I85PREP
⌘ K
CCP-C study materials
CCP-C study resources

CCP-C practice questions

One question at a time. Build your CCP-C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts and Architecture

Which cloud characteristic lets a consumer start new server instances and storage without contacting the provider's staff?

  1. On-demand self-service Correct answer.
  2. Measured service
  3. Rapid elasticity
  4. Resource pooling

Explanation

On-demand self-service means the consumer unilaterally provisions capabilities such as compute and storage through a portal or API, with no human interaction on the provider side. The other characteristics describe how capacity scales, how resources are shared, and how usage is metered.

Question 2Cloud Concepts and Architecture

A development team wants to deploy only application code, leaving the operating system, runtime, and patches to the provider. Which service model fits best?

  1. Desktop as a service
  2. Infrastructure as a service
  3. Platform as a service Correct answer.
  4. Software as a service

Explanation

In platform as a service the provider manages servers, operating systems, and runtimes, while the consumer controls deployed applications and their configuration. Infrastructure as a service would leave the guest operating system in the consumer's hands.

Question 3Cloud Concepts and Architecture

Several agencies with shared regulatory requirements pool infrastructure that no single agency owns outright. Which deployment model does this describe?

  1. Private cloud
  2. Public cloud
  3. Hybrid cloud
  4. Community cloud Correct answer.

Explanation

A community cloud is provisioned for use by a specific group of organizations that share concerns such as compliance or mission, and it may be managed by the members or a third party. Public, private, and hybrid models differ in who the infrastructure serves and how it is owned.

Question 4Cloud Concepts and Architecture

A customer's monthly invoice reflects the number of API calls made and gigabytes stored. Which essential characteristic does this demonstrate?

  1. Resource pooling
  2. Rapid elasticity
  3. Measured service Correct answer.
  4. Broad network access

Explanation

Measured service means the provider meters resource usage and bills accordingly, giving both parties transparency into consumption. Resource pooling concerns sharing, broad network access concerns reachability, and rapid elasticity concerns scaling.

Question 5Cloud Concepts and Architecture

Users reach the same application from laptops, phones, and branch offices over the internet and dedicated links. Which characteristic is being demonstrated?

  1. Resource pooling
  2. Broad network access Correct answer.
  3. Measured service
  4. On-demand self-service

Explanation

Broad network access means capabilities are available over the network through standard mechanisms that promote use by heterogeneous client platforms. Self-service, pooling, and metering address provisioning, sharing, and billing rather than reachability.

Question 6Cloud Concepts and Architecture

A company stops buying servers upfront and instead pays a monthly cloud invoice for what it consumes. What does this shift in spending represent?

  1. Operating expenditure Correct answer.
  2. Capital expenditure
  3. Sunk cost
  4. Depreciation

Explanation

Cloud consumption is billed as a recurring operating expense rather than a large upfront capital investment in owned equipment. This shift converts capital expenditure into variable operating expenditure that tracks actual usage.

Question 7Cloud Concepts and Architecture

A team replaces a server with a larger one that has more vCPUs and memory. Which term describes this change?

  1. Auto-scaling
  2. Horizontal scaling
  3. Vertical scaling Correct answer.
  4. Elastic scaling

Explanation

Vertical scaling, or scaling up, increases the resources of a single instance. Horizontal scaling adds or removes instances, while auto-scaling is an automation policy that adjusts capacity in response to metrics.

Question 8Cloud Concepts and Architecture

Which storage type keeps data as discrete items with metadata, addressed over HTTP APIs, and scales without pre-provisioning capacity?

  1. Object storage Correct answer.
  2. File storage
  3. Block storage
  4. Tape archive

Explanation

Object storage stores each item as an object with data, metadata, and a unique key, accessed through HTTP APIs and scaling elastically across massive numbers of objects. Block and file storage expose volumes or shared hierarchies that behave like traditional disks or network shares.

Question 9Cloud Concepts and Architecture

Which statement best distinguishes scalability from elasticity?

  1. Scalability is capacity growth to meet load; elasticity automates growth and shrinkage. Correct answer.
  2. Scalability means shrinking capacity automatically, while elasticity means manually adding capacity during incidents.
  3. Scalability applies only to storage volumes, whereas elasticity applies only to compute instances.
  4. Both terms describe the same property, since cloud definitions treat scalability and elasticity as synonyms.

Explanation

Scalability is the capacity of a system to handle growing load, while elasticity adds automation so capacity expands and contracts with demand. Elastic systems are therefore scalable, but a manually scaled system is not necessarily elastic.

