CCSP Practice Exam 1, free sample

Question 1

A technician must image a suspect drive without letting the workstation write anything to it. Which tool provides that assurance?

Accepted Answer

A hardware write blocker

Answer

A hardware hashing appliance

Answer

A packet capture tap

Answer

A forensic image viewer

Question 2

A company evaluating a provider learns that one program and one database now serve every tenant. Which consequence should it weigh?

Accepted Answer

Lower cost for the provider, higher risk for consumers

Answer

Lower cost for the provider, with no change in risk

Answer

Higher cost for the provider, lower risk for consumers

Answer

Higher cost for consumers, with stronger legal separation

Question 3

An auditor asks a team to show when a signing key moved from active to suspended in a cloud key manager. Where should that evidence sit?

Accepted Answer

In the audit logs and in the key's metadata

Answer

In the key's ciphertext header on each object

Answer

In the certificate revocation list published daily

Answer

In the change ticket raised for the rotation

Question 4

An analyst finds that a compromised front end pod reached a billing pod in another namespace of the same cluster. Which cluster default explains it?

Accepted Answer

Every pod may contact every other pod by default

Answer

Namespaces share one service account by default

Answer

Ingress controllers route all namespaces by default

Answer

Pods inherit the node's host network by default

Question 5

A service reads the jku URL from a token header, fetches that key set and verifies the signature with it. Which change should the analyst require?

Accepted Answer

Take the key from issuer published metadata

Answer

Cache the fetched key set for one hour

Answer

Require the jku URL to use HTTPS only

Answer

Log the key identifier on every verification

Practice Exam 1