says, "Based on your compliance requirements and risks identified from your threat model, derive and validate the control objectives and controls". These inputs connect governance, risk, and compliance to workload controls. Convenience or an unadapted checklist does not establish the relevant objectives.

   Reference: Identify and validate control objectives — SEC01-BP03

10. 10A US HIPAA-covered entity uses a legally separate cloud provider to maintain ePHI on its behalf. The provider stores only encrypted ePHI and has no decryption key. How does HHS guidance classify the provider?

    1. A.Exempt from HIPAA business-associate obligations because the data is encrypted
    2. B.A business associate despite lacking the encryption keyCorrect answer: B
    3. C.A covered health plan solely because it operates cloud storage
    4. D.An unrelated recipient with no need for a business associate agreement

    Explanation: HHS states, "Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules." Under the specified on-behalf-of arrangement, encryption does not eliminate business-associate status or the required agreement.

    Reference: HHS Guidance on HIPAA and Cloud Computing — Guidance introduction: encrypted ePHI and business associate status