Question 10Cloud Concepts and Architecture

In a software-as-a-service deployment, which item typically remains the customer's responsibility?

  1. Patching the operating system that hosts the application
  2. Managing user identities and access Correct answer.
  3. Replacing failed physical disks in the provider's data center
  4. Maintaining the hypervisor layer

Explanation

In software as a service the provider operates the entire stack, so the customer's remaining duties are typically its own data, configuration, and the identities and access rights it grants to users. Infrastructure and platform layers stay with the provider.

Question 11Cloud Concepts and Architecture

An application must return to service within 4 hours of an outage and can lose at most 15 minutes of data. Which requirement pair is correct?

  1. RTO of 15 minutes and RPO of 15 minutes
  2. RTO of 4 hours and RPO of 15 minutes Correct answer.
  3. RTO of 15 minutes and RPO of 4 hours
  4. RTO of 4 hours and RPO of 4 hours

Explanation

Recovery time objective is the maximum acceptable time to restore service, so the 4-hour target is the RTO. Recovery point objective is the maximum acceptable data loss measured in time, so the 15-minute target is the RPO.

Question 12Cloud Concepts and Architecture

Which design most improves the availability of a stateless web tier inside a single region?

  1. Spreading the web instances across availability zones behind a load balancer Correct answer.
  2. Running every instance in one availability zone and taking hourly snapshots
  3. Replicating the database to another region and leaving the web tier unchanged
  4. Sizing a single instance large enough that it never reaches full utilization

Explanation

Availability zones are isolated failure domains within a region, so distributing instances across them keeps the tier serving traffic when one zone fails, with the load balancer routing around unhealthy targets. Snapshots address durability, not live availability.

Question 13Cloud Concepts and Architecture

Which party aggregates and integrates services from multiple providers and offers the combined capability to consumers?

  1. Cloud auditor
  2. Cloud consumer
  3. Cloud carrier
  4. Cloud broker Correct answer.

Explanation

In the reference actor model, a cloud broker manages service use and negotiates relationships between providers and consumers, often adding aggregation, integration, or customization. Carriers provide connectivity, auditors assess controls, and consumers use the services.

Question 14Cloud Concepts and Architecture

An application runs on-premises but automatically overflows to a public cloud when local capacity is exhausted, then returns when demand falls. What is this pattern called?

  1. Cloud bursting Correct answer.
  2. Hybrid brokerage
  3. Edge computing
  4. Multi-cloud federation

Explanation

Cloud bursting is a hybrid arrangement in which a private environment handles normal load and spills peak demand to a public cloud, usually for short periods. It depends on consistent images, networking, and data access so workloads can move between environments.

Question 15Cloud Concepts and Architecture

Which mechanism primarily allows a public provider to serve many customers from shared physical hosts while keeping their workloads separate?

  1. Encrypting stored data with customer-managed keys
  2. Replicating all customer data to every physical host
  3. Virtualization that isolates tenants on shared hosts Correct answer.
  4. Distributing incoming requests with a load balancer

Explanation

Resource pooling depends on virtualization, which carves physical hosts into isolated virtual instances so multiple tenants can share hardware without interfering with each other. Load balancing spreads traffic, and encryption protects data, but neither creates the tenant separation itself.

Question 16Cloud Concepts and Architecture

Which statement accurately describes how a container differs from a virtual machine?

  1. It always provides stronger isolation than a virtual machine
  2. It includes a full guest operating system and its own kernel
  3. It cannot be scheduled or orchestrated by a platform
  4. It shares the host kernel and bundles app dependencies Correct answer.

Explanation

A container packages an application with its libraries and dependencies but uses the host operating system kernel, which makes it lighter and faster to start than a virtual machine. A virtual machine runs a complete guest operating system with its own kernel.

Question 17Cloud Concepts and Architecture

Which component abstracts physical hosts so that virtual machines can be created, started, and isolated from one another?

  1. The API gateway
  2. The hypervisor Correct answer.
  3. The load balancer
  4. The object store

Explanation

The hypervisor runs on the physical host and allocates CPU, memory, and devices to isolated virtual machines. Gateways, load balancers, and object stores operate at higher layers and do not virtualize compute hardware.

Question 18Cloud Concepts and Architecture

Which workload is the best fit for a function-as-a-service platform?

