CCP CASB & Cloud Security Posture 2 — Questions and Answers
Question 1: Which CASB deployment mode inspects traffic by sitting inline between users and cloud services in real time?
- API-based mode
- Reverse proxy mode
- Forward proxy mode (Correct answer)
- Out-of-band mode
Correct answer: Forward proxy mode
Forward proxy mode intercepts all cloud-bound traffic inline, enabling real-time inspection and control before requests reach the cloud service.
Question 2: A CSPM tool flags a misconfigured S3 bucket as 'publicly readable.' What is the FIRST remediation step?
- Delete the bucket immediately
- Enable versioning on the bucket
- Remove public access permissions and audit bucket contents (Correct answer)
- Move the bucket to a private VPC
Correct answer: Remove public access permissions and audit bucket contents
Removing public access permissions stops exposure immediately, while auditing contents determines if a data breach notification is required.
Question 3: Which cloud security concept ensures that the permissions granted to an identity are limited to only what is required for its tasks?
- Defense in depth
- Principle of least privilege (Correct answer)
- Separation of duties
- Zero-trust networking
Correct answer: Principle of least privilege
The principle of least privilege restricts identities to the minimum permissions needed, reducing the blast radius of credential compromise.
Question 4: An organization wants to prevent users from uploading sensitive files to personal cloud storage accounts while allowing corporate accounts. Which CASB feature best addresses this?
- Cloud discovery
- Tenant restriction (Correct answer)
- Data loss prevention policy
- Shadow IT reporting
Correct answer: Tenant restriction
Tenant restriction enforces access only to approved corporate tenants of a cloud service, blocking personal account usage on managed devices.
Question 5: In the shared responsibility model for SaaS, which layer is the customer always responsible for securing?
- Hypervisor and hardware
- Application code and runtime
- User access and data (Correct answer)
- Network infrastructure
Correct answer: User access and data
In SaaS, the provider manages infrastructure through application code; the customer retains responsibility for user access controls and the data they store.
Question 6: A CASB API integration can scan existing data at rest in a cloud application. What is the primary limitation of this approach compared to inline proxying?
- It cannot detect DLP violations
- It lacks visibility into traffic metadata
- It cannot enforce real-time blocking of uploads (Correct answer)
- It requires agent installation on endpoints
Correct answer: It cannot enforce real-time blocking of uploads
API-based CASB discovers and classifies data already stored in the cloud but cannot block uploads in real time because it operates out-of-band.
Question 7: Which metric is MOST useful when evaluating the risk score of a cloud application in a shadow IT discovery report?
- Total number of registered users globally
- Application's SOC 2 Type II certification status
- Amount of data uploaded by internal users (Correct answer)
- Application vendor's market capitalization
Correct answer: Amount of data uploaded by internal users
The volume of data uploaded by internal users directly quantifies the potential data exposure risk associated with unsanctioned cloud usage.
CCP CASB & Cloud Security Posture 2
Which CASB deployment mode inspects traffic by sitting inline between users and cloud services in real time?