  1. A legacy monolith that requires custom kernel modules
  2. An event-driven thumbnail generator invoked when images are uploaded Correct answer.
  3. A stateful database that must run continuously with tuned kernel parameters
  4. A 24/7 game server that keeps long-lived TCP connections open

Explanation

Function as a service suits short, event-triggered, stateless tasks that scale to zero when idle, such as processing an uploaded file. Long-running, stateful, or kernel-dependent workloads need persistent compute instead.

Question 19Cloud Concepts and Architecture

A website with a global audience wants to cut latency for static assets such as images and scripts. Which service should be added?

  1. A site-to-site VPN to each continent
  2. A content delivery network Correct answer.
  3. A block storage volume in the origin region
  4. A read replica of the relational database

Explanation

A content delivery network caches static content at points of presence near users, so requests are served from a nearby edge rather than the distant origin. Storage, VPNs, and database replicas do not cache static assets close to end users.

Question 20Cloud Concepts and Architecture

Under the shared responsibility model for infrastructure as a service, which task belongs to the customer?

  1. Replacing failed disks in the provider's storage array
  2. Maintaining the hypervisor and the host firmware
  3. Patching the guest OS and configuring security groups Correct answer.
  4. Securing the physical facility, including power and cooling

Explanation

In infrastructure as a service the provider secures facilities, hardware, and the hypervisor, while the customer owns everything from the guest operating system upward, including patching, network rules, and application security. The boundary sits at the virtualization layer.

Question 21Cloud Concepts and Architecture

A public web tier and a database sit in the same virtual network. Which design keeps the database unreachable from the internet while still allowing it to fetch software updates?

  1. Place the database in a public subnet but block the database port in a security group
  2. Assign the database a public IP address and rely on strong database authentication
  3. Put the database behind the public load balancer so only the load balancer can reach it
  4. Place the database in a private subnet with outbound access via a NAT gateway Correct answer.

Explanation

A private subnet has no route to an internet gateway, so inbound internet traffic cannot reach the database, while a NAT gateway allows outbound connections for updates. Address translation plus routing keeps the resource non-addressable from outside.

Question 22Cloud Concepts and Architecture

Each instance of a web tier stores session data on its local disk. What problem appears when the tier scales out behind a load balancer, and what is the standard remedy?

  1. The load balancer cannot register new instances; switch to DNS round robin
  2. Nothing changes; the load balancer replicates session data between instances
  3. Sessions are lost only at scale-in; increase the instance size to retain them
  4. Users may hit an instance without their session; externalize session state Correct answer.

Explanation

Local session state binds a user to one instance, so requests routed elsewhere lose the session and scale-in destroys it. Externalizing state to a shared store such as a cache or database makes the tier stateless and safe to scale horizontally.

Question 23Cloud Concepts and Architecture

Which scenario best illustrates portability rather than interoperability?

  1. Two clouds exchange data in real time through a shared API
  2. Both clouds use the same identity provider for single sign-on
  3. Both providers are used at once, connected by a shared private network
  4. A workload is exported and redeployed on another provider unchanged Correct answer.

Explanation

Portability is the ability to move a workload from one environment to another, so exporting and redeploying without code changes is the defining test. Interoperability concerns systems working together while remaining in place, such as shared APIs, identity, and networking.

Question 24Cloud Concepts and Architecture

Data gravity most directly shapes which architectural decision?

  1. Which programming language the front end should use
  2. Whether to require TLS 1.3 for all client connections
  3. How many availability zones a region should contain
  4. Where to place compute relative to large datasets Correct answer.

Explanation

Data gravity describes how large datasets attract the compute and services that use them, because moving data is slower and costlier than moving compute. Architects therefore co-locate processing with the bulk of the data and minimize cross-region transfer.

Question 25Cloud Concepts and Architecture

Which description matches a warm standby disaster recovery strategy?

  1. A scaled-down copy runs continuously and is scaled up during failover Correct answer.
  2. No cloud resources exist until a disaster is declared, then templates are deployed
  3. Only backups exist, and infrastructure is built from them after a disaster
  4. A full-size duplicate runs continuously and serves production traffic

Explanation

Warm standby keeps a functioning but reduced-capacity environment running, so failover requires scaling up rather than building from scratch, giving a moderate recovery time at moderate cost. It sits between pilot light and active-active in cost and speed.

Question 26Cloud Concepts and Architecture

A provider's services can be reached from a phone, a laptop, or an on-premises system over the internet using standard protocols. Which essential cloud characteristic does this describe?

  1. Broad network access Correct answer.
  2. Measured service
  3. Rapid elasticity
  4. Resource pooling

Explanation

Broad network access means capabilities are available over the network through standard mechanisms that promote use by heterogeneous client platforms. Measured service concerns metering and billing, resource pooling concerns shared physical hosts, and rapid elasticity concerns automatic capacity change.

Question 27Cloud Concepts and Architecture

Three hospitals with shared compliance requirements jointly fund a cloud environment that only they are allowed to use. Which deployment model is this?

  1. Community cloud Correct answer.
  2. Private cloud
  3. Public cloud
  4. Hybrid cloud

Explanation

A community cloud is provisioned for exclusive use by a specific community of consumers that share concerns such as compliance or mission. A private cloud serves a single organization, a public cloud is open to the general public, and a hybrid cloud combines two or more distinct models.

Question 28Cloud Concepts and Architecture

A development team wants to push application code to the cloud and have the provider handle the operating system, runtime, and patching. Which service model fits best?

  1. Software as a service
  2. Platform as a service Correct answer.
  3. Infrastructure as a service
  4. Desktop as a service

Explanation

Platform as a service supplies a managed runtime and middleware so developers deploy code while the provider manages servers, operating systems, and patching. Infrastructure as a service leaves operating system administration to the customer, software as a service delivers a finished application, and desktop as a service delivers virtual desktops.

Question 29Cloud Concepts and Architecture

Within a single cloud region, what does an availability zone represent?

  1. A cache node placed near end users to reduce latency
  2. A logical network segment that isolates tenants from one another
  3. A dedicated physical server reserved for a single customer
  4. Isolated data centers with separate power and cooling Correct answer.

Explanation

An availability zone is one or more physically separate data centers within a region, with independent power, cooling, and networking so a failure in one zone does not affect the others. It is not a per-customer server, a tenant network segment, or an edge cache.

Question 30Cloud Concepts and Architecture

A regulated company must keep personal data stored within its home country but wants fast response times for users abroad. Which design best satisfies both constraints?

  1. Replicate the entire database to every continent where users live
  2. Host all components in the single region with the most users
  3. Route each request to a random region through a global load balancer
  4. Keep the data in-country and add regional read caches near users Correct answer.

Explanation

Data residency requires the regulated data at rest to remain within the jurisdiction, so the system of record stays in-country while caches of permitted content near users absorb latency. Copying the regulated database to other continents breaks the constraint, a single region penalizes distant users, and random routing ignores both locality and residency.

Question 31Cloud Concepts and Architecture

A database server needs a low-latency volume that the operating system can format and treat like a locally attached disk. Which cloud storage type is appropriate?

  1. Block storage Correct answer.
  2. File storage
  3. Archive storage
  4. Object storage

Explanation

Block storage presents raw volumes that the guest operating system formats with its own file system, giving the consistent low-latency random I/O a database expects. Object storage is HTTP-addressed and cannot be mounted as a disk, archive tiers are for infrequent retrieval, and file storage adds a shared network file system layer.

Question 32Cloud Concepts and Architecture

A retail site sees traffic triple every weekday at 9 a.m. and fall again at 6 p.m., following a predictable pattern. Which scaling approach is the most efficient fit?

  1. Schedule capacity increases before 9 a.m. and decreases after 6 p.m. Correct answer.
  2. Scale up by moving to a larger instance size at each peak
  3. Provision permanently for the weekday peak all day and night
  4. Scale out only after CPU utilization has stayed above 80% for ten minutes

Explanation

Scheduled or predictive scaling adds capacity ahead of a known recurring demand pattern, so the workload never waits for a reactive threshold and does not pay for peak capacity around the clock. Reactive CPU rules lag behind a sharp, known spike, permanent peak provisioning wastes spend, and vertical scaling is disruptive and coarse.

Question 33Cloud Concepts and Architecture

A company needs a private, consistently low-latency link between its own data center and a public cloud provider, with predictable bandwidth for bulk replication. Which option fits best?

  1. A NAT gateway inside the cloud virtual network
  2. A dedicated private interconnect to the provider Correct answer.
  3. A site-to-site VPN over the public internet
  4. A content delivery network at the provider edge

Explanation

A dedicated interconnect bypasses the public internet and offers committed bandwidth with more predictable latency, which suits steady bulk replication. A VPN carries traffic over the internet where latency and throughput vary, a content delivery network caches content for end users, and a NAT gateway only translates outbound addresses for cloud resources.

Question 34Cloud Concepts and Architecture

Which architectural change most reduces the blast radius of a failure in one part of an application?

  1. Combining all functions into a single deployable unit
  2. Adding a second identical server behind a load balancer
  3. Splitting functions into independently deployed, asynchronously coupled services Correct answer.
  4. Running the existing application on a larger instance size

Explanation

Loose coupling means a failing service does not synchronously block its callers, so the effect of an outage stays contained to the affected function. A single deployable unit concentrates failures, a larger instance does not isolate faults, and a duplicate server protects only against the loss of that one whole server rather than one function.

Question 35Cloud Concepts and Architecture

Employees should sign in once with their existing corporate directory account and then reach several cloud providers without separate passwords. Which capability enables this?

  1. Federated identity with single sign-on Correct answer.
  2. Multi-factor authentication
  3. A shared administrator account
  4. Role-based access control

Explanation

Federation trusts the corporate identity provider to authenticate users and passes assertions to each cloud provider, giving single sign-on without duplicating credentials. Multi-factor authentication strengthens a single login but does not link providers, role-based access control governs permissions after authentication, and shared accounts undermine accountability.

Question 36Cloud Concepts and Architecture

An auto-scaling group must replace instances that freeze and stop responding. Which configuration achieves this?

  1. A scale-in policy triggered by low CPU utilization
  2. A longer instance startup timeout
  3. Load balancer health checks that mark failed instances for replacement Correct answer.
  4. A larger maximum group size

Explanation

Health checks probe each instance, and when a probe fails the orchestrator terminates and replaces it, which recovers frozen processes that a usage metric may never reveal. Scale-in removes healthy capacity, longer timeouts only delay start-up, and a larger maximum size merely raises the capacity ceiling.

Question 37Cloud Concepts and Architecture

A factory needs sensor analytics within milliseconds and cannot depend on a distant data center link. Which architecture addresses this?

  1. Move all processing to a centralized cloud region
  2. Batch the sensor data and upload it once per hour
  3. Process sensor data at an edge location close to the equipment Correct answer.
  4. Increase bandwidth on the wide-area link to the cloud

Explanation

Edge computing places compute near the data source, removing round-trip latency to a distant region and allowing the workload to continue when the wide-area link fails. Central processing adds latency, extra bandwidth does not remove propagation delay, and batching defers results rather than accelerating them.

Question 38Cloud Concepts and Architecture

A disaster recovery plan keeps only a minimal core of the production environment always running in a second region, with the remaining components switched on during a failover. Which strategy is this?

  1. Warm standby
  2. Pilot light Correct answer.
  3. Multi-site active-active
  4. Backup and restore

Explanation

A pilot light replicates only the core, such as data and minimal configuration, and starts the rest of the stack at failover, which costs less than warm standby but recovers more slowly. Backup and restore starts from nothing, warm standby keeps a scaled-down but fully functional stack running, and active-active serves traffic from both regions continuously.

Question 39Cloud Concepts and Architecture

In a cloud ecosystem, which role provides the network connectivity that transports services between a provider and its consumers?

  1. Cloud consumer
  2. Cloud auditor
  3. Cloud carrier Correct answer.
  4. Cloud broker

Explanation

The cloud carrier is the intermediary that provides connectivity and transport of cloud services between providers and consumers. A broker aggregates and integrates services, an auditor assesses controls and compliance, and the consumer uses the services.

Question 40Cloud Concepts and Architecture

Which comparison best explains why a like-for-like cloud bill can still be lower than an on-premises total cost of ownership?

  1. Cloud providers do not charge for data transfer between regions
  2. Cloud resources never require operational staff
  3. On-premises estimates often omit staff, power, facilities and refresh Correct answer.
  4. On-premises hardware is always more expensive per CPU hour

Explanation

A fair total cost of ownership comparison includes power, cooling, floor space, administrative labor, and periodic hardware refresh, which are frequently left out of on-premises figures and are absorbed into cloud prices. Transfer fees do exist, cloud workloads still need operations staff, and per-hour component prices alone do not capture total cost.

Question 41Cloud Security, Risk, and Compliance

Under the cloud shared responsibility model, which activity always remains the customer's responsibility regardless of whether the service is IaaS, PaaS, or SaaS?

  1. Securing the physical facilities that host the servers
  2. Maintaining the underlying network fabric
  3. Classifying data and managing who can access it Correct answer.
  4. Patching the hypervisor and host operating systems

Explanation

Providers secure the facilities, hardware, and, depending on the service model, the hypervisor, runtime, and application. Data, identity, and access decisions stay with the customer in every model. Classifying data and governing who can reach it is therefore never delegated to the provider.

Question 42Cloud Security, Risk, and Compliance

Which program provides a standardized security assessment and authorization that U.S. federal agencies rely on when adopting cloud services?

  1. PCI DSS
  2. FedRAMP Correct answer.
  3. SOC 2 Type II
  4. ISO/IEC 27001

Explanation

FedRAMP is a government-wide program that standardizes assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. SOC 2 is a private attestation report, PCI DSS focuses on cardholder data, and ISO/IEC 27001 is an international management-system standard.

Question 43Cloud Security, Risk, and Compliance

A regulator requires that customer records never be stored outside the country of origin. Which concept does this requirement describe?

  1. Data masking
  2. Data residency Correct answer.
  3. Data retention
  4. Data minimization

Explanation

Data residency is the requirement that data be stored within a specified geographic or jurisdictional boundary. Minimization limits what is collected, retention limits how long it is kept, and masking hides values while the record remains in place.

Question 44Cloud Security, Risk, and Compliance

Which practice best implements the principle of least privilege for cloud identities?

  1. Granting administrator rights to all engineers
  2. Sharing a single service account across teams
  3. Storing long-lived access keys in source code
  4. Granting only the permissions a role needs Correct answer.

Explanation

Least privilege means each identity receives the minimum permissions required for its function, with access reviewed and removed when no longer needed. Standing administrator rights, shared accounts, and embedded long-lived keys all exceed that minimum and expand the blast radius of a compromise.

Question 45Cloud Security, Risk, and Compliance

What is the primary purpose of classifying data held in cloud services?

  1. To reduce the storage cost of the data
  2. To increase the number of backups taken
  3. To eliminate the need for encryption
  4. To apply controls proportionate to its sensitivity Correct answer.

Explanation

Classification tells an organization how sensitive an asset is so that controls such as encryption, access restrictions, and retention can be matched to that sensitivity. Cost, backup frequency, and encryption decisions may follow from classification but are not its purpose.

Question 46Cloud Security, Risk, and Compliance

Which statement accurately describes a SOC 2 report?

  1. It guarantees a vendor will never suffer a breach
  2. It is a technical vulnerability scan of the network
  3. It is a government certification that remains valid for three years
  4. It attests to controls against the trust services criteria Correct answer.

Explanation

A SOC 2 report is an independent attestation on a service organization's controls relevant to one or more trust services criteria, such as security, availability, and confidentiality, covering a defined period. It is not a government certification, a vulnerability scan, or a guarantee against future incidents.

Question 47Cloud Security, Risk, and Compliance

An organization wants to retain control of the encryption keys for data it stores with a cloud provider. Which approach fits that goal?

  1. Disabling encryption so keys are not needed
  2. Relying only on provider-managed keys without an agreement
  3. Storing the keys in the same bucket as the encrypted data
  4. Using a customer-managed key held in an external key vault Correct answer.

Explanation

A customer-managed key held outside the provider's control lets the organization govern key lifecycle and revoke access by disabling the key. Keeping keys beside the ciphertext collapses the separation that makes encryption meaningful, and provider-managed default keys leave control with the provider.

Question 48Cloud Security, Risk, and Compliance

Which control protects data moving between a user's browser and a cloud-hosted application?

  1. Object versioning on the storage bucket
  2. Full-disk encryption on the application server
  3. TLS on every client connection Correct answer.
  4. Column-level masking in the database

Explanation

Transport layer security encrypts data in transit and prevents interception or tampering between client and server. Disk encryption, versioning, and column masking all act on stored data and do nothing for the network path.

Question 49Cloud Security, Risk, and Compliance

Which cloud service model places the greatest security responsibility on the customer?

  1. Functions as a Service
  2. Infrastructure as a Service Correct answer.
  3. Platform as a Service
  4. Software as a Service

Explanation

In IaaS the customer manages the guest operating system, middleware, runtime, applications, and data, while the provider handles only the physical and virtualization layers. In PaaS, SaaS, and serverless models the provider absorbs progressively more of the stack.

Question 50Cloud Security, Risk, and Compliance

A company processes personal data of individuals located in the European Union. Which obligation arises under the GDPR?

  1. Retain all personal data indefinitely so audits can be performed
  2. Obtain consent only after the data has been shared
  3. Notify the supervisory authority of qualifying breaches within 72 hours Correct answer.
  4. Transfer data to any country without additional safeguards

Explanation

The GDPR requires notification of qualifying personal data breaches to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness. It also imposes storage limitation and restricts transfers to third countries without an appropriate safeguard.